[PR #38] [MERGED] ci(bump-callers): generalize caller SHA-bump to the agents-md-integrity fleet #50

New issue

Closed

opened 2026-10-26 22:35:44 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:35:44 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/38
Author: @mattmillerai
Created: 7/19/2026
Status: ✅ Merged
Merged: 7/19/2026
Merged by: @mattmillerai

Base: main ← Head: matt/generalize-caller-bump

📝 Commits (1)

3d27c92 ci(bump-callers): generalize caller SHA-bump to the agents-md-integrity fleet

📊 Changes

6 files changed (+548 additions, -129 deletions)

View changed files

➕ .github/bump-callers/README.md (+45 -0)
➕ .github/bump-callers/bump-callers.sh (+185 -0)
➕ .github/bump-callers/tests/test_bump_callers.sh (+187 -0)
➕ .github/workflows/bump-agents-md-callers.yml (+72 -0)
📝 .github/workflows/bump-cursor-review-callers.yml (+16 -129)
➕ .github/workflows/test-bump-callers.yml (+43 -0)

📄 Description

ELI-5

We have a robot that, whenever we update our shared cursor-review workflow,
automatically opens a "please update your pinned version" PR in every repo that
uses it. This teaches that same robot a second trick: do the exact same thing for
the new agents-md-integrity workflow. Instead of copy-pasting the robot (copies
drift apart over time), both jobs now share one script; each just hands it a
different list of repos and a couple of labels.

What & why

bump-cursor-review-callers.yml auto-bumps SHA-pinned cursor-review callers
across repos listed in the CURSOR_REVIEW_CALLERS repo variable. The
agents-md-integrity reusable workflow is about to grow its own caller fleet
(~15–30 repos), and SHA-pinned callers rot without an auto-bump — the
cursor-review pins alone needed two manual bump PRs in a single day.

This generalizes the bump machinery so both fleets are driven by one shared
script, .github/bump-callers/bump-callers.sh, with two thin workflow
entrypoints that supply per-fleet parameters (caller variable, human tag,
reusable-workflow filename):

Entrypoint	Triggers on	Caller variable	Empty list
`bump-cursor-review-callers.yml`	`cursor-review.yml`	`CURSOR_REVIEW_CALLERS`	hard error
`bump-agents-md-callers.yml` (new)	`agents-md-integrity.yml` or `.github/agents-md-integrity/**`	`AGENTS_MD_CALLERS`	clean no-op

Judgment calls

One script, two entrypoints (not a matrix). The ticket preferred a single
parameterized implementation but explicitly allowed two thin entrypoints when
the path-filter triggers differ. They genuinely differ here, and — more
importantly — a unified trigger would spuriously cross-bump (a cursor-review.yml
change would open no-op PRs against agents-md callers, and vice versa). So the
shared logic lives once in bump-callers.sh; the two entrypoints differ only in
trigger + parameters. This is the anti-drift shape the ticket asked for.
CURSOR_REVIEW_CALLERS behavior is preserved byte-for-byte — same branch
name, commit message, PR title/body, sed pin+comment rewrite, ::add-mask::
masking, the trailing-newline restore, and the single-line PR body. The only
mechanical change to that path is that the (previously inline) logic now lives
in the checked-out script, so the entrypoint gained an actions/checkout step.
AGENTS_MD_CALLERS is seeded empty ([]). I set the repo variable directly
(config, not code — harmless additive []). An empty/absent list is a clean
no-op for this fleet (ALLOW_EMPTY=true), so the workflow is safe to run before
any callers exist; the rollout's per-repo caller tickets add entries as callers
land. The must-always-have-callers cursor-review fleet still hard-fails on empty
(guards against a silent no-op dispatcher).
The shared pin-comment rewrite is a no-op for agents-md callers. agents-md
callers pin with a # v1 comment (not the # github-workflows#NN form the
cursor-review callers use), so the shared comment-normalize sed simply doesn't
match and leaves # v1 intact — verified in the tests.

Tests

New test-bump-callers.yml runs shellcheck + a bash functional suite that stubs
gh (no network) and asserts: both caller variables parse, private repo names are
masked out of the (public) run logs, the caller's pinned SHA is rewritten (both
SHA refs for agents-md), the pin comment is normalized while # v1 is preserved,
the committed file keeps exactly one trailing newline, and the empty (no-op vs
hard-fail) and malformed guards fire. All 25 assertions pass locally; shellcheck
clean.

Per this public repo's convention, no tracker references in the title/body/commits.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/38 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/19/2026 **Status:** ✅ Merged **Merged:** 7/19/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/generalize-caller-bump` --- ### 📝 Commits (1) - [`3d27c92`](https://github.com/Comfy-Org/github-workflows/commit/3d27c9218023907951beaa68be2966450e5895a3) ci(bump-callers): generalize caller SHA-bump to the agents-md-integrity fleet ### 📊 Changes **6 files changed** (+548 additions, -129 deletions) <details> <summary>View changed files</summary> ➕ `.github/bump-callers/README.md` (+45 -0) ➕ `.github/bump-callers/bump-callers.sh` (+185 -0) ➕ `.github/bump-callers/tests/test_bump_callers.sh` (+187 -0) ➕ `.github/workflows/bump-agents-md-callers.yml` (+72 -0) 📝 `.github/workflows/bump-cursor-review-callers.yml` (+16 -129) ➕ `.github/workflows/test-bump-callers.yml` (+43 -0) </details> ### 📄 Description ## ELI-5 We have a robot that, whenever we update our shared `cursor-review` workflow, automatically opens a "please update your pinned version" PR in every repo that uses it. This teaches that same robot a second trick: do the exact same thing for the new `agents-md-integrity` workflow. Instead of copy-pasting the robot (copies drift apart over time), both jobs now share **one** script; each just hands it a different list of repos and a couple of labels. ## What & why `bump-cursor-review-callers.yml` auto-bumps SHA-pinned cursor-review callers across repos listed in the `CURSOR_REVIEW_CALLERS` repo variable. The `agents-md-integrity` reusable workflow is about to grow its own caller fleet (~15–30 repos), and SHA-pinned callers rot without an auto-bump — the cursor-review pins alone needed two manual bump PRs in a single day. This generalizes the bump machinery so both fleets are driven by **one** shared script, `.github/bump-callers/bump-callers.sh`, with two thin workflow entrypoints that supply per-fleet parameters (caller variable, human tag, reusable-workflow filename): | Entrypoint | Triggers on | Caller variable | Empty list | |---|---|---|---| | `bump-cursor-review-callers.yml` | `cursor-review.yml` | `CURSOR_REVIEW_CALLERS` | hard error | | `bump-agents-md-callers.yml` (new) | `agents-md-integrity.yml` or `.github/agents-md-integrity/**` | `AGENTS_MD_CALLERS` | clean no-op | ## Judgment calls - **One script, two entrypoints (not a matrix).** The ticket preferred a single parameterized implementation but explicitly allowed two thin entrypoints when the path-filter triggers differ. They genuinely differ here, and — more importantly — a unified trigger would spuriously cross-bump (a `cursor-review.yml` change would open no-op PRs against agents-md callers, and vice versa). So the shared logic lives once in `bump-callers.sh`; the two entrypoints differ only in trigger + parameters. This is the anti-drift shape the ticket asked for. - **`CURSOR_REVIEW_CALLERS` behavior is preserved byte-for-byte** — same branch name, commit message, PR title/body, `sed` pin+comment rewrite, `::add-mask::` masking, the trailing-newline restore, and the single-line PR body. The only mechanical change to that path is that the (previously inline) logic now lives in the checked-out script, so the entrypoint gained an `actions/checkout` step. - **`AGENTS_MD_CALLERS` is seeded empty (`[]`).** I set the repo variable directly (config, not code — harmless additive `[]`). An empty/absent list is a clean no-op for this fleet (`ALLOW_EMPTY=true`), so the workflow is safe to run before any callers exist; the rollout's per-repo caller tickets add entries as callers land. The must-always-have-callers cursor-review fleet still hard-fails on empty (guards against a silent no-op dispatcher). - **The shared pin-comment rewrite is a no-op for agents-md callers.** agents-md callers pin with a `# v1` comment (not the `# github-workflows#NN` form the cursor-review callers use), so the shared comment-normalize `sed` simply doesn't match and leaves `# v1` intact — verified in the tests. ## Tests New `test-bump-callers.yml` runs shellcheck + a `bash` functional suite that stubs `gh` (no network) and asserts: both caller variables parse, private repo names are masked out of the (public) run logs, the caller's pinned SHA is rewritten (both SHA refs for agents-md), the pin comment is normalized while `# v1` is preserved, the committed file keeps exactly one trailing newline, and the empty (no-op vs hard-fail) and malformed guards fire. All 25 assertions pass locally; shellcheck clean. Per this public repo's convention, no tracker references in the title/body/commits. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:35:44 +00:00