[PR #32] [MERGED] ci(bump-callers): wire cloud-code-bot review identity into flagged callers (BE-1814) #43

New issue

Closed

opened 2026-10-26 22:35:40 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:35:40 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/32
Author: @mattmillerai
Created: 7/16/2026
Status: ✅ Merged
Merged: 7/21/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-1814-wire-bot-identity-callers

📝 Commits (3)

4758456 ci(bump-callers): wire cloud-code-bot review identity into flagged callers (BE-1814)
72b12c1 Merge origin/main into matt/be-1814-wire-bot-identity-callers
cd1181d feat(bump-callers): teach the shared bumper the wire_bot field (BE-1814)

📊 Changes

5 files changed (+415 additions, -20 deletions)

View changed files

📝 .github/bump-callers/bump-callers.sh (+56 -15)
📝 .github/bump-callers/tests/test_bump_callers.sh (+74 -0)
➕ .github/cursor-review/tests/test_wire_bot_identity.py (+131 -0)
➕ .github/cursor-review/wire-bot-identity.py (+133 -0)
📝 .github/workflows/bump-cursor-review-callers.yml (+21 -5)

📄 Description

ELI-5

The cursor-review bot can now post its review under a dedicated cloud-code-bot identity instead of the generic github-actions[bot] (that ability landed in Story 1.1, PR #13). Each consumer repo has to opt in by adding two lines to its thin caller: the app id (bot_app_id) and the paired private key secret. Rather than hand-edit every repo, this teaches the existing caller-bump machinery to add those two lines automatically — but only for the repos that actually hold the cloud-code-bot creds. Repos without the creds are untouched and keep posting as github-actions[bot].

What & why

Story 1.3 of BE-1800, refit to the existing cloud-code-bot creds (vars.APP_ID = app 2016716 / secrets.CLOUD_CODE_BOT_PRIVATE_KEY). No new secrets to provision — each consumer maps creds it already has.

.github/cursor-review/wire-bot-identity.py (new) — idempotently injects into a caller:
- bot_app_id: ${{ vars.APP_ID }} as the first child of with:
- BOT_APP_PRIVATE_KEY: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }} under secrets:
It edits only those two anchors (line-based, not a PyYAML round-trip) so the fan-out PR diff is exactly the wiring — the callers' comments, folded diff_excludes, and SHA-pin lines are preserved byte-for-byte. Already-wired callers are a no-op.
.github/bump-callers/bump-callers.sh — each caller entry in the CURSOR_REVIEW_CALLERS repo variable gains an optional wire_bot field. When true, the caller is piped through the helper alongside the SHA bump (via WIRE_BOT_SCRIPT, set only by bump-cursor-review-callers.yml — the shared script stays fleet-agnostic, so bump-agents-md-callers.yml never sets it). Intended only for repos confirmed to hold the creds:
- cloud + comfy-cloud-mcp-server — already wired by hand ⇒ injection would be a verified no-op (they still get the SHA bump).
- comfy-inapp-agent + Comfy-iOS — their cursor-review-auto-label.yml callers already use vars.APP_ID + secrets.CLOUD_CODE_BOT_PRIVATE_KEY, so the creds are provisioned. These are the repos this is meant to wire.
- Not intended: comfy-local-mcp / ComfySwiftSDK / comfy-infra / the public OSS repos (no cloud-code-bot creds), and not swarmhost (its own caller comment states the app isn't provisioned there yet).
- The live CURSOR_REVIEW_CALLERS variable does not yet flag any entry wire_bot: true — this PR ships the capability; actually wiring the four repos above needs a follow-up gh variable set (see "How it propagates").
Added unit tests (tests/test_wire_bot_identity.py, 8 cases; test_bump_callers.sh gains 4 wire_bot cases) that run under the existing CI.

Non-breaking / incremental: both bot_app_id (input) and BOT_APP_PRIVATE_KEY (secret) are optional in the reusable workflow — a caller without them keeps posting as github-actions[bot].

How it propagates

This PR gives the bump script the capability; wiring only lands in a consumer repo once its CURSOR_REVIEW_CALLERS entry is flagged "wire_bot": true AND the workflow runs — either on the next cursor-review.yml push, or via a manual workflow_dispatch after merge. Recommended sequence after merge:

gh variable get CURSOR_REVIEW_CALLERS -R Comfy-Org/github-workflows → add "wire_bot": true to the comfy-inapp-agent and Comfy-iOS entries (optionally cloud / comfy-cloud-mcp-server too, where it's a no-op).
gh variable set CURSOR_REVIEW_CALLERS -R Comfy-Org/github-workflows --body '<updated JSON>'.
gh workflow run bump-cursor-review-callers.yml -R Comfy-Org/github-workflows to propagate immediately.

Verification

python3 -m unittest discover green across .github/cursor-review/tests and .github/agents-md-integrity/tests.
shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh clean.
bash .github/bump-callers/tests/test_bump_callers.sh — 86 passed, 0 failed (includes the 4 new wire_bot cases: wired end-to-end, not-flagged never wires, WIRE_BOT_SCRIPT unset degrades to SHA-only, already-wired+already-current is a clean skip).

Judgment calls

Chesterton's Fence: wiring is folded into the same content-equality check (NEW_CONTENT == OLD_CONTENT) that gates the SHA bump, so a wiring-only change on an already-SHA-current caller still stages the file instead of being short-circuited — same intent as the original grep -qF "$NEW_SHA" early-skip this replaces, generalized.
Scope of wire_bot: deliberately conservative — flagged only where creds are provably present (existing wiring or an auto-label caller using the same app). swarmhost excluded per its own caller's note. A repo that references a missing secret would still degrade safely to github-actions[bot], but flagging one without the app would be misleading, so it's opt-in per caller.
WIRE_BOT_SCRIPT kept fleet-specific: bump-callers.sh is shared with the agents-md-integrity fleet, which has no use for bot-identity wiring — only bump-cursor-review-callers.yml sets the env var, so a stray wire_bot: true in the other fleet's variable degrades to a harmless warning instead of an error.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/32 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/16/2026 **Status:** ✅ Merged **Merged:** 7/21/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-1814-wire-bot-identity-callers` --- ### 📝 Commits (3) - [`4758456`](https://github.com/Comfy-Org/github-workflows/commit/4758456b0662ae69eaf1340acb25476bb8063928) ci(bump-callers): wire cloud-code-bot review identity into flagged callers (BE-1814) - [`72b12c1`](https://github.com/Comfy-Org/github-workflows/commit/72b12c1493d6fe25bebe7db3545b9ccc41995389) Merge origin/main into matt/be-1814-wire-bot-identity-callers - [`cd1181d`](https://github.com/Comfy-Org/github-workflows/commit/cd1181d65ba64fb4e94d5f4894e5bbe97eb71871) feat(bump-callers): teach the shared bumper the wire_bot field (BE-1814) ### 📊 Changes **5 files changed** (+415 additions, -20 deletions) <details> <summary>View changed files</summary> 📝 `.github/bump-callers/bump-callers.sh` (+56 -15) 📝 `.github/bump-callers/tests/test_bump_callers.sh` (+74 -0) ➕ `.github/cursor-review/tests/test_wire_bot_identity.py` (+131 -0) ➕ `.github/cursor-review/wire-bot-identity.py` (+133 -0) 📝 `.github/workflows/bump-cursor-review-callers.yml` (+21 -5) </details> ### 📄 Description ## ELI-5 The cursor-review bot can now post its review under a dedicated **cloud-code-bot** identity instead of the generic `github-actions[bot]` (that ability landed in Story 1.1, PR #13). Each consumer repo has to opt in by adding two lines to its thin caller: the app id (`bot_app_id`) and the paired private key secret. Rather than hand-edit every repo, this teaches the existing **caller-bump machinery** to add those two lines automatically — but only for the repos that actually hold the cloud-code-bot creds. Repos without the creds are untouched and keep posting as `github-actions[bot]`. ## What & why Story 1.3 of [BE-1800](https://linear.app/comfyorg/issue/BE-1800), refit to the existing `cloud-code-bot` creds (`vars.APP_ID` = app 2016716 / `secrets.CLOUD_CODE_BOT_PRIVATE_KEY`). No new secrets to provision — each consumer maps creds it already has. - **`.github/cursor-review/wire-bot-identity.py`** (new) — idempotently injects into a caller: - `bot_app_id: ${{ vars.APP_ID }}` as the first child of `with:` - `BOT_APP_PRIVATE_KEY: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }}` under `secrets:` It edits only those two anchors (line-based, **not** a PyYAML round-trip) so the fan-out PR diff is exactly the wiring — the callers' comments, folded `diff_excludes`, and SHA-pin lines are preserved byte-for-byte. Already-wired callers are a no-op. - **`.github/bump-callers/bump-callers.sh`** — each caller entry in the `CURSOR_REVIEW_CALLERS` repo variable gains an optional `wire_bot` field. When `true`, the caller is piped through the helper alongside the SHA bump (via `WIRE_BOT_SCRIPT`, set only by `bump-cursor-review-callers.yml` — the shared script stays fleet-agnostic, so `bump-agents-md-callers.yml` never sets it). Intended **only** for repos confirmed to hold the creds: - `cloud` + `comfy-cloud-mcp-server` — already wired by hand ⇒ injection would be a verified no-op (they still get the SHA bump). - `comfy-inapp-agent` + `Comfy-iOS` — their `cursor-review-auto-label.yml` callers already use `vars.APP_ID` + `secrets.CLOUD_CODE_BOT_PRIVATE_KEY`, so the creds are provisioned. **These are the repos this is meant to wire.** - **Not** intended: `comfy-local-mcp` / `ComfySwiftSDK` / `comfy-infra` / the public OSS repos (no cloud-code-bot creds), and **not** `swarmhost` (its own caller comment states the app isn't provisioned there yet). - **The live `CURSOR_REVIEW_CALLERS` variable does not yet flag any entry `wire_bot: true`** — this PR ships the capability; actually wiring the four repos above needs a follow-up `gh variable set` (see "How it propagates"). - Added unit tests (`tests/test_wire_bot_identity.py`, 8 cases; `test_bump_callers.sh` gains 4 `wire_bot` cases) that run under the existing CI. **Non-breaking / incremental:** both `bot_app_id` (input) and `BOT_APP_PRIVATE_KEY` (secret) are optional in the reusable workflow — a caller without them keeps posting as `github-actions[bot]`. ## How it propagates This PR gives the bump script the *capability*; wiring only lands in a consumer repo once its `CURSOR_REVIEW_CALLERS` entry is flagged `"wire_bot": true` AND the workflow runs — either on the next `cursor-review.yml` push, or via a manual **`workflow_dispatch`** after merge. Recommended sequence after merge: 1. `gh variable get CURSOR_REVIEW_CALLERS -R Comfy-Org/github-workflows` → add `"wire_bot": true` to the `comfy-inapp-agent` and `Comfy-iOS` entries (optionally `cloud` / `comfy-cloud-mcp-server` too, where it's a no-op). 2. `gh variable set CURSOR_REVIEW_CALLERS -R Comfy-Org/github-workflows --body '<updated JSON>'`. 3. `gh workflow run bump-cursor-review-callers.yml -R Comfy-Org/github-workflows` to propagate immediately. ## Verification - `python3 -m unittest discover` green across `.github/cursor-review/tests` and `.github/agents-md-integrity/tests`. - `shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh` clean. - `bash .github/bump-callers/tests/test_bump_callers.sh` — 86 passed, 0 failed (includes the 4 new `wire_bot` cases: wired end-to-end, not-flagged never wires, `WIRE_BOT_SCRIPT` unset degrades to SHA-only, already-wired+already-current is a clean skip). ## Judgment calls - **Chesterton's Fence:** wiring is folded into the same content-equality check (`NEW_CONTENT == OLD_CONTENT`) that gates the SHA bump, so a wiring-only change on an already-SHA-current caller still stages the file instead of being short-circuited — same intent as the original `grep -qF "$NEW_SHA"` early-skip this replaces, generalized. - **Scope of `wire_bot`:** deliberately conservative — flagged only where creds are provably present (existing wiring or an auto-label caller using the same app). `swarmhost` excluded per its own caller's note. A repo that references a missing secret would still degrade safely to `github-actions[bot]`, but flagging one without the app would be misleading, so it's opt-in per caller. - **`WIRE_BOT_SCRIPT` kept fleet-specific:** `bump-callers.sh` is shared with the agents-md-integrity fleet, which has no use for bot-identity wiring — only `bump-cursor-review-callers.yml` sets the env var, so a stray `wire_bot: true` in the *other* fleet's variable degrades to a harmless warning instead of an error. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:35:40 +00:00