-
Notifications
You must be signed in to change notification settings - Fork 0
ci(bump-callers): add cursor-review-auto-label caller fleet (BE-4005) #60
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
mattmillerai
wants to merge
2
commits into
main
Choose a base branch
from
matt/be-4005-bump-cursor-review-auto-label-callers
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
114 changes: 114 additions & 0 deletions
114
.github/workflows/bump-cursor-review-auto-label-callers.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| name: Bump cursor-review-auto-label callers | ||
|
|
||
| # When the cursor-review-auto-label reusable workflow is updated on main, open | ||
| # a SHA-bump PR in every repo that pins a caller against it. PRs are opened by | ||
| # Cloud Code Bot so they are easy to filter and merge. | ||
| # | ||
| # This is a thin entrypoint over the shared bumper at | ||
| # .github/bump-callers/bump-callers.sh — the same script drives the | ||
| # cursor-review, agents-md-integrity, pr-size, AND assign-reviewers caller | ||
| # fleets (bump-cursor-review-callers.yml, bump-agents-md-callers.yml, | ||
| # bump-pr-size-callers.yml, bump-assign-reviewers-callers.yml). Keeping ONE | ||
| # implementation is deliberate: a forked copy is how other shared machinery in | ||
| # the org has drifted. The entrypoints differ only in their path-filter trigger | ||
| # and the parameters passed below. (They stay separate rather than a single | ||
| # matrix because their triggers differ — a cursor-review-auto-label.yml change | ||
| # must not spuriously bump the other fleets' callers, and vice versa. In | ||
| # particular, repos pinning BOTH cursor-review.yml and | ||
| # cursor-review-auto-label.yml get each caller bumped by its own fleet, so the | ||
| # two siblings stay in lock-step instead of the auto-label caller silently | ||
| # drifting behind.) | ||
| # | ||
| # The caller list is NOT hardcoded here. This repo is PUBLIC (workflow file and | ||
| # Actions run logs are both publicly viewable), and most callers are private, so | ||
| # their names must never appear in this file or its logs. The list lives in the | ||
| # repo-level Actions variable `CURSOR_REVIEW_AUTO_LABEL_CALLERS` (config, not a | ||
| # credential — a variable, not a secret, since secrets are write-only via the | ||
| # API) as a JSON array of {"repo","file","label"} objects, same shape as | ||
| # CURSOR_REVIEW_CALLERS. Every repo name is `::add-mask::`ed out of the (public) | ||
| # run logs before it is ever echoed. The variable is seeded EMPTY (`[]`) — an | ||
| # empty list is a clean no-op here (ALLOW_EMPTY below); existing consumers' | ||
| # auto-label callers are registered by editing the variable (see the update | ||
| # flow), and new entries are added as callers land. | ||
| # | ||
| # Update flow — adding/removing a caller needs NO public commit: | ||
| # gh variable set CURSOR_REVIEW_AUTO_LABEL_CALLERS --repo Comfy-Org/github-workflows \ | ||
| # --body "$(jq -c . callers.json)" | ||
| # Keep the canonical callers.json in a PRIVATE infra/ops repo so variable edits | ||
| # have a reviewed source of truth; the org audit log records each edit. (The | ||
| # specific home repo is intentionally not named here — this file is public.) | ||
|
|
||
| on: | ||
| workflow_dispatch: {} # allow on-demand runs (e.g. to re-bump callers) | ||
| push: | ||
| branches: [main] | ||
| paths: | ||
| # cursor-review-auto-label.yml is entirely self-contained — its labeling | ||
| # logic runs inline via actions/github-script, with no external | ||
| # prompt/script asset dir (unlike cursor-review/** or | ||
| # scripts/check-pr-size/**). So the workflow file itself is the only path | ||
| # that can change its behavior. | ||
| - .github/workflows/cursor-review-auto-label.yml | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| # Serialize runs of this fleet. The bumper pushes to a STABLE branch | ||
| # (ci/bump-cursor-review-auto-label) shared across runs, so two overlapping | ||
| # runs (a rapid second main push, or a push racing a manual re-run) would | ||
| # force-reset that branch and race the PR update — an older run finishing last | ||
| # could leave the committed diff pinned to a stale SHA. cancel-in-progress: | ||
| # false lets the running bump finish; GitHub keeps only the newest pending run, | ||
| # so the latest SHA always wins (BE-3882). | ||
| concurrency: | ||
| group: bump-cursor-review-auto-label-callers | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| bump: | ||
| # Guard against a workflow_dispatch run from a non-main ref: github.sha is | ||
| # the tip of whatever ref was selected, and the bumper force-resets a stable | ||
| # shared branch — a manual run from an older ref would pin every caller to a | ||
| # stale SHA (and run this job's script, with the App token minted below, | ||
| # from an unreviewed commit). The push trigger is already main-only, so this | ||
| # only ever skips stray manual runs. | ||
| if: github.ref == 'refs/heads/main' | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Generate Cloud Code Bot token | ||
| uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 | ||
| id: token | ||
| with: | ||
| app-id: ${{ vars.APP_ID }} | ||
| private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }} | ||
| owner: Comfy-Org | ||
|
mattmillerai marked this conversation as resolved.
|
||
|
|
||
| - name: Bump SHA in caller repos | ||
| env: | ||
| GH_TOKEN: ${{ steps.token.outputs.token }} | ||
| NEW_SHA: ${{ github.sha }} | ||
|
mattmillerai marked this conversation as resolved.
|
||
| VAR_NAME: CURSOR_REVIEW_AUTO_LABEL_CALLERS | ||
| TAG: cursor-review-auto-label | ||
| WORKFLOW_FILE: cursor-review-auto-label.yml | ||
| # Seeded empty; an empty list is a clean no-op, not an error (the | ||
| # variable is repo config the merge itself cannot create — see the | ||
| # header comment for the registration flow). | ||
| ALLOW_EMPTY: "true" | ||
| # JSON array of {"repo","file","label"} — see the header comment for | ||
| # the update flow. Kept in a variable (not the file) so private caller | ||
| # names never land in this public repo or its logs. | ||
| CALLERS_JSON: ${{ vars.CURSOR_REVIEW_AUTO_LABEL_CALLERS }} | ||
| run: | | ||
| # The push path filter also matches a commit that DELETES the | ||
| # reusable workflow; bumping callers to a SHA where the file is gone | ||
| # would break every caller. Deletion means decommissioning — no-op. | ||
| if [[ ! -f .github/workflows/cursor-review-auto-label.yml ]]; then | ||
| echo "cursor-review-auto-label.yml absent at this SHA — decommissioned; nothing to bump" | ||
| exit 0 | ||
| fi | ||
| bash .github/bump-callers/bump-callers.sh | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.