[PR #341] [MERGED] feat(cursor-review): runs_on input to route the credential-free jobs to a caller's runners #343

New issue

Closed

opened 2026-10-26 22:38:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:38:44 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/341
Author: @mattmillerai
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/6/2026
Merged by: @mattmillerai

Base: main ← Head: matt/cursor-review-runner-input

📝 Commits (2)

d093062 feat(cursor-review): runner input to choose runs-on for every job
74c0c83 fix(cursor-review): route only credential-free jobs to the caller's runner pool

📊 Changes

5 files changed (+99 additions, -26 deletions)

View changed files

📝 .github/cursor-review/README.md (+2 -1)
📝 .github/cursor-review/tests/test_workflow_job_isolation.py (+25 -0)
📝 .github/workflows/cursor-review.yml (+70 -24)
📝 README.md (+1 -1)
📝 docs/callers/cursor-review.md (+1 -0)

📄 Description

ELI-5

Adds a setting that picks which machines run the heavy parts of the Cursor review. Nothing changes unless a repo sets it: the default is still GitHub's hosted runners. Jobs that hold write credentials always stay on GitHub's runners.

Changes

New input runs_on. It is JSON-encoded, default '"ubuntu-latest"', and has the same shape as cursor-review-auto-label.yml's runs_on, so one repo variable can feed both. An empty value falls back to the default.
Only the four jobs with no write credential follow it: diff-size, preflight, the review panel and consolidate. They use runs-on: ${{ fromJSON(inputs.runs_on || '"ubuntu-latest"') }}. The gate, ledger, blocking gate, Slack notices, and every job that mints the App token or holds pull-requests: write stay hard-pinned to ubuntu-latest. A new isolation test pins that split.
The input description, the README knob table, the caller guide and the root catalog line say which pools are safe. The routed jobs run models with unsandboxed shell over the PR's code, so a self-hosted pool must give each job a fresh pod (fresh filesystem and $HOME), carry no cloud identity or token, and block private networks and the metadata server. The image must be linux/x64 with bash, git, curl, jq, python3, gh, tar and GNU coreutils.
The copied workflows_ref guard comments, all changed together, and the --sandbox rationale now account for a caller pool.

Testing

cursor-review suite (749 tests) and workflow-pins suite (502) pass locally.
check_workflow_pins.py, the org-repo-literal lint and the agents-md lint pass.
actionlint v1.7.7 reports the same 53 findings on this file as on main, so nothing new.
Mutation check: routing post-review to runs_on fails the new isolation test.
Default behavior is unchanged: every job still resolves to ubuntu-latest.

Provenance

Authored by: agent-work loop
Verified:

cursor-review and workflow-pins unittest suites pass at the current head
workflow-pins, org-repo-literal and agents-md lints pass
actionlint reports no new findings versus main
the new runner-split test fails when a credential job is routed to runs_on (mutation check)

Deviations:

Review round: the input was renamed runner → runs_on (JSON, matching the auto-label input) and scoped to the four credential-free jobs instead of all 12
The empty-job.workflow_sha guard branch still warns rather than fails: GitHub's 30-day runner-update rule makes it unreachable in practice

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/341 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/6/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/cursor-review-runner-input` --- ### 📝 Commits (2) - [`d093062`](https://github.com/Comfy-Org/github-workflows/commit/d0930627b12154e0259327ef51e89666768de13a) feat(cursor-review): runner input to choose runs-on for every job - [`74c0c83`](https://github.com/Comfy-Org/github-workflows/commit/74c0c830e929b778608a2441ff0cd24cfee84945) fix(cursor-review): route only credential-free jobs to the caller's runner pool ### 📊 Changes **5 files changed** (+99 additions, -26 deletions) <details> <summary>View changed files</summary> 📝 `.github/cursor-review/README.md` (+2 -1) 📝 `.github/cursor-review/tests/test_workflow_job_isolation.py` (+25 -0) 📝 `.github/workflows/cursor-review.yml` (+70 -24) 📝 `README.md` (+1 -1) 📝 `docs/callers/cursor-review.md` (+1 -0) </details> ### 📄 Description ## ELI-5 Adds a setting that picks which machines run the heavy parts of the Cursor review. Nothing changes unless a repo sets it: the default is still GitHub's hosted runners. Jobs that hold write credentials always stay on GitHub's runners. ## Changes - New input `runs_on`. It is JSON-encoded, default `'"ubuntu-latest"'`, and has the same shape as `cursor-review-auto-label.yml`'s `runs_on`, so one repo variable can feed both. An empty value falls back to the default. - Only the four jobs with no write credential follow it: `diff-size`, `preflight`, the `review` panel and `consolidate`. They use `runs-on: ${{ fromJSON(inputs.runs_on || '"ubuntu-latest"') }}`. The gate, ledger, blocking gate, Slack notices, and every job that mints the App token or holds `pull-requests: write` stay hard-pinned to `ubuntu-latest`. A new isolation test pins that split. - The input description, the README knob table, the caller guide and the root catalog line say which pools are safe. The routed jobs run models with unsandboxed shell over the PR's code, so a self-hosted pool must give each job a fresh pod (fresh filesystem and `$HOME`), carry no cloud identity or token, and block private networks and the metadata server. The image must be linux/x64 with bash, git, curl, jq, python3, gh, tar and GNU coreutils. - The copied `workflows_ref` guard comments, all changed together, and the `--sandbox` rationale now account for a caller pool. ## Testing - cursor-review suite (749 tests) and workflow-pins suite (502) pass locally. - `check_workflow_pins.py`, the org-repo-literal lint and the agents-md lint pass. - actionlint v1.7.7 reports the same 53 findings on this file as on main, so nothing new. - Mutation check: routing `post-review` to `runs_on` fails the new isolation test. - Default behavior is unchanged: every job still resolves to `ubuntu-latest`. ## Provenance **Authored by:** agent-work loop **Verified:** - cursor-review and workflow-pins unittest suites pass at the current head - workflow-pins, org-repo-literal and agents-md lints pass - actionlint reports no new findings versus main - the new runner-split test fails when a credential job is routed to `runs_on` (mutation check) **Deviations:** - Review round: the input was renamed `runner` → `runs_on` (JSON, matching the auto-label input) and scoped to the four credential-free jobs instead of all 12 - The empty-`job.workflow_sha` guard branch still warns rather than fails: GitHub's 30-day runner-update rule makes it unreachable in practice 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:38:44 +00:00