ci: register pr-size as a caller fleet on the shared bump-callers.sh

.github/bump-callers/README.md

@@ -7,23 +7,28 @@ forward automatically instead of silently drifting commits behind.
 
 - **`bump-callers.sh`** — the one, fleet-agnostic bump script (parse the caller
   list, mask private repo names, rewrite the pin, open one PR per caller). It is
-  the single source of truth; the two workflow entrypoints are thin wrappers
-  that only supply per-fleet parameters. A forked copy is how other shared
-  machinery in the org has drifted — this stays one file on purpose.
+  the single source of truth; the workflow entrypoints are thin wrappers that
+  only supply per-fleet parameters. A forked copy is how other shared machinery
+  in the org has drifted — this stays one file on purpose.
 - **`tests/`** — a `bash` functional suite (stubs `gh`, no network), run by
   [`test-bump-callers.yml`](../workflows/test-bump-callers.yml) plus shellcheck.
 
-## The two fleets
+## The fleets
 
 | Entrypoint | Triggers on a change to | Caller variable | Seeded |
 |---|---|---|---|
 | [`bump-cursor-review-callers.yml`](../workflows/bump-cursor-review-callers.yml) | `cursor-review.yml` | `CURSOR_REVIEW_CALLERS` | non-empty (hard-fails if empty) |
 | [`bump-agents-md-callers.yml`](../workflows/bump-agents-md-callers.yml) | `agents-md-integrity.yml` or `agents-md-integrity/**` | `AGENTS_MD_CALLERS` | empty `[]` (grows as callers land) |
-
-They stay as two thin entrypoints rather than one matrix because their triggers
-differ: a `cursor-review.yml` change must not spuriously bump agents-md callers,
-and vice versa. Everything else (masking, the PR-per-caller flow, the trailing-
-newline fix, the single-line PR body) lives once in `bump-callers.sh`.
+| [`bump-pr-size-callers.yml`](../workflows/bump-pr-size-callers.yml) | `pr-size.yml` | `PR_SIZE_CALLERS` | empty `[]` (`pr-size.yml` hasn't landed yet; grows as callers land) |
+
+They stay as thin entrypoints rather than one matrix because their triggers
+differ: a `cursor-review.yml` change must not spuriously bump agents-md or
+pr-size callers, and vice versa. Everything else (masking, the PR-per-caller
+flow, the trailing-newline fix, the single-line PR body) lives once in
+`bump-callers.sh`. Registering a new fleet is: add a thin entrypoint (copy an
+existing one, swap the path filter + `VAR_NAME`/`TAG`/`WORKFLOW_FILE`/
+`ALLOW_EMPTY`), seed its variable, and add a row to this table + the paths in
+`test-bump-callers.yml`.
 
 ## The caller variables
 

.github/bump-callers/bump-callers.sh

@@ -5,11 +5,12 @@
 # When a reusable workflow (e.g. cursor-review.yml or agents-md-integrity.yml)
 # is updated on main, this opens a SHA-bump PR in every repo that pins a caller
 # against it. It is fleet-agnostic: the thin workflow entrypoints
-# (bump-cursor-review-callers.yml, bump-agents-md-callers.yml) invoke it with a
-# different caller list, human tag, and reusable-workflow filename. There is ONE
-# implementation so the two fleets cannot drift apart (a forked copy is how
-# other shared machinery in the org has rotted); the entrypoints differ only in
-# their path-filter triggers and the parameters below.
+# (bump-cursor-review-callers.yml, bump-agents-md-callers.yml,
+# bump-pr-size-callers.yml) invoke it with a different caller list, human tag,
+# and reusable-workflow filename. There is ONE implementation so the fleets
+# cannot drift apart (a forked copy is how other shared machinery in the org
+# has rotted); the entrypoints differ only in their path-filter triggers and
+# the parameters below.
 #
 # This repo is PUBLIC (both the workflow files and the Actions run logs are
 # publicly viewable) and most callers are private, so caller names must never

.github/workflows/bump-agents-md-callers.yml

@@ -39,6 +39,9 @@ on:
       - .github/workflows/agents-md-integrity.yml
       - .github/agents-md-integrity/**
 
+permissions:
+  contents: read
+
 jobs:
   bump:
     runs-on: ubuntu-latest

.github/workflows/bump-cursor-review-callers.yml

@@ -33,6 +33,9 @@ on:
     paths:
       - .github/workflows/cursor-review.yml
 
+permissions:
+  contents: read
+
 jobs:
   bump:
     runs-on: ubuntu-latest

.github/workflows/bump-pr-size-callers.yml

@@ -0,0 +1,75 @@
+name: Bump pr-size callers
+
+# When the pr-size reusable workflow is updated on main, open a SHA-bump PR in
+# every repo that pins a caller against it. PRs are opened by Cloud Code Bot so
+# they are easy to filter and merge.
+#
+# This is a thin entrypoint over the shared bumper at
+# .github/bump-callers/bump-callers.sh — the same script drives the
+# cursor-review and agents-md-integrity caller fleets (bump-cursor-review-
+# callers.yml, bump-agents-md-callers.yml). Keeping ONE implementation is
+# deliberate: a forked copy is how other shared machinery in the org has
+# drifted. The entrypoints differ only in their path-filter trigger and the
+# three parameters passed below. (They stay separate rather than a single
+# matrix because their triggers differ — a pr-size.yml change must not
+# spuriously bump the other fleets' callers, and vice versa.)
+#
+# The caller list is NOT hardcoded here. This repo is PUBLIC (workflow file and
+# Actions run logs are both publicly viewable), and most callers are private, so
+# their names must never appear in this file or its logs. The list lives in the
+# repo-level Actions variable `PR_SIZE_CALLERS` (config, not a credential — a
+# variable, not a secret, since secrets are write-only via the API) as a JSON
+# array of {"repo","file","label"} objects, same shape as the other fleets'
+# variables. Every repo name is `::add-mask::`ed out of the (public) run logs
+# before it is ever echoed. The variable is seeded EMPTY (`[]`) — an empty list
+# is a clean no-op here (ALLOW_EMPTY below), since pr-size.yml itself hasn't
+# landed yet; the rollout's per-repo caller tickets add entries as callers land.
+#
+# Update flow — adding/removing a caller needs NO public commit:
+#   gh variable set PR_SIZE_CALLERS --repo Comfy-Org/github-workflows \
+#     --body "$(jq -c . callers.json)"
+# Keep the canonical callers.json in a PRIVATE infra/ops repo so variable edits
+# have a reviewed source of truth; the org audit log records each edit. (The
+# specific home repo is intentionally not named here — this file is public.)
+
+on:
+  workflow_dispatch: {}   # allow on-demand runs (e.g. to re-bump callers)
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/pr-size.yml
+
+permissions:
+  contents: read
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Generate Cloud Code Bot token
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
+        id: token
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.CLOUD_CODE_BOT_PRIVATE_KEY }}
+          owner: Comfy-Org
+
+      - name: Bump SHA in caller repos
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+          NEW_SHA: ${{ github.sha }}
+          VAR_NAME: PR_SIZE_CALLERS
+          TAG: pr-size
+          WORKFLOW_FILE: pr-size.yml
+          # Seeded empty; an empty list is a clean no-op, not an error.
+          ALLOW_EMPTY: "true"
+          # JSON array of {"repo","file","label"} — see the header comment for the
+          # update flow. Kept in a variable (not the file) so private caller names
+          # never land in this public repo or its logs.
+          CALLERS_JSON: ${{ vars.PR_SIZE_CALLERS }}
+        run: bash .github/bump-callers/bump-callers.sh

.github/workflows/test-bump-callers.yml

@@ -2,10 +2,10 @@ name: Test bump-callers script
 
 # Runs the functional tests + shellcheck for the shared caller-bump script
 # (.github/bump-callers/bump-callers.sh). That one script drives the SHA-bump
-# fan-out for BOTH the cursor-review and agents-md-integrity caller fleets, so a
-# regression here silently breaks every consumer repo's pin auto-bump (or, worse,
-# leaks a private caller name into this public repo's run logs) — cheap to guard
-# with a unit run on change. Mirrors test-cursor-review-scripts.yml /
+# fan-out for the cursor-review, agents-md-integrity, AND pr-size caller fleets,
+# so a regression here silently breaks every consumer repo's pin auto-bump (or,
+# worse, leaks a private caller name into this public repo's run logs) — cheap
+# to guard with a unit run on change. Mirrors test-cursor-review-scripts.yml /
 # test-agents-md-integrity.yml.
 
 on:
@@ -14,13 +14,15 @@ on:
       - '.github/bump-callers/**'
       - '.github/workflows/bump-cursor-review-callers.yml'
       - '.github/workflows/bump-agents-md-callers.yml'
+      - '.github/workflows/bump-pr-size-callers.yml'
       - '.github/workflows/test-bump-callers.yml'
   push:
     branches: [main]
     paths:
       - '.github/bump-callers/**'
       - '.github/workflows/bump-cursor-review-callers.yml'
       - '.github/workflows/bump-agents-md-callers.yml'
+      - '.github/workflows/bump-pr-size-callers.yml'
       - '.github/workflows/test-bump-callers.yml'
 
 permissions:

AGENTS.md

@@ -61,8 +61,9 @@ tests — run the matching command above for whatever you touched.
 - `assign-reviewers.yml` — expertise-aware, load-balanced reviewer requests.
 - `assign-prs-to-author.yml` — assigns unassigned open PRs to their author.
 - `detect-unreviewed-merge.yml` — SOC 2: flags PRs merged without approval.
-- `bump-cursor-review-callers.yml` / `bump-agents-md-callers.yml` — thin
-  entrypoints over `bump-callers.sh` that fan SHA bumps out to consumers.
+- `bump-cursor-review-callers.yml` / `bump-agents-md-callers.yml` /
+  `bump-pr-size-callers.yml` — thin entrypoints over `bump-callers.sh` that fan
+  SHA bumps out to consumers.
 
 ## Conventions & gotchas
 
@@ -80,10 +81,11 @@ tests — run the matching command above for whatever you touched.
   self-enrollment callers (`ci-cursor-review.yml`, `ci-detect-unreviewed-merge.yml`)
   deliberately pin a merged-main SHA instead of a local `./` path for the same
   reason — do not "simplify" them to a local path.
-- **One bumper, not two.** `bump-callers.sh` backs both fleets; the two
+- **One bumper, not several.** `bump-callers.sh` backs every fleet; the
   `bump-*-callers.yml` files are thin per-fleet wrappers (they stay separate so a
-  `cursor-review.yml` change doesn't spuriously bump agents-md callers). Do not
-  fork the script — a forked copy is how other shared org machinery has drifted.
+  `cursor-review.yml` change doesn't spuriously bump agents-md or pr-size
+  callers). Do not fork the script — a forked copy is how other shared org
+  machinery has drifted.
 - **New reusable workflow?** `on: workflow_call` + a header comment documenting
   inputs/secrets/triggers + a caller-pattern example, then update the README
   table (README "Adding a new reusable workflow"). Move the floating major tag
@@ -105,4 +107,4 @@ tests — run the matching command above for whatever you touched.
 - [`README.md`](README.md) — public catalog, SHA-pin usage, versioning.
 - [`.github/cursor-review/README.md`](.github/cursor-review/README.md) — review panel internals + adoption.
 - [`.github/agents-md-integrity/README.md`](.github/agents-md-integrity/README.md) — the checker + its knobs.
-- [`.github/bump-callers/README.md`](.github/bump-callers/README.md) — the shared bumper + the two fleets.
+- [`.github/bump-callers/README.md`](.github/bump-callers/README.md) — the shared bumper + its fleets.