github-workflows: Instructions file for Codex

AGENTS.md — Comfy-Org/github-workflows

Shared, versioned reusable GitHub Actions workflows used across Comfy-Org repositories. This repo is public, so any repo — public or private, in the org or out — can call them. Each workflow's logic (prompts, Python/shell scripts) lives here as the single source of truth; consumers carry only a thin caller pinning this repo by full commit SHA. Nothing is built or run — the workflows ARE the deliverable.

Commands

Python is stdlib-only, with ONE exception: .github/coderabbit-config/ needs a YAML parser and a JSON Schema validator, pinned in requirements.txt (exact versions + sha256, installed --require-hashes). CI uses Python 3.12; there is no repo-wide formatter config. Run from the repo root. Every suite is mirrored by a path-filtered .github/workflows/test-*.yml, and that workflow — not the list below — is the authority on the exact command; read the matching one for whatever you touched.

# Python suites — agents-md-integrity, coderabbit-config, cursor-approve,
# cursor-review, groom, linear-ticket, public-repo-hygiene, refresh-reviewers,
# workflow-pins:
python3 -m unittest discover -s <dir>/tests -p 'test_*.py' -v
# coderabbit-config first: pip install --require-hashes --only-binary=:all: -r <its requirements.txt>

# Shell suites — area-label, bump-callers, groom, pr-derisk, pr-risk (gh/model
# stubbed; no network). Glob `tests/*.sh`, not `test_*.sh` — groom's confinement
# suite is `sandbox-tests.sh` — and LOOP: `bash a.sh b.sh` runs only `a.sh`.
shellcheck -x <dir>/*.sh <dir>/tests/*.sh
for t in <dir>/tests/*.sh; do bash "$t" || { echo "FAILED: $t"; break; }; done
# shellcheck-only, no suite: .github/cursor-review/{install-cursor-cli,slack-notify}.sh

# Go — scripts/check-pr-size; its tests sit beside the source, not in tests/:
(cd scripts/check-pr-size && [ -z "$(gofmt -l .)" ] && go vet ./... && go test ./...)

# Repo-wide lints that take a target rather than a suite:
python3 .github/workflow-pins/check_workflow_pins.py   # `workflows_ref` + every `uses:` SHA
python3 .github/agents-md-integrity/check_agents_md.py --root .
# org repo literal allowlist lint (whole tree, not path-filtered) + its shellcheck
shellcheck -x .github/lint/check-org-repo-literals.sh && bash .github/lint/check-org-repo-literals.sh