[PR #62] [MERGED] ci(bump-callers): bring sibling entrypoints to parity with hardened auto-label bumper (BE-4058) #75

New issue

Closed

opened 2026-10-26 22:35:57 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:35:57 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/62
Author: @mattmillerai
Created: 7/22/2026
Status: ✅ Merged
Merged: 7/26/2026
Merged by: @mattmillerai

Base: main ← Head: matt/be-4058-bump-callers-parity

📝 Commits (2)

9a88de9 ci(bump-callers): bring sibling entrypoints to parity with hardened auto-label bumper (BE-4058)
069c36d ci(bump-callers): skip stale re-runs + treat asset-dir deletion as decommission (BE-4058)

📊 Changes

4 files changed (+116 additions, -8 deletions)

View changed files

📝 .github/workflows/bump-agents-md-callers.yml (+29 -2)
📝 .github/workflows/bump-assign-reviewers-callers.yml (+29 -2)
📝 .github/workflows/bump-cursor-review-callers.yml (+29 -2)
📝 .github/workflows/bump-pr-size-callers.yml (+29 -2)

📄 Description

ELI-5

We have five little robots that, whenever one of our shared workflow files changes, go tell every repo that uses it "hey, update to the new version." The newest robot (PR #60) got three safety upgrades after its review; the four older robots never got them. This PR gives the same three upgrades to the older four, copied word-for-word from the new one: (1) they now fetch their tools from an exact, tamper-proof address instead of a movable label; (2) they refuse to run if someone accidentally starts them from an old copy of the code (which would push everyone backwards); (3) if the file they announce got deleted, they say "nothing to announce" and stop instead of telling every repo to use a file that no longer exists.

What

Mirrors the three hardenings from commit 89e3110 (bump-cursor-review-auto-label-callers.yml, PR #60's review panel) onto the four pre-existing sibling entrypoints — bump-cursor-review-callers.yml, bump-agents-md-callers.yml, bump-pr-size-callers.yml, bump-assign-reviewers-callers.yml — with the exact comments/idiom from the reference:

SHA-pin the checkout step — bare actions/checkout@v6 → actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3, per the repo's own AGENTS.md pin-by-SHA policy. Tag→commit mapping independently verified via the GitHub API (v6.0.3 annotated tag dereferences to df4cb1c...); same pin already used by pr-size.yml and PR #60.
Main-only job guard — if: github.ref == 'refs/heads/main' on the bump job. All siblings gained workflow_dispatch in #15 and set NEW_SHA: ${{ github.sha }}; a manual dispatch from a non-main/older ref would pin every caller to that stale SHA (the bumper force-resets a stable shared ci/bump-* branch, so an old-ref run can overwrite a newer bump and downgrade consumers) and would run bump-callers.sh from an unreviewed ref with the freshly minted App token. The push trigger is already main-only, so this only skips stray manual runs.
Deletion no-op guard — each fleet's push path filter also matches a commit that DELETES its reusable workflow, which would open caller PRs pinned to a SHA where the referenced file no longer exists. The run step now checks the fleet's WORKFLOW_FILE at the checked-out SHA and exits 0 ("absent at this SHA — decommissioned; nothing to bump") before invoking bump-callers.sh.

bump-callers.sh and its tests are untouched — workflow-YAML only, as the ticket scopes.

Verification

shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh — clean
bash .github/bump-callers/tests/test_bump_callers.sh — 88 passed, 0 failed
All four YAML files parse (yaml.safe_load)
v6.0.3 tag→commit mapping verified live against actions/checkout (annotated tag 9f69817 → commit df4cb1c...)

Judgment calls / notes

Not stacked on #60. The reference file lives on #60's still-open branch, but this PR only edits the four siblings on main — no file overlap, so it's based on main and merges independently in either order.
Deletion guard checks the workflow file only, not asset dirs. For fleets whose path filter also watches an asset dir (.github/cursor-review/**, scripts/check-pr-size/**), an asset-dir-only deletion with the workflow file still present still bumps — correct, since callers reference the workflow file, and this matches the ticket's "if the fleet's WORKFLOW_FILE is absent" spec and the 89e3110 idiom.
Out of scope, noting for the record: other workflows in this repo (cursor-review.yml, agents-md-integrity.yml, several test-*.yml) still use bare actions/checkout@v6 / setup-python@v6. The ticket scopes this PR to the four bump entrypoints; the rest would be a separate sweep.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/62 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/22/2026 **Status:** ✅ Merged **Merged:** 7/26/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/be-4058-bump-callers-parity` --- ### 📝 Commits (2) - [`9a88de9`](https://github.com/Comfy-Org/github-workflows/commit/9a88de9b9069332001321424ead565f847de4100) ci(bump-callers): bring sibling entrypoints to parity with hardened auto-label bumper (BE-4058) - [`069c36d`](https://github.com/Comfy-Org/github-workflows/commit/069c36d50bd04f2842d06fabbb51d44789380f12) ci(bump-callers): skip stale re-runs + treat asset-dir deletion as decommission (BE-4058) ### 📊 Changes **4 files changed** (+116 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/bump-agents-md-callers.yml` (+29 -2) 📝 `.github/workflows/bump-assign-reviewers-callers.yml` (+29 -2) 📝 `.github/workflows/bump-cursor-review-callers.yml` (+29 -2) 📝 `.github/workflows/bump-pr-size-callers.yml` (+29 -2) </details> ### 📄 Description ## ELI-5 We have five little robots that, whenever one of our shared workflow files changes, go tell every repo that uses it "hey, update to the new version." The newest robot (PR #60) got three safety upgrades after its review; the four older robots never got them. This PR gives the same three upgrades to the older four, copied word-for-word from the new one: (1) they now fetch their tools from an exact, tamper-proof address instead of a movable label; (2) they refuse to run if someone accidentally starts them from an old copy of the code (which would push everyone backwards); (3) if the file they announce got deleted, they say "nothing to announce" and stop instead of telling every repo to use a file that no longer exists. ## What Mirrors the three hardenings from commit 89e3110 (`bump-cursor-review-auto-label-callers.yml`, PR #60's review panel) onto the four pre-existing sibling entrypoints — `bump-cursor-review-callers.yml`, `bump-agents-md-callers.yml`, `bump-pr-size-callers.yml`, `bump-assign-reviewers-callers.yml` — with the exact comments/idiom from the reference: 1. **SHA-pin the checkout step** — bare `actions/checkout@v6` → `actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3`, per the repo's own AGENTS.md pin-by-SHA policy. Tag→commit mapping independently verified via the GitHub API (`v6.0.3` annotated tag dereferences to `df4cb1c...`); same pin already used by `pr-size.yml` and PR #60. 2. **Main-only job guard** — `if: github.ref == 'refs/heads/main'` on the `bump` job. All siblings gained `workflow_dispatch` in #15 and set `NEW_SHA: ${{ github.sha }}`; a manual dispatch from a non-main/older ref would pin every caller to that stale SHA (the bumper force-resets a stable shared `ci/bump-*` branch, so an old-ref run can overwrite a newer bump and downgrade consumers) and would run `bump-callers.sh` from an unreviewed ref with the freshly minted App token. The push trigger is already main-only, so this only skips stray manual runs. 3. **Deletion no-op guard** — each fleet's push path filter also matches a commit that DELETES its reusable workflow, which would open caller PRs pinned to a SHA where the referenced file no longer exists. The run step now checks the fleet's `WORKFLOW_FILE` at the checked-out SHA and exits 0 ("absent at this SHA — decommissioned; nothing to bump") before invoking `bump-callers.sh`. `bump-callers.sh` and its tests are untouched — workflow-YAML only, as the ticket scopes. ## Verification - `shellcheck -x .github/bump-callers/bump-callers.sh .github/bump-callers/tests/test_bump_callers.sh` — clean - `bash .github/bump-callers/tests/test_bump_callers.sh` — 88 passed, 0 failed - All four YAML files parse (`yaml.safe_load`) - `v6.0.3` tag→commit mapping verified live against `actions/checkout` (annotated tag `9f69817` → commit `df4cb1c...`) ## Judgment calls / notes - **Not stacked on #60.** The reference file lives on #60's still-open branch, but this PR only edits the four siblings on `main` — no file overlap, so it's based on `main` and merges independently in either order. - **Deletion guard checks the workflow file only, not asset dirs.** For fleets whose path filter also watches an asset dir (`.github/cursor-review/**`, `scripts/check-pr-size/**`), an asset-dir-only deletion with the workflow file still present still bumps — correct, since callers reference the workflow file, and this matches the ticket's "if the fleet's WORKFLOW_FILE is absent" spec and the 89e3110 idiom. - **Out of scope, noting for the record:** other workflows in this repo (`cursor-review.yml`, `agents-md-integrity.yml`, several `test-*.yml`) still use bare `actions/checkout@v6` / `setup-python@v6`. The ticket scopes this PR to the four bump entrypoints; the rest would be a separate sweep. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:35:57 +00:00