[PR #355] [MERGED] fix(bump-callers): move cursor-approve and axis pins with cursor-review, and bump on their changes (BE-19438) #358

New issue

Closed

opened 2026-10-26 22:38:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:38:59 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/355
Author: @mattmillerai
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-19438-bump-companions

📝 Commits (2)

f5dc191 fix(bump-callers): move cursor-approve and axis pins with cursor-review, and bump on their changes (BE-19438)
715fedd fix(bump-callers): anchor the family address on @, allowlist the companion fixtures, watch auto-approve.py (BE-19438)

📊 Changes

6 files changed (+502 additions, -25 deletions)

View changed files

📝 .github/bump-callers/README.md (+25 -5)
📝 .github/bump-callers/bump-callers.sh (+92 -17)
📝 .github/bump-callers/tests/test_bump_callers.sh (+189 -0)
📝 .github/bump-callers/tests/test_paths_contract.sh (+102 -3)
📝 .github/lint/org-repo-allowlist.txt (+4 -0)
📝 .github/workflows/bump-cursor-review-callers.yml (+90 -0)

📄 Description

ELI-5

Some repos run cursor-review and cursor-approve (plus its "axis" reviewers) from one workflow file. Every pin in that file has to point at the same commit of this repo. The auto-bumper saw the extra workflows, decided they belonged to some other fleet, and moved only cursor-review's pin. It still moved every workflows_ref:, so cursor-approve ended up running one version's workflow against another version's scripts. It also never opened a bump PR when only cursor-approve or the axes changed. This PR tells the bumper that the cursor-approve family belongs with cursor-review, so they all move together, and makes changes to them trigger a bump.

What changed

.github/bump-callers/bump-callers.sh

New optional input COMPANION_FILES: bare reusable filenames that ship as one family with WORKFLOW_FILE. Leaving it unset keeps every other fleet's behavior byte-identical. A malformed entry (a path, no .yml, a glob) is a hard error. The list is split with read -a, so a stray *.yml can't glob.
Sibling detection ignores companions. A file calling cursor-review plus companions now counts as "ours alone", so every uses: and every workflows_ref: moves, and the github-workflows main (<sha>) markers are refreshed on every family line.
When a genuine sibling also shares the file (e.g. groom.yml), rule 1's SHA_ADDR names the whole family (/(cursor-review\.yml|cursor-approve\.yml|…)@, anchored on the @ that ends the filename so a sibling such as axis-design.yml-v2.yml, or a family name in a sibling line's comment URL, never matches). The companions still move and the sibling's pin and # main @ note stay as they were. The pre-rewrite address gate and the post-rewrite stale-pin assertion read the same address, so both cover companions.
Rewrote the "unreachable" comment on rule 2. It can be reached: a caller that pins cursor-approve and the axes in the same file as cursor-review reached it. That case is now closed. The comment names the one remaining residual: a genuine sibling with its own workflows_ref: would still have that input moved. No caller does this today.

.github/workflows/bump-cursor-review-callers.yml

Passes COMPANION_FILES: cursor-approve.yml, cursor-axis-base.yml, axis-{correctness,conformance,business,design,completeness}.yml.
paths: now watches those seven workflow files and .github/cursor-approve/**, minus .github/cursor-approve/tests/** and .github/cursor-approve/README.md, following the existing .github/cursor-review exclusions.
The preflight lists are mirrored: WATCHED_ASSETS (the 7 files plus .github/cursor-approve), WATCHED_PATHSPECS (the same, plus the two :(exclude)s) and WATCHED_EXEC (the 7 workflows, the 4 scripts and the 8 prompts the approve half loads from workflows_ref, plus .github/cursor-review/auto-approve.py, which cursor-approve.yml runs).

.github/bump-callers/README.md: the fleet table row and the "two reusables" section now describe companions and the remaining residuals (a sibling's own workflows_ref:, and a cosmetic stale github-workflows main (<sha>) marker on a moved family line in the sibling case).

.github/lint/org-repo-allowlist.txt: enumerates the four new invented test-fixture names (secret-companions, -componly, -compsib, -compstale).

Testing

Run locally against the current head (Linux, bash 5):

Command	Result
`bash .github/bump-callers/tests/test_bump_callers.sh`	485 passed, 0 failed (was 437; +48 new)
`bash .github/bump-callers/tests/test_paths_contract.sh`	197 passed, 0 failed (was 168; +29 new)
`bash .github/bump-callers/tests/test_preflight.sh`	445 passed, 0 failed (unchanged)
`python3 -m unittest discover -s .github/workflow-pins/tests -p 'test_*.py'`	OK (43 skipped)
`python3 .github/workflow-pins/check_workflow_pins.py`	OK
`shellcheck -x` on bump-callers.sh, preflight.sh and the three test scripts	clean
`check-org-repo-literals.sh`, `check_agents_md.py --root .`	OK

New cases:

The real caller's shape: cursor-review, 2×cursor-approve and 2 axes, with 3 workflows_ref, starting from the split state. All 5 uses: and all 3 workflows_ref move, all 5 markers are refreshed, the third-party actions/checkout@<sha> is untouched, and there is no half-bump warning.
The same file without COMPANION_FILES: still multi-reusable, as before. This shows the input is what makes the difference.
A genuine sibling (groom.yml) beside the companions: the companions move, and groom's pin and # main @ note are unchanged. So are a sibling named axis-design.yml-v2.yml and a sibling whose comment URL names cursor-review.yml (both checks fail without the @ anchor).
A companion uses: the rewrite can't move (@${{ … }}) in the sibling case fails the repo with nothing committed.
A file pinning only a companion clears the address gate and is bumped.
Malformed COMPANION_FILES values are rejected.
Paths contract: cursor-approve.yml, each axis, cursor-approve/aggregate.py and a prompt trigger the fleet. cursor-approve/tests/** and cursor-approve/README.md alone don't. A new two-way check keeps COMPANION_FILES in sync with the paths: filter's reusable-workflow entries. The reverse direction (every .ya?ml reusable in the filter other than WATCHED is a companion) runs for every fleet, not only companion fleets.
Checked by mutation: against the old bump-callers.sh, 30 of the new bump assertions fail. Against the old entrypoint, 10 of the new contract assertions fail.

Provenance

Authored by: agent-work loop

Verified:

All three bump-callers suites pass on the current head: test_bump_callers 485/0, test_paths_contract 197/0, test_preflight 445/0.
shellcheck -x is clean on the bump-callers scripts and tests.
check_workflow_pins.py, the workflow-pins unittest suite, check-org-repo-literals.sh and check_agents_md.py all pass.
Mutation check: the two new @-anchor assertions fail against the unanchored SHA_ADDR.

Deviations:

The workflows_ref: of a sibling that shares the file is still moved. This is documented as a residual, since no caller does it today.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/355 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-19438-bump-companions` --- ### 📝 Commits (2) - [`f5dc191`](https://github.com/Comfy-Org/github-workflows/commit/f5dc191dc855304ac82e19523b4503588e9eea3e) fix(bump-callers): move cursor-approve and axis pins with cursor-review, and bump on their changes (BE-19438) - [`715fedd`](https://github.com/Comfy-Org/github-workflows/commit/715feddbe28d61326c7c6d83d47c8a89e45f60b7) fix(bump-callers): anchor the family address on `@`, allowlist the companion fixtures, watch auto-approve.py (BE-19438) ### 📊 Changes **6 files changed** (+502 additions, -25 deletions) <details> <summary>View changed files</summary> 📝 `.github/bump-callers/README.md` (+25 -5) 📝 `.github/bump-callers/bump-callers.sh` (+92 -17) 📝 `.github/bump-callers/tests/test_bump_callers.sh` (+189 -0) 📝 `.github/bump-callers/tests/test_paths_contract.sh` (+102 -3) 📝 `.github/lint/org-repo-allowlist.txt` (+4 -0) 📝 `.github/workflows/bump-cursor-review-callers.yml` (+90 -0) </details> ### 📄 Description ## ELI-5 Some repos run cursor-review and cursor-approve (plus its "axis" reviewers) from one workflow file. Every pin in that file has to point at the same commit of this repo. The auto-bumper saw the extra workflows, decided they belonged to some other fleet, and moved only cursor-review's pin. It still moved every `workflows_ref:`, so cursor-approve ended up running one version's workflow against another version's scripts. It also never opened a bump PR when only cursor-approve or the axes changed. This PR tells the bumper that the cursor-approve family belongs with cursor-review, so they all move together, and makes changes to them trigger a bump. ## What changed **`.github/bump-callers/bump-callers.sh`** - New optional input `COMPANION_FILES`: bare reusable filenames that ship as one family with `WORKFLOW_FILE`. Leaving it unset keeps every other fleet's behavior byte-identical. A malformed entry (a path, no `.yml`, a glob) is a hard error. The list is split with `read -a`, so a stray `*.yml` can't glob. - Sibling detection ignores companions. A file calling cursor-review plus companions now counts as "ours alone", so every `uses:` and every `workflows_ref:` moves, and the `github-workflows main (<sha>)` markers are refreshed on every family line. - When a genuine sibling also shares the file (e.g. `groom.yml`), rule 1's `SHA_ADDR` names the whole family (`/(cursor-review\.yml|cursor-approve\.yml|…)@`, anchored on the `@` that ends the filename so a sibling such as `axis-design.yml-v2.yml`, or a family name in a sibling line's comment URL, never matches). The companions still move and the sibling's pin and `# main @` note stay as they were. The pre-rewrite address gate and the post-rewrite stale-pin assertion read the same address, so both cover companions. - Rewrote the "unreachable" comment on rule 2. It can be reached: a caller that pins cursor-approve and the axes in the same file as cursor-review reached it. That case is now closed. The comment names the one remaining residual: a genuine sibling with its own `workflows_ref:` would still have that input moved. No caller does this today. **`.github/workflows/bump-cursor-review-callers.yml`** - Passes `COMPANION_FILES`: `cursor-approve.yml`, `cursor-axis-base.yml`, `axis-{correctness,conformance,business,design,completeness}.yml`. - `paths:` now watches those seven workflow files and `.github/cursor-approve/**`, minus `.github/cursor-approve/tests/**` and `.github/cursor-approve/README.md`, following the existing `.github/cursor-review` exclusions. - The preflight lists are mirrored: `WATCHED_ASSETS` (the 7 files plus `.github/cursor-approve`), `WATCHED_PATHSPECS` (the same, plus the two `:(exclude)`s) and `WATCHED_EXEC` (the 7 workflows, the 4 scripts and the 8 prompts the approve half loads from `workflows_ref`, plus `.github/cursor-review/auto-approve.py`, which cursor-approve.yml runs). **`.github/bump-callers/README.md`**: the fleet table row and the "two reusables" section now describe companions and the remaining residuals (a sibling's own `workflows_ref:`, and a cosmetic stale `github-workflows main (<sha>)` marker on a moved family line in the sibling case). **`.github/lint/org-repo-allowlist.txt`**: enumerates the four new invented test-fixture names (`secret-companions`, `-componly`, `-compsib`, `-compstale`). ## Testing Run locally against the current head (Linux, bash 5): | Command | Result | |---|---| | `bash .github/bump-callers/tests/test_bump_callers.sh` | **485 passed, 0 failed** (was 437; +48 new) | | `bash .github/bump-callers/tests/test_paths_contract.sh` | **197 passed, 0 failed** (was 168; +29 new) | | `bash .github/bump-callers/tests/test_preflight.sh` | **445 passed, 0 failed** (unchanged) | | `python3 -m unittest discover -s .github/workflow-pins/tests -p 'test_*.py'` | OK (43 skipped) | | `python3 .github/workflow-pins/check_workflow_pins.py` | OK | | `shellcheck -x` on bump-callers.sh, preflight.sh and the three test scripts | clean | | `check-org-repo-literals.sh`, `check_agents_md.py --root .` | OK | New cases: - **The real caller's shape**: cursor-review, 2×cursor-approve and 2 axes, with 3 `workflows_ref`, starting from the split state. All 5 `uses:` and all 3 `workflows_ref` move, all 5 markers are refreshed, the third-party `actions/checkout@<sha>` is untouched, and there is no half-bump warning. - **The same file without `COMPANION_FILES`**: still multi-reusable, as before. This shows the input is what makes the difference. - **A genuine sibling (`groom.yml`) beside the companions**: the companions move, and groom's pin and `# main @` note are unchanged. So are a sibling named `axis-design.yml-v2.yml` and a sibling whose comment URL names `cursor-review.yml` (both checks fail without the `@` anchor). - **A companion `uses:` the rewrite can't move** (`@${{ … }}`) in the sibling case fails the repo with nothing committed. - **A file pinning only a companion** clears the address gate and is bumped. - **Malformed `COMPANION_FILES` values** are rejected. - **Paths contract**: `cursor-approve.yml`, each axis, `cursor-approve/aggregate.py` and a prompt trigger the fleet. `cursor-approve/tests/**` and `cursor-approve/README.md` alone don't. A new two-way check keeps `COMPANION_FILES` in sync with the `paths:` filter's reusable-workflow entries. The reverse direction (every `.ya?ml` reusable in the filter other than `WATCHED` is a companion) runs for every fleet, not only companion fleets. - Checked by mutation: against the old `bump-callers.sh`, 30 of the new bump assertions fail. Against the old entrypoint, 10 of the new contract assertions fail. ## Provenance **Authored by:** agent-work loop **Verified:** - All three bump-callers suites pass on the current head: test_bump_callers 485/0, test_paths_contract 197/0, test_preflight 445/0. - `shellcheck -x` is clean on the bump-callers scripts and tests. - `check_workflow_pins.py`, the workflow-pins unittest suite, `check-org-repo-literals.sh` and `check_agents_md.py` all pass. - Mutation check: the two new `@`-anchor assertions fail against the unanchored SHA_ADDR. **Deviations:** - The `workflows_ref:` of a sibling that shares the file is still moved. This is documented as a residual, since no caller does it today. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-26 22:38:59 +00:00

bsakaguchi referenced this issue

2026-10-26 22:38:59 +00:00

[PR #358] [MERGED] feat(cursor-review): per-author auto-approve opt-in (approve_authors) #359

bsakaguchi closed this issue

2026-10-26 22:38:59 +00:00

bsakaguchi referenced this issue

2026-10-26 22:39:02 +00:00

[PR #360] [MERGED] fix(cursor-review): gate a delta re-raise on an earlier round's open thread even without repeat_of #362