From 9a88de9b9069332001321424ead565f847de4100 Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Tue, 21 Jul 2026 21:37:19 -0700 Subject: [PATCH 1/2] ci(bump-callers): bring sibling entrypoints to parity with hardened auto-label bumper (BE-4058) Mirror the three hardenings from 89e3110 (bump-cursor-review-auto-label-callers.yml, PR #60) onto the four pre-existing bump-*-callers entrypoints: - SHA-pin actions/checkout (v6.0.3) per the repo's pin-everything policy - main-only job guard: skip workflow_dispatch runs from non-main refs, which would pin every caller to a stale SHA and run bump-callers.sh from an unreviewed commit with the freshly minted App token - deletion no-op guard: a push that DELETES the reusable workflow matches the path filter; exit 0 instead of opening caller PRs pinned to a SHA where the referenced file no longer exists --- .github/workflows/bump-agents-md-callers.yml | 19 +++++++++++++++++-- .../bump-assign-reviewers-callers.yml | 19 +++++++++++++++++-- .../workflows/bump-cursor-review-callers.yml | 19 +++++++++++++++++-- .github/workflows/bump-pr-size-callers.yml | 19 +++++++++++++++++-- 4 files changed, 68 insertions(+), 8 deletions(-) diff --git a/.github/workflows/bump-agents-md-callers.yml b/.github/workflows/bump-agents-md-callers.yml index 03106f3..59c045e 100644 --- a/.github/workflows/bump-agents-md-callers.yml +++ b/.github/workflows/bump-agents-md-callers.yml @@ -56,10 +56,17 @@ concurrency: jobs: bump: + # Guard against a workflow_dispatch run from a non-main ref: github.sha is + # the tip of whatever ref was selected, and the bumper force-resets a stable + # shared branch — a manual run from an older ref would pin every caller to a + # stale SHA (and run this job's script, with the App token minted below, + # from an unreviewed commit). The push trigger is already main-only, so this + # only ever skips stray manual runs. + if: github.ref == 'refs/heads/main' runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -84,4 +91,12 @@ jobs: # update flow. Kept in a variable (not the file) so private caller names # never land in this public repo or its logs. CALLERS_JSON: ${{ vars.AGENTS_MD_CALLERS }} - run: bash .github/bump-callers/bump-callers.sh + run: | + # The push path filter also matches a commit that DELETES the + # reusable workflow; bumping callers to a SHA where the file is gone + # would break every caller. Deletion means decommissioning — no-op. + if [[ ! -f .github/workflows/agents-md-integrity.yml ]]; then + echo "agents-md-integrity.yml absent at this SHA — decommissioned; nothing to bump" + exit 0 + fi + bash .github/bump-callers/bump-callers.sh diff --git a/.github/workflows/bump-assign-reviewers-callers.yml b/.github/workflows/bump-assign-reviewers-callers.yml index 71de7e1..b85c9d9 100644 --- a/.github/workflows/bump-assign-reviewers-callers.yml +++ b/.github/workflows/bump-assign-reviewers-callers.yml @@ -61,10 +61,17 @@ concurrency: jobs: bump: + # Guard against a workflow_dispatch run from a non-main ref: github.sha is + # the tip of whatever ref was selected, and the bumper force-resets a stable + # shared branch — a manual run from an older ref would pin every caller to a + # stale SHA (and run this job's script, with the App token minted below, + # from an unreviewed commit). The push trigger is already main-only, so this + # only ever skips stray manual runs. + if: github.ref == 'refs/heads/main' runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -89,4 +96,12 @@ jobs: # update flow. Kept in a variable (not the file) so private caller names # never land in this public repo or its logs. CALLERS_JSON: ${{ vars.ASSIGN_REVIEWERS_CALLERS }} - run: bash .github/bump-callers/bump-callers.sh + run: | + # The push path filter also matches a commit that DELETES the + # reusable workflow; bumping callers to a SHA where the file is gone + # would break every caller. Deletion means decommissioning — no-op. + if [[ ! -f .github/workflows/assign-reviewers.yml ]]; then + echo "assign-reviewers.yml absent at this SHA — decommissioned; nothing to bump" + exit 0 + fi + bash .github/bump-callers/bump-callers.sh diff --git a/.github/workflows/bump-cursor-review-callers.yml b/.github/workflows/bump-cursor-review-callers.yml index 9dbc3e5..d80127a 100644 --- a/.github/workflows/bump-cursor-review-callers.yml +++ b/.github/workflows/bump-cursor-review-callers.yml @@ -68,10 +68,17 @@ concurrency: jobs: bump: + # Guard against a workflow_dispatch run from a non-main ref: github.sha is + # the tip of whatever ref was selected, and the bumper force-resets a stable + # shared branch — a manual run from an older ref would pin every caller to a + # stale SHA (and run this job's script, with the App token minted below, + # from an unreviewed commit). The push trigger is already main-only, so this + # only ever skips stray manual runs. + if: github.ref == 'refs/heads/main' runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -98,4 +105,12 @@ jobs: # agents-md-integrity entrypoint never sets this, so bump-callers.sh # skips wiring there even if its variable somehow set the flag. WIRE_BOT_SCRIPT: ${{ github.workspace }}/.github/cursor-review/wire-bot-identity.py - run: bash .github/bump-callers/bump-callers.sh + run: | + # The push path filter also matches a commit that DELETES the + # reusable workflow; bumping callers to a SHA where the file is gone + # would break every caller. Deletion means decommissioning — no-op. + if [[ ! -f .github/workflows/cursor-review.yml ]]; then + echo "cursor-review.yml absent at this SHA — decommissioned; nothing to bump" + exit 0 + fi + bash .github/bump-callers/bump-callers.sh diff --git a/.github/workflows/bump-pr-size-callers.yml b/.github/workflows/bump-pr-size-callers.yml index 146a775..15ae1fd 100644 --- a/.github/workflows/bump-pr-size-callers.yml +++ b/.github/workflows/bump-pr-size-callers.yml @@ -60,10 +60,17 @@ concurrency: jobs: bump: + # Guard against a workflow_dispatch run from a non-main ref: github.sha is + # the tip of whatever ref was selected, and the bumper force-resets a stable + # shared branch — a manual run from an older ref would pin every caller to a + # stale SHA (and run this job's script, with the App token minted below, + # from an unreviewed commit). The push trigger is already main-only, so this + # only ever skips stray manual runs. + if: github.ref == 'refs/heads/main' runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -88,4 +95,12 @@ jobs: # update flow. Kept in a variable (not the file) so private caller names # never land in this public repo or its logs. CALLERS_JSON: ${{ vars.PR_SIZE_CALLERS }} - run: bash .github/bump-callers/bump-callers.sh + run: | + # The push path filter also matches a commit that DELETES the + # reusable workflow; bumping callers to a SHA where the file is gone + # would break every caller. Deletion means decommissioning — no-op. + if [[ ! -f .github/workflows/pr-size.yml ]]; then + echo "pr-size.yml absent at this SHA — decommissioned; nothing to bump" + exit 0 + fi + bash .github/bump-callers/bump-callers.sh From 069c36d50bd04f2842d06fabbb51d44789380f12 Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Tue, 21 Jul 2026 21:57:41 -0700 Subject: [PATCH 2/2] ci(bump-callers): skip stale re-runs + treat asset-dir deletion as decommission (BE-4058) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review follow-ups from the cursor-review panel on PR #62: - A manual re-run of an older main run passes the `github.ref == 'refs/heads/main'` guard but executes with that run's stale github.sha, force-repinning every caller backwards. Verify github.sha is still the tip of main (git ls-remote) before bumping; a newer push always has its own queued run that does the bump. - The decommission guard only checked the reusable .yml, but the push path filter also fires on the run-time asset dir callers load from the pinned SHA (.github/cursor-review/**, .github/agents-md-integrity/**, scripts/check-pr-size/**). Deleting that dir while leaving the yml would repin callers to a SHA whose scripts are gone — check both. assign-reviewers has no asset dir; noted inline. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/bump-agents-md-callers.yml | 20 +++++++++++++++---- .../bump-assign-reviewers-callers.yml | 12 +++++++++++ .../workflows/bump-cursor-review-callers.yml | 20 +++++++++++++++---- .github/workflows/bump-pr-size-callers.yml | 20 +++++++++++++++---- 4 files changed, 60 insertions(+), 12 deletions(-) diff --git a/.github/workflows/bump-agents-md-callers.yml b/.github/workflows/bump-agents-md-callers.yml index 59c045e..d3e507f 100644 --- a/.github/workflows/bump-agents-md-callers.yml +++ b/.github/workflows/bump-agents-md-callers.yml @@ -92,11 +92,23 @@ jobs: # never land in this public repo or its logs. CALLERS_JSON: ${{ vars.AGENTS_MD_CALLERS }} run: | + # The main-only ref guard above cannot catch a manual RE-RUN of an + # older main run: github.ref is refs/heads/main but github.sha is + # that run's original (now stale) commit, and the bumper would + # force-repin every caller to it. Only act from the current tip — + # any newer push has its own queued run that does the bump. + main_tip=$(git ls-remote origin refs/heads/main | cut -f1) + if [[ "$main_tip" != "$GITHUB_SHA" ]]; then + echo "github.sha $GITHUB_SHA is not the current main tip ($main_tip) — stale run/re-run; nothing to bump" + exit 0 + fi # The push path filter also matches a commit that DELETES the - # reusable workflow; bumping callers to a SHA where the file is gone - # would break every caller. Deletion means decommissioning — no-op. - if [[ ! -f .github/workflows/agents-md-integrity.yml ]]; then - echo "agents-md-integrity.yml absent at this SHA — decommissioned; nothing to bump" + # reusable workflow — or the run-time assets callers load from the + # pinned SHA (.github/agents-md-integrity/**); bumping callers to a + # SHA where either is gone would break every caller. Deletion means + # decommissioning — no-op. + if [[ ! -f .github/workflows/agents-md-integrity.yml || ! -d .github/agents-md-integrity ]]; then + echo "agents-md-integrity.yml or .github/agents-md-integrity/ absent at this SHA — decommissioned; nothing to bump" exit 0 fi bash .github/bump-callers/bump-callers.sh diff --git a/.github/workflows/bump-assign-reviewers-callers.yml b/.github/workflows/bump-assign-reviewers-callers.yml index b85c9d9..078a2ee 100644 --- a/.github/workflows/bump-assign-reviewers-callers.yml +++ b/.github/workflows/bump-assign-reviewers-callers.yml @@ -97,9 +97,21 @@ jobs: # never land in this public repo or its logs. CALLERS_JSON: ${{ vars.ASSIGN_REVIEWERS_CALLERS }} run: | + # The main-only ref guard above cannot catch a manual RE-RUN of an + # older main run: github.ref is refs/heads/main but github.sha is + # that run's original (now stale) commit, and the bumper would + # force-repin every caller to it. Only act from the current tip — + # any newer push has its own queued run that does the bump. + main_tip=$(git ls-remote origin refs/heads/main | cut -f1) + if [[ "$main_tip" != "$GITHUB_SHA" ]]; then + echo "github.sha $GITHUB_SHA is not the current main tip ($main_tip) — stale run/re-run; nothing to bump" + exit 0 + fi # The push path filter also matches a commit that DELETES the # reusable workflow; bumping callers to a SHA where the file is gone # would break every caller. Deletion means decommissioning — no-op. + # (This fleet has no run-time asset dir — the yml is self-contained — + # so unlike the sibling entrypoints only the workflow file is checked.) if [[ ! -f .github/workflows/assign-reviewers.yml ]]; then echo "assign-reviewers.yml absent at this SHA — decommissioned; nothing to bump" exit 0 diff --git a/.github/workflows/bump-cursor-review-callers.yml b/.github/workflows/bump-cursor-review-callers.yml index d80127a..36cbb90 100644 --- a/.github/workflows/bump-cursor-review-callers.yml +++ b/.github/workflows/bump-cursor-review-callers.yml @@ -106,11 +106,23 @@ jobs: # skips wiring there even if its variable somehow set the flag. WIRE_BOT_SCRIPT: ${{ github.workspace }}/.github/cursor-review/wire-bot-identity.py run: | + # The main-only ref guard above cannot catch a manual RE-RUN of an + # older main run: github.ref is refs/heads/main but github.sha is + # that run's original (now stale) commit, and the bumper would + # force-repin every caller to it. Only act from the current tip — + # any newer push has its own queued run that does the bump. + main_tip=$(git ls-remote origin refs/heads/main | cut -f1) + if [[ "$main_tip" != "$GITHUB_SHA" ]]; then + echo "github.sha $GITHUB_SHA is not the current main tip ($main_tip) — stale run/re-run; nothing to bump" + exit 0 + fi # The push path filter also matches a commit that DELETES the - # reusable workflow; bumping callers to a SHA where the file is gone - # would break every caller. Deletion means decommissioning — no-op. - if [[ ! -f .github/workflows/cursor-review.yml ]]; then - echo "cursor-review.yml absent at this SHA — decommissioned; nothing to bump" + # reusable workflow — or the run-time assets callers load from the + # pinned SHA (.github/cursor-review/**); bumping callers to a SHA + # where either is gone would break every caller. Deletion means + # decommissioning — no-op. + if [[ ! -f .github/workflows/cursor-review.yml || ! -d .github/cursor-review ]]; then + echo "cursor-review.yml or .github/cursor-review/ absent at this SHA — decommissioned; nothing to bump" exit 0 fi bash .github/bump-callers/bump-callers.sh diff --git a/.github/workflows/bump-pr-size-callers.yml b/.github/workflows/bump-pr-size-callers.yml index 15ae1fd..5e9a272 100644 --- a/.github/workflows/bump-pr-size-callers.yml +++ b/.github/workflows/bump-pr-size-callers.yml @@ -96,11 +96,23 @@ jobs: # never land in this public repo or its logs. CALLERS_JSON: ${{ vars.PR_SIZE_CALLERS }} run: | + # The main-only ref guard above cannot catch a manual RE-RUN of an + # older main run: github.ref is refs/heads/main but github.sha is + # that run's original (now stale) commit, and the bumper would + # force-repin every caller to it. Only act from the current tip — + # any newer push has its own queued run that does the bump. + main_tip=$(git ls-remote origin refs/heads/main | cut -f1) + if [[ "$main_tip" != "$GITHUB_SHA" ]]; then + echo "github.sha $GITHUB_SHA is not the current main tip ($main_tip) — stale run/re-run; nothing to bump" + exit 0 + fi # The push path filter also matches a commit that DELETES the - # reusable workflow; bumping callers to a SHA where the file is gone - # would break every caller. Deletion means decommissioning — no-op. - if [[ ! -f .github/workflows/pr-size.yml ]]; then - echo "pr-size.yml absent at this SHA — decommissioned; nothing to bump" + # reusable workflow — or the run-time tool sources callers build from + # the pinned SHA (scripts/check-pr-size/**); bumping callers to a SHA + # where either is gone would break every caller. Deletion means + # decommissioning — no-op. + if [[ ! -f .github/workflows/pr-size.yml || ! -d scripts/check-pr-size ]]; then + echo "pr-size.yml or scripts/check-pr-size/ absent at this SHA — decommissioned; nothing to bump" exit 0 fi bash .github/bump-callers/bump-callers.sh