[PR #333] [MERGED] ci(bump-callers): make an empty area-label roster fail loudly #335

New issue

Closed

opened 2026-10-26 22:38:38 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:38:38 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/333
Author: @mattmillerai
Created: 9/19/2026
Status: ✅ Merged
Merged: 9/21/2026
Merged by: @mattmillerai

Base: main ← Head: matt/area-label-allow-empty-false

📝 Commits (1)

e2c1d21 ci(bump-callers): make an empty area-label roster fail loudly

📊 Changes

1 file changed (+8 additions, -4 deletions)

View changed files

📝 .github/workflows/bump-area-label-callers.yml (+8 -4)

📄 Description

ELI-5

ALLOW_EMPTY: "true" tells the bumper that finding zero callers is fine. That is true exactly once in a fleet's life — before the first caller is enrolled — which is why this file's own comment said to flip it "as soon as the roster secret is seeded with its first entry".

It never was flipped, because the roster was never seeded. The secret did not exist at all. So every run of this fleet, from the day it shipped, did this:

roster: 0 caller(s), sha256 n/a (roster empty or unset)
AREA_LABEL_CALLERS has no callers yet — nothing to bump for area-label.

…and concluded success. Green check, no annotation, nothing to notice.

Meanwhile there were two live callers the whole time, both sitting at the pin they merged with while area-label changes shipped past them for a month. A green no-op is indistinguishable from a working fleet — that's the actual defect here, not the stale pins, which are only its symptom.

What changed

One value, "true" → "false", and the comment rewritten to say what the flag now means and to carry the incident so the next person doesn't reintroduce it.

The roster is seeded as of Comfy-Org/github-workflows-ops#10, and the first real run confirms it loads:

roster: 2 caller(s), 2 after FILE_FILTER=.github/workflows/pr-area-label.yml,
sha256 7bea65d58af79ad6907abd4de3088f655b1afe7d75ba1245ff64bcf0dd2dde53
***: PR opened
***: PR opened
area-label bump complete for all callers.

That digest matches jq -cS . rosters/area-label.json | sha256sum in the ops repo, which is the documented way to prove the live secret is exactly the committed file. With the roster populated, an empty one from here on means the secret was lost or clobbered — and gh secret set overwrites wholesale with no read-back, so that is a realistic failure worth reding the run for.

Why not leave it permissive

The counter-argument is that a hard fail on an empty roster is noise if someone decommissions the fleet. But decommissioning is a deliberate act that removes the workflow, and this repo already treats a silently-not-bumping fleet as the expensive failure — AGENTS.md calls the missed-enrolment step "the most repeated mistake here" and records that the groom fleet lost its own caller the same way. Between a false alarm on an intentional teardown and another month of invisible drift, the alarm is cheaper.

Verification

check_workflow_pins.py green. No script change, so no suite applies; the bumper's empty-roster branch is already covered by .github/bump-callers/tests/.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/333 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 9/19/2026 **Status:** ✅ Merged **Merged:** 9/21/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/area-label-allow-empty-false` --- ### 📝 Commits (1) - [`e2c1d21`](https://github.com/Comfy-Org/github-workflows/commit/e2c1d21cc6e85292500a1846271d5bd8ed226c8e) ci(bump-callers): make an empty area-label roster fail loudly ### 📊 Changes **1 file changed** (+8 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/bump-area-label-callers.yml` (+8 -4) </details> ### 📄 Description ## ELI-5 `ALLOW_EMPTY: "true"` tells the bumper that finding **zero** callers is fine. That is true exactly once in a fleet's life — before the first caller is enrolled — which is why this file's own comment said to flip it *"as soon as the roster secret is seeded with its first entry"*. It never was flipped, because the roster was never seeded. The secret did not exist at all. So every run of this fleet, from the day it shipped, did this: ``` roster: 0 caller(s), sha256 n/a (roster empty or unset) AREA_LABEL_CALLERS has no callers yet — nothing to bump for area-label. ``` …and concluded **success**. Green check, no annotation, nothing to notice. Meanwhile there were two live callers the whole time, both sitting at the pin they merged with while area-label changes shipped past them for a month. **A green no-op is indistinguishable from a working fleet** — that's the actual defect here, not the stale pins, which are only its symptom. ## What changed One value, `"true"` → `"false"`, and the comment rewritten to say what the flag now means and to carry the incident so the next person doesn't reintroduce it. The roster is seeded as of Comfy-Org/github-workflows-ops#10, and the first real run confirms it loads: ``` roster: 2 caller(s), 2 after FILE_FILTER=.github/workflows/pr-area-label.yml, sha256 7bea65d58af79ad6907abd4de3088f655b1afe7d75ba1245ff64bcf0dd2dde53 ***: PR opened ***: PR opened area-label bump complete for all callers. ``` That digest matches `jq -cS . rosters/area-label.json | sha256sum` in the ops repo, which is the documented way to prove the live secret is exactly the committed file. With the roster populated, an empty one from here on means the secret was **lost or clobbered** — and `gh secret set` overwrites wholesale with no read-back, so that is a realistic failure worth reding the run for. ## Why not leave it permissive The counter-argument is that a hard fail on an empty roster is noise if someone decommissions the fleet. But decommissioning is a deliberate act that removes the workflow, and this repo already treats a silently-not-bumping fleet as the expensive failure — AGENTS.md calls the missed-enrolment step *"the most repeated mistake here"* and records that the groom fleet lost its own caller the same way. Between a false alarm on an intentional teardown and another month of invisible drift, the alarm is cheaper. ## Verification `check_workflow_pins.py` green. No script change, so no suite applies; the bumper's empty-roster branch is already covered by `.github/bump-callers/tests/`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:38:38 +00:00