github-workflows/.github/workflows/test-cursor-review-scripts.yml at main · Comfy-Org/github-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
name: Test cursor-review scripts

# Runs the Python unit tests for the cursor-review helper scripts, especially
# the stdio MCP output contract used by reviewers and the judge. These scripts
# drive panel consolidation for every consumer repo, so they are cheap to
# guard with a unit run on change.
# Inputs/secrets: none. Triggers: path-filtered pull requests and pushes to main.
# Also runs the .github/cursor-approve/ suite (axis prompts, verdict aggregator
# and the read-only context proxy).
# Caller pattern: none; this is repository-local CI, not a reusable workflow.
#
# cursor-review.yml itself is in the path filter because two suites read it:
# catalog-drift.py reads the model pins OUT of it (BE-4819), and
# test_workflow_job_isolation.py pins the credential split (no job both checks
# out PR code and holds the bot key / pull-requests: write). Both assertions are
# only worth anything if they run when the file they parse changes.
#
# The declared-vs-documented input drift check no longer lives here: it folded
# into the table-driven harness at
# .github/workflow-pins/tests/test_inputs_docs_drift.py, which reads BOTH
# docs/callers/cursor-review.md and .github/cursor-review/README.md. Both paths
# are in test-workflow-pins.yml's filters, and a docs-only PR that deletes the
# `blocking` row (the #31 scenario) still fires the alarm, over there.
#
# docs/callers/cursor-approve.md and docs/callers/cursor-review.md ARE listed
# below anyway, because a suite here reads them too: test_caller_doc_pattern.py
# pins the `if:` guards on the cursor-approve caller snippet and on
# cursor-review's `next:` approve_gate example. A copied caller is only as good
# as the snippet, and dropping `!cancelled()` from it silently withholds every
# approval (see that file's docstring).

on:
  pull_request:
    paths:
      - '.github/cursor-review/**'
      - '.github/cursor-approve/**'
      - '.github/workflows/cursor-review.yml'
      - '.github/workflows/cursor-review-catalog-drift.yml'
      # The cursor-approve suite asserts properties of these workflows too
      # (secret isolation, the guard byte-copy, the CLI pin).
      - '.github/workflows/cursor-approve.yml'
      - '.github/workflows/cursor-axis-base.yml'
      # The cursor-approve suite asserts bump-cursor-cli-pin.yml lists EVERY
      # workflow carrying the CLI pin, so any workflow gaining (or losing) the
      # pin must trigger it — hence all of them (both extensions the suite
      # scans), not just the bumper.
      - '.github/workflows/*.yml'
      - '.github/workflows/*.yaml'
      - '.github/workflows/axis-*.yml'
      # test_caller_doc_pattern.py reads the caller snippets out of these
      # pages and pins their `if:` guards; the regression it guards is a
      # docs-only edit — dropping `!cancelled()` from a snippet a caller copies.
      - 'docs/callers/cursor-approve.md'
      - 'docs/callers/cursor-review.md'
      - '.github/workflows/test-cursor-review-scripts.yml'
  push:
    branches: [main]
    paths:
      - '.github/cursor-review/**'
      - '.github/cursor-approve/**'
      - '.github/workflows/cursor-review.yml'
      - '.github/workflows/cursor-review-catalog-drift.yml'
      # The cursor-approve suite asserts properties of these workflows too
      # (secret isolation, the guard byte-copy, the CLI pin).
      - '.github/workflows/cursor-approve.yml'
      - '.github/workflows/cursor-axis-base.yml'
      # The cursor-approve suite asserts bump-cursor-cli-pin.yml lists EVERY
      # workflow carrying the CLI pin, so any workflow gaining (or losing) the
      # pin must trigger it — hence all of them (both extensions the suite
      # scans), not just the bumper.
      - '.github/workflows/*.yml'
      - '.github/workflows/*.yaml'
      - '.github/workflows/axis-*.yml'
      # test_caller_doc_pattern.py reads the caller snippets out of these
      # pages and pins their `if:` guards; the regression it guards is a
      # docs-only edit — dropping `!cancelled()` from a snippet a caller copies.
      - 'docs/callers/cursor-approve.md'
      - 'docs/callers/cursor-review.md'
      - '.github/workflows/test-cursor-review-scripts.yml'

permissions:
  contents: read

jobs:
  test:
    name: unittest + shellcheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: ShellCheck the cursor-review shell scripts
        # These run inside the review jobs with no unit tests behind them, so
        # shellcheck is the only automated guard on install-cursor-cli.sh (the
        # sha256-pinned CLI installer) and slack-notify.sh.
        run: shellcheck -x .github/cursor-review/install-cursor-cli.sh .github/cursor-review/slack-notify.sh

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.12'

      - name: Run cursor-review script tests
        run: python3 -m unittest discover -s .github/cursor-review/tests -p 'test_*.py' -v

      - name: Run cursor-approve script tests
        # The axis prompts and verdict aggregator behind cursor-approve, plus
        # context-proxy.py, the read-only Linear/Notion/Slack MCP proxy the axes
        # query (every network call in its suite is mocked). That workflow's
        # decide job reuses cursor-review's auto-approve.py, so the suites share
        # this job.
        run: python3 -m unittest discover -s .github/cursor-approve/tests -p 'test_*.py' -v