[PR #370] [MERGED] feat(cursor-review): read the panel list from CURSOR_PANEL_MODELS, so one org variable drives the fleet #371

New issue

Closed

opened 2026-10-26 22:39:08 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:39:08 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/370
Author: @mattmillerai
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @mattmillerai

Base: main ← Head: matt/panel-models-org-variable

📝 Commits (1)

610e05b feat(cursor-review): read the panel list from CURSOR_PANEL_MODELS, so one org variable drives the fleet

📊 Changes

3 files changed (+55 additions, -76 deletions)

View changed files

📝 .github/workflows/ci-cursor-review.yml (+6 -44)
📝 .github/workflows/cursor-review.yml (+20 -3)
📝 docs/callers/cursor-review.md (+29 -29)

📄 Description

Why

panel_models was an input only. Overriding the panel therefore meant editing every caller to wire a variable through — #367 did that for this repo's caller and nothing else. That is not a global knob; it is 20 pending PRs.

What

The reusable now falls back to the CURSOR_PANEL_MODELS variable when the caller passes no input:

PANEL_MODELS_OVERRIDE: ${{ inputs.panel_models || vars.CURSOR_PANEL_MODELS }}

vars inside a reusable resolves against the caller's repo and org. Verified empirically rather than from docs, which are silent on it: CURSOR_REVIEW_DM_EMAIL_MAP is set on a caller repo and not on this one, and the Slack DM feature works on that caller.

So:

Where it's set	Effect
Org	every enrolled caller picks it up, no caller edits
A repo	that repo wins; org value untouched elsewhere
Neither	the built-in list — i.e. today's behaviour exactly
Deleted	reverts, no PR, no fleet bump

The panel_models input still exists and takes precedence, for a caller that wants its own list regardless of any variable.

Also in here

This repo's caller stops wiring the variable through an input, which is now redundant — the reusable reads the same variable directly. −44 lines of comment, replaced by a six-line pointer to the docs. This repo's panel is now driven by the same variable as everyone else's.
The round log names which source won, not just the effective list. With two sources, the list alone no longer tells you where to go change it.
Docs rewritten around "set the variable" instead of "wire the input".

Unchanged, and still true

An override forfeits catalog-drift.py coverage either way, because extract_panel_models() parses the heredoc. The docs say so, and say to fold a proven list back into the heredoc and delete the variable.

Worth a reviewer's attention

Because the variable is caller-side, any caller repo's admin can now set a repo-level value and narrow the panel judging their own PRs — no PR, no CODEOWNERS, run log as the only record. That write is repo-admin, who can already swap the pin or delete the caller outright, so it isn't a new trust boundary — but it is a quieter one. Documented rather than left to be discovered.

Testing

python3 -m unittest discover -s .github/cursor-review/tests — 1147 passed
check_workflow_pins.py, check_agents_md.py --root . — pass
Source-detection branch simulated across all four input/variable combinations

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/370 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/panel-models-org-variable` --- ### 📝 Commits (1) - [`610e05b`](https://github.com/Comfy-Org/github-workflows/commit/610e05b7a4a69190ea106762e7b1fec2ef99b3c9) feat(cursor-review): read the panel list from CURSOR_PANEL_MODELS, so one org variable drives the fleet ### 📊 Changes **3 files changed** (+55 additions, -76 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci-cursor-review.yml` (+6 -44) 📝 `.github/workflows/cursor-review.yml` (+20 -3) 📝 `docs/callers/cursor-review.md` (+29 -29) </details> ### 📄 Description ## Why `panel_models` was an **input only**. Overriding the panel therefore meant editing *every caller* to wire a variable through — #367 did that for this repo's caller and nothing else. That is not a global knob; it is 20 pending PRs. ## What The reusable now falls back to the `CURSOR_PANEL_MODELS` variable when the caller passes no input: ```yaml PANEL_MODELS_OVERRIDE: ${{ inputs.panel_models || vars.CURSOR_PANEL_MODELS }} ``` `vars` inside a reusable resolves against the **caller's** repo and org. Verified empirically rather than from docs, which are silent on it: `CURSOR_REVIEW_DM_EMAIL_MAP` is set on a caller repo and not on this one, and the Slack DM feature works on that caller. So: | Where it's set | Effect | |---|---| | Org | every enrolled caller picks it up, no caller edits | | A repo | that repo wins; org value untouched elsewhere | | Neither | the built-in list — i.e. today's behaviour exactly | | Deleted | reverts, no PR, no fleet bump | The `panel_models` input still exists and takes precedence, for a caller that wants its own list regardless of any variable. ## Also in here - **This repo's caller stops wiring the variable through an input**, which is now redundant — the reusable reads the same variable directly. −44 lines of comment, replaced by a six-line pointer to the docs. This repo's panel is now driven by the same variable as everyone else's. - **The round log names which source won**, not just the effective list. With two sources, the list alone no longer tells you where to go change it. - Docs rewritten around "set the variable" instead of "wire the input". ## Unchanged, and still true An override forfeits `catalog-drift.py` coverage either way, because `extract_panel_models()` parses the heredoc. The docs say so, and say to fold a proven list back into the heredoc and delete the variable. ## Worth a reviewer's attention Because the variable is caller-side, any caller repo's admin can now set a repo-level value and narrow the panel judging their own PRs — no PR, no CODEOWNERS, run log as the only record. That write is repo-admin, who can already swap the pin or delete the caller outright, so it isn't a new trust boundary — but it is a quieter one. Documented rather than left to be discovered. ## Testing - `python3 -m unittest discover -s .github/cursor-review/tests` — 1147 passed - `check_workflow_pins.py`, `check_agents_md.py --root .` — pass - Source-detection branch simulated across all four input/variable combinations 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:39:08 +00:00