[PR #338] feat(workflows): add an optional runs_on input to nine reusable workflows #338

New issue

Open

opened 2026-10-26 22:38:40 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:38:40 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/338
Author: @anupreet-comfy
Created: 9/29/2026
Status: 🔄 Open

Base: main ← Head: anupreet-comfy/be-17523-runs-on-input

📝 Commits (1)

4912b29 feat(workflows): add an optional runs_on input to nine reusable workflows

📊 Changes

20 files changed (+205 additions, -69 deletions)

View changed files

📝 .github/cursor-review/README.md (+1 -0)
📝 .github/workflows/agents-md-integrity.yml (+14 -1)
📝 .github/workflows/assign-reviewers.yml (+14 -1)
📝 .github/workflows/cursor-review.yml (+48 -27)
📝 .github/workflows/detect-unreviewed-merge.yml (+14 -1)
📝 .github/workflows/groom.yml (+44 -30)
📝 .github/workflows/linear-ticket.yml (+14 -1)
📝 .github/workflows/pr-area-label.yml (+15 -2)
📝 .github/workflows/pr-risk.yml (+16 -3)
📝 .github/workflows/pr-size.yml (+15 -2)
📝 README.md (+1 -1)
📝 docs/callers/agents-md-integrity.md (+1 -0)
📝 docs/callers/assign-reviewers.md (+1 -0)
📝 docs/callers/cursor-review.md (+1 -0)
📝 docs/callers/detect-unreviewed-merge.md (+1 -0)
📝 docs/callers/groom.md (+1 -0)
📝 docs/callers/linear-ticket.md (+1 -0)
📝 docs/callers/pr-area-label.md (+1 -0)
📝 docs/callers/pr-risk.md (+1 -0)
📝 docs/callers/pr-size.md (+1 -0)

📄 Description

Nine reusable workflows gain an optional runs_on input, so a private caller can run their jobs on its own self-hosted runners. cursor-review-auto-label.yml already has this input (.github/workflows/cursor-review-auto-label.yml:80 and :128), and this PR copies its contract exactly: a JSON-encoded string, default '"ubuntu-latest"', read by every job as runs-on: ${{ fromJSON(inputs.runs_on) }}.

Workflow	Jobs now reading `runs_on`
`agents-md-integrity.yml`	1
`assign-reviewers.yml`	1
`cursor-review.yml`	11
`detect-unreviewed-merge.yml`	1
`groom.yml`	7
`linear-ticket.yml`	1
`pr-area-label.yml`	2
`pr-risk.yml`	3
`pr-size.yml`	2

Default behaviour and public callers

A caller that passes nothing gets ubuntu-latest on every job, exactly as before, so merging this PR and bumping callers moves no job. Nothing in this repository picks a self-hosted label; only a caller that writes runs_on: in its own workflow file changes its runner. The input description and each caller guide tell public repositories to keep the default, because their pull requests run code from anyone. A self-hosted runner group that admits only selected private repositories also refuses a job from any other repository, so a public caller that did pass such a label would queue rather than run there (runner-group policy, not something this PR enforces).

cursor-review.yml carried a runs_on input until #31 dropped it inside an unrelated judge-parsing fix; .github/reviewers.yml:67-69 still records the approval of that parameterization. The README sentence that said cursor-review has no runs_on input now says the runner defaults to ubuntu-latest and a private caller may override it. The comments in cursor-review.yml and groom.yml that reasoned "every job here is ubuntu-latest" now say every job defaults to it, and name a runs_on override as the way a stale self-hosted runner could reach the empty-job.workflow_sha branch.

Docs

Each of the nine docs/callers/*.md Inputs tables gains a runs_on row, and .github/cursor-review/README.md gains a knob-table row; test_inputs_docs_drift failed on the knob table until that row existed.

Verification

actionlint 1.7.12: 71 findings on origin/main and 71 on this branch, identical after stripping line numbers.
zizmor 1.22.0 (auditor persona, JSON): identical findings per audit and file on both sides; the default persona shows the same 6 unsuppressed findings on both.
check_workflow_pins.py: OK (11 workflows_ref declarations, 156 SHA-pinned uses:). check_agents_md.py --root .: passed.
Python suites under Python 3.12: cursor-review, workflow-pins (includes the docs-drift tests), groom, agents-md-integrity and linear-ticket pass.
Shell suites: bump-callers and most of pr-risk pass locally; pr-risk/test_grade_targets.sh, area-label/test_apply.sh and area-label/test_lib.sh fail identically on origin/main under macOS /bin/bash 3.2, so this PR did not cause those failures. check-org-repo-literals.sh needs a newer bash than the macOS one and did not run locally.
Unverified: no caller has run a job through the new input. This repository's self-enrollment callers pin merged SHAs, so this PR's CI still runs the old workflow bodies. The behaviour rests on the identical, already-shipping cursor-review-auto-label.yml pattern.

After merge

The bump-callers fleets will open SHA-bump PRs in each enrolled repository. Those bumps change nothing on their own; a repository opts in afterwards by adding runs_on: to its caller.

Part of BE-17780

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/338 **Author:** [@anupreet-comfy](https://github.com/anupreet-comfy) **Created:** 9/29/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `anupreet-comfy/be-17523-runs-on-input` --- ### 📝 Commits (1) - [`4912b29`](https://github.com/Comfy-Org/github-workflows/commit/4912b291f50c6034613428bf0f6fa38c63516674) feat(workflows): add an optional runs_on input to nine reusable workflows ### 📊 Changes **20 files changed** (+205 additions, -69 deletions) <details> <summary>View changed files</summary> 📝 `.github/cursor-review/README.md` (+1 -0) 📝 `.github/workflows/agents-md-integrity.yml` (+14 -1) 📝 `.github/workflows/assign-reviewers.yml` (+14 -1) 📝 `.github/workflows/cursor-review.yml` (+48 -27) 📝 `.github/workflows/detect-unreviewed-merge.yml` (+14 -1) 📝 `.github/workflows/groom.yml` (+44 -30) 📝 `.github/workflows/linear-ticket.yml` (+14 -1) 📝 `.github/workflows/pr-area-label.yml` (+15 -2) 📝 `.github/workflows/pr-risk.yml` (+16 -3) 📝 `.github/workflows/pr-size.yml` (+15 -2) 📝 `README.md` (+1 -1) 📝 `docs/callers/agents-md-integrity.md` (+1 -0) 📝 `docs/callers/assign-reviewers.md` (+1 -0) 📝 `docs/callers/cursor-review.md` (+1 -0) 📝 `docs/callers/detect-unreviewed-merge.md` (+1 -0) 📝 `docs/callers/groom.md` (+1 -0) 📝 `docs/callers/linear-ticket.md` (+1 -0) 📝 `docs/callers/pr-area-label.md` (+1 -0) 📝 `docs/callers/pr-risk.md` (+1 -0) 📝 `docs/callers/pr-size.md` (+1 -0) </details> ### 📄 Description Nine reusable workflows gain an optional `runs_on` input, so a private caller can run their jobs on its own self-hosted runners. `cursor-review-auto-label.yml` already has this input (`.github/workflows/cursor-review-auto-label.yml:80` and `:128`), and this PR copies its contract exactly: a JSON-encoded string, default `'"ubuntu-latest"'`, read by every job as `runs-on: ${{ fromJSON(inputs.runs_on) }}`. | Workflow | Jobs now reading `runs_on` | |---|---| | `agents-md-integrity.yml` | 1 | | `assign-reviewers.yml` | 1 | | `cursor-review.yml` | 11 | | `detect-unreviewed-merge.yml` | 1 | | `groom.yml` | 7 | | `linear-ticket.yml` | 1 | | `pr-area-label.yml` | 2 | | `pr-risk.yml` | 3 | | `pr-size.yml` | 2 | ## Default behaviour and public callers A caller that passes nothing gets `ubuntu-latest` on every job, exactly as before, so merging this PR and bumping callers moves no job. Nothing in this repository picks a self-hosted label; only a caller that writes `runs_on:` in its own workflow file changes its runner. The input description and each caller guide tell public repositories to keep the default, because their pull requests run code from anyone. A self-hosted runner group that admits only selected private repositories also refuses a job from any other repository, so a public caller that did pass such a label would queue rather than run there (runner-group policy, not something this PR enforces). `cursor-review.yml` carried a `runs_on` input until #31 dropped it inside an unrelated judge-parsing fix; `.github/reviewers.yml:67-69` still records the approval of that parameterization. The README sentence that said cursor-review has no `runs_on` input now says the runner defaults to `ubuntu-latest` and a private caller may override it. The comments in `cursor-review.yml` and `groom.yml` that reasoned "every job here is `ubuntu-latest`" now say every job defaults to it, and name a `runs_on` override as the way a stale self-hosted runner could reach the empty-`job.workflow_sha` branch. ## Docs Each of the nine `docs/callers/*.md` Inputs tables gains a `runs_on` row, and `.github/cursor-review/README.md` gains a knob-table row; `test_inputs_docs_drift` failed on the knob table until that row existed. ## Verification - `actionlint` 1.7.12: 71 findings on `origin/main` and 71 on this branch, identical after stripping line numbers. - `zizmor` 1.22.0 (auditor persona, JSON): identical findings per audit and file on both sides; the default persona shows the same 6 unsuppressed findings on both. - `check_workflow_pins.py`: OK (11 `workflows_ref` declarations, 156 SHA-pinned `uses:`). `check_agents_md.py --root .`: passed. - Python suites under Python 3.12: `cursor-review`, `workflow-pins` (includes the docs-drift tests), `groom`, `agents-md-integrity` and `linear-ticket` pass. - Shell suites: `bump-callers` and most of `pr-risk` pass locally; `pr-risk/test_grade_targets.sh`, `area-label/test_apply.sh` and `area-label/test_lib.sh` fail identically on `origin/main` under macOS `/bin/bash` 3.2, so this PR did not cause those failures. `check-org-repo-literals.sh` needs a newer bash than the macOS one and did not run locally. - Unverified: no caller has run a job through the new input. This repository's self-enrollment callers pin merged SHAs, so this PR's CI still runs the old workflow bodies. The behaviour rests on the identical, already-shipping `cursor-review-auto-label.yml` pattern. ## After merge The bump-callers fleets will open SHA-bump PRs in each enrolled repository. Those bumps change nothing on their own; a repository opts in afterwards by adding `runs_on:` to its caller. Part of [BE-17780](https://linear.app/comfyorg/issue/BE-17780) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-26 22:38:40 +00:00