[PR #161] [MERGED] ci(cursor-review): re-sync workflows_ref to the pinned uses: SHA and stop Dependabot splitting the pair #160

New issue

Closed

opened 2026-10-31 22:01:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 22:01:54 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/comfy-python-sdk/pull/161
Author: @mattmillerai
Created: 9/18/2026
Status: ✅ Merged
Merged: 10/3/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-15269-resync-cursor-review-pins

📝 Commits (2)

683f66c ci(cursor-review): re-sync workflows_ref to the pinned uses: SHA
7a2b8ea Merge origin/main into matt/be-15269-resync-cursor-review-pins

📊 Changes

1 file changed (+10 additions, -0 deletions)

View changed files

📝 .github/dependabot.yml (+10 -0)

📄 Description

ELI-5

This repo's Cursor-review job pins the shared reusable workflow in two places: uses: picks which workflow definition runs, and the workflows_ref: input picks which prompts/scripts that workflow downloads at run time. Dependabot only ever rewrites uses:, so it splits the pair — twice already. This tells Dependabot to stop touching that pair and leave it to the bumper fleet that moves both halves together.

What changed

.github/dependabot.yml — the existing github-actions entry gains a two-entry ignore for the Comfy-Org/github-workflows reusables. Nothing else in the file changes: the pip entry, and the github-actions entry's schedule, open-pull-requests-limit, commit-message, labels and groups, are untouched.

That is now the whole diff — 10 lines in one file. See Superseded half below for what left it.

Both entries are load-bearing and must not be collapsed to a single Comfy-Org/github-workflows*. Dependabot names a reusable-workflow dependency by its full path (PR #146's own title reads Comfy-Org/github-workflows/.github/workflows/cursor-review.yml), and a dependency-name without a wildcard is an exact match — so the exact form covers the owner/repo shape and the /* form covers the per-file shape, while a single trailing star would expand unanchored and also swallow any future sibling repo whose name merely starts with github-workflows. This follows the precedent documented at length in Comfy-Org/cloud's own .github/dependabot.yml, which I read directly rather than copying from the work item.

Superseded half — the workflow edit is gone, on purpose

This PR originally also re-synced .github/workflows/ci-cursor-review.yml, moving workflows_ref: from ffcc3f5 up to 425c154 (the SHA uses: already held). While it sat open, main landed #164 — opened by app/cloud-code-bot with the body "Opened by the bump-cursor-review-callers workflow", merged 2026-09-18T23:33Z — which moved both pins together to the newer f22ad8f. That is the same fix at a later SHA, produced by the fleet this PR's ignore hands the job to.

The two therefore conflicted, and the conflict was resolved in main's favour: its pair is already aligned and strictly newer, so the hand re-sync here was redundant. ci-cursor-review.yml on the merged tree contains exactly one distinct 40-hex SHA, f22ad8f888fdef6f0a50bfdfa96bb20f74f651a0, so the two pins agree — which is the outcome this PR was after; it just arrived from upstream first.

Worth stating plainly, because it is the load-bearing evidence for the ignore: #164 is a live demonstration that the compensating control works. This repo is not merely eligible for the bumper fleet's roster — the fleet fired on it and moved both halves correctly.

How the split happened

uses: and workflows_ref: were in lock-step until two Dependabot PRs rewrote uses: alone — #136 (merged 2026-09-09) and #146 (merged 2026-09-14) — leaving the job running a September-12 workflow definition against August-28 assets for roughly nine days. The caller-fleet bot's own PR #125, which correctly moved both pins to 425c154, was closed unmerged on 2026-09-14 at 21:15Z — 33 minutes after #146 merged over it. That is the loop this ignore breaks.

Verification

Run on the merged tree (this branch merged with main), not on the pre-merge branch:

python3 -c "import yaml; yaml.safe_load(open('.github/dependabot.yml'))" parses; the github-actions entry's ignore reads back as exactly the two dependency-name entries and its groups (actions-minor-and-patch) is intact. .github/workflows/ci-cursor-review.yml also parses as YAML.
grep -oE '[0-9a-f]{40}' .github/workflows/ci-cursor-review.yml | sort -u → exactly one line, f22ad8f888fdef6f0a50bfdfa96bb20f74f651a0. The two pins agree.
git diff origin/main --stat → .github/dependabot.yml | 10 ++++++++++, one file. No stray carry-over from the conflict resolution.
Repo toolchain, all green: ruff check . (all checks passed), ruff format --check . (57 files already formatted), mypy src (no issues, 21 files), pytest -q (975 passed, 9 skipped), and python3 scripts/check_public_repo_hygiene.py (no internal-only references — this one matters because the diff adds a Comfy-Org/<repo> reference to a world-readable file).

Falsification of the capability this diff denies

An ignore entry removes a capability — automatic bumping of these reusables — so before shipping it the replacement path was checked rather than asserted from the comment text. Read-only checks against Comfy-Org/github-workflows: .github/workflows/bump-cursor-review-callers.yml exists and drives .github/bump-callers/bump-callers.sh, which carries an explicit INPUT_PIN_RE for workflows_ref: alongside the uses: rewrite and an assertion that the two halves move together. Since then the path has been confirmed empirically rather than by inspection: PR #125 and PR #164 in this repo were both opened by that workflow, and #164 merged. So the pin keeps a working owner after this change; it does not become orphaned.

Scope swept, including the half this does not fix

All 5 workflow files and all 16 uses: pins in .github/workflows/ were swept. Exactly 1 is a Comfy-Org/github-workflows reusable and it is the repo's only workflows_ref: — so there is no second split pin here. The other 15 pins cover 6 distinct third-party/marketplace actions (actions/checkout, actions/setup-python, actions/upload-artifact, actions/download-artifact, pypa/gh-action-pypi-publish, contributor-assistant/github-action) and are deliberately left under Dependabot's management — the ignore is scoped to the two reusable-workflow name forms precisely so those keep getting bumped.

Residual

No guard enforces that the two pins stay aligned. The upstream Require a pinned workflows_ref step only checks that the input is a non-empty 40-hex string; verified at f22ad8f, nothing compares it to the caller's uses: SHA. This PR removes the automated cause of a split but not a human edit or partial revert. Deferred to a follow-up rather than fixed here: the clean lever is upstream (job.workflow_sha is by definition the uses: SHA and the workflow already reads it), and the warn-vs-fail-closed rollout across the caller set is a human call. Tracked from this thread.
Not verified: the org-wide "4 of 72 callers" measurement this work was scoped from. That survey spans private repos and a caller roster held as a repository secret, neither of which was readable here. The split, the fix and the bumper path were verified for this repo only; the claim that three other callers are in the same state is carried over unverified and those repos are untouched here. If that number is right, each of them needs the same two-line change.
The ignore has no update-types:/versions: qualifier, so it suppresses Dependabot security advisories for these reusables as well as version updates. That is the upstream precedent's deliberate trade-off (a first-party org repo pinned to reviewed SHAs is not a public-registry package, so an advisory-driven bump is not its update path), and this PR adopts it as-is rather than re-litigating it. Naming it because it is a real reduction in coverage that the diff does not make visible on its own.
Nothing in the repo's own suite exercises a GitHub Actions caller. The 975 passing tests are the Python SDK's and are insensitive to this diff; they are reported as evidence the merge with main is clean, not as evidence about the ignore.

Provenance

Authored by: agent-work loop
Verified: on the merged tree — ruff check: all checks passed; ruff format --check: 57 files already formatted; mypy src: no issues in 21 source files; pytest -q: 975 passed, 9 skipped; check_public_repo_hygiene.py: no internal-only references; dependabot.yml/ci-cursor-review.yml both parse as YAML; ci-cursor-review.yml holds exactly one distinct 40-hex SHA (f22ad8f); net diff vs main is 10 lines in .github/dependabot.yml alone
Deviations: the original workflow edit was dropped during conflict resolution — main's #164 re-synced both pins to a newer SHA first, making the hand re-sync redundant; resolved in main's favour rather than re-applying the older 425c154 (see Superseded half). The pin-alignment guard raised in review is deferred to a follow-up, not fixed here (see Residual).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/comfy-python-sdk/pull/161 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 9/18/2026 **Status:** ✅ Merged **Merged:** 10/3/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-15269-resync-cursor-review-pins` --- ### 📝 Commits (2) - [`683f66c`](https://github.com/Comfy-Org/comfy-python-sdk/commit/683f66c21bdacbb341ecde451a664f13c40b4869) ci(cursor-review): re-sync workflows_ref to the pinned uses: SHA - [`7a2b8ea`](https://github.com/Comfy-Org/comfy-python-sdk/commit/7a2b8ea2a97711d11124918851942b29bd02f4e4) Merge origin/main into matt/be-15269-resync-cursor-review-pins ### 📊 Changes **1 file changed** (+10 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.github/dependabot.yml` (+10 -0) </details> ### 📄 Description ## ELI-5 This repo's Cursor-review job pins the shared reusable workflow in **two** places: `uses:` picks which workflow definition runs, and the `workflows_ref:` input picks which prompts/scripts that workflow downloads at run time. Dependabot only ever rewrites `uses:`, so it splits the pair — twice already. This tells Dependabot to stop touching that pair and leave it to the bumper fleet that moves both halves together. ## What changed - `.github/dependabot.yml` — the existing `github-actions` entry gains a two-entry `ignore` for the `Comfy-Org/github-workflows` reusables. Nothing else in the file changes: the `pip` entry, and the `github-actions` entry's `schedule`, `open-pull-requests-limit`, `commit-message`, `labels` and `groups`, are untouched. That is now the **whole** diff — 10 lines in one file. See *Superseded half* below for what left it. Both entries are load-bearing and must not be collapsed to a single `Comfy-Org/github-workflows*`. Dependabot names a reusable-workflow dependency by its **full path** (PR #146's own title reads `Comfy-Org/github-workflows/.github/workflows/cursor-review.yml`), and a `dependency-name` without a wildcard is an exact match — so the exact form covers the `owner/repo` shape and the `/*` form covers the per-file shape, while a single trailing star would expand unanchored and also swallow any future sibling repo whose name merely starts with `github-workflows`. This follows the precedent documented at length in `Comfy-Org/cloud`'s own `.github/dependabot.yml`, which I read directly rather than copying from the work item. ## Superseded half — the workflow edit is gone, on purpose This PR originally also re-synced `.github/workflows/ci-cursor-review.yml`, moving `workflows_ref:` from `ffcc3f5` up to `425c154` (the SHA `uses:` already held). While it sat open, **`main` landed #164** — opened by `app/cloud-code-bot` with the body *"Opened by the `bump-cursor-review-callers` workflow"*, merged 2026-09-18T23:33Z — which moved **both** pins together to the newer `f22ad8f`. That is the same fix at a later SHA, produced by the fleet this PR's `ignore` hands the job to. The two therefore conflicted, and the conflict was resolved **in main's favour**: its pair is already aligned and strictly newer, so the hand re-sync here was redundant. `ci-cursor-review.yml` on the merged tree contains exactly one distinct 40-hex SHA, `f22ad8f888fdef6f0a50bfdfa96bb20f74f651a0`, so the two pins agree — which is the outcome this PR was after; it just arrived from upstream first. Worth stating plainly, because it is the load-bearing evidence for the `ignore`: #164 is a live demonstration that the compensating control works. This repo is not merely eligible for the bumper fleet's roster — the fleet fired on it and moved both halves correctly. ## How the split happened `uses:` and `workflows_ref:` were in lock-step until two Dependabot PRs rewrote `uses:` alone — #136 (merged 2026-09-09) and #146 (merged 2026-09-14) — leaving the job running a September-12 workflow definition against August-28 assets for roughly nine days. The caller-fleet bot's own PR #125, which correctly moved *both* pins to `425c154`, was closed unmerged on 2026-09-14 at 21:15Z — 33 minutes after #146 merged over it. That is the loop this `ignore` breaks. ## Verification Run on the merged tree (this branch merged with `main`), not on the pre-merge branch: - `python3 -c "import yaml; yaml.safe_load(open('.github/dependabot.yml'))"` parses; the `github-actions` entry's `ignore` reads back as exactly the two `dependency-name` entries and its `groups` (`actions-minor-and-patch`) is intact. `.github/workflows/ci-cursor-review.yml` also parses as YAML. - `grep -oE '[0-9a-f]{40}' .github/workflows/ci-cursor-review.yml | sort -u` → exactly one line, `f22ad8f888fdef6f0a50bfdfa96bb20f74f651a0`. The two pins agree. - `git diff origin/main --stat` → `.github/dependabot.yml | 10 ++++++++++`, one file. No stray carry-over from the conflict resolution. - Repo toolchain, all green: `ruff check .` (all checks passed), `ruff format --check .` (57 files already formatted), `mypy src` (no issues, 21 files), `pytest -q` (**975 passed, 9 skipped**), and `python3 scripts/check_public_repo_hygiene.py` (no internal-only references — this one matters because the diff adds a `Comfy-Org/<repo>` reference to a world-readable file). ## Falsification of the capability this diff denies An `ignore` entry removes a capability — automatic bumping of these reusables — so before shipping it the replacement path was checked rather than asserted from the comment text. Read-only checks against `Comfy-Org/github-workflows`: `.github/workflows/bump-cursor-review-callers.yml` exists and drives `.github/bump-callers/bump-callers.sh`, which carries an explicit `INPUT_PIN_RE` for `workflows_ref:` alongside the `uses:` rewrite and an assertion that the two halves move together. Since then the path has been confirmed **empirically rather than by inspection**: PR #125 and PR #164 in this repo were both opened by that workflow, and #164 merged. So the pin keeps a working owner after this change; it does not become orphaned. ## Scope swept, including the half this does not fix All 5 workflow files and all 16 `uses:` pins in `.github/workflows/` were swept. Exactly **1** is a `Comfy-Org/github-workflows` reusable and it is the repo's only `workflows_ref:` — so there is no second split pin here. The other **15** pins cover 6 distinct third-party/marketplace actions (`actions/checkout`, `actions/setup-python`, `actions/upload-artifact`, `actions/download-artifact`, `pypa/gh-action-pypi-publish`, `contributor-assistant/github-action`) and are **deliberately left under Dependabot's management** — the `ignore` is scoped to the two reusable-workflow name forms precisely so those keep getting bumped. ## Residual - **No guard enforces that the two pins stay aligned.** The upstream `Require a pinned workflows_ref` step only checks that the input is a non-empty 40-hex string; verified at `f22ad8f`, nothing compares it to the caller's `uses:` SHA. This PR removes the automated *cause* of a split but not a human edit or partial revert. Deferred to a follow-up rather than fixed here: the clean lever is upstream (`job.workflow_sha` is by definition the `uses:` SHA and the workflow already reads it), and the warn-vs-fail-closed rollout across the caller set is a human call. Tracked from [this thread](https://github.com/Comfy-Org/comfy-python-sdk/pull/161#discussion_r4042756616). - **Not verified: the org-wide "4 of 72 callers" measurement this work was scoped from.** That survey spans private repos and a caller roster held as a repository secret, neither of which was readable here. The split, the fix and the bumper path were verified **for this repo only**; the claim that three other callers are in the same state is carried over unverified and those repos are untouched here. If that number is right, each of them needs the same two-line change. - **The `ignore` has no `update-types:`/`versions:` qualifier, so it suppresses Dependabot *security* advisories for these reusables as well as version updates.** That is the upstream precedent's deliberate trade-off (a first-party org repo pinned to reviewed SHAs is not a public-registry package, so an advisory-driven bump is not its update path), and this PR adopts it as-is rather than re-litigating it. Naming it because it is a real reduction in coverage that the diff does not make visible on its own. - **Nothing in the repo's own suite exercises a GitHub Actions caller.** The 975 passing tests are the Python SDK's and are insensitive to this diff; they are reported as evidence the merge with `main` is clean, not as evidence about the `ignore`. ## Provenance - **Authored by:** agent-work loop - **Verified:** on the merged tree — ruff check: all checks passed; ruff format --check: 57 files already formatted; mypy src: no issues in 21 source files; pytest -q: 975 passed, 9 skipped; check_public_repo_hygiene.py: no internal-only references; dependabot.yml/ci-cursor-review.yml both parse as YAML; ci-cursor-review.yml holds exactly one distinct 40-hex SHA (f22ad8f); net diff vs main is 10 lines in .github/dependabot.yml alone - **Deviations:** the original workflow edit was dropped during conflict resolution — main's #164 re-synced both pins to a newer SHA first, making the hand re-sync redundant; resolved in main's favour rather than re-applying the older 425c154 (see Superseded half). The pin-alignment guard raised in review is deferred to a follow-up, not fixed here (see Residual). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 22:01:54 +00:00