ci(bump-callers): add cursor-review-auto-label caller fleet (BE-4005) - #60
ci(bump-callers): add cursor-review-auto-label caller fleet (BE-4005)#60mattmillerai wants to merge 3 commits into
Conversation
The auto-bump system covered cursor-review, agents-md, pr-size, and assign-reviewers, but not cursor-review-auto-label.yml — so every consumer's auto-label caller silently drifted behind the reusable it pins while its sibling ci-cursor-review.yml stayed current. Add the missing thin entrypoint (reads vars.CURSOR_REVIEW_AUTO_LABEL_CALLERS, runs the shared bump-callers.sh), register it in the fleet table + test path filters, and cover its exact parameters in the functional suite.
mattmillerai
added
cursor-review
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughChangesThe pull request adds a Cursor review auto-label fleet
Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant CloudCodeBotToken
participant BumpCallers
participant TargetRepositories
GitHubActions->>GitHubActions: Trigger on dispatch or main workflow change
CloudCodeBotToken->>GitHubActions: Provide GitHub App token
GitHubActions->>BumpCallers: Invoke with fleet configuration and new SHA
BumpCallers->>TargetRepositories: Create SHA-bump pull requests
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔍 Cursor Review — Consolidated panel
Triggered by @mattmillerai.
Found 4 finding(s).
| Severity | Count |
|---|---|
| 🟠 High | 1 |
| 🟡 Medium | 1 |
| 🟢 Low | 2 |
Panel: 8/8 reviewers contributed findings.
…ut, main-only guard, deletion no-op) (BE-4005) - Pin actions/checkout to df4cb1c0 # v6.0.3 (repo SHA-pin policy; matches pr-size.yml) - Guard the bump job with 'if: github.ref == refs/heads/main' so a manual workflow_dispatch from a non-main ref cannot pin callers to a stale SHA or run the bumper from an unreviewed commit with the App token - No-op cleanly when cursor-review-auto-label.yml is absent at the triggering SHA (the push path filter also matches deletion) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
🤖 The reviews loop filed Linear follow-up ticket(s) for review thread(s) deferred as out of scope for this PR:
|
…uto-label bumper (BE-4058) (#62) * ci(bump-callers): bring sibling entrypoints to parity with hardened auto-label bumper (BE-4058) Mirror the three hardenings from 89e3110 (bump-cursor-review-auto-label-callers.yml, PR #60) onto the four pre-existing bump-*-callers entrypoints: - SHA-pin actions/checkout (v6.0.3) per the repo's pin-everything policy - main-only job guard: skip workflow_dispatch runs from non-main refs, which would pin every caller to a stale SHA and run bump-callers.sh from an unreviewed commit with the freshly minted App token - deletion no-op guard: a push that DELETES the reusable workflow matches the path filter; exit 0 instead of opening caller PRs pinned to a SHA where the referenced file no longer exists * ci(bump-callers): skip stale re-runs + treat asset-dir deletion as decommission (BE-4058) Review follow-ups from the cursor-review panel on PR #62: - A manual re-run of an older main run passes the `github.ref == 'refs/heads/main'` guard but executes with that run's stale github.sha, force-repinning every caller backwards. Verify github.sha is still the tip of main (git ls-remote) before bumping; a newer push always has its own queued run that does the bump. - The decommission guard only checked the reusable .yml, but the push path filter also fires on the run-time asset dir callers load from the pinned SHA (.github/cursor-review/**, .github/agents-md-integrity/**, scripts/check-pr-size/**). Deleting that dir while leaving the yml would repin callers to a SHA whose scripts are gone — check both. assign-reviewers has no asset dir; noted inline. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…allers Resolves conflicts in AGENTS.md and test-bump-callers.yml where main added the groom caller fleet (BE-4523/BE-4003) alongside this branch's cursor-review-auto-label caller fleet — merged both intents.
|
Holding this PR — merging it now would stand up a second, competing bumper fleet. PR #81 (BE-4682) merged to `main` today and already ships this exact fleet: it watches `.github/workflows/cursor-review-auto-label.yml` (same trigger path this PR uses) and opens SHA-bump PRs to the same consumers, as `bump-auto-label-callers.yml` / repo variable `AUTO_LABEL_CALLERS` — already seeded with the 5 real callers (`Comfy-Org/cloud`, `Comfy-Org/website`, + 3 others per #81's description) and with the hardened `workflow_dispatch`/stale-SHA guard that BE-4058 exists to backport to the other fleets. This PR's `bump-cursor-review-auto-label-callers.yml` / `CURSOR_REVIEW_AUTO_LABEL_CALLERS` is the same fleet under a different name, seeded empty. Merging both means every future change to `cursor-review-auto-label.yml` fires two independent bumpers against the same consumer repos — duplicate SHA-bump PRs, and a second unused variable sitting next to the one actually in use. That's the "one bumper, not several" foot-gun this repo's own AGENTS.md calls out, just at the fleet level instead of a forked script. Needs a human call rather than a silent conflict resolution: close this one as superseded by #81, or repurpose/rebase it into something that doesn't duplicate #81's fleet. Leaving the merge conflict (`test-bump-callers.yml`, `AGENTS.md`) unresolved until that's decided. |
2 participants
ELI-5
This repo auto-opens "update your pin" PRs in consumer repos whenever one of its reusable workflows changes — one little bumper workflow per reusable.
cursor-review-auto-label.ymlnever got a bumper, so every repo using it slowly fell behind (while its siblingci-cursor-review.ymlcaller stayed current, leaving the two cursor-review callers in a repo pinned to different commits of this repo). This PR adds the missing bumper.What
.github/workflows/bump-cursor-review-auto-label-callers.yml— thin entrypoint over the sharedbump-callers.sh, mirroringbump-cursor-review-callers.yml: triggers on push-to-main touching.github/workflows/cursor-review-auto-label.yml(plusworkflow_dispatchfor on-demand re-bumps), readsvars.CURSOR_REVIEW_AUTO_LABEL_CALLERS, opens one SHA-bump PR per consumer as Cloud Code Bot. Own concurrency group + stable branch (ci/bump-cursor-review-auto-label), per the BE-3882 serialization pattern..github/bump-callers/README.md— new fleet row in the table..github/workflows/test-bump-callers.yml— new entrypoint added to both path filters so wrapper changes run the suite..github/bump-callers/tests/test_bump_callers.sh— two new cases driving the fleet's exact entrypoint parameters (VAR_NAME/TAG/WORKFLOW_FILE/ALLOW_EMPTY): (1) two callers — mirroring the two real consumers — each get a SHA-bump PR with the pin rewritten, comment normalized, and repo names masked; (2) an unseeded/empty variable is a clean no-op. 100/100 checks pass locally,shellcheckclean,actionlintclean.AGENTS.mdcatalog + two already-stale header comments synced (the shared script's header now points at the README fleet table instead of enumerating fleets, so it can't drift again).After merge, seed the variable with the current consumers:
(Then optionally
gh workflow run bump-cursor-review-auto-label-callers.ymlto catch both consumers up immediately.) Also add the entries to the canonicalcallers.jsonin the private ops repo.Judgment calls
ALLOW_EMPTY: "true"— deviates from the mirror target (CURSOR_REVIEW_CALLERShard-fails when empty). Deliberate: the variable is repo config the merge itself cannot create, so hard-fail semantics would guarantee a red run for any reusable change landing in the merge→seed window. This matches thebump-assign-reviewers-callers.ymlprecedent (variable created out-of-band, seeded empty). Trade-off: if seeding is forgotten, the fleet no-ops silently — hence the loud follow-up above.WIRE_BOT_SCRIPT— the bot-identity injection (BE-1814) is cursor-review-specific by design (bump-cursor-review-callers.ymlsays it is "set only here"); auto-label callers already pass their own app creds per the reusable's contract.actions/checkout@v6(tag, not SHA) — byte-identical to all four sibling bumpers; kept consistent rather than diverging in one file.Testing
shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh— cleanbash .github/bump-callers/tests/test_bump_callers.sh— 100 passed, 0 failed (12 new checks)actionlinton both touched workflows — cleanpython3 .github/agents-md-integrity/check_agents_md.py --root .— passed (pre-existing CODEOWNERS warning only)