ci(bump-callers): add bump-assign-reviewers-callers.yml dispatch flow (BE-3924) #54
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| name: Bump assign-reviewers callers | ||
|
|
||
| # When the assign-reviewers reusable workflow is updated on main, open a | ||
| # SHA-bump PR in every repo that pins a caller against it. PRs are opened by | ||
| # Cloud Code Bot so they are easy to filter and merge. | ||
| # | ||
| # This is a thin entrypoint over the shared bumper at | ||
| # .github/bump-callers/bump-callers.sh — the same script drives the | ||
| # cursor-review, agents-md-integrity, AND pr-size caller fleets | ||
| # (bump-cursor-review-callers.yml, bump-agents-md-callers.yml, | ||
| # bump-pr-size-callers.yml). Keeping ONE implementation is deliberate: a forked | ||
| # copy is how other shared machinery in the org has drifted. The entrypoints | ||
| # differ only in their path-filter trigger and the parameters passed below. | ||
| # (They stay separate rather than a single matrix because their triggers differ | ||
| # — an assign-reviewers.yml change must not spuriously bump the other fleets' | ||
| # callers, and vice versa.) | ||
| # | ||
| # The caller list is NOT hardcoded here. This repo is PUBLIC (workflow file and | ||
| # Actions run logs are both publicly viewable), and most callers are private, so | ||
| # their names must never appear in this file or its logs. The list lives in the | ||
| # repo-level Actions variable `ASSIGN_REVIEWERS_CALLERS` (config, not a | ||
| # credential — a variable, not a secret, since secrets are write-only via the | ||
| # API) as a JSON array of {"repo","file","label"} objects, same shape as | ||
| # CURSOR_REVIEW_CALLERS. Every repo name is `::add-mask::`ed out of the (public) | ||
| # run logs before it is ever echoed. The variable is seeded EMPTY (`[]`) — an | ||
| # empty list is a clean no-op here (ALLOW_EMPTY below); the rollout's per-repo | ||
| # caller tickets add entries as callers land (today only Comfy-Org/cloud pins a | ||
| # caller). | ||
| # | ||
| # Update flow — adding/removing a caller needs NO public commit: | ||
| # gh variable set ASSIGN_REVIEWERS_CALLERS --repo Comfy-Org/github-workflows \ | ||
| # --body "$(jq -c . callers.json)" | ||
| # Keep the canonical callers.json in a PRIVATE infra/ops repo so variable edits | ||
| # have a reviewed source of truth; the org audit log records each edit. (The | ||
| # specific home repo is intentionally not named here — this file is public.) | ||
|
|
||
| on: | ||
| workflow_dispatch: {} # allow on-demand runs (e.g. to re-bump callers) | ||
|
There was a problem hiding this comment. 🟠 High — |
||
| push: | ||
| branches: [main] | ||
| paths: | ||
| # assign-reviewers.yml is entirely self-contained — its selection logic | ||
| # runs inline via actions/github-script, with no external prompt/script | ||
| # asset dir (unlike cursor-review/** or scripts/check-pr-size/**). So the | ||
| # workflow file itself is the only path that can change its behavior. | ||
| - .github/workflows/assign-reviewers.yml | ||
|
There was a problem hiding this comment. 🟢 Low — The push path filter also fires when |
||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| # Serialize runs of this fleet. The bumper now pushes to a STABLE branch | ||
| # (ci/bump-assign-reviewers) shared across runs, so two overlapping runs (a | ||
| # rapid second main push, or a push racing a manual re-run) would force-reset | ||
| # that branch and race the PR update — an older run finishing last could leave | ||
| # the committed diff pinned to a stale SHA. cancel-in-progress: false lets the | ||
| # running bump finish; GitHub keeps only the newest pending run, so the latest | ||
| # SHA always wins (BE-3882). | ||
| concurrency: | ||
| group: bump-assign-reviewers-callers | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| bump: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
|
There was a problem hiding this comment. 🟠 High — |
||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Generate Cloud Code Bot token | ||
| uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 | ||
| id: token | ||
| with: | ||
| app-id: ${{ vars.APP_ID }} | ||
| private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }} | ||
| owner: Comfy-Org | ||
|
There was a problem hiding this comment. 🟡 Medium — The token is requested with only |
||
|
|
||
| - name: Bump SHA in caller repos | ||
| env: | ||
| GH_TOKEN: ${{ steps.token.outputs.token }} | ||
| NEW_SHA: ${{ github.sha }} | ||
|
There was a problem hiding this comment. 🟡 Medium — |
||
| VAR_NAME: ASSIGN_REVIEWERS_CALLERS | ||
| TAG: assign-reviewers | ||
| WORKFLOW_FILE: assign-reviewers.yml | ||
| # Seeded empty; an empty list is a clean no-op, not an error. | ||
| ALLOW_EMPTY: "true" | ||
|
There was a problem hiding this comment. 🟢 Low — |
||
| # JSON array of {"repo","file","label"} — see the header comment for the | ||
| # update flow. Kept in a variable (not the file) so private caller names | ||
| # never land in this public repo or its logs. | ||
| CALLERS_JSON: ${{ vars.ASSIGN_REVIEWERS_CALLERS }} | ||
|
There was a problem hiding this comment. 🟠 High — |
||
| run: bash .github/bump-callers/bump-callers.sh | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🟡 Medium — This comment hard-codes the caller repo name
Comfy-Org/cloud, permanently disclosing a private consumer in this public repo's source history — the exact leak the surrounding design (variable-stored,::add-mask::ed caller list) exists to prevent. Drop the repo name from the comment. Raised by 1 of 8 reviewers (gpt-5.6-sol-max adversarial).