[PR #20] [MERGED] fix(ci): correct create-github-app-token pin so the cursor-review bump can run #28

New issue

Closed

opened 2026-10-26 22:35:32 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:35:32 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/20
Author: @mattmillerai
Created: 7/3/2026
Status: ✅ Merged
Merged: 7/3/2026
Merged by: @mattmillerai

Base: main ← Head: ci/fix-bump-cursor-review-token-pin

📝 Commits (2)

77b3c3f fix(ci): correct create-github-app-token pin in bump-cursor-review-callers
6b11037 ci: register comfy-local-mcp as a cursor-review caller

📊 Changes

1 file changed (+65 additions, -29 deletions)

View changed files

📝 .github/workflows/bump-cursor-review-callers.yml (+65 -29)

📄 Description

ELI-5

A robot is supposed to open an "update me" pull request in eight repos whenever we change our shared code-review workflow. To do its job the robot needs a keycard — but the keycard number written down pointed at a card that doesn't exist, so the robot failed at the front door every single time and never opened a single PR. This fixes the keycard number. It also teaches the robot to skip one jammed door and keep going, instead of giving up on the other seven.

What was broken

bump-cursor-review-callers pins actions/create-github-app-token to a commit SHA that does not exist in that action's repo. GitHub resolves uses: before it runs the step, so the Generate token step failed to resolve on every run — the job died at step one and the caller fan-out never executed. Result: pushes to cursor-review.yml opened zero bump PRs (every run since the token step was added has a failure conclusion).

Changes

Fix the pin. create-github-app-token@df432cee… → @d72941d797fd3113feb6b93fd0dec494b13a2547, the real v1.12.0 commit (the inline comment already said v1.12.0; the old SHA resolved to nothing).
Fault-isolate the loop. Each caller is bumped in bump_one() with every gh call guarded; a failing repo becomes a per-repo ::warning:: and the loop continues, then the job exits non-zero at the end if any repo failed. Previously set -euo pipefail meant the first unguarded failure aborted the run and silently starved every caller after it — the "didn't reach all repos" symptom.

Verification

YAML parses; the extracted run script passes bash -n.
Confirmed the old SHA 422s (No commit found) and d72941d… is the tagged v1.12.0 commit.
Post-merge: trigger via workflow_dispatch (or the next cursor-review.yml change) and confirm bump PRs land in the eight callers.

Also in this PR

Registers Comfy-Org/comfy-local-mcp as a cursor-review caller (one entry in the CALLERS list) so future cursor-review.yml bumps fan out to it. Its caller file lands in Comfy-Org/comfy-local-mcp#19. Until that merges the dispatcher just logs not found — skipping for it (harmless, thanks to the fault-isolation above).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/20 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/3/2026 **Status:** ✅ Merged **Merged:** 7/3/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `ci/fix-bump-cursor-review-token-pin` --- ### 📝 Commits (2) - [`77b3c3f`](https://github.com/Comfy-Org/github-workflows/commit/77b3c3f84e4e7026f518a5df9010fc8c357aa0e8) fix(ci): correct create-github-app-token pin in bump-cursor-review-callers - [`6b11037`](https://github.com/Comfy-Org/github-workflows/commit/6b1103794442614bd2945308cd682d6021b1db09) ci: register comfy-local-mcp as a cursor-review caller ### 📊 Changes **1 file changed** (+65 additions, -29 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/bump-cursor-review-callers.yml` (+65 -29) </details> ### 📄 Description ## ELI-5 A robot is supposed to open an "update me" pull request in eight repos whenever we change our shared code-review workflow. To do its job the robot needs a keycard — but the keycard number written down pointed at a card that doesn't exist, so the robot failed at the front door every single time and never opened a single PR. This fixes the keycard number. It also teaches the robot to skip one jammed door and keep going, instead of giving up on the other seven. ## What was broken `bump-cursor-review-callers` pins `actions/create-github-app-token` to a commit SHA that does not exist in that action's repo. GitHub resolves `uses:` before it runs the step, so the **Generate token** step failed to resolve on every run — the job died at step one and the caller fan-out never executed. Result: pushes to `cursor-review.yml` opened **zero** bump PRs (every run since the token step was added has a `failure` conclusion). ## Changes 1. **Fix the pin.** `create-github-app-token@df432cee…` → `@d72941d797fd3113feb6b93fd0dec494b13a2547`, the real `v1.12.0` commit (the inline comment already said `v1.12.0`; the old SHA resolved to nothing). 2. **Fault-isolate the loop.** Each caller is bumped in `bump_one()` with every `gh` call guarded; a failing repo becomes a per-repo `::warning::` and the loop continues, then the job exits non-zero at the end if any repo failed. Previously `set -euo pipefail` meant the first unguarded failure aborted the run and silently starved every caller after it — the "didn't reach all repos" symptom. ## Verification 1. YAML parses; the extracted run script passes `bash -n`. 2. Confirmed the old SHA 422s (`No commit found`) and `d72941d…` is the tagged `v1.12.0` commit. 3. Post-merge: trigger via `workflow_dispatch` (or the next `cursor-review.yml` change) and confirm bump PRs land in the eight callers. ## Also in this PR Registers `Comfy-Org/comfy-local-mcp` as a cursor-review caller (one entry in the CALLERS list) so future `cursor-review.yml` bumps fan out to it. Its caller file lands in Comfy-Org/comfy-local-mcp#19. Until that merges the dispatcher just logs `not found — skipping` for it (harmless, thanks to the fault-isolation above). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:35:32 +00:00