ci(bump-callers): add cursor-review-auto-label caller fleet (BE-4005)#60
Open
mattmillerai wants to merge 3 commits into
Open
ci(bump-callers): add cursor-review-auto-label caller fleet (BE-4005)#60mattmillerai wants to merge 3 commits into
mattmillerai wants to merge 3 commits into
Conversation
The auto-bump system covered cursor-review, agents-md, pr-size, and assign-reviewers, but not cursor-review-auto-label.yml — so every consumer's auto-label caller silently drifted behind the reusable it pins while its sibling ci-cursor-review.yml stayed current. Add the missing thin entrypoint (reads vars.CURSOR_REVIEW_AUTO_LABEL_CALLERS, runs the shared bump-callers.sh), register it in the fleet table + test path filters, and cover its exact parameters in the functional suite.
mattmillerai
added
cursor-review
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughChangesThe pull request adds a Cursor review auto-label fleet
Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant CloudCodeBotToken
participant BumpCallers
participant TargetRepositories
GitHubActions->>GitHubActions: Trigger on dispatch or main workflow change
CloudCodeBotToken->>GitHubActions: Provide GitHub App token
GitHubActions->>BumpCallers: Invoke with fleet configuration and new SHA
BumpCallers->>TargetRepositories: Create SHA-bump pull requests
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🔍 Cursor Review — Consolidated panel
Triggered by @mattmillerai.
Found 4 finding(s).
| Severity | Count |
|---|---|
| 🟠 High | 1 |
| 🟡 Medium | 1 |
| 🟢 Low | 2 |
Panel: 8/8 reviewers contributed findings.
…ut, main-only guard, deletion no-op) (BE-4005) - Pin actions/checkout to df4cb1c0 # v6.0.3 (repo SHA-pin policy; matches pr-size.yml) - Guard the bump job with 'if: github.ref == refs/heads/main' so a manual workflow_dispatch from a non-main ref cannot pin callers to a stale SHA or run the bumper from an unreviewed commit with the App token - No-op cleanly when cursor-review-auto-label.yml is absent at the triggering SHA (the push path filter also matches deletion) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Author
|
🤖 The reviews loop filed Linear follow-up ticket(s) for review thread(s) deferred as out of scope for this PR:
|
mattmillerai
added a commit
that referenced
this pull request
Jul 26, 2026
…uto-label bumper (BE-4058) (#62) * ci(bump-callers): bring sibling entrypoints to parity with hardened auto-label bumper (BE-4058) Mirror the three hardenings from 89e3110 (bump-cursor-review-auto-label-callers.yml, PR #60) onto the four pre-existing bump-*-callers entrypoints: - SHA-pin actions/checkout (v6.0.3) per the repo's pin-everything policy - main-only job guard: skip workflow_dispatch runs from non-main refs, which would pin every caller to a stale SHA and run bump-callers.sh from an unreviewed commit with the freshly minted App token - deletion no-op guard: a push that DELETES the reusable workflow matches the path filter; exit 0 instead of opening caller PRs pinned to a SHA where the referenced file no longer exists * ci(bump-callers): skip stale re-runs + treat asset-dir deletion as decommission (BE-4058) Review follow-ups from the cursor-review panel on PR #62: - A manual re-run of an older main run passes the `github.ref == 'refs/heads/main'` guard but executes with that run's stale github.sha, force-repinning every caller backwards. Verify github.sha is still the tip of main (git ls-remote) before bumping; a newer push always has its own queued run that does the bump. - The decommission guard only checked the reusable .yml, but the push path filter also fires on the run-time asset dir callers load from the pinned SHA (.github/cursor-review/**, .github/agents-md-integrity/**, scripts/check-pr-size/**). Deleting that dir while leaving the yml would repin callers to a SHA whose scripts are gone — check both. assign-reviewers has no asset dir; noted inline. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
…allers Resolves conflicts in AGENTS.md and test-bump-callers.yml where main added the groom caller fleet (BE-4523/BE-4003) alongside this branch's cursor-review-auto-label caller fleet — merged both intents.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ELI-5
This repo auto-opens "update your pin" PRs in consumer repos whenever one of its reusable workflows changes — one little bumper workflow per reusable.
cursor-review-auto-label.ymlnever got a bumper, so every repo using it slowly fell behind (while its siblingci-cursor-review.ymlcaller stayed current, leaving the two cursor-review callers in a repo pinned to different commits of this repo). This PR adds the missing bumper.What
.github/workflows/bump-cursor-review-auto-label-callers.yml— thin entrypoint over the sharedbump-callers.sh, mirroringbump-cursor-review-callers.yml: triggers on push-to-main touching.github/workflows/cursor-review-auto-label.yml(plusworkflow_dispatchfor on-demand re-bumps), readsvars.CURSOR_REVIEW_AUTO_LABEL_CALLERS, opens one SHA-bump PR per consumer as Cloud Code Bot. Own concurrency group + stable branch (ci/bump-cursor-review-auto-label), per the BE-3882 serialization pattern..github/bump-callers/README.md— new fleet row in the table..github/workflows/test-bump-callers.yml— new entrypoint added to both path filters so wrapper changes run the suite..github/bump-callers/tests/test_bump_callers.sh— two new cases driving the fleet's exact entrypoint parameters (VAR_NAME/TAG/WORKFLOW_FILE/ALLOW_EMPTY): (1) two callers — mirroring the two real consumers — each get a SHA-bump PR with the pin rewritten, comment normalized, and repo names masked; (2) an unseeded/empty variable is a clean no-op. 100/100 checks pass locally,shellcheckclean,actionlintclean.AGENTS.mdcatalog + two already-stale header comments synced (the shared script's header now points at the README fleet table instead of enumerating fleets, so it can't drift again).After merge, seed the variable with the current consumers:
(Then optionally
gh workflow run bump-cursor-review-auto-label-callers.ymlto catch both consumers up immediately.) Also add the entries to the canonicalcallers.jsonin the private ops repo.Judgment calls
ALLOW_EMPTY: "true"— deviates from the mirror target (CURSOR_REVIEW_CALLERShard-fails when empty). Deliberate: the variable is repo config the merge itself cannot create, so hard-fail semantics would guarantee a red run for any reusable change landing in the merge→seed window. This matches thebump-assign-reviewers-callers.ymlprecedent (variable created out-of-band, seeded empty). Trade-off: if seeding is forgotten, the fleet no-ops silently — hence the loud follow-up above.WIRE_BOT_SCRIPT— the bot-identity injection (BE-1814) is cursor-review-specific by design (bump-cursor-review-callers.ymlsays it is "set only here"); auto-label callers already pass their own app creds per the reusable's contract.actions/checkout@v6(tag, not SHA) — byte-identical to all four sibling bumpers; kept consistent rather than diverging in one file.Testing
shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh— cleanbash .github/bump-callers/tests/test_bump_callers.sh— 100 passed, 0 failed (12 new checks)actionlinton both touched workflows — cleanpython3 .github/agents-md-integrity/check_agents_md.py --root .— passed (pre-existing CODEOWNERS warning only)