ci(bump-cursor-review): trigger on .github/cursor-review/** asset changes (BE-3916)

[mattmillerai]

ELI-5

When someone edits the cursor-review workflow file, a robot automatically opens "please update your pinned version" PRs in every repo that uses it. But cursor-review's real behavior also lives in sibling scripts and prompts (.github/cursor-review/**, e.g. extract-findings.py) that consumers pull in at the exact SHA they pinned. Editing one of those scripts changes what every pinned caller runs — but the robot didn't wake up for it, so consumers silently kept running the old (possibly buggy) script. This PR makes the robot also wake up on .github/cursor-review/** changes, so a fix to a prompt/script fans out a bump PR just like a workflow-file change does.

What changed

• .github/workflows/bump-cursor-review-callers.yml — added .github/cursor-review/** to the push: path filter (previously only .github/workflows/cursor-review.yml), with an inline comment explaining why. This mirrors the two sibling fleets that already do this:
  • agents-md: .github/workflows/agents-md-integrity.yml + .github/agents-md-integrity/**
  • pr-size: .github/workflows/pr-size.yml + scripts/check-pr-size/**
• .github/bump-callers/README.md — updated the fleet table's "Triggers on a change to" cell to cursor-review.yml or cursor-review/**, matching the agents-md row's phrasing.

Why

cursor-review.yml is not self-contained: its checkout steps pull this repo's .github/cursor-review/* prompts + scripts at inputs.workflows_ref (the SHA a consumer pins). So a behavior-changing edit under .github/cursor-review/** changes what every pinned caller runs, yet did not trigger a SHA-bump PR — consumers silently stayed on the old revision. Deferred from a review thread on #35 as out of scope there.

Testing

• bash .github/bump-callers/tests/test_bump_callers.sh → 88 passed, 0 failed
• shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh → clean
• python3 -c "import yaml; yaml.safe_load(...)" on the edited workflow → valid

No test changes needed — this is purely a trigger-path addition, not a change to bump-callers.sh.

Notes / judgment calls

• The glob .github/cursor-review/** also matches tests/** and README.md, so a test-only or docs-only edit would open a bump PR. This exactly matches the sibling agents-md-integrity/** and check-pr-size/** patterns, and the bumper is idempotent (an already-pinned SHA is a clean skip), so the slight over-breadth is the accepted, consistent tradeoff.
• test-bump-callers.yml did not need .github/cursor-review/** added — it runs the bump-callers unit suite and already triggers on the edited bump-cursor-review-callers.yml. The README's "add paths to test-bump-callers.yml" note is for registering a new entrypoint, not for widening an existing fleet's runtime trigger.

Closes BE-3916.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 19 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c55ce5dd-5dd6-4c79-89c3-9bb59a0b9c69

📥 Commits

Reviewing files that changed from the base of the PR and between eda264b and 8f6d47e.

📒 Files selected for processing (2)

• .github/bump-callers/README.md
• .github/workflows/bump-cursor-review-callers.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch matt/be-3916-cursor-review-assets-trigger

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch matt/be-3916-cursor-review-assets-trigger

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Cursor Review — Consolidated panel

Triggered by @mattmillerai.

✅ No high-signal findings.

Panel: 8/8 reviewers contributed findings.