diff --git a/.github/bump-callers/README.md b/.github/bump-callers/README.md index 5700d1c..f37b549 100644 --- a/.github/bump-callers/README.md +++ b/.github/bump-callers/README.md @@ -7,7 +7,7 @@ forward automatically instead of silently drifting commits behind. - **`bump-callers.sh`** — the one, fleet-agnostic bump script (parse the caller list, mask private repo names, rewrite the pin, keep one bump PR per caller - current). It is the single source of truth; the two workflow entrypoints are + current). It is the single source of truth; the workflow entrypoints are thin wrappers that only supply per-fleet parameters. A forked copy is how other shared machinery in the org has drifted — this stays one file on purpose. - **One open bump PR per (repo, fleet), updated in place.** The head branch is @@ -19,17 +19,22 @@ forward automatically instead of silently drifting commits behind. - **`tests/`** — a `bash` functional suite (stubs `gh`, no network), run by [`test-bump-callers.yml`](../workflows/test-bump-callers.yml) plus shellcheck. -## The two fleets +## The fleets | Entrypoint | Triggers on a change to | Caller variable | Seeded | |---|---|---|---| | [`bump-cursor-review-callers.yml`](../workflows/bump-cursor-review-callers.yml) | `cursor-review.yml` | `CURSOR_REVIEW_CALLERS` | non-empty (hard-fails if empty) | | [`bump-agents-md-callers.yml`](../workflows/bump-agents-md-callers.yml) | `agents-md-integrity.yml` or `agents-md-integrity/**` | `AGENTS_MD_CALLERS` | empty `[]` (grows as callers land) | - -They stay as two thin entrypoints rather than one matrix because their triggers -differ: a `cursor-review.yml` change must not spuriously bump agents-md callers, -and vice versa. Everything else (masking, the PR-per-caller flow, the trailing- -newline fix, the single-line PR body) lives once in `bump-callers.sh`. +| [`bump-pr-size-callers.yml`](../workflows/bump-pr-size-callers.yml) | `pr-size.yml` | `PR_SIZE_CALLERS` | empty `[]` (grows as callers land) | + +They stay as thin entrypoints rather than one matrix because their triggers +differ: a `cursor-review.yml` change must not spuriously bump agents-md or +pr-size callers, and vice versa. Everything else (masking, the PR-per-caller +flow, the trailing-newline fix, the single-line PR body) lives once in +`bump-callers.sh`. Registering a new fleet is: add a thin entrypoint (copy an +existing one, swap the path filter + `VAR_NAME`/`TAG`/`WORKFLOW_FILE`/ +`ALLOW_EMPTY`), seed its variable, and add a row to this table + the paths in +`test-bump-callers.yml`. ## The caller variables diff --git a/.github/bump-callers/bump-callers.sh b/.github/bump-callers/bump-callers.sh index bd86b06..d0eea72 100755 --- a/.github/bump-callers/bump-callers.sh +++ b/.github/bump-callers/bump-callers.sh @@ -5,11 +5,12 @@ # When a reusable workflow (e.g. cursor-review.yml or agents-md-integrity.yml) # is updated on main, this opens a SHA-bump PR in every repo that pins a caller # against it. It is fleet-agnostic: the thin workflow entrypoints -# (bump-cursor-review-callers.yml, bump-agents-md-callers.yml) invoke it with a -# different caller list, human tag, and reusable-workflow filename. There is ONE -# implementation so the two fleets cannot drift apart (a forked copy is how -# other shared machinery in the org has rotted); the entrypoints differ only in -# their path-filter triggers and the parameters below. +# (bump-cursor-review-callers.yml, bump-agents-md-callers.yml, +# bump-pr-size-callers.yml) invoke it with a different caller list, human tag, +# and reusable-workflow filename. There is ONE implementation so the fleets +# cannot drift apart (a forked copy is how other shared machinery in the org +# has rotted); the entrypoints differ only in their path-filter triggers and +# the parameters below. # # This repo is PUBLIC (both the workflow files and the Actions run logs are # publicly viewable) and most callers are private, so caller names must never diff --git a/.github/workflows/bump-agents-md-callers.yml b/.github/workflows/bump-agents-md-callers.yml index eadf825..4f58dc1 100644 --- a/.github/workflows/bump-agents-md-callers.yml +++ b/.github/workflows/bump-agents-md-callers.yml @@ -39,6 +39,9 @@ on: - .github/workflows/agents-md-integrity.yml - .github/agents-md-integrity/** +permissions: + contents: read + # Serialize runs of this fleet. The bumper now pushes to a STABLE branch # (ci/bump-agents-md-integrity) shared across runs, so two overlapping runs (a # rapid second main push, or a push racing a manual re-run) would force-reset diff --git a/.github/workflows/bump-cursor-review-callers.yml b/.github/workflows/bump-cursor-review-callers.yml index 0524c6a..b0769b2 100644 --- a/.github/workflows/bump-cursor-review-callers.yml +++ b/.github/workflows/bump-cursor-review-callers.yml @@ -33,6 +33,9 @@ on: paths: - .github/workflows/cursor-review.yml +permissions: + contents: read + # Serialize runs of this fleet. The bumper now pushes to a STABLE branch # (ci/bump-cursor-review) shared across runs, so two overlapping runs (a rapid # second main push, or a push racing a manual re-run) would force-reset that diff --git a/.github/workflows/bump-pr-size-callers.yml b/.github/workflows/bump-pr-size-callers.yml new file mode 100644 index 0000000..2234dae --- /dev/null +++ b/.github/workflows/bump-pr-size-callers.yml @@ -0,0 +1,86 @@ +name: Bump pr-size callers + +# When the pr-size reusable workflow is updated on main, open a SHA-bump PR in +# every repo that pins a caller against it. PRs are opened by Cloud Code Bot so +# they are easy to filter and merge. +# +# This is a thin entrypoint over the shared bumper at +# .github/bump-callers/bump-callers.sh — the same script drives the +# cursor-review and agents-md-integrity caller fleets (bump-cursor-review- +# callers.yml, bump-agents-md-callers.yml). Keeping ONE implementation is +# deliberate: a forked copy is how other shared machinery in the org has +# drifted. The entrypoints differ only in their path-filter trigger and the +# three parameters passed below. (They stay separate rather than a single +# matrix because their triggers differ — a pr-size.yml change must not +# spuriously bump the other fleets' callers, and vice versa.) +# +# The caller list is NOT hardcoded here. This repo is PUBLIC (workflow file and +# Actions run logs are both publicly viewable), and most callers are private, so +# their names must never appear in this file or its logs. The list lives in the +# repo-level Actions variable `PR_SIZE_CALLERS` (config, not a credential — a +# variable, not a secret, since secrets are write-only via the API) as a JSON +# array of {"repo","file","label"} objects, same shape as the other fleets' +# variables. Every repo name is `::add-mask::`ed out of the (public) run logs +# before it is ever echoed. The variable is seeded EMPTY (`[]`) — an empty list +# is a clean no-op here (ALLOW_EMPTY below); the rollout's per-repo caller +# tickets add entries as callers land. +# +# Update flow — adding/removing a caller needs NO public commit: +# gh variable set PR_SIZE_CALLERS --repo Comfy-Org/github-workflows \ +# --body "$(jq -c . callers.json)" +# Keep the canonical callers.json in a PRIVATE infra/ops repo so variable edits +# have a reviewed source of truth; the org audit log records each edit. (The +# specific home repo is intentionally not named here — this file is public.) + +on: + workflow_dispatch: {} # allow on-demand runs (e.g. to re-bump callers) + push: + branches: [main] + paths: + - .github/workflows/pr-size.yml + +permissions: + contents: read + +# Serialize runs of this fleet. The bumper now pushes to a STABLE branch +# (ci/bump-pr-size) shared across runs, so two overlapping runs (a rapid second +# main push, or a push racing a manual re-run) would force-reset that branch +# and race the PR update — an older run finishing last could leave the +# committed diff pinned to a stale SHA. cancel-in-progress: false lets the +# running bump finish; GitHub keeps only the newest pending run, so the latest +# SHA always wins (BE-3882). +concurrency: + group: bump-pr-size-callers + cancel-in-progress: false + +jobs: + bump: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + with: + persist-credentials: false + + - name: Generate Cloud Code Bot token + uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 + id: token + with: + app-id: ${{ vars.APP_ID }} + private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }} + owner: Comfy-Org + + - name: Bump SHA in caller repos + env: + GH_TOKEN: ${{ steps.token.outputs.token }} + NEW_SHA: ${{ github.sha }} + VAR_NAME: PR_SIZE_CALLERS + TAG: pr-size + WORKFLOW_FILE: pr-size.yml + # Seeded empty; an empty list is a clean no-op, not an error. + ALLOW_EMPTY: "true" + # JSON array of {"repo","file","label"} — see the header comment for the + # update flow. Kept in a variable (not the file) so private caller names + # never land in this public repo or its logs. + CALLERS_JSON: ${{ vars.PR_SIZE_CALLERS }} + run: bash .github/bump-callers/bump-callers.sh diff --git a/.github/workflows/test-bump-callers.yml b/.github/workflows/test-bump-callers.yml index a07bede..d50e021 100644 --- a/.github/workflows/test-bump-callers.yml +++ b/.github/workflows/test-bump-callers.yml @@ -2,10 +2,10 @@ name: Test bump-callers script # Runs the functional tests + shellcheck for the shared caller-bump script # (.github/bump-callers/bump-callers.sh). That one script drives the SHA-bump -# fan-out for BOTH the cursor-review and agents-md-integrity caller fleets, so a -# regression here silently breaks every consumer repo's pin auto-bump (or, worse, -# leaks a private caller name into this public repo's run logs) — cheap to guard -# with a unit run on change. Mirrors test-cursor-review-scripts.yml / +# fan-out for the cursor-review, agents-md-integrity, AND pr-size caller fleets, +# so a regression here silently breaks every consumer repo's pin auto-bump (or, +# worse, leaks a private caller name into this public repo's run logs) — cheap +# to guard with a unit run on change. Mirrors test-cursor-review-scripts.yml / # test-agents-md-integrity.yml. on: @@ -14,6 +14,7 @@ on: - '.github/bump-callers/**' - '.github/workflows/bump-cursor-review-callers.yml' - '.github/workflows/bump-agents-md-callers.yml' + - '.github/workflows/bump-pr-size-callers.yml' - '.github/workflows/test-bump-callers.yml' push: branches: [main] @@ -21,6 +22,7 @@ on: - '.github/bump-callers/**' - '.github/workflows/bump-cursor-review-callers.yml' - '.github/workflows/bump-agents-md-callers.yml' + - '.github/workflows/bump-pr-size-callers.yml' - '.github/workflows/test-bump-callers.yml' permissions: diff --git a/AGENTS.md b/AGENTS.md index aca9a33..1a59db9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -61,8 +61,9 @@ tests — run the matching command above for whatever you touched. - `assign-reviewers.yml` — expertise-aware, load-balanced reviewer requests. - `assign-prs-to-author.yml` — assigns unassigned open PRs to their author. - `detect-unreviewed-merge.yml` — SOC 2: flags PRs merged without approval. -- `bump-cursor-review-callers.yml` / `bump-agents-md-callers.yml` — thin - entrypoints over `bump-callers.sh` that fan SHA bumps out to consumers. +- `bump-cursor-review-callers.yml` / `bump-agents-md-callers.yml` / + `bump-pr-size-callers.yml` — thin entrypoints over `bump-callers.sh` that fan + SHA bumps out to consumers. ## Conventions & gotchas @@ -80,10 +81,11 @@ tests — run the matching command above for whatever you touched. self-enrollment callers (`ci-cursor-review.yml`, `ci-detect-unreviewed-merge.yml`) deliberately pin a merged-main SHA instead of a local `./` path for the same reason — do not "simplify" them to a local path. -- **One bumper, not two.** `bump-callers.sh` backs both fleets; the two +- **One bumper, not several.** `bump-callers.sh` backs every fleet; the `bump-*-callers.yml` files are thin per-fleet wrappers (they stay separate so a - `cursor-review.yml` change doesn't spuriously bump agents-md callers). Do not - fork the script — a forked copy is how other shared org machinery has drifted. + `cursor-review.yml` change doesn't spuriously bump agents-md or pr-size + callers). Do not fork the script — a forked copy is how other shared org + machinery has drifted. - **New reusable workflow?** `on: workflow_call` + a header comment documenting inputs/secrets/triggers + a caller-pattern example, then update the README table (README "Adding a new reusable workflow"). Move the floating major tag @@ -105,4 +107,4 @@ tests — run the matching command above for whatever you touched. - [`README.md`](README.md) — public catalog, SHA-pin usage, versioning. - [`.github/cursor-review/README.md`](.github/cursor-review/README.md) — review panel internals + adoption. - [`.github/agents-md-integrity/README.md`](.github/agents-md-integrity/README.md) — the checker + its knobs. -- [`.github/bump-callers/README.md`](.github/bump-callers/README.md) — the shared bumper + the two fleets. +- [`.github/bump-callers/README.md`](.github/bump-callers/README.md) — the shared bumper + its fleets.