[PR #1] [MERGED] feat: add reusable cursor-review workflow + centralized assets #14

New issue

Closed

opened 2026-10-26 22:35:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:35:25 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/1
Author: @mattmillerai
Created: 6/2/2026
Status: ✅ Merged
Merged: 6/2/2026
Merged by: @mattmillerai

Base: main ← Head: feat/cursor-review-reusable

📝 Commits (1)

c6b5549 feat: add reusable cursor-review workflow + centralized assets

📊 Changes

10 files changed (+1463 additions, -0 deletions)

View changed files

➕ .github/cursor-review/__pycache__/extract-findings.cpython-314.pyc (+0 -0)
➕ .github/cursor-review/__pycache__/post-review.cpython-314.pyc (+0 -0)
➕ .github/cursor-review/extract-findings.py (+101 -0)
➕ .github/cursor-review/post-review.py (+297 -0)
➕ .github/cursor-review/prompt-adversarial.md (+43 -0)
➕ .github/cursor-review/prompt-edge-case.md (+45 -0)
➕ .github/cursor-review/prompt-judge.md (+52 -0)
➕ .github/cursor-review/slack-notify.sh (+224 -0)
➕ .github/workflows/cursor-review.yml (+700 -0)
📝 README.md (+1 -0)

📄 Description

Extracts the label-triggered multi-model Cursor review out of the private consumer repos (cloud, comfy-cloud-mcp-server) into one shared reusable workflow here — single source of truth, no per-repo drift.

Why

cursor-review was copy-ported into each consumer repo. The copies drift (e.g. the severity feature landed in cloud but not comfy-cloud-mcp-server, and a verbatim re-copy then failed the consumer's markdown formatter). Centralizing ends that: consumers carry only a thin caller.

What's here

.github/workflows/cursor-review.yml — reusable workflow_call workflow. Same job graph as the private original: gate → diff-size → 8-cell panel (4 labs × adversarial/edge-case) → judge consolidate → Slack start/complete DMs. Repo-specific knobs are now inputs:
- judge_model (default claude-opus-4-7-thinking-xhigh)
- diff_size_cap (default 5000)
- review_label (default cursor-review)
- diff_excludes (generic default; consumers pass their generated/vendored paths)
- workflows_ref (which ref of this repo to load assets from)
- secrets: CURSOR_API_KEY (required), SLACK_BOT_TOKEN (optional)
.github/cursor-review/ — the trusted review logic: prompt-adversarial.md, prompt-edge-case.md, prompt-judge.md, extract-findings.py, post-review.py, slack-notify.sh.

Trust model (improved)

The private original git show'd the prompts/scripts from the consumer's base SHA (trusted-but-in-PR-repo). Here the workflow loads them by checking out this repo (public, pinned via workflows_ref), so a PR in the consumer repo can't influence what runs at all. The diff under review still comes from the PR head; the logic doesn't.

Severity

The bundled post-review.py + prompts include the CodeRabbit-style severity categorization (🔴 critical / 🟠 high / 🟡 medium / 🟢 low / ⚪ nit badges + a summary count table), so this is the latest version — it supersedes the in-flight per-repo severity port.

Validation

actionlint clean (exit 0); post-review.py / extract-findings.py compile.

Rollout

Merge this.
comfy-cloud-mcp-server migrates to a thin caller (separate PR, depends on this) and deletes its local copies.
cloud migrates next (follow-up; cloud-team review).
Move the floating v1 tag once reviewed so callers can pin to @v1.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/1 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 6/2/2026 **Status:** ✅ Merged **Merged:** 6/2/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `feat/cursor-review-reusable` --- ### 📝 Commits (1) - [`c6b5549`](https://github.com/Comfy-Org/github-workflows/commit/c6b5549f8ea1fb04c3713119a17d178f3ea39e25) feat: add reusable cursor-review workflow + centralized assets ### 📊 Changes **10 files changed** (+1463 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `.github/cursor-review/__pycache__/extract-findings.cpython-314.pyc` (+0 -0) ➕ `.github/cursor-review/__pycache__/post-review.cpython-314.pyc` (+0 -0) ➕ `.github/cursor-review/extract-findings.py` (+101 -0) ➕ `.github/cursor-review/post-review.py` (+297 -0) ➕ `.github/cursor-review/prompt-adversarial.md` (+43 -0) ➕ `.github/cursor-review/prompt-edge-case.md` (+45 -0) ➕ `.github/cursor-review/prompt-judge.md` (+52 -0) ➕ `.github/cursor-review/slack-notify.sh` (+224 -0) ➕ `.github/workflows/cursor-review.yml` (+700 -0) 📝 `README.md` (+1 -0) </details> ### 📄 Description Extracts the label-triggered multi-model Cursor review out of the private consumer repos (`cloud`, `comfy-cloud-mcp-server`) into one shared reusable workflow here — single source of truth, no per-repo drift. ## Why cursor-review was copy-ported into each consumer repo. The copies drift (e.g. the severity feature landed in `cloud` but not `comfy-cloud-mcp-server`, and a verbatim re-copy then failed the consumer's markdown formatter). Centralizing ends that: consumers carry only a thin caller. ## What's here - **`.github/workflows/cursor-review.yml`** — reusable `workflow_call` workflow. Same job graph as the private original: gate → diff-size → 8-cell panel (4 labs × adversarial/edge-case) → judge consolidate → Slack start/complete DMs. Repo-specific knobs are now inputs: - `judge_model` (default `claude-opus-4-7-thinking-xhigh`) - `diff_size_cap` (default 5000) - `review_label` (default `cursor-review`) - `diff_excludes` (generic default; consumers pass their generated/vendored paths) - `workflows_ref` (which ref of this repo to load assets from) - secrets: `CURSOR_API_KEY` (required), `SLACK_BOT_TOKEN` (optional) - **`.github/cursor-review/`** — the trusted review logic: `prompt-adversarial.md`, `prompt-edge-case.md`, `prompt-judge.md`, `extract-findings.py`, `post-review.py`, `slack-notify.sh`. ## Trust model (improved) The private original `git show`'d the prompts/scripts from the consumer's **base SHA** (trusted-but-in-PR-repo). Here the workflow loads them by checking out **this** repo (public, pinned via `workflows_ref`), so a PR in the consumer repo can't influence what runs at all. The diff under review still comes from the PR head; the logic doesn't. ## Severity The bundled `post-review.py` + prompts include the CodeRabbit-style severity categorization (🔴 critical / 🟠 high / 🟡 medium / 🟢 low / ⚪ nit badges + a summary count table), so this is the latest version — it supersedes the in-flight per-repo severity port. ## Validation `actionlint` clean (exit 0); `post-review.py` / `extract-findings.py` compile. ## Rollout 1. Merge this. 2. `comfy-cloud-mcp-server` migrates to a thin caller (separate PR, depends on this) and deletes its local copies. 3. `cloud` migrates next (follow-up; cloud-team review). 4. Move the floating `v1` tag once reviewed so callers can pin to `@v1`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:35:25 +00:00