Bump the failproofai submodule pointer when this repo's main moves

[NiveditJain]

FailproofAI/failproofai is picking this repo up as a skills submodule (FailproofAI/failproofai#559). This adds the job that keeps its pinned commit tracking our main, so nobody has to bump the gitlink by hand.

What it does

On every push to main here: mint a version-bot token scoped to failproofai → rewrite the skills gitlink → push straight to its main.

It's the mirror image of failproofai's bump-platform-submodule.yml — same direction (the submodule's source pushes the bump downstream), same mechanism, we're just the source this time:

	Upstream	Downstream	Job lives in
Today	failproofai	platform, agenteye	failproofai
This PR	skills	failproofai	skills (here)

The direct push works because failproofai's main is covered by the org-level failproofai-rules ruleset — the same ruleset object that governs platform and agenteye — and version-bot is a bypass actor on it. So the existing bypass covers this repo's pushes too; no ruleset change needed.

⚠️ Needs a one-time admin step before it works

This repo has no Actions secrets at all today. The job fails at the token step until someone with admin copies both values over from failproofai, which already has them:

gh secret set VERSION_BOT_APP_ID      --repo FailproofAI/skills
gh secret set VERSION_BOT_PRIVATE_KEY --repo FailproofAI/skills < version-bot.pem

Same shape as the SKILLS_SYNC_PAT setup that agenteye's sync-skill.yml documents. The workflow header repeats these instructions so they're findable from the file itself.

Merge order

Land FailproofAI/failproofai#559 first. Until skills/ is a gitlink over there, this job aborts with is not a gitlink — aborting rather than inventing the entry.

One consequence worth knowing

A bump landing on failproofai's main triggers its push-driven bump-platform-submodule.yml, so platform and agenteye then get bumped to the new failproofai SHA. That cascade is by design — they track failproofai main — but it does mean one commit here eventually produces bump commits in three repos. Worth a look if that churn isn't wanted. (App-token pushes do trigger downstream workflows, unlike GITHUB_TOKEN pushes; that's what makes the chain fire.) There's no cycle back here, so it terminates.

Verified

I extracted the exact run: block from the YAML and ran it against a real clone of failproofai's submodule branch with skills/ empty on disk, matching CI's submodules: false. git push was stubbed, so nothing was pushed.

• Normal bump — gitlink 37d6892 → new SHA, mode 160000 preserved, only that one tree entry changed.
• The SIGPIPE hazard the original documents — an 18,940-byte / 201-line squash-merge body reduced correctly to just Upstream: <first line> under set -euo pipefail, no failure.
• Idempotent — re-running when already at the SHA logs Already at … nothing to do and creates no commit.
• Missing gitlink — ::error:: + exit 1.

Not exercised locally: the push itself and the rebase-retry path, which are carried over verbatim from the proven original.

🤖 Generated with Claude Code

https://claude.ai/code/session_01U6pt7MCEDAasEYkrLUGork

[coderabbitai]

Warning

Review limit reached

@NiveditJain, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 38 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f5cf5e78-50a1-4e3c-99ac-841bd9e4c928

📥 Commits

Reviewing files that changed from the base of the PR and between 37d6892 and ced5c8e.

📒 Files selected for processing (1)

• .github/workflows/bump-failproofai-submodule.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hermes-exosphere]

Hermes Agent Review — APPROVED ✓

Adds the companion CI job that keeps the skills gitlink in FailproofAI/failproofai in sync when this repo's main moves. Mirror image of failproofai's own bump-platform-submodule.yml.

What's here

• New workflow: .github/workflows/bump-failproofai-submodule.yml (124 lines)
• Triggered on every push to main (and workflow_dispatch)
• Mints a version-bot app token, checks out FailproofAI/failproofai main, rewrites the skills gitlink, pushes directly

What's good

• ✅ Follows the proven pattern from failproofai's bump-platform-submodule.yml — same app token mechanism, same race-safe push loop (3-attempt rebase-and-retry), same SIGPIPE-safe subject extraction
• ✅ Version-bot is already a bypass actor on the org-level failproofai-rules ruleset — no ruleset change needed
• ✅ Concurrency is serialized (group: bump-failproofai-submodule, cancel-in-progress: false) so back-to-back merges produce sequential bumps
• ✅ Clear error handling: detects non-gitlink with ::error:: + exit 1, idempotent when SHA hasn't changed
• ✅ Permissions are minimal: contents: read on this repo; all writes use the app token
• ✅ Workflow header documents the one-time admin step (secrets setup)
• ✅ PR body is thorough: merge order, secret setup instructions, downstream cascade implications all documented

No concerns

The workflow is a straightforward adaptation of a proven pattern. The verified test results in the PR body (normal bump, SIGPIPE handling, idempotency, missing gitlink) plus the clean CodeRabbit pass give confidence it works.

Merge away. 🚀

Note

Remember the one-time admin step before this goes live: copy VERSION_BOT_APP_ID and VERSION_BOT_PRIVATE_KEY secrets from FailproofAI/failproofai to FailproofAI/skills.