Comfy-Org/github-workflows

Fork 0

mirror of https://github.com/Comfy-Org/github-workflows.git synced 2026-11-05 00:17:37 +00:00

[PR #241] [MERGED] ci: self-enroll this repo in its own agents-md-integrity reusable #248

New issue

Closed

opened 2026-10-26 22:37:45 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:37:45 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/241
Author: @mattmillerai
Created: 8/27/2026
Status: ✅ Merged
Merged: 8/27/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-9615-ci-agents-md-integrity

📝 Commits (2)

088b505 ci: self-enroll this repo in its own agents-md-integrity reusable
73555cd ci(agents-md-integrity): route the self-caller and scope its tamper claim (BE-9615)

📊 Changes

3 files changed (+46 additions, -6 deletions)

View changed files

📝 .github/reviewers.yml (+5 -0)
➕ .github/workflows/ci-agents-md-integrity.yml (+35 -0)
📝 AGENTS.md (+6 -6)

📄 Description

ELI-5

This repo ships the workflow that checks other repos' AGENTS.md files, but it never ran that check on itself — its own AGENTS.md drifted to 305 lines and no PR check caught it (a reviewer did, on #227). This PR turns the checker on for this repo, so that class of drift can never merge silently again.

What changed

New .github/workflows/ci-agents-md-integrity.yml: a thin caller enrolling this repo in its own reusable agents-md-integrity.yml, following the existing self-enrollment convention (ci-cursor-review.yml / ci-groom.yml) and the canonical caller in docs/callers/agents-md-integrity.md. Both uses: and workflows_ref: pin the same merged-main full SHA (75685ed9fd20a8ab4e74b3d17d2002dae63224c2, tip of main at authoring time) — identical on purpose, since the reusable fail-fasts on a missing/short workflows_ref. Deliberately NOT a local ./ path: per the AGENTS.md conventions, a local path would run the PR's own copy of the checker, letting a PR weaken the logic judging it.
The pull_request trigger is unfiltered (no path filter), matching the canonical caller doc — the job is seconds of stdlib Python, and an unfiltered trigger keeps it eligible as a required status check later (a path-filtered required check wedges PRs that skip it).
AGENTS.md: the self-gating bullet flips back to the affirmative — it IS itself gated, via the new caller — keeping the under-200/aim-≤150, @AGENTS.md-shim, and no-.cursorrules clauses; and the self-enrollment caller list in the conventions section now includes ci-agents-md-integrity.yml. This resolves the review finding deferred from #227 (the "no caller backing it" thread). Because the new caller runs on this PR itself, the check validates the claim in the same run.
.github/reviewers.yml: the agents-md rule enumerated the reusable, the checker package and the test workflow but no ci- caller, so the new self-caller matched no glob and fell through to default_pool. It is now named outright, as the assign-reviewers rule already does for its own ci- caller — otherwise PRs touching only this tamper-sensitive file (including the bump fleet's SHA-bump PRs once enrolled) would route to non-owners.

Review-round changes (`73555cd`)

Three panel findings from the first review round, all fixed in the follow-up commit:

Routing gap (reviewers.yml) — described above.
Overclaimed tamper-proofness — the caller header said the SHA pin makes the check tamper-proof. It makes the checker script tamper-proof; on pull_request GitHub still reads the caller file itself from the PR's own ref, so a PR can loosen with:, repoint uses:, or delete the job and still report green under the same check name. The header now claims only the half that holds and names what would close the other half (a CODEOWNERS entry for .github/workflows/**, or a branch rule — repo-policy changes, out of scope here).
Self-contradicting pin annotation — the pin read # v1 — github-workflows main (75685ed), asserting both that the SHA is the v1 tag and that it is an untagged main commit. It was also only half-maintained: bump-callers.sh rewrites the github-workflows main (<short>) form on every bump and never touches # v1, so after the first automated bump it would have claimed v1 for a commit the tag does not point at. It now uses the sibling self-callers' # github-workflows main (<short>) form, which the bumper keeps honest.

Expected CI on this PR

The new AGENTS.md Integrity check fires on this PR (the caller lands with the trigger that runs it) and should pass — AGENTS.md is 150 lines — with one non-fatal warning: the repo has no .github/CODEOWNERS, and require_codeowners defaults to false. CODEOWNERS is deliberately not added here (out of scope).
test-workflow-pins runs (path-filtered to .github/workflows/**); its suite and lint pass locally (see Provenance).

Provenance

Authored by: agent-work loop
Verified: python3 -m unittest discover -s .github/workflow-pins/tests: 308 passed, 0 failed; python3 -m unittest discover -s .github/agents-md-integrity/tests: 46 passed, 0 failed; python3 -m unittest discover -s .github/refresh-reviewers/tests: 48 passed, 0 failed; python3 .github/workflow-pins/check_workflow_pins.py: OK (11 workflows declare workflows_ref, none defaulted, every checkout guarded); python3 .github/agents-md-integrity/check_agents_md.py --root .: passed with 1 warning (missing CODEOWNERS, expected). The edited reviewers.yml was additionally round-tripped through refresh-reviewers/generate.py's own parser to confirm the new path lands in the intended rule and in no earlier one.
Deviations: none

Residual

Enrollment is TWO steps and this PR is only the first: a maintainer must add this repo to the AGENTS_MD_CALLERS roster variable. Until that happens the bump-agents-md-callers fleet exits 0 against a roster that does not name this repo, both pins here stay frozen, and no run log reports the drift — exactly the repeated mistake the AGENTS.md enrollment bullet warns about, and which ci-groom.yml already hit. The caller header now states this in the file itself, and it is filed as a follow-up.
The check appearing again on the push-to-main run can only be observed after merge; the PR-side run of the same check is the pre-merge evidence.
The repo has no CODEOWNERS file, so AGENTS.md has no DRI and the caller file has no ownership gate. That is a repo-policy decision for a maintainer, not a change this PR should make unilaterally.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/241 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 8/27/2026 **Status:** ✅ Merged **Merged:** 8/27/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-9615-ci-agents-md-integrity` --- ### 📝 Commits (2) - [`088b505`](https://github.com/Comfy-Org/github-workflows/commit/088b505b4bf7a19122fe0ddc52b9178392f92538) ci: self-enroll this repo in its own agents-md-integrity reusable - [`73555cd`](https://github.com/Comfy-Org/github-workflows/commit/73555cdf889adc85e55d5c52721eb90fab01af0c) ci(agents-md-integrity): route the self-caller and scope its tamper claim (BE-9615) ### 📊 Changes **3 files changed** (+46 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `.github/reviewers.yml` (+5 -0) ➕ `.github/workflows/ci-agents-md-integrity.yml` (+35 -0) 📝 `AGENTS.md` (+6 -6) </details> ### 📄 Description ## ELI-5 This repo ships the workflow that checks other repos' `AGENTS.md` files, but it never ran that check on itself — its own `AGENTS.md` drifted to 305 lines and no PR check caught it (a reviewer did, on #227). This PR turns the checker on for this repo, so that class of drift can never merge silently again. ## What changed - New `.github/workflows/ci-agents-md-integrity.yml`: a thin caller enrolling this repo in its own reusable `agents-md-integrity.yml`, following the existing self-enrollment convention (`ci-cursor-review.yml` / `ci-groom.yml`) and the canonical caller in `docs/callers/agents-md-integrity.md`. Both `uses:` and `workflows_ref:` pin the same merged-main full SHA (`75685ed9fd20a8ab4e74b3d17d2002dae63224c2`, tip of main at authoring time) — identical on purpose, since the reusable fail-fasts on a missing/short `workflows_ref`. Deliberately NOT a local `./` path: per the AGENTS.md conventions, a local path would run the PR's own copy of the checker, letting a PR weaken the logic judging it. - The `pull_request` trigger is unfiltered (no path filter), matching the canonical caller doc — the job is seconds of stdlib Python, and an unfiltered trigger keeps it eligible as a required status check later (a path-filtered required check wedges PRs that skip it). - `AGENTS.md`: the self-gating bullet flips back to the affirmative — it IS itself gated, via the new caller — keeping the under-200/aim-≤150, `@AGENTS.md`-shim, and no-`.cursorrules` clauses; and the self-enrollment caller list in the conventions section now includes `ci-agents-md-integrity.yml`. This resolves the review finding deferred from #227 (the "no caller backing it" thread). Because the new caller runs on this PR itself, the check validates the claim in the same run. - `.github/reviewers.yml`: the agents-md rule enumerated the reusable, the checker package and the test workflow but no `ci-` caller, so the new self-caller matched no glob and fell through to `default_pool`. It is now named outright, as the assign-reviewers rule already does for its own `ci-` caller — otherwise PRs touching only this tamper-sensitive file (including the bump fleet's SHA-bump PRs once enrolled) would route to non-owners. ## Review-round changes (73555cd) Three panel findings from the first review round, all fixed in the follow-up commit: - **Routing gap (`reviewers.yml`)** — described above. - **Overclaimed tamper-proofness** — the caller header said the SHA pin makes the check tamper-proof. It makes the checker *script* tamper-proof; on `pull_request` GitHub still reads the caller file itself from the PR's own ref, so a PR can loosen `with:`, repoint `uses:`, or delete the job and still report green under the same check name. The header now claims only the half that holds and names what would close the other half (a CODEOWNERS entry for `.github/workflows/**`, or a branch rule — repo-policy changes, out of scope here). - **Self-contradicting pin annotation** — the pin read `# v1 — github-workflows main (75685ed)`, asserting both that the SHA is the `v1` tag and that it is an untagged main commit. It was also only half-maintained: `bump-callers.sh` rewrites the `github-workflows main (<short>)` form on every bump and never touches `# v1`, so after the first automated bump it would have claimed `v1` for a commit the tag does not point at. It now uses the sibling self-callers' `# github-workflows main (<short>)` form, which the bumper keeps honest. ## Expected CI on this PR - The new `AGENTS.md Integrity` check fires on this PR (the caller lands with the trigger that runs it) and should pass — `AGENTS.md` is 150 lines — with one non-fatal warning: the repo has no `.github/CODEOWNERS`, and `require_codeowners` defaults to false. CODEOWNERS is deliberately not added here (out of scope). - `test-workflow-pins` runs (path-filtered to `.github/workflows/**`); its suite and lint pass locally (see Provenance). ## Provenance - **Authored by:** agent-work loop - **Verified:** `python3 -m unittest discover -s .github/workflow-pins/tests`: 308 passed, 0 failed; `python3 -m unittest discover -s .github/agents-md-integrity/tests`: 46 passed, 0 failed; `python3 -m unittest discover -s .github/refresh-reviewers/tests`: 48 passed, 0 failed; `python3 .github/workflow-pins/check_workflow_pins.py`: OK (11 workflows declare `workflows_ref`, none defaulted, every checkout guarded); `python3 .github/agents-md-integrity/check_agents_md.py --root .`: passed with 1 warning (missing CODEOWNERS, expected). The edited `reviewers.yml` was additionally round-tripped through `refresh-reviewers/generate.py`'s own parser to confirm the new path lands in the intended rule and in no earlier one. - **Deviations:** none ## Residual - Enrollment is TWO steps and this PR is only the first: a maintainer must add this repo to the `AGENTS_MD_CALLERS` roster variable. Until that happens the `bump-agents-md-callers` fleet exits 0 against a roster that does not name this repo, both pins here stay frozen, and no run log reports the drift — exactly the repeated mistake the AGENTS.md enrollment bullet warns about, and which `ci-groom.yml` already hit. The caller header now states this in the file itself, and it is filed as a follow-up. - The check appearing again on the push-to-main run can only be observed after merge; the PR-side run of the same check is the pre-merge evidence. - The repo has no CODEOWNERS file, so `AGENTS.md` has no DRI and the caller file has no ownership gate. That is a repo-policy decision for a maintainer, not a change this PR should make unilaterally. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:37:45 +00:00

closed this issue
added the
pull-request
label

No labels

cursor-review-catalog-drift

groom

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Comfy-Org/github-workflows#248

No description provided.

Rows
Columns