[Feature] Allow Flow action extension `runtime_url`s to be relative by EliasJRH · Pull Request #7715 · Shopify/cli

EliasJRH · 2026-06-04T15:03:51Z

WHY are these changes introduced?

Closes https://github.com/Shopify/flow/issues/21604

To start allowing the usage of URLs relative to an apps application_url in Flow action extensions.

WHAT is this pull request doing?

This pull request extends the capabilities of Flow action extensions to allow them to start using relative runtime_urls in their config.

How to test your changes?

Create an with a Flow action extension with a relative runtime_url
Run shopify app dev, install app + Flow on dev store and create workflow using Flow action extension
Trigger workflow, observe that local tunnel endpoint is hit at specified relative path
Deploy app with shopify app deploy, create workflow with deployed Flow action extension
Trigger workflow, observe that application url endpoint is hit at specified relative path

Post-release steps

The existing dev docs for Flow action extensions make no mention of using relative urls or how it would work with a local app dev setup. Documentation will be written to describe this.

Checklist

I've considered possible cross-platform impacts (Mac, Linux, Windows)
I've considered possible documentation changes
I've considered analytics changes to measure impact
The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

… time

steve-low · 2026-06-04T20:54:55Z

  return baseFieldSchema.parse(configField)
 }

-export const startsWithHttps = (url: string) => url.startsWith('https://')


Do we still have a validation where if the the url is not relative, we check that it starts with https?

Yes, the validateFlowActionUrl calls validateRelativeUrl which will return true if the url is relative or https

ryanische · 2026-06-04T21:05:19Z

+const containsUrlControlCharacter = (value: string) => /[\r\n\t]/.test(value)
+
+const isFlowActionRelativeUrl = (value: string) => {
+  return value.startsWith('/') && !value.startsWith('//') && !containsUrlControlCharacter(value)
+}


Are these relevant to the validateRelativeUrl function in validation/common.ts as well?

They could be. I'm not sure what other cases the validateRelativeUrl handles so I think it'd be best to propose as a follow up for the CLI team.

ryanische · 2026-06-04T21:11:13Z

  appModuleFeatures: (_) => [],
-  deployConfig: async (config, extensionPath) => {
+  /**
+   * During `app dev`, swap any relative URLs (starting with `/`) for the dev


Just confirming behaviour - this only happens for app dev, not app deploy?

Yes, during app dev relative urls will be prepended by the auto-generated cloudflare tunnel url and during app deploy they'll be prepended with the configured application url

gonzaloriestra · 2026-06-11T11:43:35Z

+    )
+  }
+
+  if (!resolvedUrl.startsWith('https://')) {


We already have a URL validation function in packages/app/src/cli/models/app/validation/common.ts you could re-use

It also checks for newlines, so maybe you can drop that check from the relative URL validation as well.

Feel free to update it if needed.

I think this would be a good addition outside of this PR as I'd want to make sure that the other extensions that use this validation would still work as expected.

Copilot

Pull request overview

This PR updates Flow action extension URL handling to allow runtime_url (and related URL fields) to be specified as relative paths (e.g. /api/execute) and then resolved against the app’s application_url during app dev and app deploy.

Changes:

Replaced Flow action URL validation to accept either absolute HTTPS URLs or relative URLs starting with a single /, with additional control-character and protocol-relative URL rejection.
Added URL resolution logic to prepend the app/tunnel application_url for relative Flow action URLs during dev and deploy.
Added/expanded unit tests and introduced a changeset for a minor bump.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/app/src/cli/services/flow/validation.ts	Adds `validateFlowActionUrl` to validate absolute HTTPS or `/...` relative URLs and reject control characters / protocol-relative URLs.
packages/app/src/cli/services/flow/validation.test.ts	Adds test coverage for `validateFlowActionUrl` acceptance/rejection cases.
packages/app/src/cli/services/flow/utils.ts	Introduces `resolveFlowActionUrl` to resolve relative URLs against `application_url` and enforce HTTPS.
packages/app/src/cli/services/flow/utils.test.ts	Adds tests covering URL resolution and error cases for `resolveFlowActionUrl`.
packages/app/src/cli/services/flow/types.ts	Defines the set of Flow action URL fields and the `FlowActionUrlField` union type.
packages/app/src/cli/models/extensions/specifications/flow_action.ts	Uses the new validator and resolves URL fields for deploy/dev patching.
packages/app/src/cli/models/extensions/specifications/flow_action.test.ts	Adds spec-level tests for parsing, deploy URL resolution, and dev URL patching.
.changeset/light-lamps-draw.md	Declares a minor bump for `@shopify/app` due to new relative URL support.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

EliasJRH added 2 commits June 3, 2026 14:39

Allow for relative urls in Flow action extensions during development

487d5bd

Allow flow action deployments to use relative urls

67fd91d

github-actions Bot added the no-changelog This PR doesn't include a changeset entry. Is an internal only change not relevant to end users. label Jun 4, 2026

EliasJRH changed the title ~~Relative dev flow action urls~~ [Feature] Allow Flow action extension runtime_urls to be relative Jun 4, 2026

EliasJRH added 3 commits June 4, 2026 13:12

Have runtime urls be properly resolved with app url at dev and deploy…

563c8dd

… time

Remove unused validation function

26c25d2

Expand deploy config url resolution test

3b29450

EliasJRH self-assigned this Jun 4, 2026

EliasJRH added the includes-post-release-steps PRs including this label require additional steps after releasing label Jun 4, 2026

EliasJRH added 4 commits June 4, 2026 15:13

Add and use custom Flow action url validation

4b9e23b

Tighten URL validation

569fe8d

Tigheten URL resolver function

d7f6e39

Add changeset

e9e8ed7

github-actions Bot added Area: @shopify/app @shopify/app package issues and removed no-changelog This PR doesn't include a changeset entry. Is an internal only change not relevant to end users. labels Jun 4, 2026

EliasJRH marked this pull request as ready for review June 4, 2026 20:09

EliasJRH requested review from a team as code owners June 4, 2026 20:09

EliasJRH requested a review from ryanische June 4, 2026 20:14

steve-low reviewed Jun 4, 2026

View reviewed changes

ryanische reviewed Jun 4, 2026

View reviewed changes

Clean up validation and validation messages

dde49be

EliasJRH mentioned this pull request Jun 5, 2026

[Feature] Extend ExtensionInstance.deployConfig to include app config info #7697

Merged

4 tasks

gonzaloriestra approved these changes Jun 11, 2026

View reviewed changes

Base automatically changed from extend_deploy_config to main June 11, 2026 13:18

Reword changelog

636093c

Copilot AI review requested due to automatic review settings June 11, 2026 13:44

Copilot started reviewing on behalf of EliasJRH June 11, 2026 13:44 View session

Copilot AI reviewed Jun 11, 2026

View reviewed changes

Comment thread packages/app/src/cli/services/flow/utils.ts Outdated

tighten https validation

1b626d0

EliasJRH requested a review from ryanische June 15, 2026 13:43

ryanische approved these changes Jun 15, 2026

View reviewed changes

EliasJRH added this pull request to the merge queue Jun 15, 2026

Merged via the queue into main with commit b55ce16 Jun 15, 2026
28 checks passed

EliasJRH deleted the relative_dev_flow_action_urls branch June 15, 2026 17:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Feature] Allow Flow action extension `runtime_url`s to be relative#7715

[Feature] Allow Flow action extension `runtime_url`s to be relative#7715
EliasJRH merged 12 commits into
mainfrom
relative_dev_flow_action_urls

EliasJRH commented Jun 4, 2026 •

edited

Loading

Uh oh!

steve-low Jun 4, 2026

Uh oh!

EliasJRH Jun 5, 2026

Uh oh!

ryanische Jun 4, 2026 •

edited

Loading

Uh oh!

EliasJRH Jun 5, 2026

Uh oh!

Uh oh!

ryanische Jun 4, 2026

Uh oh!

EliasJRH Jun 5, 2026

Uh oh!

gonzaloriestra Jun 11, 2026

Uh oh!

EliasJRH Jun 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

EliasJRH commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

WHY are these changes introduced?

WHAT is this pull request doing?

How to test your changes?

Post-release steps

Checklist

Uh oh!

steve-low Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

EliasJRH Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

ryanische Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

EliasJRH Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ryanische Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

EliasJRH Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

gonzaloriestra Jun 11, 2026

Choose a reason for hiding this comment

Uh oh!

EliasJRH Jun 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

EliasJRH commented Jun 4, 2026 •

edited

Loading

ryanische Jun 4, 2026 •

edited

Loading