ci(bump-callers): wire cloud-code-bot review identity into flagged callers (BE-1814)

[mattmillerai]

ELI-5

The cursor-review bot can now post its review under a dedicated cloud-code-bot identity instead of the generic github-actions[bot] (that ability landed in Story 1.1, PR #13). Each consumer repo has to opt in by adding two lines to its thin caller: the app id (bot_app_id) and the paired private key secret. Rather than hand-edit every repo, this teaches the existing caller-bump machinery to add those two lines automatically — but only for the repos that actually hold the cloud-code-bot creds. Repos without the creds are untouched and keep posting as github-actions[bot].

What & why

Story 1.3 of BE-1800, refit to the existing cloud-code-bot creds (vars.APP_ID = app 2016716 / secrets.CLOUD_CODE_BOT_PRIVATE_KEY). No new secrets to provision — each consumer maps creds it already has.

• .github/cursor-review/wire-bot-identity.py (new) — idempotently injects into a caller:

  • bot_app_id: ${{ vars.APP_ID }} as the first child of with:
  • BOT_APP_PRIVATE_KEY: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }} under secrets:

  It edits only those two anchors (line-based, not a PyYAML round-trip) so the fan-out PR diff is exactly the wiring — the callers' comments, folded diff_excludes, and SHA-pin lines are preserved byte-for-byte. Already-wired callers are a no-op.

• .github/bump-callers/bump-callers.sh — each caller entry in the CURSOR_REVIEW_CALLERS repo variable gains an optional wire_bot field. When true, the caller is piped through the helper alongside the SHA bump (via WIRE_BOT_SCRIPT, set only by bump-cursor-review-callers.yml — the shared script stays fleet-agnostic, so bump-agents-md-callers.yml never sets it). Intended only for repos confirmed to hold the creds:

  • cloud + comfy-cloud-mcp-server — already wired by hand ⇒ injection would be a verified no-op (they still get the SHA bump).
  • comfy-inapp-agent + Comfy-iOS — their cursor-review-auto-label.yml callers already use vars.APP_ID + secrets.CLOUD_CODE_BOT_PRIVATE_KEY, so the creds are provisioned. These are the repos this is meant to wire.
  • Not intended: comfy-local-mcp / ComfySwiftSDK / comfy-infra / the public OSS repos (no cloud-code-bot creds), and not swarmhost (its own caller comment states the app isn't provisioned there yet).
  • The live CURSOR_REVIEW_CALLERS variable does not yet flag any entry wire_bot: true — this PR ships the capability; actually wiring the four repos above needs a follow-up gh variable set (see "How it propagates").

• Added unit tests (tests/test_wire_bot_identity.py, 8 cases; test_bump_callers.sh gains 4 wire_bot cases) that run under the existing CI.

Non-breaking / incremental: both bot_app_id (input) and BOT_APP_PRIVATE_KEY (secret) are optional in the reusable workflow — a caller without them keeps posting as github-actions[bot].

How it propagates

This PR gives the bump script the capability; wiring only lands in a consumer repo once its CURSOR_REVIEW_CALLERS entry is flagged "wire_bot": true AND the workflow runs — either on the next cursor-review.yml push, or via a manual workflow_dispatch after merge. Recommended sequence after merge:

1. gh variable get CURSOR_REVIEW_CALLERS -R Comfy-Org/github-workflows → add "wire_bot": true to the comfy-inapp-agent and Comfy-iOS entries (optionally cloud / comfy-cloud-mcp-server too, where it's a no-op).
2. gh variable set CURSOR_REVIEW_CALLERS -R Comfy-Org/github-workflows --body '<updated JSON>'.
3. gh workflow run bump-cursor-review-callers.yml -R Comfy-Org/github-workflows to propagate immediately.

Verification

• python3 -m unittest discover green across .github/cursor-review/tests and .github/agents-md-integrity/tests.
• shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh clean.
• bash .github/bump-callers/tests/test_bump_callers.sh — 86 passed, 0 failed (includes the 4 new wire_bot cases: wired end-to-end, not-flagged never wires, WIRE_BOT_SCRIPT unset degrades to SHA-only, already-wired+already-current is a clean skip).

Judgment calls

• Chesterton's Fence: wiring is folded into the same content-equality check (NEW_CONTENT == OLD_CONTENT) that gates the SHA bump, so a wiring-only change on an already-SHA-current caller still stages the file instead of being short-circuited — same intent as the original grep -qF "$NEW_SHA" early-skip this replaces, generalized.
• Scope of wire_bot: deliberately conservative — flagged only where creds are provably present (existing wiring or an auto-label caller using the same app). swarmhost excluded per its own caller's note. A repo that references a missing secret would still degrade safely to github-actions[bot], but flagging one without the app would be misleading, so it's opt-in per caller.
• WIRE_BOT_SCRIPT kept fleet-specific: bump-callers.sh is shared with the agents-md-integrity fleet, which has no use for bot-identity wiring — only bump-cursor-review-callers.yml sets the env var, so a stray wire_bot: true in the other fleet's variable degrades to a harmless warning instead of an error.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 47 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: f9093641-76d7-4fdd-a0d0-e41ecce8d0b6

📥 Commits

Reviewing files that changed from the base of the PR and between aa5ae62 and cd1181d.

📒 Files selected for processing (5)

• .github/bump-callers/bump-callers.sh
• .github/bump-callers/tests/test_bump_callers.sh
• .github/cursor-review/tests/test_wire_bot_identity.py
• .github/cursor-review/wire-bot-identity.py
• .github/workflows/bump-cursor-review-callers.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch matt/be-1814-wire-bot-identity-callers

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch matt/be-1814-wire-bot-identity-callers

---

_{Comment @coderabbitai help to get the list of available commands.}

[deepme987]

doing a blind approval since @mattmillerai you're driving this e2e. feel free to re-assign me if you need me to review it