[PR #199] [MERGED] docs: reword committed comments that name private caller repos (BE-8191) #206

New issue

Closed

opened 2026-10-26 22:37:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:37:22 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/199
Author: @mattmillerai
Created: 8/20/2026
Status: ✅ Merged
Merged: 8/21/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-8191-reword-private-caller-comments

📝 Commits (2)

91b133e docs: reword committed comments that name private caller repos (BE-8191)
423d0ee docs: fix redaction artifacts flagged by the review panel (BE-8191)

📊 Changes

15 files changed (+31 additions, -31 deletions)

View changed files

📝 .github/dependabot.yml (+2 -2)
📝 .github/groom/README.md (+2 -2)
📝 .github/groom/scope.py (+1 -1)
📝 .github/refresh-reviewers/README.md (+1 -1)
📝 .github/refresh-reviewers/generate.py (+1 -1)
📝 .github/workflows/bump-area-label-callers.yml (+1 -1)
📝 .github/workflows/bump-linear-ticket-callers.yml (+4 -4)
📝 .github/workflows/ci-groom.yml (+7 -7)
📝 .github/workflows/groom.yml (+2 -2)
📝 .github/workflows/pr-area-label.yml (+3 -3)
📝 .github/workflows/refresh-reviewers.yml (+1 -1)
📝 .github/workflows/stale.yml (+2 -2)
📝 scripts/area-label/lib.sh (+2 -2)
📝 scripts/pr-risk/grade-pr-risk.sh (+1 -1)
📝 scripts/pr-risk/tests/test_grade_pr_risk.sh (+1 -1)

📄 Description

ELI-5

This repo is public. A bunch of code comments still said, out loud, the names of
the private repos that call these workflows. This PR rewords those comments so
they say "a private caller" / "a live caller" instead — without losing a single
thing they were explaining. Nothing runs differently.

What changed

Comment/doc text only across 15 files — zero behavior change. Every site
keeps its full operational meaning (the rationale, the evidence, the numbers);
only the identifying names go.

file	what the comment now says
`.github/workflows/bump-linear-ticket-callers.yml:105`	"Live callers already pin this workflow" — the empty-roster-is-a-bug rationale, `ALLOW_EMPTY: "false"` and the seeding instruction are unchanged
`.github/workflows/pr-area-label.yml:25`	first shipped "in a private caller repo"; every caller shares ONE hardened implementation. The upstream PR number went with it — it is meaningless without the repo name
`.github/workflows/stale.yml:10-12`	neutral `owner/repo#158` example; the point (two repos' batches in one Slack channel need per-line repo attribution) survives intact
`.github/workflows/bump-area-label-callers.yml:102`	flip to `"false"` "once the next caller repo lands its caller"
`.github/workflows/ci-groom.yml:25,64`	"a private caller" / "one caller"; at :64 the IaC-tool detail is also dropped — naming the tool a private repo runs is the same class of leak
`.github/workflows/groom.yml:36,371`	the security-boundary reference and the `vars`-resolution example no longer name the repo (or its internal workflow path)
`.github/workflows/refresh-reviewers.yml:9`, `.github/refresh-reviewers/README.md:70`, `.github/refresh-reviewers/generate.py:12`	"validated ... against a caller repo's history"
`.github/dependabot.yml:24,94`	"matching the callers' github-actions cadence"; the v1.12.0-vs-v3.2.0 403 evidence-not-changelog rationale is kept whole, with the repo named generically
`.github/groom/README.md:144-145`	placeholder examples use the `example` fixture repo already used elsewhere in this codebase
`.github/groom/scope.py:199`	"labels those subtrees itself"
`scripts/area-label/lib.sh:9-10`	"the original private-repo port ... hardened in review"; the entire no-tools / no-token / enum-constrained posture description is kept verbatim
`scripts/pr-risk/grade-pr-risk.sh:69`, `scripts/pr-risk/tests/test_grade_pr_risk.sh:316`	"measured on a live caller"; the 103 and 66 check counts are kept

Rule being enforced: AGENTS.md → "Conventions & gotchas" → "Public repo — never
leak private caller names ... Keep private repo paths/detail out of workflow
files, commit messages, and PR text."

Scope calls worth a reviewer's eye

Six sites go beyond the ticket's enumerated list — groom.yml:36,
groom.yml:371, refresh-reviewers.yml:9, refresh-reviewers/README.md:70,
refresh-reviewers/generate.py:12. They are the identical class of comment
and they are required by the ticket's own verification criterion (the
word-boundary grep for the caller names must come back clean of repo-name
hits); the enumerated list alone does not satisfy it. groom.yml:36 was the widest
leak of the set — it named a private repo and an internal file path inside it.
Two grammar adjustments beyond the literal replacement text, both forced
by the substitution:
- stale.yml — the prescribed phrase renders ungrammatically after the swap,
  so the line reads "looks identical whichever repo it came from" rather
  than "which of the two repos it came from". Meaning identical.
- pr-area-label.yml — subject changed plural→singular, so keep→keeps
  and their→its.
Reflow. Three comment blocks were re-wrapped so no added line exceeds the
file's pre-existing maximum comment width. No wording beyond the above changed.

Deliberately NOT changed (swept, and the size of the residual)

The sweep covered the whole tree, not just the fixed sites. What is left after
this PR, and why:

Comfy-Org/unreviewed-merges (README.md, docs/callers/detect-unreviewed-merge.md,
.github/workflows/detect-unreviewed-merge.yml) — 9 references, load-bearing
in code and deliberately documented. Out of scope by the ticket's own
instruction; a separate decision.
The bot App slug — ~30 references. A functional App identity string, not
prose.
Generic-cloud prose (ci-groom.yml:66 "repo, cloud, or publish"; the sandbox's
"cloud metadata" egress assertions) — ~10 references. Not repo names.
#proj-cloud in stale.yml:36,50 — 2 references. A Slack channel name
documenting the slack_channel input's default, whose channel ID
(C08V9NDB3B4) is already the committed default two lines below. Renaming the
human-readable half while the ID stays would be theatre, and it is not a repo
name. Judgment call — flagging it rather than deciding it silently.
One caller's bare name used as a fixture repo basename in
.github/groom/tests/test_ledger.py (8×) and test_scope.py (2×) —
10 references. Arbitrary test-fixture strings, and the ticket protects test
fixtures as a class. Safe to rename later if wanted; not a comment.

Also swept and clean at zero: every other org repo in the fleet, private
or public, beyond the two this ticket is about — a qualified Comfy-Org/<name>
grep for each returns 0 across the tree, so this PR's two names were the whole
exposure.

History is not scrubbed. This stops future publication of these names; the
names remain reachable in this repo's git history and in already-published run
logs. Undoing that is a separate, far more invasive decision.

Verification

The ticket's own acceptance is two git grep sweeps for the private caller
names — one for the qualified Comfy-Org/<name> form, one word-boundary sweep
for the bare names. Run against this branch: the qualified sweep returns no
hits, and the bare sweep returns only the residual classes enumerated in
the section above (bot App slug, generic-cloud prose, the Slack channel default,
the test fixtures). The exact patterns are on the ticket; they are not repeated
here, since spelling them out in a world-readable PR body would defeat the
change.

Full test matrix from AGENTS.md, plus every suite whose directory this diff
touches — see Verified below. Two environment gaps, both pre-existing and
independent of this diff (each reproduces identically on main):

scripts/area-label/tests/test_lib.sh — needs yq, absent on this machine.
Not run here; CI runs it. The file's change is a header comment only and
bash -n scripts/area-label/lib.sh parses clean.
.github/coderabbit-config/tests/ — 1 error, jsonschema not installed
locally. That directory is not touched by this diff.
check_agents_md.py --root . fails on AGENTS.md being 281 lines (ceiling
200). Pre-existing on main; AGENTS.md is not in this diff.

Refs BE-8191 — the ticket stays open because the Slack-channel and test-fixture
residuals above sit in files the ticket names (stale.yml, the groom tests) and
this PR does not resolve them.

Provenance

Authored by: agent-work loop
Verified: after the review-fix commit, workflow-pins 118 OK and groom
365 OK (1 skipped) re-run green and every re-changed .yml re-parsed with
yaml.safe_load; original matrix: groom 365 tests OK (1 skipped); cursor-review 194 OK;
workflow-pins 118 OK; linear-ticket 74 OK; agents-md-integrity 46 OK;
refresh-reviewers 48 OK; bump-callers 424 + preflight 278 + paths-contract 66
passed, 0 failed; pr-risk grade 138 / grade-targets 105 / publish-surfaces 94 /
apply-label 48 / resolve-enabled 27 / pin-contract 28 passed, 0 failed;
pr-derisk 63 passed, 0 failed; shellcheck -x clean on all changed shell
files; every changed .yml re-parsed with yaml.safe_load
Deviations: the two grammar adjustments and the comment reflow in "Scope
calls" above; six sites fixed beyond the enumerated list, for the reason given
there; the Slack-channel comment and the test fixtures left in place, sized above;
four panel findings addressed post-review (ci-groom.yml credential invariant
restored, dependabot.yml bot App slug restored for consistency with the
residual policy, stale.yml antecedent fix, checkable ALLOW_EMPTY flip trigger)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/199 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 8/20/2026 **Status:** ✅ Merged **Merged:** 8/21/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-8191-reword-private-caller-comments` --- ### 📝 Commits (2) - [`91b133e`](https://github.com/Comfy-Org/github-workflows/commit/91b133e8ef4a9d2b6f8211f62dedaaf138f69b27) docs: reword committed comments that name private caller repos (BE-8191) - [`423d0ee`](https://github.com/Comfy-Org/github-workflows/commit/423d0ee7cbff34592b426cb1255277d368a006c0) docs: fix redaction artifacts flagged by the review panel (BE-8191) ### 📊 Changes **15 files changed** (+31 additions, -31 deletions) <details> <summary>View changed files</summary> 📝 `.github/dependabot.yml` (+2 -2) 📝 `.github/groom/README.md` (+2 -2) 📝 `.github/groom/scope.py` (+1 -1) 📝 `.github/refresh-reviewers/README.md` (+1 -1) 📝 `.github/refresh-reviewers/generate.py` (+1 -1) 📝 `.github/workflows/bump-area-label-callers.yml` (+1 -1) 📝 `.github/workflows/bump-linear-ticket-callers.yml` (+4 -4) 📝 `.github/workflows/ci-groom.yml` (+7 -7) 📝 `.github/workflows/groom.yml` (+2 -2) 📝 `.github/workflows/pr-area-label.yml` (+3 -3) 📝 `.github/workflows/refresh-reviewers.yml` (+1 -1) 📝 `.github/workflows/stale.yml` (+2 -2) 📝 `scripts/area-label/lib.sh` (+2 -2) 📝 `scripts/pr-risk/grade-pr-risk.sh` (+1 -1) 📝 `scripts/pr-risk/tests/test_grade_pr_risk.sh` (+1 -1) </details> ### 📄 Description ## ELI-5 This repo is public. A bunch of code comments still said, out loud, the names of the private repos that call these workflows. This PR rewords those comments so they say "a private caller" / "a live caller" instead — without losing a single thing they were explaining. Nothing runs differently. ## What changed Comment/doc text only across 15 files — **zero behavior change**. Every site keeps its full operational meaning (the rationale, the evidence, the numbers); only the identifying names go. | file | what the comment now says | |---|---| | `.github/workflows/bump-linear-ticket-callers.yml:105` | "Live callers already pin this workflow" — the empty-roster-is-a-bug rationale, `ALLOW_EMPTY: "false"` and the seeding instruction are unchanged | | `.github/workflows/pr-area-label.yml:25` | first shipped "in a private caller repo"; every caller shares ONE hardened implementation. The upstream PR number went with it — it is meaningless without the repo name | | `.github/workflows/stale.yml:10-12` | neutral `owner/repo#158` example; the point (two repos' batches in one Slack channel need per-line repo attribution) survives intact | | `.github/workflows/bump-area-label-callers.yml:102` | flip to `"false"` "once the next caller repo lands its caller" | | `.github/workflows/ci-groom.yml:25,64` | "a private caller" / "one caller"; at :64 the IaC-tool detail is also dropped — naming the tool a private repo runs is the same class of leak | | `.github/workflows/groom.yml:36,371` | the security-boundary reference and the `vars`-resolution example no longer name the repo (or its internal workflow path) | | `.github/workflows/refresh-reviewers.yml:9`, `.github/refresh-reviewers/README.md:70`, `.github/refresh-reviewers/generate.py:12` | "validated ... against a caller repo's history" | | `.github/dependabot.yml:24,94` | "matching the callers' github-actions cadence"; the v1.12.0-vs-v3.2.0 403 evidence-not-changelog rationale is kept whole, with the repo named generically | | `.github/groom/README.md:144-145` | placeholder examples use the `example` fixture repo already used elsewhere in this codebase | | `.github/groom/scope.py:199` | "labels those subtrees itself" | | `scripts/area-label/lib.sh:9-10` | "the original private-repo port ... hardened in review"; the entire no-tools / no-token / enum-constrained posture description is kept verbatim | | `scripts/pr-risk/grade-pr-risk.sh:69`, `scripts/pr-risk/tests/test_grade_pr_risk.sh:316` | "measured on a live caller"; the 103 and 66 check counts are kept | Rule being enforced: AGENTS.md → "Conventions & gotchas" → *"Public repo — never leak private caller names ... Keep private repo paths/detail out of workflow files, commit messages, and PR text."* ## Scope calls worth a reviewer's eye 1. **Six sites go beyond the ticket's enumerated list** — `groom.yml:36`, `groom.yml:371`, `refresh-reviewers.yml:9`, `refresh-reviewers/README.md:70`, `refresh-reviewers/generate.py:12`. They are the identical class of comment and they are required by the ticket's **own verification criterion** (the word-boundary grep for the caller names must come back clean of repo-name hits); the enumerated list alone does not satisfy it. `groom.yml:36` was the widest leak of the set — it named a private repo *and* an internal file path inside it. 2. **Two grammar adjustments beyond the literal replacement text**, both forced by the substitution: - `stale.yml` — the prescribed phrase renders ungrammatically after the swap, so the line reads "looks identical **whichever** repo it came from" rather than "which of the two repos it came from". Meaning identical. - `pr-area-label.yml` — subject changed plural→singular, so `keep`→`keeps` and `their`→`its`. 3. **Reflow.** Three comment blocks were re-wrapped so no added line exceeds the file's pre-existing maximum comment width. No wording beyond the above changed. ## Deliberately NOT changed (swept, and the size of the residual) The sweep covered the whole tree, not just the fixed sites. What is left after this PR, and why: - `Comfy-Org/unreviewed-merges` (`README.md`, `docs/callers/detect-unreviewed-merge.md`, `.github/workflows/detect-unreviewed-merge.yml`) — **9 references**, load-bearing in code and deliberately documented. Out of scope by the ticket's own instruction; a separate decision. - The bot App slug — **~30 references**. A functional App identity string, not prose. - Generic-cloud prose (`ci-groom.yml:66` "repo, cloud, or publish"; the sandbox's "cloud metadata" egress assertions) — **~10 references**. Not repo names. - `#proj-cloud` in `stale.yml:36,50` — **2 references**. A Slack channel name documenting the `slack_channel` input's default, whose channel ID (`C08V9NDB3B4`) is already the committed default two lines below. Renaming the human-readable half while the ID stays would be theatre, and it is not a repo name. **Judgment call — flagging it rather than deciding it silently.** - One caller's bare name used as a fixture repo basename in `.github/groom/tests/test_ledger.py` (8×) and `test_scope.py` (2×) — **10 references**. Arbitrary test-fixture strings, and the ticket protects test fixtures as a class. Safe to rename later if wanted; not a comment. Also swept and **clean at zero**: every *other* org repo in the fleet, private or public, beyond the two this ticket is about — a qualified `Comfy-Org/<name>` grep for each returns 0 across the tree, so this PR's two names were the whole exposure. **History is not scrubbed.** This stops future publication of these names; the names remain reachable in this repo's git history and in already-published run logs. Undoing that is a separate, far more invasive decision. ## Verification The ticket's own acceptance is two `git grep` sweeps for the private caller names — one for the qualified `Comfy-Org/<name>` form, one word-boundary sweep for the bare names. Run against this branch: the qualified sweep returns **no hits**, and the bare sweep returns **only** the residual classes enumerated in the section above (bot App slug, generic-cloud prose, the Slack channel default, the test fixtures). The exact patterns are on the ticket; they are not repeated here, since spelling them out in a world-readable PR body would defeat the change. Full test matrix from AGENTS.md, plus every suite whose directory this diff touches — see **Verified** below. Two environment gaps, both pre-existing and independent of this diff (each reproduces identically on `main`): - `scripts/area-label/tests/test_lib.sh` — needs `yq`, absent on this machine. Not run here; CI runs it. The file's change is a header comment only and `bash -n scripts/area-label/lib.sh` parses clean. - `.github/coderabbit-config/tests/` — 1 error, `jsonschema` not installed locally. That directory is not touched by this diff. - `check_agents_md.py --root .` fails on `AGENTS.md` being 281 lines (ceiling 200). Pre-existing on `main`; `AGENTS.md` is not in this diff. Refs BE-8191 — the ticket stays open because the Slack-channel and test-fixture residuals above sit in files the ticket names (`stale.yml`, the groom tests) and this PR does not resolve them. ## Provenance - **Authored by:** agent-work loop - **Verified:** after the review-fix commit, workflow-pins 118 OK and groom 365 OK (1 skipped) re-run green and every re-changed `.yml` re-parsed with `yaml.safe_load`; original matrix: groom 365 tests OK (1 skipped); cursor-review 194 OK; workflow-pins 118 OK; linear-ticket 74 OK; agents-md-integrity 46 OK; refresh-reviewers 48 OK; bump-callers 424 + preflight 278 + paths-contract 66 passed, 0 failed; pr-risk grade 138 / grade-targets 105 / publish-surfaces 94 / apply-label 48 / resolve-enabled 27 / pin-contract 28 passed, 0 failed; pr-derisk 63 passed, 0 failed; `shellcheck -x` clean on all changed shell files; every changed `.yml` re-parsed with `yaml.safe_load` - **Deviations:** the two grammar adjustments and the comment reflow in "Scope calls" above; six sites fixed beyond the enumerated list, for the reason given there; the Slack-channel comment and the test fixtures left in place, sized above; four panel findings addressed post-review (ci-groom.yml credential invariant restored, dependabot.yml bot App slug restored for consistency with the residual policy, stale.yml antecedent fix, checkable `ALLOW_EMPTY` flip trigger) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:37:22 +00:00