ci(cursor-review): re-sync workflows_ref to the pinned uses: SHA and stop Dependabot splitting the pair

[mattmillerai]

ELI-5

This repo's Cursor-review job pins the shared reusable workflow in two places: uses: picks which workflow definition runs, and the workflows_ref: input picks which prompts/scripts that workflow downloads at run time. Dependabot only ever rewrites uses:, so it splits the pair — twice already. This tells Dependabot to stop touching that pair and leave it to the bumper fleet that moves both halves together.

What changed

• .github/dependabot.yml — the existing github-actions entry gains a two-entry ignore for the Comfy-Org/github-workflows reusables. Nothing else in the file changes: the pip entry, and the github-actions entry's schedule, open-pull-requests-limit, commit-message, labels and groups, are untouched.

That is now the whole diff — 10 lines in one file. See Superseded half below for what left it.

Both entries are load-bearing and must not be collapsed to a single Comfy-Org/github-workflows*. Dependabot names a reusable-workflow dependency by its full path (PR #146's own title reads Comfy-Org/github-workflows/.github/workflows/cursor-review.yml), and a dependency-name without a wildcard is an exact match — so the exact form covers the owner/repo shape and the /* form covers the per-file shape, while a single trailing star would expand unanchored and also swallow any future sibling repo whose name merely starts with github-workflows. This follows the precedent documented at length in Comfy-Org/cloud's own .github/dependabot.yml, which I read directly rather than copying from the work item.

Superseded half — the workflow edit is gone, on purpose

This PR originally also re-synced .github/workflows/ci-cursor-review.yml, moving workflows_ref: from ffcc3f5 up to 425c154 (the SHA uses: already held). While it sat open, main landed #164 — opened by app/cloud-code-bot with the body "Opened by the bump-cursor-review-callers workflow", merged 2026-09-18T23:33Z — which moved both pins together to the newer f22ad8f. That is the same fix at a later SHA, produced by the fleet this PR's ignore hands the job to.

The two therefore conflicted, and the conflict was resolved in main's favour: its pair is already aligned and strictly newer, so the hand re-sync here was redundant. ci-cursor-review.yml on the merged tree contains exactly one distinct 40-hex SHA, f22ad8f888fdef6f0a50bfdfa96bb20f74f651a0, so the two pins agree — which is the outcome this PR was after; it just arrived from upstream first.

Worth stating plainly, because it is the load-bearing evidence for the ignore: #164 is a live demonstration that the compensating control works. This repo is not merely eligible for the bumper fleet's roster — the fleet fired on it and moved both halves correctly.

How the split happened

uses: and workflows_ref: were in lock-step until two Dependabot PRs rewrote uses: alone — #136 (merged 2026-09-09) and #146 (merged 2026-09-14) — leaving the job running a September-12 workflow definition against August-28 assets for roughly nine days. The caller-fleet bot's own PR #125, which correctly moved both pins to 425c154, was closed unmerged on 2026-09-14 at 21:15Z — 33 minutes after #146 merged over it. That is the loop this ignore breaks.

Verification

Run on the merged tree (this branch merged with main), not on the pre-merge branch:

• python3 -c "import yaml; yaml.safe_load(open('.github/dependabot.yml'))" parses; the github-actions entry's ignore reads back as exactly the two dependency-name entries and its groups (actions-minor-and-patch) is intact. .github/workflows/ci-cursor-review.yml also parses as YAML.
• grep -oE '[0-9a-f]{40}' .github/workflows/ci-cursor-review.yml | sort -u → exactly one line, f22ad8f888fdef6f0a50bfdfa96bb20f74f651a0. The two pins agree.
• git diff origin/main --stat → .github/dependabot.yml | 10 ++++++++++, one file. No stray carry-over from the conflict resolution.
• Repo toolchain, all green: ruff check . (all checks passed), ruff format --check . (57 files already formatted), mypy src (no issues, 21 files), pytest -q (975 passed, 9 skipped), and python3 scripts/check_public_repo_hygiene.py (no internal-only references — this one matters because the diff adds a Comfy-Org/<repo> reference to a world-readable file).

Falsification of the capability this diff denies

An ignore entry removes a capability — automatic bumping of these reusables — so before shipping it the replacement path was checked rather than asserted from the comment text. Read-only checks against Comfy-Org/github-workflows: .github/workflows/bump-cursor-review-callers.yml exists and drives .github/bump-callers/bump-callers.sh, which carries an explicit INPUT_PIN_RE for workflows_ref: alongside the uses: rewrite and an assertion that the two halves move together. Since then the path has been confirmed empirically rather than by inspection: PR #125 and PR #164 in this repo were both opened by that workflow, and #164 merged. So the pin keeps a working owner after this change; it does not become orphaned.

Scope swept, including the half this does not fix

All 5 workflow files and all 16 uses: pins in .github/workflows/ were swept. Exactly 1 is a Comfy-Org/github-workflows reusable and it is the repo's only workflows_ref: — so there is no second split pin here. The other 15 pins cover 6 distinct third-party/marketplace actions (actions/checkout, actions/setup-python, actions/upload-artifact, actions/download-artifact, pypa/gh-action-pypi-publish, contributor-assistant/github-action) and are deliberately left under Dependabot's management — the ignore is scoped to the two reusable-workflow name forms precisely so those keep getting bumped.

Residual

• No guard enforces that the two pins stay aligned. The upstream Require a pinned workflows_ref step only checks that the input is a non-empty 40-hex string; verified at f22ad8f, nothing compares it to the caller's uses: SHA. This PR removes the automated cause of a split but not a human edit or partial revert. Deferred to a follow-up rather than fixed here: the clean lever is upstream (job.workflow_sha is by definition the uses: SHA and the workflow already reads it), and the warn-vs-fail-closed rollout across the caller set is a human call. Tracked from this thread.
• Not verified: the org-wide "4 of 72 callers" measurement this work was scoped from. That survey spans private repos and a caller roster held as a repository secret, neither of which was readable here. The split, the fix and the bumper path were verified for this repo only; the claim that three other callers are in the same state is carried over unverified and those repos are untouched here. If that number is right, each of them needs the same two-line change.
• The ignore has no update-types:/versions: qualifier, so it suppresses Dependabot security advisories for these reusables as well as version updates. That is the upstream precedent's deliberate trade-off (a first-party org repo pinned to reviewed SHAs is not a public-registry package, so an advisory-driven bump is not its update path), and this PR adopts it as-is rather than re-litigating it. Naming it because it is a real reduction in coverage that the diff does not make visible on its own.
• Nothing in the repo's own suite exercises a GitHub Actions caller. The 975 passing tests are the Python SDK's and are insensitive to this diff; they are reported as evidence the merge with main is clean, not as evidence about the ignore.

Provenance

• Authored by: agent-work loop
• Verified: on the merged tree — ruff check: all checks passed; ruff format --check: 57 files already formatted; mypy src: no issues in 21 source files; pytest -q: 975 passed, 9 skipped; check_public_repo_hygiene.py: no internal-only references; dependabot.yml/ci-cursor-review.yml both parse as YAML; ci-cursor-review.yml holds exactly one distinct 40-hex SHA (f22ad8f); net diff vs main is 10 lines in .github/dependabot.yml alone
• Deviations: the original workflow edit was dropped during conflict resolution — main's ci: bump cursor-review to github-workflows@f22ad8f #164 re-synced both pins to a newer SHA first, making the hand re-sync redundant; resolved in main's favour rather than re-applying the older 425c154 (see Superseded half). The pin-alignment guard raised in review is deferred to a follow-up, not fixed here (see Residual).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 4973df46-03d1-41bf-bbe0-c7a7e1bdfc79

📥 Commits

Reviewing files that changed from the base of the PR and between addfd9f and 683f66c.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/ci-cursor-review.yml

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The changes prevent Dependabot updates for Comfy-Org/github-workflows and update the Cursor review workflow references to commit 425c154ce5049324ee23ad10e106baeed4cfa31b.

Changes

Workflow dependency maintenance

Layer / File(s)	Summary
Dependabot ignore policy .github/dependabot.yml	Dependabot ignores Comfy-Org/github-workflows and its per-file dependency names.
Cursor workflow pin update .github/workflows/ci-cursor-review.yml	The reusable Cursor review workflow and workflows_ref use the new pinned commit.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: christian-byrne

Merge Risk: ⚪ Minimal · up to 683f6

The workflow pins and Dependabot ignore policy are aligned, with no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately identifies both main changes: re-synchronizing the pinned Cursor review workflow references and preventing Dependabot from splitting the dependency pair. It is specific and concis…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Cursor Review — Consolidated panel

Triggered by @mattmillerai.

Found 2 finding(s).

Severity	Count
🟢 Low	2

Panel: 6/6 reviewers contributed findings.

[robinjhuang]

Auto-approved under the full-autonomy policy.

Gates verified at 683f66c21bdacbb341ecde451a664f13c40b4869:

• full-autonomy label present
• assigned to, or review requested from, @robinjhuang
• not a draft
• 8 required check(s) green — none failing, none pending

Issued by full-autonomy-approve.yml (run). This approval attests
that the machine gates above passed at this commit. It does not attest that a
human read the diff.

[mattmillerai]

Heads-up for re-review: this PR's diff got smaller, not bigger.

It was conflicting with main. While it sat open, main landed #164 — opened by app/cloud-code-bot via the bump-cursor-review-callers workflow, merged 2026-09-18T23:33Z — which moved both cursor-review pins together to f22ad8f. That is the same re-sync this branch did by hand at the older 425c154, done by the fleet upstream first.

Resolved in main's favour: its pair is already aligned and strictly newer, so the hand re-sync here was redundant. .github/workflows/ci-cursor-review.yml drops out of the diff entirely.

Net diff vs main is now 10 lines in .github/dependabot.yml — just the ignore that stops Dependabot rewriting uses: alone and splitting the pair again. ci-cursor-review.yml on the merged tree holds exactly one distinct 40-hex SHA (f22ad8f888fdef6f0a50bfdfa96bb20f74f651a0), so the pins agree.

Worth noting that #164 is also the evidence the ignore needed: it shows the bumper fleet is live on this repo and moves both halves correctly, so the pin keeps a working owner once Dependabot stops touching it.

Merged tree verified green: ruff check, ruff format --check (57 files), mypy src (21 files), pytest -q (975 passed, 9 skipped), check_public_repo_hygiene.py. All PR checks pass.

Both cursor-review threads are answered and resolved; the pin-alignment guard raised in one of them is deferred to a tracked follow-up (upstream fix + a warn-vs-fail rollout decision), not fixed here. PR body updated throughout.

The approval was dismissed by this push, so re-review is needed — a human still presses merge.

[mattmillerai]

🤖 The reviews loop filed Linear follow-up ticket(s) for review thread(s) deferred as out of scope for this PR:

• BE-15927 — Enforce that cursor-review's uses: SHA and workflows_ref: input point at the same commit — filed as agent-spike (premise unverified)

The following carry agent-spike instead of agent-ok because their reachability claim was not backed by evidence (BE-5378) — the claim is investigated before any code is written, and "the premise does not hold" is a valid, successful outcome:

• Enforce that cursor-review's uses: SHA and workflows_ref: input point at the same commit — no reachability block in the proposal

[robinjhuang]

Auto-approved under the full-autonomy policy.

Gates verified at 7a2b8ea2a97711d11124918851942b29bd02f4e4:

• full-autonomy label present
• assigned to, or review requested from, @robinjhuang
• not a draft
• 8 required check(s) green — none failing, none pending

Issued by full-autonomy-approve.yml (run). This approval attests
that the machine gates above passed at this commit. It does not attest that a
human read the diff.