Comfy-Org/github-workflows

Fork 0

mirror of https://github.com/Comfy-Org/github-workflows.git synced 2026-11-05 00:17:37 +00:00

[PR #396] [MERGED] feat(cursor-review): optional direct-Anthropic review cells via a pinned Claude Code CLI over a read-only PR checkout #397

New issue

Closed

opened 2026-10-26 22:39:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:39:22 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/396
Author: @mattmillerai
Created: 10/9/2026
Status: ✅ Merged
Merged: 10/9/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-19913-anthropic-direct-cells

📝 Commits (7)

ce872cd feat(cursor-review): optional direct-Anthropic review cells via a pinned Claude Code CLI over a read-only PR checkout (BE-19913)
f82d7b9 fix(cursor-review): harden the direct-Anthropic cells per review
49bec95 fix(cursor-review): load no PR-authored Claude config in the direct-Anthropic cells
e2a926c fix(cursor-review): deny /proc and /sys to the direct-Anthropic agent independently of --restricted
1290970 fix(cursor-review): keep Grep and Glob in the direct-Anthropic cells by dropping --bare (BE-19913)
e2ebf0f feat(cursor-review): record each direct-Anthropic cell's token usage as an artifact (BE-19913)
7b0f72b fix(cursor-review): make usage recording best-effort and refuse malformed counts (BE-19913)

📊 Changes

10 files changed (+1119 additions, -43 deletions)

View changed files

📝 .github/cursor-review/README.md (+5 -1)
📝 .github/cursor-review/aggregate-panel.py (+53 -14)
📝 .github/cursor-review/package.json (+3 -2)
📝 .github/cursor-review/tests/test_aggregate_panel.py (+122 -0)
📝 .github/cursor-review/tests/test_workflow_job_isolation.py (+66 -0)
📝 .github/cursor-review/tests/test_workflow_panel_integrity.py (+162 -15)
📝 .github/cursor-review/tests/test_workflow_ref_guard_parity.py (+1 -1)
📝 .github/workflow-pins/tests/test_check_workflow_pins.py (+3 -2)
📝 .github/workflows/cursor-review.yml (+700 -8)
📝 docs/callers/cursor-review.md (+4 -0)

📄 Description

Adds an opt-in pair of direct-Anthropic review cells to cursor-review.yml. It mirrors review-openai-direct step for step, with one deliberate difference: the agent also reads a read-only PR checkout. Diff-only cells miss every finding that needs a file outside the diff.

What changed

Inputs: anthropic_direct_model (default '', same plain-id check as openai_direct_model; refused with a warning when it equals openai_direct_model, whose artifact name it would collide with), anthropic_direct_effort (default xhigh; anything outside low|medium|high|xhigh|max warns and falls back to xhigh), and anthropic_direct_replaces_cursor_anthropic (default true).
Secret: optional ANTHROPIC_API_KEY, documented like OPENAI_API_KEY.
gate resolves anthropic_key_present, so preflight (which follows runs_on) never references the secret.
preflight / Define panel models:
- Emits anthropic_direct, anthropic_direct_counts and a validated anthropic_direct_effort.
- When replacing, it drops every id whose lower-cased form starts with claude-. This runs after the OpenAI drop, so the empty-panel ::error:: sees both drops.
- judge_model is never touched.
- Both direct model ids now refuse any whitespace before the id regex: grep -x matched line by line, so a multi-line value got through on one clean line. This also fixes the existing openai_direct_model check.
New job review-anthropic-direct (ubuntu-latest, contents: read, 2-entry matrix):
- Seeded error artifact and a byte-identical workflows_ref guard.
- Assets checkout, then a Checkout PR repo step: same pinned action SHA as review, ref: pull_request.head.sha (the reviewed diff's RIGHT side, not the merge ref), path: _pr, fetch-depth: 1, persist-credentials: false. Following steps run find _pr -type l -delete and remove PR-authored Claude config (rm -rf _pr/.claude _pr/.mcp.json _pr/CLAUDE.local.md), the counterpart of the Cursor cells' rm -rf .cursor.
- pr-diff and ledger downloads, then the key check.
- CLI install from the package.json pin, using the same exact-version jq check as the Codex install, plus a Verify step. That step checks the version and also fails by name if claude --help stops listing any confinement flag the cell relies on (--restricted, --disallowedTools, --permission-prompts, --setting-sources, …).
- A byte-identical Build prompt.
- claude -p --bare --restricted --setting-sources "" --tools "Read,Grep,Glob" --strict-mcp-config --disallowedTools "Read(//proc/**),Read(//sys/**)" … with the shared review-output-mcp.py as the only MCP server, run in _pr. Every python3 in that step (and the MCP server it spawns) runs with -I, so a PR-planted json.py in the cwd cannot shadow the stdlib. Its key, CLAUDE_CONFIG_DIR and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 are set in that one step's env. The result JSON goes to /tmp/claude-result.json and is never echoed. The key is in that process's env, so /proc/self/environ is denied by explicit rules that do not depend on --restricted.
- A key-exfil guard copied from groom's finder guard: if the record contains the key, it is rewritten to status=error.
- Then the status-only Report cell outcome, the findings-direct-<type>-<model> upload, and Fail the leg when the cell did not submit.
aggregate-panel.py counts direct cells per lab:
- The existing --direct-* flags stay the OpenAI ones.
- New --anthropic-direct-model/-counts/-result flags cover Anthropic.
- Each artifact is assigned to a lab by its model id. One matching neither lab is a mismatch when any lab counts, and advisory otherwise, as today.
- The markers are still script-set only.
CLI pin: "@anthropic-ai/claude-code": "2.1.286" in .github/cursor-review/package.json, whose description now names both CLIs.
Docs: rows for the three inputs and the secret in .github/cursor-review/README.md and docs/callers/cursor-review.md. They include the zero-data-retention note for private repos and the Read/Grep/Glob-only, --restricted description.

Follow-ups from review (`1290970`, `e2ebf0f`, `7b0f72b`)

Dropped --bare. On the pinned 2.1.286 binary, --bare silently removes Grep and Glob from --tools "Read,Grep,Glob". The agent was left with Read only, so it could open files it already knew about but never search the checkout, which is the reason it gets a checkout at all. Everything --bare would skip is already off:
- --setting-sources "" and a fresh CLAUDE_CONFIG_DIR load no settings, hooks, plugins or CLAUDE.md instructions.
- --strict-mcp-config admits only the submission server.
- CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 stops telemetry.
- Auth is the env key alone.
The verify step no longer requires --bare, and a new test pins its absence.
Token usage artifact. New Record token usage and Upload usage artifact steps: each cell uploads usage-direct-<review_type>-<model>, kept 30 days.
- It holds the API's own token counts as Claude Code totals them: integers and model ids only, with no prices and nothing model-written.
- It reads measured=false when the cell left no result, e.g. after a timeout.
- It isn't named findings-*, so consolidate never reads it as a cell, and its upload is best-effort.
- Callers can measure the cells' cost without an Admin API key.
- Executed tests in RecordTokenUsageTest cover these behaviours.
Usage recording hardened (CodeRabbit). Record token usage is continue-on-error, like its upload. A present but malformed count or model id makes the record measured: false rather than a zero a cost report would trust.
The consolidate needs: comment now reads correctly for two direct jobs.

Tests

test_aggregate_panel.py gets a new PerLabTest. It covers:
- both labs counting, and both labs advisory
- OpenAI counting with Anthropic advisory, and the reverse
- a missing counted Anthropic artifact (synthesised as an error), and a missing advisory one (not synthesised)
- marker forgery
- per-lab inconsistency
- a direct artifact matching neither lab
- the CLI flags
test_workflow_panel_integrity.py: DirectCellsGateWhenTheyReplaceTest is now parameterised per lab, and AnthropicDirectCellsGateWhenTheyReplaceTest executes preflight → aggregate → leg check for the new job. I checked the sabotage cases by hand. Each of these one-line edits makes the twin fail:
- --anthropic-direct-counts false
- preflight's anthropic_direct_counts=true changed to false
- the leg's exit 1 changed to true
- an emptied ANTHROPIC_DIRECT_MODEL
Guard counts bumped: EXPECTED_GUARDS 12→13, and the workflow-pins self-check 23→24.
test_workflow_job_isolation.py: new assertion that ANTHROPIC_API_KEY is referenced only by gate and review-anthropic-direct, and that the latter is on ubuntu-latest. Another asserts that the claude invocation carries --bare, --restricted and --setting-sources "", and that the job removes _pr/.claude and _pr/.mcp.json. A third pins the /proc + /sys deny rule, --permission-prompts none and the verify step's flag check. Removing the deny rule fails it.
Results: cursor-review suite (1300 tests) OK; workflow-pins suite OK, including the input-docs drift harness. check_workflow_pins.py, check_agents_md.py --root . and check-org-repo-literals.sh all pass.
actionlint: diffed against main's copy of the file, there is no new kind of finding. The only additions are one more instance each of the existing guard-step warnings (job.workflow_sha unknown to actionlint, and SC2018/SC2019 info), because the guard is a byte-identical copy.

Judgment calls

CLI pin is 2.1.286, not the newest release that is ≥7 days old (2.1.287). The flags used here were verified on 2.1.286. The npm package is a native-binary wrapper, so I could not check 2.1.287's flags from the tarball. Dependabot will move it from here.
With anthropic_direct_model unset, behaviour is unchanged: the job is skipped, the new aggregate flags default to off/skipped, and every existing test passes unmodified apart from the two guard counts.

Residual

Exercised on Linux, not yet on a GitHub runner. The job's own step scripts, taken verbatim from the workflow, ran in a node:22-bookworm container with the pinned 2.1.286 binary and a real key.
- Verify Claude Code CLI version passed, including the version parse and every flag.
- The edge-case cell submitted status=ok with no permission denials.
- The exfil guard stayed quiet.
- The usage record was written with measured=true.
The first live run should still check that both cells report status=ok.
Confinement probes on that Linux setup:
- Read, Grep and Glob on /proc were refused with both layers, with --restricted alone, and with the deny rules alone. All three succeeded with neither, so the probe is real.
- A PR-planted CLAUDE.md instructing a one-word reply was ignored under --setting-sources "".
CLI pin. 2.1.295's changelog fixes "--tools and --restricted not applying to built-in tools that register after launch". In these 2.1.286 runs the agent was offered only Glob, Grep and Read, plus the submission tools under MCP. Take Dependabot's bump past 2.1.295 once it clears the cooldown.
The judge (Consolidate panel) stays on Cursor. Moving it, retrying direct cells on transient API errors, and supporting more than one direct Anthropic model are all out of scope.

Provenance

Authored by: agent-work loop
Verified:
- Unit suites on the current head: cursor-review (1300 tests) and workflow-pins, both OK.
- Repo lints pass on the current head: check_workflow_pins.py, check-org-repo-literals.sh and check_agents_md.py --root ..
- The new whitespace guard was checked by hand against single-line, multi-line, embedded-space and trailing-newline ids.
- actionlint was diffed against main before the review-fix commits and has not been re-run since.
- Sabotage edits fail the new tests: the wiring sabotage, dropping --setting-sources "", and dropping the /proc deny rule.
- Confinement was tested locally on CLI 2.1.281 with claude -p. With --restricted alone, and with the deny rules alone, file-tool reads of /proc and /sys were refused.
Deviations: CLI pin is 2.1.286 rather than 2.1.287 (see Judgment calls). No run on a GitHub runner yet (see Residual).

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/396 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 10/9/2026 **Status:** ✅ Merged **Merged:** 10/9/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-19913-anthropic-direct-cells` --- ### 📝 Commits (7) - [`ce872cd`](https://github.com/Comfy-Org/github-workflows/commit/ce872cd5261e4703e5f57e08b2db0f4888c88955) feat(cursor-review): optional direct-Anthropic review cells via a pinned Claude Code CLI over a read-only PR checkout (BE-19913) - [`f82d7b9`](https://github.com/Comfy-Org/github-workflows/commit/f82d7b936f456a1a56edb349ce029dc7bcc7ac27) fix(cursor-review): harden the direct-Anthropic cells per review - [`49bec95`](https://github.com/Comfy-Org/github-workflows/commit/49bec9595c3ce343800a2b17c688327a8292af2e) fix(cursor-review): load no PR-authored Claude config in the direct-Anthropic cells - [`e2a926c`](https://github.com/Comfy-Org/github-workflows/commit/e2a926cd2596e832455e9ecc1516fa404c7f5520) fix(cursor-review): deny /proc and /sys to the direct-Anthropic agent independently of --restricted - [`1290970`](https://github.com/Comfy-Org/github-workflows/commit/1290970b1c41e2c561869d8f5278e5f33b429c78) fix(cursor-review): keep Grep and Glob in the direct-Anthropic cells by dropping --bare (BE-19913) - [`e2ebf0f`](https://github.com/Comfy-Org/github-workflows/commit/e2ebf0fd5ed86303900e7119654bae1ea58e3d0b) feat(cursor-review): record each direct-Anthropic cell's token usage as an artifact (BE-19913) - [`7b0f72b`](https://github.com/Comfy-Org/github-workflows/commit/7b0f72b2cca783f6cc22d7d072268bd740dda190) fix(cursor-review): make usage recording best-effort and refuse malformed counts (BE-19913) ### 📊 Changes **10 files changed** (+1119 additions, -43 deletions) <details> <summary>View changed files</summary> 📝 `.github/cursor-review/README.md` (+5 -1) 📝 `.github/cursor-review/aggregate-panel.py` (+53 -14) 📝 `.github/cursor-review/package.json` (+3 -2) 📝 `.github/cursor-review/tests/test_aggregate_panel.py` (+122 -0) 📝 `.github/cursor-review/tests/test_workflow_job_isolation.py` (+66 -0) 📝 `.github/cursor-review/tests/test_workflow_panel_integrity.py` (+162 -15) 📝 `.github/cursor-review/tests/test_workflow_ref_guard_parity.py` (+1 -1) 📝 `.github/workflow-pins/tests/test_check_workflow_pins.py` (+3 -2) 📝 `.github/workflows/cursor-review.yml` (+700 -8) 📝 `docs/callers/cursor-review.md` (+4 -0) </details> ### 📄 Description Adds an opt-in pair of **direct-Anthropic** review cells to `cursor-review.yml`. It mirrors `review-openai-direct` step for step, with one deliberate difference: the agent also reads a **read-only PR checkout**. Diff-only cells miss every finding that needs a file outside the diff. ## What changed - **Inputs:** `anthropic_direct_model` (default `''`, same plain-id check as `openai_direct_model`; refused with a warning when it equals `openai_direct_model`, whose artifact name it would collide with), `anthropic_direct_effort` (default `xhigh`; anything outside `low|medium|high|xhigh|max` warns and falls back to `xhigh`), and `anthropic_direct_replaces_cursor_anthropic` (default `true`). - **Secret:** optional `ANTHROPIC_API_KEY`, documented like `OPENAI_API_KEY`. - **`gate`** resolves `anthropic_key_present`, so `preflight` (which follows `runs_on`) never references the secret. - **`preflight` / `Define panel models`:** - Emits `anthropic_direct`, `anthropic_direct_counts` and a validated `anthropic_direct_effort`. - When replacing, it drops every id whose lower-cased form starts with `claude-`. This runs after the OpenAI drop, so the empty-panel `::error::` sees both drops. - `judge_model` is never touched. - Both direct model ids now refuse any whitespace before the id regex: `grep -x` matched line by line, so a multi-line value got through on one clean line. This also fixes the existing `openai_direct_model` check. - **New job `review-anthropic-direct`** (`ubuntu-latest`, `contents: read`, 2-entry matrix): - Seeded error artifact and a byte-identical `workflows_ref` guard. - Assets checkout, then a `Checkout PR repo` step: same pinned action SHA as `review`, `ref: pull_request.head.sha` (the reviewed diff's RIGHT side, not the merge ref), `path: _pr`, `fetch-depth: 1`, `persist-credentials: false`. Following steps run `find _pr -type l -delete` and remove PR-authored Claude config (`rm -rf _pr/.claude _pr/.mcp.json _pr/CLAUDE.local.md`), the counterpart of the Cursor cells' `rm -rf .cursor`. - `pr-diff` and ledger downloads, then the key check. - CLI install from the `package.json` pin, using the same exact-version `jq` check as the Codex install, plus a `Verify` step. That step checks the version and also fails by name if `claude --help` stops listing any confinement flag the cell relies on (`--restricted`, `--disallowedTools`, `--permission-prompts`, `--setting-sources`, …). - A byte-identical `Build prompt`. - `claude -p --bare --restricted --setting-sources "" --tools "Read,Grep,Glob" --strict-mcp-config --disallowedTools "Read(//proc/**),Read(//sys/**)" …` with the shared `review-output-mcp.py` as the only MCP server, run in `_pr`. Every `python3` in that step (and the MCP server it spawns) runs with `-I`, so a PR-planted `json.py` in the cwd cannot shadow the stdlib. Its key, `CLAUDE_CONFIG_DIR` and `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1` are set in that one step's env. The result JSON goes to `/tmp/claude-result.json` and is never echoed. The key is in that process's env, so `/proc/self/environ` is denied by explicit rules that do not depend on `--restricted`. - A key-exfil guard copied from groom's finder guard: if the record contains the key, it is rewritten to status=error. - Then the status-only `Report cell outcome`, the `findings-direct-<type>-<model>` upload, and `Fail the leg when the cell did not submit`. - **`aggregate-panel.py`** counts direct cells **per lab**: - The existing `--direct-*` flags stay the OpenAI ones. - New `--anthropic-direct-model/-counts/-result` flags cover Anthropic. - Each artifact is assigned to a lab by its model id. One matching neither lab is a mismatch when any lab counts, and advisory otherwise, as today. - The markers are still script-set only. - **CLI pin:** `"@anthropic-ai/claude-code": "2.1.286"` in `.github/cursor-review/package.json`, whose description now names both CLIs. - **Docs:** rows for the three inputs and the secret in `.github/cursor-review/README.md` and `docs/callers/cursor-review.md`. They include the zero-data-retention note for private repos and the Read/Grep/Glob-only, `--restricted` description. ## Follow-ups from review (1290970, e2ebf0f, 7b0f72b) - **Dropped `--bare`.** On the pinned 2.1.286 binary, `--bare` silently removes Grep and Glob from `--tools "Read,Grep,Glob"`. The agent was left with Read only, so it could open files it already knew about but never search the checkout, which is the reason it gets a checkout at all. Everything `--bare` would skip is already off: - `--setting-sources ""` and a fresh `CLAUDE_CONFIG_DIR` load no settings, hooks, plugins or CLAUDE.md instructions. - `--strict-mcp-config` admits only the submission server. - `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1` stops telemetry. - Auth is the env key alone. The verify step no longer requires `--bare`, and a new test pins its absence. - **Token usage artifact.** New `Record token usage` and `Upload usage artifact` steps: each cell uploads `usage-direct-<review_type>-<model>`, kept 30 days. - It holds the API's own token counts as Claude Code totals them: integers and model ids only, with no prices and nothing model-written. - It reads `measured=false` when the cell left no result, e.g. after a timeout. - It isn't named `findings-*`, so `consolidate` never reads it as a cell, and its upload is best-effort. - Callers can measure the cells' cost without an Admin API key. - Executed tests in `RecordTokenUsageTest` cover these behaviours. - **Usage recording hardened (CodeRabbit).** `Record token usage` is `continue-on-error`, like its upload. A present but malformed count or model id makes the record `measured: false` rather than a zero a cost report would trust. - The `consolidate` `needs:` comment now reads correctly for two direct jobs. ## Tests - `test_aggregate_panel.py` gets a new `PerLabTest`. It covers: - both labs counting, and both labs advisory - OpenAI counting with Anthropic advisory, and the reverse - a missing counted Anthropic artifact (synthesised as an error), and a missing advisory one (not synthesised) - marker forgery - per-lab inconsistency - a direct artifact matching neither lab - the CLI flags - `test_workflow_panel_integrity.py`: `DirectCellsGateWhenTheyReplaceTest` is now parameterised per lab, and `AnthropicDirectCellsGateWhenTheyReplaceTest` executes preflight → aggregate → leg check for the new job. I checked the sabotage cases by hand. Each of these one-line edits makes the twin fail: - `--anthropic-direct-counts false` - preflight's `anthropic_direct_counts=true` changed to `false` - the leg's `exit 1` changed to `true` - an emptied `ANTHROPIC_DIRECT_MODEL` - Guard counts bumped: `EXPECTED_GUARDS` 12→13, and the workflow-pins self-check 23→24. - `test_workflow_job_isolation.py`: new assertion that `ANTHROPIC_API_KEY` is referenced only by `gate` and `review-anthropic-direct`, and that the latter is on `ubuntu-latest`. Another asserts that the `claude` invocation carries `--bare`, `--restricted` and `--setting-sources ""`, and that the job removes `_pr/.claude` and `_pr/.mcp.json`. A third pins the `/proc` + `/sys` deny rule, `--permission-prompts none` and the verify step's flag check. Removing the deny rule fails it. - Results: cursor-review suite (1300 tests) OK; workflow-pins suite OK, including the input-docs drift harness. `check_workflow_pins.py`, `check_agents_md.py --root .` and `check-org-repo-literals.sh` all pass. - `actionlint`: diffed against `main`'s copy of the file, there is no new kind of finding. The only additions are one more instance each of the existing guard-step warnings (`job.workflow_sha` unknown to actionlint, and SC2018/SC2019 info), because the guard is a byte-identical copy. ## Judgment calls - **CLI pin is 2.1.286, not the newest release that is ≥7 days old (2.1.287).** The flags used here were verified on 2.1.286. The npm package is a native-binary wrapper, so I could not check 2.1.287's flags from the tarball. Dependabot will move it from here. - With `anthropic_direct_model` unset, behaviour is unchanged: the job is skipped, the new aggregate flags default to off/`skipped`, and every existing test passes unmodified apart from the two guard counts. ## Residual - **Exercised on Linux, not yet on a GitHub runner.** The job's own step scripts, taken verbatim from the workflow, ran in a `node:22-bookworm` container with the pinned 2.1.286 binary and a real key. - `Verify Claude Code CLI version` passed, including the version parse and every flag. - The edge-case cell submitted `status=ok` with no permission denials. - The exfil guard stayed quiet. - The usage record was written with `measured=true`. The first live run should still check that both cells report `status=ok`. - **Confinement probes on that Linux setup:** - Read, Grep and Glob on `/proc` were refused with both layers, with `--restricted` alone, and with the deny rules alone. All three succeeded with neither, so the probe is real. - A PR-planted `CLAUDE.md` instructing a one-word reply was ignored under `--setting-sources ""`. - **CLI pin.** 2.1.295's changelog fixes "`--tools` and `--restricted` not applying to built-in tools that register after launch". In these 2.1.286 runs the agent was offered only Glob, Grep and Read, plus the submission tools under MCP. Take Dependabot's bump past 2.1.295 once it clears the cooldown. - The judge (`Consolidate panel`) stays on Cursor. Moving it, retrying direct cells on transient API errors, and supporting more than one direct Anthropic model are all out of scope. ## Provenance - **Authored by:** agent-work loop - **Verified:** - Unit suites on the current head: cursor-review (1300 tests) and workflow-pins, both OK. - Repo lints pass on the current head: `check_workflow_pins.py`, `check-org-repo-literals.sh` and `check_agents_md.py --root .`. - The new whitespace guard was checked by hand against single-line, multi-line, embedded-space and trailing-newline ids. - `actionlint` was diffed against `main` before the review-fix commits and has not been re-run since. - Sabotage edits fail the new tests: the wiring sabotage, dropping `--setting-sources ""`, and dropping the `/proc` deny rule. - Confinement was tested locally on CLI 2.1.281 with `claude -p`. With `--restricted` alone, and with the deny rules alone, file-tool reads of `/proc` and `/sys` were refused. - **Deviations:** CLI pin is 2.1.286 rather than 2.1.287 (see Judgment calls). No run on a GitHub runner yet (see Residual). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:39:22 +00:00

closed this issue
added the
pull-request
label

No labels

cursor-review-catalog-drift

groom

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Comfy-Org/github-workflows#397

No description provided.

Rows
Columns