[PR #13] [MERGED] feat(cursor-review): optional dedicated bot identity for review posting (BE-1812) #22

New issue

Closed

opened 2026-10-26 22:35:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:35:29 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/13
Author: @mattmillerai
Created: 6/25/2026
Status: ✅ Merged
Merged: 6/26/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-1812-story-11-cursor-review-reusable-workflow-optional-dedicated

📝 Commits (3)

0486dff feat(cursor-review): optional dedicated bot identity for review posting (BE-1812)
e600ea3 refactor(cursor-review): App ID as input (reuse cloud-code-bot), drop secrets-if workaround
f4427a4 docs(cursor-review): genericize bot-identity example comments for OSS

📊 Changes

1 file changed (+30 additions, -1 deletions)

View changed files

📝 .github/workflows/cursor-review.yml (+30 -1)

📄 Description

Implements BE-1812 (hunks 1+2 of the BE-1800 approach): the cursor-review reusable workflow can post under an optional dedicated bot identity instead of the shared github-actions[bot], so its review threads become distinct and queryable.

Change — one file, `.github/workflows/cursor-review.yml`

Two optional workflow_call secrets: BOT_APP_ID, BOT_APP_PRIVATE_KEY (both required: false).
A Detect bot identity step + a conditional actions/create-github-app-token@v2 mint step before Post review.
Post review's token becomes ${{ steps.bot_token.outputs.token || secrets.GITHUB_TOKEN }}.

post-review.py is untouched — the comment author follows whatever token it gets.

Note: secrets can't be referenced in a step if:, so a tiny Detect bot identity step surfaces presence as a step output the mint step gates on (actionlint-clean).

Safe to merge now (red-safe / no-op until configured)

With no creds supplied, the mint step is skipped and posting stays github-actions[bot] — zero behavior change for every consumer, including OSS callers. It posts under the new identity only once the App + org secrets exist (BE-1813) and callers pass them through (BE-1814).

Two usual footguns were already handled here, so no companion edits:

Dedup keys on the review body marker, not the author — identity change won't re-trigger reviews.
Triggerer attribution already falls back to the PR assignee on a bot actor — Slack DM attribution survives.

Pin style matches the file (bare tags). Caller passthrough is the separate BE-1814.

Refs BE-1812 · parent BE-1800.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/13 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 6/25/2026 **Status:** ✅ Merged **Merged:** 6/26/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-1812-story-11-cursor-review-reusable-workflow-optional-dedicated` --- ### 📝 Commits (3) - [`0486dff`](https://github.com/Comfy-Org/github-workflows/commit/0486dff685618ee1db2f96a8e0e321b9486e90c2) feat(cursor-review): optional dedicated bot identity for review posting (BE-1812) - [`e600ea3`](https://github.com/Comfy-Org/github-workflows/commit/e600ea39b9a93d4d958336dcf28d3ebeaca78718) refactor(cursor-review): App ID as input (reuse cloud-code-bot), drop secrets-if workaround - [`f4427a4`](https://github.com/Comfy-Org/github-workflows/commit/f4427a4c813dd21ee0b732809b600754cd8fbaca) docs(cursor-review): genericize bot-identity example comments for OSS ### 📊 Changes **1 file changed** (+30 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/cursor-review.yml` (+30 -1) </details> ### 📄 Description Implements **BE-1812** (hunks 1+2 of the BE-1800 approach): the cursor-review reusable workflow can post under an **optional** dedicated bot identity instead of the shared `github-actions[bot]`, so its review threads become distinct and queryable. ## Change — one file, `.github/workflows/cursor-review.yml` 1. Two **optional** `workflow_call` secrets: `BOT_APP_ID`, `BOT_APP_PRIVATE_KEY` (both `required: false`). 2. A `Detect bot identity` step + a conditional `actions/create-github-app-token@v2` mint step before **Post review**. 3. **Post review**'s token becomes `${{ steps.bot_token.outputs.token || secrets.GITHUB_TOKEN }}`. `post-review.py` is untouched — the comment author follows whatever token it gets. > Note: `secrets` can't be referenced in a step `if:`, so a tiny `Detect bot identity` step surfaces presence as a step output the mint step gates on (`actionlint`-clean). ## Safe to merge now (red-safe / no-op until configured) With no creds supplied, the mint step is skipped and posting stays `github-actions[bot]` — zero behavior change for every consumer, including OSS callers. It posts under the new identity only once the App + org secrets exist (**BE-1813**) and callers pass them through (**BE-1814**). Two usual footguns were already handled here, so no companion edits: - **Dedup keys on the review body marker**, not the author — identity change won't re-trigger reviews. - **Triggerer attribution already falls back to the PR assignee on a bot actor** — Slack DM attribution survives. Pin style matches the file (bare tags). Caller passthrough is the separate BE-1814. Refs BE-1812 · parent BE-1800. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:35:29 +00:00