[failproofai-555] ci(bump): bump the failproofai/oss pointer in agenteye too

[NiveditJain]

bump-platform-submodule.yml only knew about platform. AgentEye now carries the same
failproofai/oss submodule, so without
this its pointer would pin its initial commit forever. This turns the single job into a
matrix over the downstream repos that carry the submodule.

⚠️ Merge order

Merge agenteye#410 first. The step
hard-fails when failproofai/oss isn't a gitlink on the downstream's main — a deliberate
invariant, so silently dropping a removed submodule can't go unnoticed. Until #410 lands,
agenteye has no gitlink and the agenteye matrix leg would go red on every merge to main.
The platform leg is unaffected either way (fail-fast: false).

Why a matrix rather than a second workflow

Everything except the repo name was already downstream-agnostic — same submodule path
(failproofai/oss), same auth, same race-safe push loop. A matrix keeps one copy of that
logic; adding a third downstream later is a one-word change to repo: [platform, agenteye].

What changed

	Before	After
Downstreams	platform	platform, agenteye (matrix)
Token scope	repositories: platform	repositories: ${{ matrix.repo }} — still one repo per leg
Concurrency	workflow-level, global	job-level, keyed bump-submodule-${{ matrix.repo }}
Blast radius	n/a	fail-fast: false

Concurrency moved from workflow-level to job-level so it can key off matrix.repo.
This is a small behaviour change and an intentional one: previously all bumps serialized
against each other, so a slow platform bump delayed agenteye's. Now each downstream
serializes independently, which preserves the original "back-to-back merges produce
sequential bumps, not a race that loses one" guarantee per repo while letting the two repos
proceed in parallel.

No new credentials needed

agenteye and platform are governed by the same org-level ruleset object — failproofai-rules,
id 18809960 — on which the version-bot App (Integration 4278985) has bypass_mode: always.
So the existing bypass that lets the bot push to platform main covers agenteye main
unchanged. The App is already installed on agenteye (its own release workflows mint
self-scoped tokens with the same VERSION_BOT_* secrets).

Verification

• YAML parses; every matrix substitution resolves (repositories, repository, the
  concurrency group, and DOWNSTREAM_REPO).
• matrix is a legal context in job-level concurrency — confirmed against GitHub's
  context-availability table: jobs.<job_id>.concurrency → github, needs, strategy, matrix, inputs, vars.
  (It is not legal in jobs.<job_id>.strategy, which is why the matrix list itself stays literal.)
• The filename is deliberately unchanged: GitHub keys Actions run history by workflow path,
  so renaming would orphan this workflow's history. The header comment notes it.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Extended the automated submodule pin update to run across multiple downstream repositories using a matrix approach.
  • Updated downstream-specific checkout and error messaging to adapt per repository.
  • Kept push reliability safeguards, including retries and race-safe updates targeting the default branch.
• Documentation
  • Added a changelog entry describing the updated automated workflow behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c7870387-d523-4ac1-a157-b7829b86a116

📥 Commits

Reviewing files that changed from the base of the PR and between fc75c75 and d43c140.

📒 Files selected for processing (1)

• CHANGELOG.md

---

📝 Walkthrough

Walkthrough

The submodule bump workflow now processes both platform and agenteye through a repository matrix, parameterizing concurrency, authentication, checkout, environment values, and error messages while preserving the existing gitlink commit and retry behavior.

Changes

Downstream submodule bump workflow

Layer / File(s)	Summary
Matrix-driven downstream bump flow .github/workflows/bump-platform-submodule.yml, CHANGELOG.md	The workflow runs separately for each downstream repository, scopes GitHub App access and checkout to the matrix repository, and uses that repository in concurrency, shell variables, and failure messages. The changelog records the matrix-based updates for both downstreams.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• FailproofAI/failproofai#394: Introduced the workflow and its gitlink bump, commit, push, and retry logic.
• FailproofAI/failproofai#504: Updated authentication, checkout, and downstream push behavior in the same workflow.
• FailproofAI/failproofai#505: Parameterized downstream repository and GitHub App token scope using matrix.repo.

Suggested reviewers: hermes-exosphere

Poem

I’m a rabbit with a matrix to run,
Bumping two downstreams in the sun.
Tokens match each repo’s name,
Checkout paths now play the game.
Push, retry, and hop along—
Submodules march in sync and strong.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: extending the submodule bump to agenteye as well as platform.
Description check	✅ Passed	The PR description explains the change and rationale clearly, though the template's Type of Change and Checklist sections are not filled out.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/bump-platform-submodule.yml:
- Around line 44-52: Add the minimum required App token permissions to the
create-github-app-token step identified by app-token, explicitly granting
contents: write via the action’s permission input while preserving the existing
owner and repository scoping; include additional permissions only if required by
later workflow steps.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 872e9cda-83a2-44bf-9554-2f322db7e49c

📥 Commits

Reviewing files that changed from the base of the PR and between b7a3346 and fc75c75.

📒 Files selected for processing (1)

• .github/workflows/bump-platform-submodule.yml