[PR #264] [MERGED] feat(bump-callers): refuse a Skip-caller-bump skip while the fleet owes a catch-up #267

New issue

Closed

opened 2026-10-26 22:37:55 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:37:55 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/264
Author: @mattmillerai
Created: 9/5/2026
Status: ✅ Merged
Merged: 9/5/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-10008-owed-bump-gate

📝 Commits (1)

0f6af87 feat(bump-callers): refuse a Skip-caller-bump skip while the fleet owes a catch-up (BE-10008)

📊 Changes

17 files changed (+912 additions, -30 deletions)

View changed files

📝 .github/bump-callers/README.md (+44 -7)
📝 .github/bump-callers/preflight.sh (+290 -23)
📝 .github/bump-callers/tests/test_paths_contract.sh (+55 -0)
📝 .github/bump-callers/tests/test_preflight.sh (+393 -0)
📝 .github/workflows/bump-agents-md-callers.yml (+10 -0)
📝 .github/workflows/bump-area-label-callers.yml (+10 -0)
📝 .github/workflows/bump-assign-reviewers-callers.yml (+10 -0)
📝 .github/workflows/bump-auto-label-callers.yml (+10 -0)
📝 .github/workflows/bump-coderabbit-config-callers.yml (+10 -0)
📝 .github/workflows/bump-cursor-review-callers.yml (+10 -0)
📝 .github/workflows/bump-detect-unreviewed-merge-callers.yml (+10 -0)
📝 .github/workflows/bump-groom-callers.yml (+10 -0)
📝 .github/workflows/bump-linear-ticket-callers.yml (+10 -0)
📝 .github/workflows/bump-pr-derisk-callers.yml (+10 -0)
📝 .github/workflows/bump-pr-risk-callers.yml (+10 -0)
📝 .github/workflows/bump-pr-size-callers.yml (+10 -0)
📝 .github/workflows/bump-public-repo-hygiene-callers.yml (+10 -0)

📄 Description

ELI-5

A Skip-caller-bump: true trailer lets a docs-only commit inside a watched surface say "don't fan a churn SHA-bump PR out to every caller for this." The gate that honors it looked only at the push in front of it. But a bump run is also the catch-up for an earlier watched change whose own run never bumped — it failed at the token mint or inside bump-callers.sh, it was cancelled, or it never started at all because GitHub evaluates a paths: filter against only the first 300 changed files of a push. Declining today's docs push declined that catch-up too, and callers sat on a stale SHA with nothing red anywhere. That was the gate's own KNOWN LIMIT comment and the bump-callers README's §"Known limit". This closes it: before honoring a trailer, the preflight now checks whether the fleet still owes a bump, and refuses the skip if it does.

Not hypothetical — bump-cursor-review-callers.yml has ~23 runs in retained history whose Bump SHA in caller repos step ended failure, and bump-groom-callers.yml has a cancelled run that produced zero jobs. Each of those is a watched change that reached no caller until some later behavioral bump happened along.

What changed

.github/bump-callers/preflight.sh — a fleet_owes_bump probe, called from the skip_caller_bump_requested acceptance path, before the skip's emit false. It answers the question the push payload cannot, from this fleet's own Actions run history — the .github/groom/interval.py pattern: derivable with only actions: read on the ambient token, so no new secret and no writable store, and fail-open by construction.

Left endpoint. From GITHUB_WORKFLOW_REF + GITHUB_REPOSITORY, list this workflow's successful runs on main, newest first, one bounded page (30), and take the first whose job carries a step named exactly Bump SHA in caller repos with conclusion success. That step is skipped on a declined run and success on a real bump — the entire discriminator. push and workflow_dispatch runs both count (a dispatch recovery bump is as much of a catch-up as a push one). The endpoint is that run's head_sha, not the SHA it pinned: a re-pointed run had already proved its surface unchanged up to its pin target, so the difference can only add commits to the range, i.e. it errs toward bumping.
Walk that range to HEAD, restricted to the watched surface, checking each commit's message with the one shared $SKIP_TRAILER_JQ trailer definition. Per commit, not as a content diff — that is what lets an earlier, legitimately-skipped trailered push keep being excused by its own trailer instead of poisoning every later skip.
Any untrailered watched commit refuses the skip, with a ::notice:: naming the oldest owed commit: catch-up owed for <sha>, whose own run never bumped.

The gh api reads sit in their own tiny functions with no --jq, so the suite can stub gh with canned JSON. The watched-surface pathspec choice (WATCHED_PATHSPECS, else WATCHED + WATCHED_ASSETS) was hoisted out of the hand-off guard into one surface_pathspecs helper both readers now call — a second hand-rolled copy would let the two disagree about which commits count on exactly the input (an excluding fleet) where that changes the verdict.

All 13 bump-*-callers.yml entrypoints — permissions: gains actions: read, and the preflight step's env: gains GH_TOKEN: ${{ github.token }}. Both read-only, and both well ahead of the org-wide write token, which is still minted only after and only if the preflight says proceed.

.github/bump-callers/tests/test_paths_contract.sh — asserts, per entrypoint, that it names its bump step exactly OWED_BUMP_STEP_NAME (read out of preflight.sh, not restated), that it grants actions: read at the workflow level (and declares no job-level permissions: block that would replace it), and that its preflight step wires github.token. All three fail silently green: break any one and the trailer quietly stops being honored forever, in the safe direction, with nothing red.

.github/bump-callers/README.md — §"Known limit" replaced by §"The owed-bump check", plus its residuals and the two new env rows.

Riskiest line, and why it is safe

if skip_caller_bump_requested && ! fleet_owes_bump; then — the whole feature turns on one added condition in front of an existing skip. It is safe in the direction that matters: fleet_owes_bump returns "owes" (refuse the skip) for every indeterminate answer — no gh, no jq, an Actions API error, no qualifying run inside the scan bound, an unreadable jobs payload, a failed deepening fetch, an endpoint that is not an ancestor of HEAD, a range past SKIP_TRAILER_RANGE_MAX. So the check can only ever narrow a skip, never widen one; its worst bug is status-quo churn (a bump that could have been skipped), which is the behavior that existed before the trailer did. And the && short-circuit means a workflow_dispatch run, or any untrailered push, never reaches the probe at all — the documented recovery path is untouched and spends no API call.

Everything under it is ||-guarded so nothing aborts under the file's set -euo pipefail, and owed_untrailered_commit shape-checks the sha it extracts before it is interpolated anywhere.

How this was verified

Hermetic suites (throwaway bare repos, a canned gh on PATH, no network):

bash .github/bump-callers/tests/test_preflight.sh — 445 passed, 0 failed (was 392; +53). New cases: a catch-up owed by an untrailered watched commit newer than the last bumping run (proceed=true + the naming notice); the all-trailered control (proceed=false); per-commit excusal across two trailered pushes, then the same range with one untrailered commit spliced in; an unwatched untrailered commit owing nothing; :(exclude) honored for the pr-risk-shaped fleet in both directions; the --depth=1 production checkout deepening and still producing a real answer both ways; workflow_dispatch and untrailered pushes short-circuiting with no notice at all; and the whole fail-open surface — API error, a history where nothing bumped, a declined run listed ahead of a real one, a dispatch recovery bump as the endpoint, empty history, missing GITHUB_WORKFLOW_REF/GITHUB_REPOSITORY, an endpoint absent from this history, and no gh on PATH at all (a curated PATH holding only the binaries the script shells out to, so it measures an absent binary rather than a failing one).
bash .github/bump-callers/tests/test_paths_contract.sh — 110 passed, 0 failed (was 70; +40). Negative-checked by hand: renaming the bump step in one entrypoint, deleting actions: read from a second and GH_TOKEN from a third produced exactly three failures and no others; restoring them returned to green.
bash .github/bump-callers/tests/test_bump_callers.sh — 437 passed, 0 failed (untouched).
shellcheck -x over bump-callers.sh, preflight.sh and all three suites — clean.
python3 .github/workflow-pins/check_workflow_pins.py — OK, 11 workflows, 0 exempt. python3 .github/agents-md-integrity/check_agents_md.py --root . — passed (2 pre-existing warnings, unchanged). All 13 edited entrypoints re-parsed with PyYAML: permissions == {contents: read, actions: read} and GH_TOKEN present in the preflight step's env.

Read-only checks against the real Actions API, because the probe's premises are claims about production data and no unit test can falsify them (all non-mutating gh api reads):

The runs endpoint accepts the workflow basename with branch=main&status=success&per_page=N and returns newest-first.
Real jobs payloads name the step exactly Bump SHA in caller repos, with conclusion: "success" on runs that bumped (e.g. 33667061259, 33220810341).
if:-gated steps really do report conclusion: "skipped" in this repo's own jobs payloads (confirmed across several recent runs of other workflows), which is the half of the discriminator the bump fleets have no retained example of — see Residual.
The failure modes the ticket describes are present in this repo's history: ~23 bump-cursor-review-callers.yml runs whose bump step ended failure, and a cancelled bump-groom-callers.yml run (30936094387) with zero jobs — the shape (.jobs // [])[] guards against. status=success correctly excludes all of them.

Negative-claim falsification. This diff adds a refusal path, so the premise worth falsifying is "the preflight cannot see whether an earlier run bumped." I went and looked rather than asserting it: the Actions run-history reads above are exactly that capability, they work, and the change uses them instead of shipping a dead end. The trailer's own capability is preserved, not removed — owed_none, owed_percommit and owed_unwatched all still produce proceed=false, and workflow_dispatch still overrides unconditionally.

Provenance

Authored by: agent-work loop
Verified: test_preflight.sh 445 passed / 0 failed; test_paths_contract.sh 110 passed / 0 failed (plus a hand-run negative check that its three new assertions bite); test_bump_callers.sh 437 passed / 0 failed; shellcheck -x clean over all five shell files; check_workflow_pins.py OK; check_agents_md.py passed with 2 pre-existing warnings; all 13 entrypoints re-parsed with PyYAML
Deviations: none against the plan; the unexercised artifacts and accepted limits are listed under Residual

Residual

Not fixed / not exercised here, written to stand on its own:

The skipped half of the discriminator has no retained example on a bump fleet. The probe treats a run as "bumped" only when the Bump SHA in caller repos step's conclusion is exactly success. The success side is confirmed against real runs; the skipped side is confirmed only generically — I swept the last 30 successful runs of all 13 fleets and none has a declined-but-green run, so I confirmed skipped on if:-gated steps in other workflows of this repo instead. The probe's safety does not depend on the exact value (anything other than success reads as "did not bump", which walks back and, at worst, bumps), but if Actions ever reported success for an if:-skipped step the probe would take a declined run as the left endpoint and wrongly conclude nothing is owed. Worth a one-line assertion the first time a fleet legitimately declines.
The scan bound and the retention window are accepted churn. One page of 30 runs: a fleet whose last real bump has aged out of that page, or out of the Actions run-retention window, reads as "cannot determine" and bumps. Same for a fleet whose preflight step loses actions: read or GH_TOKEN. Documented in both the script and the README; the contract test covers the third case, nothing covers the first two, and nothing goes red when they happen.
No end-to-end run. A real bump-*-callers.yml run opens SHA-bump PRs in consumer repos, so I did not trigger one — verification is the hermetic harness plus the read-only API queries above. The first production exercise will be whichever fleet next sees a trailered push.
API cost is unmeasured. Each trailered push now spends 2+ Actions API calls (1 for the run list, 1 per run scanned until a bumping one is found; 2 in the healthy case). No rate-limit budgeting was added, and none of the 13 jobs was re-timed.
git ls-remote/fetch behaviour on the normal path is newly load-bearing. The probe is the first thing in preflight.sh that needs real history on the non-stale path, so it may now run git fetch --unshallow on runs that previously never fetched. Bounded by this repo's own history and by the jobs' existing timeout-minutes, and covered by the owed_shallow case, but it is new work on the hot path.
Unexercised artifact: the origin review thread (https://github.com/Comfy-Org/github-workflows/pull/235#discussion_r3870884195) — I could confirm PR #235 is merged (2026-08-27T14:44:29Z, branch matt/be-9571-skip-caller-bump-trailer), which was the stated precondition, but a gh api read of that individual review comment hit GitHub's secondary rate limit twice and I did not read its text. The design implemented here comes from the task brief, not from that thread, so if the thread raised a constraint the brief did not carry, it is not reflected here.
Unexercised artifact: the upstream investigation's findings write-up, referenced by the brief as the evidence this work is built on. It lives outside this repo and was not reachable from this environment; only the brief's summary of it was available.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/264 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 9/5/2026 **Status:** ✅ Merged **Merged:** 9/5/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-10008-owed-bump-gate` --- ### 📝 Commits (1) - [`0f6af87`](https://github.com/Comfy-Org/github-workflows/commit/0f6af87f55232e358ee45f45a19b668ee1de6c72) feat(bump-callers): refuse a Skip-caller-bump skip while the fleet owes a catch-up (BE-10008) ### 📊 Changes **17 files changed** (+912 additions, -30 deletions) <details> <summary>View changed files</summary> 📝 `.github/bump-callers/README.md` (+44 -7) 📝 `.github/bump-callers/preflight.sh` (+290 -23) 📝 `.github/bump-callers/tests/test_paths_contract.sh` (+55 -0) 📝 `.github/bump-callers/tests/test_preflight.sh` (+393 -0) 📝 `.github/workflows/bump-agents-md-callers.yml` (+10 -0) 📝 `.github/workflows/bump-area-label-callers.yml` (+10 -0) 📝 `.github/workflows/bump-assign-reviewers-callers.yml` (+10 -0) 📝 `.github/workflows/bump-auto-label-callers.yml` (+10 -0) 📝 `.github/workflows/bump-coderabbit-config-callers.yml` (+10 -0) 📝 `.github/workflows/bump-cursor-review-callers.yml` (+10 -0) 📝 `.github/workflows/bump-detect-unreviewed-merge-callers.yml` (+10 -0) 📝 `.github/workflows/bump-groom-callers.yml` (+10 -0) 📝 `.github/workflows/bump-linear-ticket-callers.yml` (+10 -0) 📝 `.github/workflows/bump-pr-derisk-callers.yml` (+10 -0) 📝 `.github/workflows/bump-pr-risk-callers.yml` (+10 -0) 📝 `.github/workflows/bump-pr-size-callers.yml` (+10 -0) 📝 `.github/workflows/bump-public-repo-hygiene-callers.yml` (+10 -0) </details> ### 📄 Description ## ELI-5 A `Skip-caller-bump: true` trailer lets a docs-only commit inside a watched surface say "don't fan a churn SHA-bump PR out to every caller for this." The gate that honors it looked only at the push in front of it. But a bump run is also the **catch-up** for an *earlier* watched change whose own run never bumped — it failed at the token mint or inside `bump-callers.sh`, it was cancelled, or it never started at all because GitHub evaluates a `paths:` filter against only the first 300 changed files of a push. Declining today's docs push declined that catch-up too, and callers sat on a stale SHA with nothing red anywhere. That was the gate's own `KNOWN LIMIT` comment and the bump-callers README's §"Known limit". This closes it: before honoring a trailer, the preflight now checks whether the fleet still owes a bump, and refuses the skip if it does. Not hypothetical — `bump-cursor-review-callers.yml` has ~23 runs in retained history whose `Bump SHA in caller repos` step ended `failure`, and `bump-groom-callers.yml` has a `cancelled` run that produced zero jobs. Each of those is a watched change that reached no caller until some later behavioral bump happened along. ## What changed **`.github/bump-callers/preflight.sh`** — a `fleet_owes_bump` probe, called from the `skip_caller_bump_requested` acceptance path, before the skip's `emit false`. It answers the question the push payload cannot, from this fleet's own Actions run history — the `.github/groom/interval.py` pattern: derivable with only `actions: read` on the ambient token, so no new secret and no writable store, and fail-open by construction. 1. **Left endpoint.** From `GITHUB_WORKFLOW_REF` + `GITHUB_REPOSITORY`, list this workflow's successful runs on `main`, newest first, one bounded page (30), and take the first whose job carries a step named exactly `Bump SHA in caller repos` with conclusion `success`. That step is `skipped` on a declined run and `success` on a real bump — the entire discriminator. `push` and `workflow_dispatch` runs both count (a dispatch recovery bump is as much of a catch-up as a push one). The endpoint is that run's `head_sha`, not the SHA it pinned: a re-pointed run had already proved its surface unchanged up to its pin target, so the difference can only *add* commits to the range, i.e. it errs toward bumping. 2. **Walk that range to `HEAD`**, restricted to the watched surface, checking each commit's message with the one shared `$SKIP_TRAILER_JQ` trailer definition. **Per commit, not as a content diff** — that is what lets an earlier, legitimately-skipped trailered push keep being excused by its own trailer instead of poisoning every later skip. 3. **Any untrailered watched commit refuses the skip**, with a `::notice::` naming the *oldest* owed commit: *catch-up owed for `<sha>`, whose own run never bumped.* The `gh api` reads sit in their own tiny functions with no `--jq`, so the suite can stub `gh` with canned JSON. The watched-surface pathspec choice (`WATCHED_PATHSPECS`, else `WATCHED` + `WATCHED_ASSETS`) was hoisted out of the hand-off guard into one `surface_pathspecs` helper both readers now call — a second hand-rolled copy would let the two disagree about which commits count on exactly the input (an excluding fleet) where that changes the verdict. **All 13 `bump-*-callers.yml` entrypoints** — `permissions:` gains `actions: read`, and the preflight step's `env:` gains `GH_TOKEN: ${{ github.token }}`. Both read-only, and both well ahead of the org-wide write token, which is still minted only after and only if the preflight says proceed. **`.github/bump-callers/tests/test_paths_contract.sh`** — asserts, per entrypoint, that it names its bump step exactly `OWED_BUMP_STEP_NAME` (read out of `preflight.sh`, not restated), that it grants `actions: read` at the workflow level (and declares no job-level `permissions:` block that would replace it), and that its preflight step wires `github.token`. All three fail *silently green*: break any one and the trailer quietly stops being honored forever, in the safe direction, with nothing red. **`.github/bump-callers/README.md`** — §"Known limit" replaced by §"The owed-bump check", plus its residuals and the two new env rows. ## Riskiest line, and why it is safe `if skip_caller_bump_requested && ! fleet_owes_bump; then` — the whole feature turns on one added condition in front of an existing skip. It is safe in the direction that matters: `fleet_owes_bump` returns "owes" (refuse the skip) for **every** indeterminate answer — no `gh`, no `jq`, an Actions API error, no qualifying run inside the scan bound, an unreadable jobs payload, a failed deepening fetch, an endpoint that is not an ancestor of `HEAD`, a range past `SKIP_TRAILER_RANGE_MAX`. So the check can only ever *narrow* a skip, never widen one; its worst bug is status-quo churn (a bump that could have been skipped), which is the behavior that existed before the trailer did. And the `&&` short-circuit means a `workflow_dispatch` run, or any untrailered push, never reaches the probe at all — the documented recovery path is untouched and spends no API call. Everything under it is `||`-guarded so nothing aborts under the file's `set -euo pipefail`, and `owed_untrailered_commit` shape-checks the sha it extracts before it is interpolated anywhere. ## How this was verified Hermetic suites (throwaway bare repos, a canned `gh` on PATH, no network): - `bash .github/bump-callers/tests/test_preflight.sh` — **445 passed, 0 failed** (was 392; +53). New cases: a catch-up owed by an untrailered watched commit newer than the last bumping run (proceed=true + the naming notice); the all-trailered control (proceed=false); per-commit excusal across two trailered pushes, then the same range with one untrailered commit spliced in; an unwatched untrailered commit owing nothing; `:(exclude)` honored for the pr-risk-shaped fleet in both directions; the `--depth=1` production checkout deepening and still producing a *real* answer both ways; `workflow_dispatch` and untrailered pushes short-circuiting with no notice at all; and the whole fail-open surface — API error, a history where nothing bumped, a declined run listed *ahead* of a real one, a dispatch recovery bump as the endpoint, empty history, missing `GITHUB_WORKFLOW_REF`/`GITHUB_REPOSITORY`, an endpoint absent from this history, and **no `gh` on PATH at all** (a curated PATH holding only the binaries the script shells out to, so it measures an absent binary rather than a failing one). - `bash .github/bump-callers/tests/test_paths_contract.sh` — **110 passed, 0 failed** (was 70; +40). Negative-checked by hand: renaming the bump step in one entrypoint, deleting `actions: read` from a second and `GH_TOKEN` from a third produced exactly three failures and no others; restoring them returned to green. - `bash .github/bump-callers/tests/test_bump_callers.sh` — **437 passed, 0 failed** (untouched). - `shellcheck -x` over `bump-callers.sh`, `preflight.sh` and all three suites — clean. - `python3 .github/workflow-pins/check_workflow_pins.py` — OK, 11 workflows, 0 exempt. `python3 .github/agents-md-integrity/check_agents_md.py --root .` — passed (2 pre-existing warnings, unchanged). All 13 edited entrypoints re-parsed with PyYAML: `permissions == {contents: read, actions: read}` and `GH_TOKEN` present in the preflight step's env. Read-only checks against the **real** Actions API, because the probe's premises are claims about production data and no unit test can falsify them (all non-mutating `gh api` reads): - The runs endpoint accepts the workflow **basename** with `branch=main&status=success&per_page=N` and returns newest-first. - Real jobs payloads name the step exactly `Bump SHA in caller repos`, with `conclusion: "success"` on runs that bumped (e.g. `33667061259`, `33220810341`). - `if:`-gated steps really do report `conclusion: "skipped"` in this repo's own jobs payloads (confirmed across several recent runs of other workflows), which is the half of the discriminator the bump fleets have no retained example of — see Residual. - The failure modes the ticket describes are present in this repo's history: ~23 `bump-cursor-review-callers.yml` runs whose bump step ended `failure`, and a `cancelled` `bump-groom-callers.yml` run (`30936094387`) with **zero** jobs — the shape `(.jobs // [])[]` guards against. `status=success` correctly excludes all of them. **Negative-claim falsification.** This diff adds a refusal path, so the premise worth falsifying is "the preflight cannot see whether an earlier run bumped." I went and looked rather than asserting it: the Actions run-history reads above are exactly that capability, they work, and the change *uses* them instead of shipping a dead end. The trailer's own capability is preserved, not removed — `owed_none`, `owed_percommit` and `owed_unwatched` all still produce `proceed=false`, and `workflow_dispatch` still overrides unconditionally. ## Provenance - **Authored by:** agent-work loop - **Verified:** test_preflight.sh 445 passed / 0 failed; test_paths_contract.sh 110 passed / 0 failed (plus a hand-run negative check that its three new assertions bite); test_bump_callers.sh 437 passed / 0 failed; shellcheck -x clean over all five shell files; check_workflow_pins.py OK; check_agents_md.py passed with 2 pre-existing warnings; all 13 entrypoints re-parsed with PyYAML - **Deviations:** none against the plan; the unexercised artifacts and accepted limits are listed under Residual ## Residual Not fixed / not exercised here, written to stand on its own: - **The `skipped` half of the discriminator has no retained example on a bump fleet.** The probe treats a run as "bumped" only when the `Bump SHA in caller repos` step's conclusion is exactly `success`. The `success` side is confirmed against real runs; the `skipped` side is confirmed only *generically* — I swept the last 30 successful runs of all 13 fleets and none has a declined-but-green run, so I confirmed `skipped` on `if:`-gated steps in other workflows of this repo instead. The probe's safety does not depend on the exact value (anything other than `success` reads as "did not bump", which walks back and, at worst, bumps), but if Actions ever reported `success` for an `if:`-skipped step the probe would take a declined run as the left endpoint and wrongly conclude nothing is owed. Worth a one-line assertion the first time a fleet legitimately declines. - **The scan bound and the retention window are accepted churn.** One page of 30 runs: a fleet whose last real bump has aged out of that page, or out of the Actions run-retention window, reads as "cannot determine" and bumps. Same for a fleet whose preflight step loses `actions: read` or `GH_TOKEN`. Documented in both the script and the README; the contract test covers the third case, nothing covers the first two, and nothing goes red when they happen. - **No end-to-end run.** A real `bump-*-callers.yml` run opens SHA-bump PRs in consumer repos, so I did not trigger one — verification is the hermetic harness plus the read-only API queries above. The first production exercise will be whichever fleet next sees a trailered push. - **API cost is unmeasured.** Each trailered push now spends 2+ Actions API calls (1 for the run list, 1 per run scanned until a bumping one is found; 2 in the healthy case). No rate-limit budgeting was added, and none of the 13 jobs was re-timed. - **`git ls-remote`/fetch behaviour on the normal path is newly load-bearing.** The probe is the first thing in `preflight.sh` that needs real history on the *non-stale* path, so it may now run `git fetch --unshallow` on runs that previously never fetched. Bounded by this repo's own history and by the jobs' existing `timeout-minutes`, and covered by the `owed_shallow` case, but it is new work on the hot path. - **Unexercised artifact:** the origin review thread (https://github.com/Comfy-Org/github-workflows/pull/235#discussion_r3870884195) — I could confirm PR #235 is merged (`2026-08-27T14:44:29Z`, branch `matt/be-9571-skip-caller-bump-trailer`), which was the stated precondition, but a `gh api` read of that individual review comment hit GitHub's secondary rate limit twice and I did not read its text. The design implemented here comes from the task brief, not from that thread, so if the thread raised a constraint the brief did not carry, it is not reflected here. - **Unexercised artifact:** the upstream investigation's findings write-up, referenced by the brief as the evidence this work is built on. It lives outside this repo and was not reachable from this environment; only the brief's summary of it was available. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:37:55 +00:00