** asset changes (BE-3916) #60

New issue

Closed

opened 2026-10-26 22:35:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:35:49 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/50
Author: @mattmillerai
Created: 7/21/2026
Status: ✅ Merged
Merged: 7/21/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-3916-cursor-review-assets-trigger

📝 Commits (1)

8f6d47e ci(bump-cursor-review): trigger on .github/cursor-review/** asset changes (BE-3916)

📊 Changes

2 files changed (+7 additions, -1 deletions)

View changed files

📝 .github/bump-callers/README.md (+1 -1)
📝 .github/workflows/bump-cursor-review-callers.yml (+6 -0)

📄 Description

ELI-5

When someone edits the cursor-review workflow file, a robot automatically opens "please update your pinned version" PRs in every repo that uses it. But cursor-review's real behavior also lives in sibling scripts and prompts (.github/cursor-review/**, e.g. extract-findings.py) that consumers pull in at the exact SHA they pinned. Editing one of those scripts changes what every pinned caller runs — but the robot didn't wake up for it, so consumers silently kept running the old (possibly buggy) script. This PR makes the robot also wake up on .github/cursor-review/** changes, so a fix to a prompt/script fans out a bump PR just like a workflow-file change does.

What changed

.github/workflows/bump-cursor-review-callers.yml — added .github/cursor-review/** to the push: path filter (previously only .github/workflows/cursor-review.yml), with an inline comment explaining why. This mirrors the two sibling fleets that already do this:
- agents-md: .github/workflows/agents-md-integrity.yml + .github/agents-md-integrity/**
- pr-size: .github/workflows/pr-size.yml + scripts/check-pr-size/**
.github/bump-callers/README.md — updated the fleet table's "Triggers on a change to" cell to cursor-review.yml or cursor-review/**, matching the agents-md row's phrasing.

Why

cursor-review.yml is not self-contained: its checkout steps pull this repo's .github/cursor-review/* prompts + scripts at inputs.workflows_ref (the SHA a consumer pins). So a behavior-changing edit under .github/cursor-review/** changes what every pinned caller runs, yet did not trigger a SHA-bump PR — consumers silently stayed on the old revision. Deferred from a review thread on #35 as out of scope there.

Testing

bash .github/bump-callers/tests/test_bump_callers.sh → 88 passed, 0 failed
shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh → clean
python3 -c "import yaml; yaml.safe_load(...)" on the edited workflow → valid

No test changes needed — this is purely a trigger-path addition, not a change to bump-callers.sh.

Notes / judgment calls

The glob .github/cursor-review/** also matches tests/** and README.md, so a test-only or docs-only edit would open a bump PR. This exactly matches the sibling agents-md-integrity/** and check-pr-size/** patterns, and the bumper is idempotent (an already-pinned SHA is a clean skip), so the slight over-breadth is the accepted, consistent tradeoff.
test-bump-callers.yml did not need .github/cursor-review/** added — it runs the bump-callers unit suite and already triggers on the edited bump-cursor-review-callers.yml. The README's "add paths to test-bump-callers.yml" note is for registering a new entrypoint, not for widening an existing fleet's runtime trigger.

Closes BE-3916.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/50 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/21/2026 **Status:** ✅ Merged **Merged:** 7/21/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-3916-cursor-review-assets-trigger` --- ### 📝 Commits (1) - [`8f6d47e`](https://github.com/Comfy-Org/github-workflows/commit/8f6d47ee86c0ea730bc35212b1a2dd4000ab3fc2) ci(bump-cursor-review): trigger on .github/cursor-review/** asset changes (BE-3916) ### 📊 Changes **2 files changed** (+7 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `.github/bump-callers/README.md` (+1 -1) 📝 `.github/workflows/bump-cursor-review-callers.yml` (+6 -0) </details> ### 📄 Description ## ELI-5 When someone edits the cursor-review *workflow file*, a robot automatically opens "please update your pinned version" PRs in every repo that uses it. But cursor-review's real behavior also lives in sibling **scripts and prompts** (`.github/cursor-review/**`, e.g. `extract-findings.py`) that consumers pull in at the exact SHA they pinned. Editing one of those scripts changes what every pinned caller runs — but the robot *didn't* wake up for it, so consumers silently kept running the old (possibly buggy) script. This PR makes the robot also wake up on `.github/cursor-review/**` changes, so a fix to a prompt/script fans out a bump PR just like a workflow-file change does. ## What changed - **`.github/workflows/bump-cursor-review-callers.yml`** — added `.github/cursor-review/**` to the `push:` path filter (previously only `.github/workflows/cursor-review.yml`), with an inline comment explaining why. This mirrors the two sibling fleets that already do this: - agents-md: `.github/workflows/agents-md-integrity.yml` **+ `.github/agents-md-integrity/**`** - pr-size: `.github/workflows/pr-size.yml` **+ `scripts/check-pr-size/**`** - **`.github/bump-callers/README.md`** — updated the fleet table's "Triggers on a change to" cell to `cursor-review.yml` or `cursor-review/**`, matching the agents-md row's phrasing. ## Why `cursor-review.yml` is not self-contained: its checkout steps pull this repo's `.github/cursor-review/*` prompts + scripts at `inputs.workflows_ref` (the SHA a consumer pins). So a behavior-changing edit under `.github/cursor-review/**` changes what every pinned caller runs, yet did not trigger a SHA-bump PR — consumers silently stayed on the old revision. Deferred from a review thread on #35 as out of scope there. ## Testing - `bash .github/bump-callers/tests/test_bump_callers.sh` → **88 passed, 0 failed** - `shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh` → clean - `python3 -c "import yaml; yaml.safe_load(...)"` on the edited workflow → valid No test changes needed — this is purely a trigger-path addition, not a change to `bump-callers.sh`. ## Notes / judgment calls - The glob `.github/cursor-review/**` also matches `tests/**` and `README.md`, so a test-only or docs-only edit would open a bump PR. This exactly matches the sibling `agents-md-integrity/**` and `check-pr-size/**` patterns, and the bumper is idempotent (an already-pinned SHA is a clean skip), so the slight over-breadth is the accepted, consistent tradeoff. - `test-bump-callers.yml` did **not** need `.github/cursor-review/**` added — it runs the *bump-callers* unit suite and already triggers on the edited `bump-cursor-review-callers.yml`. The README's "add paths to `test-bump-callers.yml`" note is for registering a *new* entrypoint, not for widening an existing fleet's runtime trigger. Closes BE-3916. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:35:49 +00:00