[PR #117] [MERGED] ci(bump-callers): add detect-unreviewed-merge caller fleet (BE-6294) #128

New issue

Closed

opened 2026-10-26 22:36:32 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:36:32 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/117
Author: @mattmillerai
Created: 8/4/2026
Status: ✅ Merged
Merged: 8/4/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-6294-detect-unreviewed-merge-fleet

📝 Commits (7)

9afca0a ci(bump-callers): add detect-unreviewed-merge caller fleet (BE-6294)
577b1c8 ci(bump-callers): harden the detect-unreviewed-merge entrypoint (BE-6294)
1d81fe9 ci(bump-callers): seed the detect-unreviewed-merge roster and fix the caller-pattern doc (BE-6294)
72d5d79 ci(bump-callers): ship the detect-unreviewed-merge roster unseeded, not leaking (BE-6294)
9b93a60 ci(bump-callers): stop the header contradicting itself on seeding (BE-6294)
a8ef9a8 ci(bump-callers): stop the ALLOW_EMPTY note contradicting the pre-seed header (BE-6294)
bdd99d9 Merge remote-tracking branch 'origin/main' into matt/be-6294-detect-unreviewed-merge-fleet

📊 Changes

4 files changed (+309 additions, -14 deletions)

View changed files

📝 .github/bump-callers/README.md (+21 -1)
➕ .github/workflows/bump-detect-unreviewed-merge-callers.yml (+270 -0)
📝 .github/workflows/test-bump-callers.yml (+4 -2)
📝 AGENTS.md (+14 -11)

📄 Description

ELI-5

Every reusable workflow in this repo has a little robot whose job is: "when I change, go open a PR in each repo that uses me so their pinned SHA moves forward." detect-unreviewed-merge.yml — the SOC 2 workflow that flags PRs merged without approval — never got one, so its ~12 consumers were pinned by hand and quietly drifted onto an old commit. This adds that robot.

What changed

New .github/workflows/bump-detect-unreviewed-merge-callers.yml — a thin entrypoint over the shared .github/bump-callers/bump-callers.sh, copied from bump-pr-size-callers.yml (the cleanest current template: it carries both the stale-run guard and the decommission check) and reparameterised: VAR_NAME: DETECT_UNREVIEWED_MERGE_CALLERS, TAG: detect-unreviewed-merge, WORKFLOW_FILE: detect-unreviewed-merge.yml. Every SHA-pinned action is preserved verbatim (actions/checkout v7.0.1, actions/create-github-app-token v1.12.0 with its dependabot-ignore comment).
test-bump-callers.yml — the new entrypoint added to both the pull_request and push path filters.
.github/bump-callers/README.md — fleet row added; detect-unreviewed-merge.yml removed from "Reusables with no fleet", which now lists only the genuinely caller-less reusables.
AGENTS.md — the wrapper added to the catalog bullet (replacing the "known, deferred gap … pins move by hand" clause), and DETECT_UNREVIEWED_MERGE_CALLERS added to the fleet-variable list. Still 145 lines, inside the standard's 200-line gate.

Two deliberate differences from the pr-size template

Single-entry path filter and decommission check. detect-unreviewed-merge.yml loads nothing at run time — no workflows_ref: input, no prompt/script directory (grep for workflows_ref/scripts/ in it returns nothing). So the workflow file is the entire surface a caller pins: the push filter lists only .github/workflows/detect-unreviewed-merge.yml, and the guard drops pr-size's second -d scripts/check-pr-size condition.

ALLOW_EMPTY is deliberately not set, so it defaults to false and an empty/missing roster is a hard error (bump-callers.sh:69-83). This fleet has a known, non-empty caller set — per that script's own contract, a fleet that always has callers must never silently no-op, because that leaves every consumer un-bumped with nobody noticing. Roster seeding is a separate human step, so a run in the window before the variable exists will fail red on purpose: that is intentional nagging, not a bug, and the header comment says so explicitly to stop a future reader "fixing" it by flipping ALLOW_EMPTY on. The failure is inert — the script exits before any caller-repo write, so nothing can be mis-pinned.

Verification

shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh — clean.
bash .github/bump-callers/tests/test_bump_callers.sh — 123 passed, 0 failed (no script changes expected or made).
actionlint on the new workflow and on test-bump-callers.yml — clean.
python3 .github/agents-md-integrity/check_agents_md.py --root . — passed (the one warning, no CODEOWNERS, is pre-existing on main).
YAML parse of the new file confirms the resolved on: / concurrency: / step env: blocks match the spec above.

Judgment calls and follow-ups

Ticket suffix. The ticket prescribed the commit subject … (BE-6293); BE-6293 is the spike that found this gap, so I used (BE-6294) — the implementation ticket — in the title and commit so the Linear autolink points at the work being reviewed, and named BE-6293 in the commit body as the origin.
One line beyond the stated scope: test-bump-callers.yml's header comment enumerates the fleets the shared script drives; I added this one to that sentence rather than leave the list stale next to my own edit.
Not done, by design (from the ticket): docs/callers/** is untouched (it does not exist on main yet), and no caller repo name appears anywhere in this diff.
Follow-up (human step, this PR is safe to merge before it): seed DETECT_UNREVIEWED_MERGE_CALLERS, then workflow_dispatch the new entrypoint once — landing a fleet touches no path filter, so its own merge fires no run and existing stale pins stay stale until the reusable next changes. When seeding, note that this repo's own ci-detect-unreviewed-merge.yml is a caller and belongs in the roster: omitting a repo's own caller is the exact trap AGENTS.md records the groom fleet falling into with ci-groom.yml.
Negative-claim check: the diff adds no capability denial — no "not supported"/"unavailable"/STOP string, no new throw/deny dead-end, no test flipped to assert one. The two exit 0 paths (stale run, decommissioned workflow) are copied verbatim from the template, and the hard-fail-on-empty is the shared script's pre-existing documented default rather than a new dead-end.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/117 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 8/4/2026 **Status:** ✅ Merged **Merged:** 8/4/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-6294-detect-unreviewed-merge-fleet` --- ### 📝 Commits (7) - [`9afca0a`](https://github.com/Comfy-Org/github-workflows/commit/9afca0a4257e1b867c0072f7df03ebfad4f4e489) ci(bump-callers): add detect-unreviewed-merge caller fleet (BE-6294) - [`577b1c8`](https://github.com/Comfy-Org/github-workflows/commit/577b1c80748d5320f8d68ca92032ecd47000a7ef) ci(bump-callers): harden the detect-unreviewed-merge entrypoint (BE-6294) - [`1d81fe9`](https://github.com/Comfy-Org/github-workflows/commit/1d81fe9d5b41218e9e4b61e3c54306a5a941d84f) ci(bump-callers): seed the detect-unreviewed-merge roster and fix the caller-pattern doc (BE-6294) - [`72d5d79`](https://github.com/Comfy-Org/github-workflows/commit/72d5d7959cbf9f6934c7869bf1f33e6e3e874e3c) ci(bump-callers): ship the detect-unreviewed-merge roster unseeded, not leaking (BE-6294) - [`9b93a60`](https://github.com/Comfy-Org/github-workflows/commit/9b93a601c5a9c2dcef0fe0be190ab19df2c8fd8a) ci(bump-callers): stop the header contradicting itself on seeding (BE-6294) - [`a8ef9a8`](https://github.com/Comfy-Org/github-workflows/commit/a8ef9a8593e13b0950ca7cc853b87fe9c2959396) ci(bump-callers): stop the ALLOW_EMPTY note contradicting the pre-seed header (BE-6294) - [`bdd99d9`](https://github.com/Comfy-Org/github-workflows/commit/bdd99d94ff08f4d39df829c5babc4dd18fe6ab62) Merge remote-tracking branch 'origin/main' into matt/be-6294-detect-unreviewed-merge-fleet ### 📊 Changes **4 files changed** (+309 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `.github/bump-callers/README.md` (+21 -1) ➕ `.github/workflows/bump-detect-unreviewed-merge-callers.yml` (+270 -0) 📝 `.github/workflows/test-bump-callers.yml` (+4 -2) 📝 `AGENTS.md` (+14 -11) </details> ### 📄 Description ## ELI-5 Every reusable workflow in this repo has a little robot whose job is: "when I change, go open a PR in each repo that uses me so their pinned SHA moves forward." `detect-unreviewed-merge.yml` — the SOC 2 workflow that flags PRs merged without approval — never got one, so its ~12 consumers were pinned by hand and quietly drifted onto an old commit. This adds that robot. ## What changed - **New** `.github/workflows/bump-detect-unreviewed-merge-callers.yml` — a thin entrypoint over the shared `.github/bump-callers/bump-callers.sh`, copied from `bump-pr-size-callers.yml` (the cleanest current template: it carries both the stale-run guard and the decommission check) and reparameterised: `VAR_NAME: DETECT_UNREVIEWED_MERGE_CALLERS`, `TAG: detect-unreviewed-merge`, `WORKFLOW_FILE: detect-unreviewed-merge.yml`. Every SHA-pinned action is preserved verbatim (`actions/checkout` v7.0.1, `actions/create-github-app-token` v1.12.0 with its dependabot-ignore comment). - `test-bump-callers.yml` — the new entrypoint added to both the `pull_request` and `push` path filters. - `.github/bump-callers/README.md` — fleet row added; `detect-unreviewed-merge.yml` removed from "Reusables with no fleet", which now lists only the genuinely caller-less reusables. - `AGENTS.md` — the wrapper added to the catalog bullet (replacing the "known, deferred gap … pins move by hand" clause), and `DETECT_UNREVIEWED_MERGE_CALLERS` added to the fleet-variable list. Still 145 lines, inside the standard's 200-line gate. ## Two deliberate differences from the pr-size template **Single-entry path filter and decommission check.** `detect-unreviewed-merge.yml` loads nothing at run time — no `workflows_ref:` input, no prompt/script directory (`grep` for `workflows_ref`/`scripts/` in it returns nothing). So the workflow file is the entire surface a caller pins: the push filter lists only `.github/workflows/detect-unreviewed-merge.yml`, and the guard drops pr-size's second `-d scripts/check-pr-size` condition. **`ALLOW_EMPTY` is deliberately not set**, so it defaults to `false` and an empty/missing roster is a hard error (`bump-callers.sh:69-83`). This fleet has a known, non-empty caller set — per that script's own contract, a fleet that always has callers must never silently no-op, because that leaves every consumer un-bumped with nobody noticing. Roster seeding is a separate human step, so a run in the window before the variable exists will fail **red on purpose**: that is intentional nagging, not a bug, and the header comment says so explicitly to stop a future reader "fixing" it by flipping `ALLOW_EMPTY` on. The failure is inert — the script exits before any caller-repo write, so nothing can be mis-pinned. ## Verification - `shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh` — clean. - `bash .github/bump-callers/tests/test_bump_callers.sh` — **123 passed, 0 failed** (no script changes expected or made). - `actionlint` on the new workflow and on `test-bump-callers.yml` — clean. - `python3 .github/agents-md-integrity/check_agents_md.py --root .` — passed (the one warning, no CODEOWNERS, is pre-existing on `main`). - YAML parse of the new file confirms the resolved `on:` / `concurrency:` / step `env:` blocks match the spec above. ## Judgment calls and follow-ups - **Ticket suffix.** The ticket prescribed the commit subject `… (BE-6293)`; BE-6293 is the *spike* that found this gap, so I used `(BE-6294)` — the implementation ticket — in the title and commit so the Linear autolink points at the work being reviewed, and named BE-6293 in the commit body as the origin. - **One line beyond the stated scope:** `test-bump-callers.yml`'s header comment enumerates the fleets the shared script drives; I added this one to that sentence rather than leave the list stale next to my own edit. - **Not done, by design (from the ticket):** `docs/callers/**` is untouched (it does not exist on `main` yet), and no caller repo name appears anywhere in this diff. - **Follow-up (human step, this PR is safe to merge before it):** seed `DETECT_UNREVIEWED_MERGE_CALLERS`, then `workflow_dispatch` the new entrypoint once — landing a fleet touches no path filter, so its own merge fires no run and existing stale pins stay stale until the reusable next changes. When seeding, note that this repo's own `ci-detect-unreviewed-merge.yml` is a caller and belongs in the roster: omitting a repo's own caller is the exact trap AGENTS.md records the groom fleet falling into with `ci-groom.yml`. - **Negative-claim check:** the diff adds no capability denial — no "not supported"/"unavailable"/`STOP` string, no new throw/deny dead-end, no test flipped to assert one. The two `exit 0` paths (stale run, decommissioned workflow) are copied verbatim from the template, and the hard-fail-on-empty is the shared script's pre-existing documented default rather than a new dead-end. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:36:32 +00:00