ci(bump-callers): generalize caller SHA-bump to the agents-md-integrity fleet#38
Conversation
…ty fleet
The cursor-review caller auto-bump (a reusable-workflow SHA rots without it —
the pins needed two manual bump PRs in one day) is now fleet-agnostic. The bump
logic moves into one shared script, .github/bump-callers/bump-callers.sh, driven
by two thin workflow entrypoints that differ only in their path-filter trigger
and three parameters (caller variable, human tag, reusable-workflow filename):
- bump-cursor-review-callers.yml -> CURSOR_REVIEW_CALLERS (unchanged behavior)
- bump-agents-md-callers.yml -> AGENTS_MD_CALLERS (new; triggers on a
change to agents-md-integrity.yml or .github/agents-md-integrity/**)
One implementation, not a fork: shared machinery that got copied has drifted
before. The entrypoints stay separate rather than a single matrix because a
cursor-review.yml change must not spuriously bump agents-md callers, or vice
versa.
Preserved exactly for the cursor-review fleet: the ::add-mask:: privacy handling
for private caller names in this public repo's logs, the PR-per-caller flow, the
trailing-newline restore, and the single-line PR body. AGENTS_MD_CALLERS shares
the same {repo,file,label} JSON shape and is seeded empty ([]) — an empty list
is a clean no-op there (the fleet grows as callers land), while a fleet that must
always have callers still hard-fails on empty.
Tests: a bash functional suite stubs gh (no network) and asserts both variables
parse, private names are masked, the pin + comment are rewritten, the trailing
newline is kept, and the empty/malformed guards fire. Run in CI by
test-bump-callers.yml alongside shellcheck.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 21 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
…r-size main landed #38 (generalize caller SHA-bump to the agents-md-integrity fleet) while this branch was open, extracting the bump logic into one shared script (.github/bump-callers/bump-callers.sh) driven by thin per-fleet entrypoint workflows instead of this PR's single-dispatcher-with-registry design. Rather than reintroduce a second, forked implementation of the same bump logic (exactly what #38's own "one implementation, not a fork" design note warns against, now also codified in this repo's AGENTS.md), this PR's remaining unique goal — registering pr-size as a caller fleet — is delivered the same way: a new bump-pr-size-callers.yml thin entrypoint over the existing shared script, mirroring bump-agents-md-callers.yml (ALLOW_EMPTY=true, since pr-size.yml hasn't landed yet). bump-callers.yml (this PR's original dispatcher) is dropped; the deleted bump-cursor-review-callers.yml keeps main's version (now a thin entrypoint over the shared script rather than the old inline implementation). Docs (bump-callers/README.md, bump-callers.sh header, AGENTS.md, test-bump-callers.yml paths) updated for the third fleet.
Restore the explicit `permissions: contents: read` this PR originally added (as a zizmor excessive-permissions fix on the old bump-cursor-review-callers.yml) across all three bump-*-callers.yml entrypoints — main's #38 shared-script version and the two pre-existing sibling entrypoints (bump-agents-md-callers.yml, bump-cursor-review-callers.yml) hadn't gained it, only the new bump-pr-size- callers.yml would have otherwise. None of the jobs write via GITHUB_TOKEN (all writes go through the generated app token), so read-only is correct and matches every other workflow file in this repo, which all declare explicit permissions.
1 participant
ELI-5
We have a robot that, whenever we update our shared
cursor-reviewworkflow,automatically opens a "please update your pinned version" PR in every repo that
uses it. This teaches that same robot a second trick: do the exact same thing for
the new
agents-md-integrityworkflow. Instead of copy-pasting the robot (copiesdrift apart over time), both jobs now share one script; each just hands it a
different list of repos and a couple of labels.
What & why
bump-cursor-review-callers.ymlauto-bumps SHA-pinned cursor-review callersacross repos listed in the
CURSOR_REVIEW_CALLERSrepo variable. Theagents-md-integrityreusable workflow is about to grow its own caller fleet(~15–30 repos), and SHA-pinned callers rot without an auto-bump — the
cursor-review pins alone needed two manual bump PRs in a single day.
This generalizes the bump machinery so both fleets are driven by one shared
script,
.github/bump-callers/bump-callers.sh, with two thin workflowentrypoints that supply per-fleet parameters (caller variable, human tag,
reusable-workflow filename):
bump-cursor-review-callers.ymlcursor-review.ymlCURSOR_REVIEW_CALLERSbump-agents-md-callers.yml(new)agents-md-integrity.ymlor.github/agents-md-integrity/**AGENTS_MD_CALLERSJudgment calls
parameterized implementation but explicitly allowed two thin entrypoints when
the path-filter triggers differ. They genuinely differ here, and — more
importantly — a unified trigger would spuriously cross-bump (a
cursor-review.ymlchange would open no-op PRs against agents-md callers, and vice versa). So the
shared logic lives once in
bump-callers.sh; the two entrypoints differ only intrigger + parameters. This is the anti-drift shape the ticket asked for.
CURSOR_REVIEW_CALLERSbehavior is preserved byte-for-byte — same branchname, commit message, PR title/body,
sedpin+comment rewrite,::add-mask::masking, the trailing-newline restore, and the single-line PR body. The only
mechanical change to that path is that the (previously inline) logic now lives
in the checked-out script, so the entrypoint gained an
actions/checkoutstep.AGENTS_MD_CALLERSis seeded empty ([]). I set the repo variable directly(config, not code — harmless additive
[]). An empty/absent list is a cleanno-op for this fleet (
ALLOW_EMPTY=true), so the workflow is safe to run beforeany callers exist; the rollout's per-repo caller tickets add entries as callers
land. The must-always-have-callers cursor-review fleet still hard-fails on empty
(guards against a silent no-op dispatcher).
callers pin with a
# v1comment (not the# github-workflows#NNform thecursor-review callers use), so the shared comment-normalize
sedsimply doesn'tmatch and leaves
# v1intact — verified in the tests.Tests
New
test-bump-callers.ymlruns shellcheck + abashfunctional suite that stubsgh(no network) and asserts: both caller variables parse, private repo names aremasked out of the (public) run logs, the caller's pinned SHA is rewritten (both
SHA refs for agents-md), the pin comment is normalized while
# v1is preserved,the committed file keeps exactly one trailing newline, and the empty (no-op vs
hard-fail) and malformed guards fire. All 25 assertions pass locally; shellcheck
clean.
Per this public repo's convention, no tracker references in the title/body/commits.