[PR #98] [MERGED] fix(ci): hold create-github-app-token at v1.x in the cross-repo caller bumpers (BE-5227) #109

New issue

Closed

opened 2026-10-26 22:36:17 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:36:17 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/98
Author: @mattmillerai
Created: 7/31/2026
Status: ✅ Merged
Merged: 7/31/2026
Merged by: @mattmillerai

Base: main ← Head: mattmillerai/be-5227-fix-caller-bump-403

📝 Commits (1)

683ff25 fix(ci): hold create-github-app-token at v1.x in the cross-repo caller bumpers (BE-5227)

📊 Changes

7 files changed (+27 additions, -6 deletions)

View changed files

📝 .github/dependabot.yml (+21 -0)
📝 .github/workflows/bump-agents-md-callers.yml (+1 -1)
📝 .github/workflows/bump-assign-reviewers-callers.yml (+1 -1)
📝 .github/workflows/bump-auto-label-callers.yml (+1 -1)
📝 .github/workflows/bump-cursor-review-callers.yml (+1 -1)
📝 .github/workflows/bump-groom-callers.yml (+1 -1)
📝 .github/workflows/bump-pr-size-callers.yml (+1 -1)

📄 Description

ELI-5

A robot's job is to go around to all our other repos and update a version number after we change the shared workflow. Last night an automatic dependency update gave that robot a newer keycard. The newer keycard doesn't open other repos' doors — only its own. So for the last three merges the robot has been quietly failing at every door, and every repo is still on an old version number. This puts the old keycard back for that one robot.

The break

bump-*-callers.yml mints a cross-repo App token (owner: Comfy-Org, no repositories:) and commits the rewritten caller file via the Git Data API. Since the 2026-07-30 major group (#95) bumped actions/create-github-app-token v1.12.0 → v3.2.0, every run 403s:

gh: Resource not accessible by integration (HTTP 403)
⚠ <repo>: tree create failed — skipping
✗ bump failed for 4 repo(s)

Three consecutive failures — 3b5886b (23:02), 6ed928c (02:51), 8eebe24 (04:10) — plus a manual workflow_dispatch re-run to rule out a transient. No consumer has been bumped since, so every caller repo is stranded on a stale pin, silently: the dispatcher's failure is a red run in this repo that says nothing about the repos actually left behind.

Why the version bump is the cause

Same repo, same token config, across the boundary:

when	action	result
2026-07-30T23:03:17Z	v1.12.0	`cloud-code-bot[bot]` committed `Comfy-Org/cloud` (#5893)
2026-07-31T04:10Z	v3.2.0	403 on `Comfy-Org/cloud`, `tree create`

Nothing else on the bump path changed in that window — the diff between the last green run and the first red one touches only the two action pins in these workflows. Neither the v2.0.0 release notes (removed deprecated app_id/private_key/skip_token_revoke) nor v3.0.0's (proxy handling) document a scoping change, so this is pinned on observed behavior, not a changelog entry — which is also why the ignore comment says lifting it needs a proven cross-repo write rather than a green CI run.

Scope

Deliberately narrow — only the six cross-repo bumpers revert to v1.12.0:

bump-agents-md-callers · bump-assign-reviewers-callers · bump-auto-label-callers · bump-cursor-review-callers · bump-groom-callers · bump-pr-size-callers

The current-repo minters stay on v3.2.0 and are untouched: groom.yml, cursor-review.yml, pr-size.yml, assign-reviewers.yml, cursor-review-auto-label.yml. None set owner:, so their tokens are scoped to the running repo and never crossed the boundary that broke. That split is the whole reason this is 6 files and not 11.

A dependabot.yml ignore holds majors only — v1.x patches still arrive.

Verification

All 6 cross-repo minters confirmed off bcd2ba4; all current-repo minters confirmed still on it.
dependabot.yml parses; ignore now has 2 entries.
Nothing exercises the cross-repo path in CI, so the real check is firing bump-groom-callers after merge and confirming the three outstanding callers (comfy-cloud-mcp-server, comfy-local-mcp, comfy-infra) get bump PRs. I'll do that and report back on this PR.

Comfy-Org/cloud was already bumped by hand (cloud#5938) to unblock GROOM_CONFIG, so it will show as already at rather than as a new PR.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/98 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/31/2026 **Status:** ✅ Merged **Merged:** 7/31/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `mattmillerai/be-5227-fix-caller-bump-403` --- ### 📝 Commits (1) - [`683ff25`](https://github.com/Comfy-Org/github-workflows/commit/683ff258815809950630b03c5a2f48ef04358c95) fix(ci): hold create-github-app-token at v1.x in the cross-repo caller bumpers (BE-5227) ### 📊 Changes **7 files changed** (+27 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `.github/dependabot.yml` (+21 -0) 📝 `.github/workflows/bump-agents-md-callers.yml` (+1 -1) 📝 `.github/workflows/bump-assign-reviewers-callers.yml` (+1 -1) 📝 `.github/workflows/bump-auto-label-callers.yml` (+1 -1) 📝 `.github/workflows/bump-cursor-review-callers.yml` (+1 -1) 📝 `.github/workflows/bump-groom-callers.yml` (+1 -1) 📝 `.github/workflows/bump-pr-size-callers.yml` (+1 -1) </details> ### 📄 Description ## ELI-5 A robot's job is to go around to all our other repos and update a version number after we change the shared workflow. Last night an automatic dependency update gave that robot a newer keycard. The newer keycard doesn't open other repos' doors — only its own. So for the last three merges the robot has been quietly failing at every door, and every repo is still on an old version number. This puts the old keycard back for that one robot. ## The break `bump-*-callers.yml` mints a **cross-repo** App token (`owner: Comfy-Org`, no `repositories:`) and commits the rewritten caller file via the Git Data API. Since the 2026-07-30 major group (#95) bumped `actions/create-github-app-token` **v1.12.0 → v3.2.0**, every run 403s: ``` gh: Resource not accessible by integration (HTTP 403) ⚠ <repo>: tree create failed — skipping ✗ bump failed for 4 repo(s) ``` Three consecutive failures — `3b5886b` (23:02), `6ed928c` (02:51), `8eebe24` (04:10) — plus a manual `workflow_dispatch` re-run to rule out a transient. **No consumer has been bumped since,** so every caller repo is stranded on a stale pin, silently: the dispatcher's failure is a red run in *this* repo that says nothing about the repos actually left behind. ## Why the version bump is the cause Same repo, same token config, across the boundary: | when | action | result | |---|---|---| | 2026-07-30T23:03:17Z | v1.12.0 | `cloud-code-bot[bot]` **committed** `Comfy-Org/cloud` (#5893) | | 2026-07-31T04:10Z | v3.2.0 | **403** on `Comfy-Org/cloud`, `tree create` | Nothing else on the bump path changed in that window — the diff between the last green run and the first red one touches only the two action pins in these workflows. Neither the v2.0.0 release notes (removed deprecated `app_id`/`private_key`/`skip_token_revoke`) nor v3.0.0's (proxy handling) document a scoping change, so this is pinned on **observed behavior, not a changelog entry** — which is also why the ignore comment says lifting it needs a proven cross-repo write rather than a green CI run. ## Scope Deliberately narrow — only the **six cross-repo bumpers** revert to v1.12.0: `bump-agents-md-callers` · `bump-assign-reviewers-callers` · `bump-auto-label-callers` · `bump-cursor-review-callers` · `bump-groom-callers` · `bump-pr-size-callers` The **current-repo minters stay on v3.2.0** and are untouched: `groom.yml`, `cursor-review.yml`, `pr-size.yml`, `assign-reviewers.yml`, `cursor-review-auto-label.yml`. None set `owner:`, so their tokens are scoped to the running repo and never crossed the boundary that broke. That split is the whole reason this is 6 files and not 11. A `dependabot.yml` ignore holds majors only — v1.x patches still arrive. ## Verification 1. All 6 cross-repo minters confirmed off `bcd2ba4`; all current-repo minters confirmed still on it. 2. `dependabot.yml` parses; `ignore` now has 2 entries. 3. Nothing exercises the cross-repo path in CI, so the real check is firing `bump-groom-callers` after merge and confirming the three outstanding callers (`comfy-cloud-mcp-server`, `comfy-local-mcp`, `comfy-infra`) get bump PRs. I'll do that and report back on this PR. `Comfy-Org/cloud` was already bumped by hand (cloud#5938) to unblock `GROOM_CONFIG`, so it will show as `already at` rather than as a new PR. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:36:17 +00:00