feat: reusable PR-size cap workflow with per-repo inputs

[mattmillerai]

ELI-5

Big PRs are hard to review well, so we have a CI check (built for the cloud repo) that fails a PR when it changes too many lines of hand-written code — generated files and lockfiles don't count, and a label lets a legitimately big change through. This PR moves that check into this shared-workflows repo so any Comfy-Org repo can turn it on with a few lines of config, picking its own line cap and its own list of "don't count these" files, and can start in a warn-only mode that reports without blocking.

What

• .github/workflows/pr-size.yml — reusable (workflow_call) PR-size cap, same topology as cursor-review.yml: callers add a thin SHA-pinned wrapper; the counting logic lives here.
  • Inputs, all optional: max_lines (1000), mode (enforce | warn — warn reports and comments on overage but never fails the check, for gradual rollout), bypass_label (oversized-ok), extra_lockfiles, extra_generated_globs, comment (true), bot_app_id, workflows_ref.
  • Secrets: BOT_APP_PRIVATE_KEY (pass-through; callers use the existing vars.APP_ID + bot-key pattern). When credentials are absent or comment: false, the workflow degrades gracefully to check status + step summary — no comment job failure.
  • Two-job security split preserved from the original: the size job runs against PR code with contents: read and builds the checker from this repo's pinned checkout (no PR-authored code executes in it); the comment job holds the bot write token, checks out no PR code, and receives the report as an artifact.
• scripts/check-pr-size/ — the Go module (diff parsing, generated-file classification, cap evaluation), extended with --mode, --bypass-label, --extra-lockfiles, and --extra-generated-globs, plus an over_cap flag handed to the comment job so warn mode still comments. The base-ref-only linguist-generated reading (a PR cannot mark its own files generated) and the Go // Code generated ... DO NOT EDIT. marker rule carry over unchanged; the marker rule simply never matches in non-Go repos.
• .github/workflows/test-pr-size.yml — CI for the module: gofmt, go vet, go test on change (mirrors test-cursor-review-scripts.yml).
• README table row.

Verification

• go test ./..., go vet, gofmt -l — all clean (49 tests incl. new tables for extras parsing, glob semantics, warn/enforce exit contract, report rendering).
• End-to-end smoke against a throwaway git repo: enforce-over → exit 1 + over_cap=true; warn-over → exit 0 + over_cap=true; bypass → exit 0 + over_cap=false; extras exclude lockfiles/globs; invalid --mode → exit 2; GITHUB_STEP_SUMMARY + GITHUB_OUTPUT writes verified.
• zizmor (v1.27.0): no findings on both new workflows (actions hash-pinned, app token scoped to issues/pull-requests write). actionlint: clean — it caught that the secrets context is unavailable in step-level if, so the credentials-present test is evaluated in job env instead.

Judgment calls

• Dropped the source's persist-credentials: true + token-drop dance. The original fetched the base branch with persisted credentials, then stripped the token before running the (PR-authored) checker. Here the checker is trusted (built from this repo) and fetch-depth: 0 already fetches all refs during the authenticated checkout, so the job diffs base.sha...head.sha directly with persist-credentials: false throughout — equivalent counts (three-dot uses the merge-base), simpler, and zizmor-clean.
• Comment posting keys off an over_cap flag carried in the report artifact rather than the size job's result, because in warn mode the job is green on overage but must still comment. The flag rides the artifact (not job outputs) so it carries identically whether the size job passed or failed. A crash before rendering leaves any existing sticky comment untouched instead of overwriting it with an empty body — a small robustness improvement over the source.
• git clean -ffdx on the tool checkout before building, so files a PR pre-seeds under _pr_size_tool/ (untracked in the tool repo, which checkout does not remove) can't be compiled into the checker.
• Glob semantics for extra_generated_globs are documented in the input description (* segment-local, ** cross-segment, ? single char; slash-less patterns match base names at any depth) and pinned by table tests.
• The upstream source of this port is still in review on its home repo; if it changes before this merges, this port should be re-synced (the sticky-comment marker <!-- ci-pr-size --> is kept identical so existing comments carry over when that repo flips to a thin caller).

Out of scope (tracked separately): registering pr-size callers in the bump dispatcher, flipping the origin repo to a thin caller, and per-repo onboarding (cap selection, bypass-label creation, branch protection).

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 23 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 199a981c-e380-428f-bebe-1667eeb27aa8

📥 Commits

Reviewing files that changed from the base of the PR and between 8b0ca00 and d2e53fb.

📒 Files selected for processing (8)

• .github/workflows/pr-size.yml
• .github/workflows/test-pr-size.yml
• README.md
• scripts/check-pr-size/go.mod
• scripts/check-pr-size/main.go
• scripts/check-pr-size/main_test.go
• scripts/check-pr-size/size.go
• scripts/check-pr-size/size_test.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch matt/be-3481-pr-size-reusable

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch matt/be-3481-pr-size-reusable

---

_{Comment @coderabbitai help to get the list of available commands.}