[PR #436] ci(cursor-review): bump Cursor CLI pin to 2026.10.16-e3cb207 #438

New issue

Open

opened 2026-10-26 22:39:50 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:39:50 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/436
Author: @cloud-code-bot[bot]
Created: 10/19/2026
Status: 🔄 Open

Base: main ← Head: ci/bump-cursor-cli-pin

📝 Commits (2)

c92fc92 ci(cursor-review): bump Cursor CLI pin to 2026.10.16-e3cb207
9f46ca9 ci(cursor-approve): move cursor-axis-base.yml's Cursor CLI pin with cursor-review.yml's

📊 Changes

2 files changed (+4 additions, -4 deletions)

View changed files

📝 .github/workflows/cursor-axis-base.yml (+2 -2)
📝 .github/workflows/cursor-review.yml (+2 -2)

📄 Description

ELI5

This moves the code-review bot onto a newer release of the Cursor command-line tool. Both places that install the tool now agree on the same version and checksum, so every review job runs the exact same, verified download.

Moves the Cursor CLI pin cursor-review.yml installs from, and the identical pin cursor-axis-base.yml carries (a test keeps the two equal).


Version	`2026.10.01-e373342` → `2026.10.16-e3cb207`
sha256 (linux/x64 `agent-cli-package.tar.gz`)	`3aa3f48cd7a3909a98c9b3f2a4085f0c021088bf826690b22c61f424c843e552`
nixpkgs cross-check	not-yet-available — nixpkgs is still on `2026.10.01-e373342`
second independent download	matches — a fresh download from a separate host hashed to the same digest
smoke test	passed — `install-cursor-cli.sh` installed this artifact and the binary self-reported `2026.10.16-e3cb207`

You are the trust anchor for this digest. Cursor publishes no checksums for these artifacts, so the sha256 above is what the CDN served during this run, corroborated by one later independent download from a different host. Nothing downstream can check it further.

Merging this bumps cursor-review.yml, which triggers bump-cursor-review-callers.yml and rolls the SHA-pinned caller fleet forward.

Opened by the bump-cursor-cli-pin workflow.

Provenance

Verified:

Both pins (cursor-review.yml, cursor-axis-base.yml) carry 2026.10.16-e3cb207 / 3aa3f48c…e552.
The digest re-verified by an independent download of the linux/x64 artifact.
cursor-approve (338) and cursor-review (1732) unittest suites pass locally, including the pin-parity test that failed on the first push.
check_workflow_pins.py and the org-repo-literal lint pass.

Deviations:

The opening workflow bumped only cursor-review.yml; the cursor-axis-base.yml pin was moved in a follow-up commit by the review loop so the pin-parity test passes. The bump workflow itself still edits one file, tracked separately.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/436 **Author:** [@cloud-code-bot[bot]](https://github.com/apps/cloud-code-bot) **Created:** 10/19/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `ci/bump-cursor-cli-pin` --- ### 📝 Commits (2) - [`c92fc92`](https://github.com/Comfy-Org/github-workflows/commit/c92fc920b60bf276c5b86240ce426ca49d33d803) ci(cursor-review): bump Cursor CLI pin to 2026.10.16-e3cb207 - [`9f46ca9`](https://github.com/Comfy-Org/github-workflows/commit/9f46ca913fc8c82397217b65cb14076edc4825e8) ci(cursor-approve): move cursor-axis-base.yml's Cursor CLI pin with cursor-review.yml's ### 📊 Changes **2 files changed** (+4 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/cursor-axis-base.yml` (+2 -2) 📝 `.github/workflows/cursor-review.yml` (+2 -2) </details> ### 📄 Description ## ELI5 This moves the code-review bot onto a newer release of the Cursor command-line tool. Both places that install the tool now agree on the same version and checksum, so every review job runs the exact same, verified download. Moves the Cursor CLI pin `cursor-review.yml` installs from, and the identical pin `cursor-axis-base.yml` carries (a test keeps the two equal). | | | |---|---| | Version | `2026.10.01-e373342` → `2026.10.16-e3cb207` | | sha256 (linux/x64 `agent-cli-package.tar.gz`) | `3aa3f48cd7a3909a98c9b3f2a4085f0c021088bf826690b22c61f424c843e552` | | nixpkgs cross-check | not-yet-available — nixpkgs is still on `2026.10.01-e373342` | | second independent download | matches — a fresh download from a separate host hashed to the same digest | | smoke test | passed — `install-cursor-cli.sh` installed this artifact and the binary self-reported `2026.10.16-e3cb207` | **You are the trust anchor for this digest.** Cursor publishes no checksums for these artifacts, so the sha256 above is what the CDN served during [this run](https://github.com/Comfy-Org/github-workflows/actions/runs/39266927720), corroborated by one later independent download from a different host. Nothing downstream can check it further. Merging this bumps `cursor-review.yml`, which triggers `bump-cursor-review-callers.yml` and rolls the SHA-pinned caller fleet forward. _Opened by the `bump-cursor-cli-pin` workflow._ ## Provenance **Verified:** - Both pins (`cursor-review.yml`, `cursor-axis-base.yml`) carry `2026.10.16-e3cb207` / `3aa3f48c…e552`. - The digest re-verified by an independent download of the linux/x64 artifact. - cursor-approve (338) and cursor-review (1732) unittest suites pass locally, including the pin-parity test that failed on the first push. - `check_workflow_pins.py` and the org-repo-literal lint pass. **Deviations:** - The opening workflow bumped only `cursor-review.yml`; the `cursor-axis-base.yml` pin was moved in a follow-up commit by the review loop so the pin-parity test passes. The bump workflow itself still edits one file, tracked separately. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-26 22:39:50 +00:00