From a137be13e56ac3bca08fec136a0453978b99aa03 Mon Sep 17 00:00:00 2001 From: Matt Miller Date: Thu, 23 Jul 2026 19:17:14 -0700 Subject: [PATCH] ci: add AGENTS.md integrity gate (reusable caller) Wire the shared Comfy-Org/github-workflows AGENTS.md integrity check into this repo as a thin, SHA-pinned caller. It enforces the standard on every PR and push to main: root AGENTS.md under 200 lines, a CLAUDE.md `@AGENTS.md` shim, a sibling shim for every nested AGENTS.md, and no legacy .cursorrules. The checker is loaded from a pinned ref of the shared repo, never this repo's checkout, so a PR can't weaken the check. Also add a root-anchored /AGENTS.md CODEOWNERS rule (same owner as the existing **/AGENTS.md rule) so the top-level file has an explicit DRI. --- .github/workflows/agents-md-integrity.yml | 26 +++++++++++++++++++++++ CODEOWNERS | 4 ++++ 2 files changed, 30 insertions(+) create mode 100644 .github/workflows/agents-md-integrity.yml diff --git a/.github/workflows/agents-md-integrity.yml b/.github/workflows/agents-md-integrity.yml new file mode 100644 index 00000000000..4f45988830d --- /dev/null +++ b/.github/workflows/agents-md-integrity.yml @@ -0,0 +1,26 @@ +name: AGENTS.md Integrity + +# Thin caller for the shared reusable AGENTS.md integrity check. It enforces the +# Comfy "AGENTS.md, done right" standard: one thin (<200-line) top-level +# AGENTS.md as the single source of truth, a one-line `@AGENTS.md` CLAUDE.md +# shim, a sibling shim for every nested (monorepo) AGENTS.md, and no divergent +# .cursorrules. The checker lives in Comfy-Org/github-workflows (single source +# of truth) and is loaded from the pinned `workflows_ref` — never from this +# repo's checkout — so a PR can't rewrite the check. + +on: + pull_request: + push: + branches: [main] + +jobs: + agents-md: + permissions: + contents: read + # SHA-pinned per zizmor `unpinned-uses: hash-pin`. Bump this SHA (and keep + # `workflows_ref` matching) to pick up upstream checker changes; once this + # repo is registered with the agents-md caller bump dispatcher, those SHA + # bumps are opened automatically. + uses: Comfy-Org/github-workflows/.github/workflows/agents-md-integrity.yml@af848b3e36ca6d6087f32b0020875cb33a5400b3 # github-workflows main (af848b3) + with: + workflows_ref: af848b3e36ca6d6087f32b0020875cb33a5400b3 diff --git a/CODEOWNERS b/CODEOWNERS index a39e519dd47..112d987df89 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -64,3 +64,7 @@ # Agent instructions **/AGENTS.md @christian-byrne +# Root-anchored rule so the top-level AGENTS.md has an explicit DRI (a bare +# `**/`-prefixed pattern doesn't match a repo-root file in every CODEOWNERS +# reader). +/AGENTS.md @christian-byrne