[PR #37] [MERGED] ci: enroll this repo in its own cursor-review and unreviewed-merge gates #46

New issue

Closed

opened 2026-10-26 22:35:42 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:35:42 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/37
Author: @mattmillerai
Created: 7/19/2026
Status: ✅ Merged
Merged: 7/19/2026
Merged by: @mattmillerai

Base: main ← Head: self-enroll-ci-gates

📝 Commits (2)

2fd96a9 ci: enroll this repo in its own cursor-review and unreviewed-merge gates
f301ba6 ci: label-trigger the self-caller; add run_without_label input to the reusable gate

📊 Changes

3 files changed (+103 additions, -0 deletions)

View changed files

➕ .github/workflows/ci-cursor-review.yml (+46 -0)
➕ .github/workflows/ci-detect-unreviewed-merge.yml (+32 -0)
📝 .github/workflows/cursor-review.yml (+25 -0)

📄 Description

What

github-workflows ships the org's cursor-review panel, its unreviewed-merge detector, and (since #34) the AGENTS.md integrity check — and consumed none of them on itself. PRs here (e.g. #34, #36) merge with no AI review, no approval requirement, and no compliance trail, in the one repo whose files become every other repo's required checks. This enrolls the repo in its own gates:

ci-cursor-review.yml — SHA-pinned to this repo's own merged main, exactly like an external consumer. A local uses: ./… path would run the PR's own copy of the reviewer, letting a PR weaken the panel judging it — pinning keeps the reviewer tamper-proof. Label-triggered for now (the pinned gate only honors label events — verified live on this PR's first push, where a direct trigger ran the shell and skipped the panel).
cursor-review.yml gains an opt-in run_without_label input (default false — zero change for existing callers): plain PR events fire the panel, with the fork skip, skip-cursor-review veto, and same-commit dedupe still applying. Once the auto-bump advances this repo's own pin past this merge, the bump PR should flip the caller to run_without_label: true and widen its trigger types (noted in the caller header) — this repo has no labeling automation.
ci-detect-unreviewed-merge.yml — verbatim copy of the canonical template from Comfy-Org/unreviewed-merges/detector/, renamed because the canonical filename is occupied here by the reusable itself. Operator step remaining: provision secrets.UNREVIEWED_MERGES_TOKEN — until then the job fails loudly on pushes to main (deliberate: enrollment should never be silently inert).

Housekeeping already done outside this PR: CURSOR_API_KEY repo secret provisioned; repo added to CURSOR_REVIEW_CALLERS (13 entries).

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/37 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/19/2026 **Status:** ✅ Merged **Merged:** 7/19/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `self-enroll-ci-gates` --- ### 📝 Commits (2) - [`2fd96a9`](https://github.com/Comfy-Org/github-workflows/commit/2fd96a90acecd11a54157036b1094ea17a62beaf) ci: enroll this repo in its own cursor-review and unreviewed-merge gates - [`f301ba6`](https://github.com/Comfy-Org/github-workflows/commit/f301ba644068efde9bf1098fbed62b7c98242a23) ci: label-trigger the self-caller; add run_without_label input to the reusable gate ### 📊 Changes **3 files changed** (+103 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `.github/workflows/ci-cursor-review.yml` (+46 -0) ➕ `.github/workflows/ci-detect-unreviewed-merge.yml` (+32 -0) 📝 `.github/workflows/cursor-review.yml` (+25 -0) </details> ### 📄 Description ## What github-workflows ships the org's cursor-review panel, its unreviewed-merge detector, and (since #34) the AGENTS.md integrity check — and consumed none of them on itself. PRs here (e.g. #34, #36) merge with no AI review, no approval requirement, and no compliance trail, in the one repo whose files become every other repo's required checks. This enrolls the repo in its own gates: - **`ci-cursor-review.yml`** — SHA-pinned to this repo's own merged main, exactly like an external consumer. A local `uses: ./…` path would run the PR's **own** copy of the reviewer, letting a PR weaken the panel judging it — pinning keeps the reviewer tamper-proof. Label-triggered for now (the pinned gate only honors label events — verified live on this PR's first push, where a direct trigger ran the shell and skipped the panel). - **`cursor-review.yml` gains an opt-in `run_without_label` input** (default false — zero change for existing callers): plain PR events fire the panel, with the fork skip, `skip-cursor-review` veto, and same-commit dedupe still applying. Once the auto-bump advances this repo's own pin past this merge, the bump PR should flip the caller to `run_without_label: true` and widen its trigger types (noted in the caller header) — this repo has no labeling automation. - **`ci-detect-unreviewed-merge.yml`** — verbatim copy of the canonical template from `Comfy-Org/unreviewed-merges/detector/`, renamed because the canonical filename is occupied here by the reusable itself. **Operator step remaining: provision `secrets.UNREVIEWED_MERGES_TOKEN`** — until then the job fails loudly on pushes to main (deliberate: enrollment should never be silently inert). Housekeeping already done outside this PR: `CURSOR_API_KEY` repo secret provisioned; repo added to `CURSOR_REVIEW_CALLERS` (13 entries). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:35:42 +00:00