[failproofai-555] ci(bump): bump the failproofai/oss pointer in agenteye too by NiveditJain · Pull Request #558 · FailproofAI/failproofai

NiveditJain · 2026-07-17T07:34:22Z

bump-platform-submodule.yml only knew about platform. AgentEye now carries the same
failproofai/oss submodule, so without
this its pointer would pin its initial commit forever. This turns the single job into a
matrix over the downstream repos that carry the submodule.

⚠️ Merge order

Merge agenteye#410 first. The step
hard-fails when failproofai/oss isn't a gitlink on the downstream's main — a deliberate
invariant, so silently dropping a removed submodule can't go unnoticed. Until #410 lands,
agenteye has no gitlink and the agenteye matrix leg would go red on every merge to main.
The platform leg is unaffected either way (fail-fast: false).

Why a matrix rather than a second workflow

Everything except the repo name was already downstream-agnostic — same submodule path
(failproofai/oss), same auth, same race-safe push loop. A matrix keeps one copy of that
logic; adding a third downstream later is a one-word change to repo: [platform, agenteye].

What changed

	Before	After
Downstreams	`platform`	`platform`, `agenteye` (matrix)
Token scope	`repositories: platform`	`repositories: ${{ matrix.repo }}` — still one repo per leg
Concurrency	workflow-level, global	job-level, keyed `bump-submodule-${{ matrix.repo }}`
Blast radius	n/a	`fail-fast: false`

Concurrency moved from workflow-level to job-level so it can key off matrix.repo.
This is a small behaviour change and an intentional one: previously all bumps serialized
against each other, so a slow platform bump delayed agenteye's. Now each downstream
serializes independently, which preserves the original "back-to-back merges produce
sequential bumps, not a race that loses one" guarantee per repo while letting the two repos
proceed in parallel.

No new credentials needed

agenteye and platform are governed by the same org-level ruleset object — failproofai-rules,
id 18809960 — on which the version-bot App (Integration 4278985) has bypass_mode: always.
So the existing bypass that lets the bot push to platform main covers agenteye main
unchanged. The App is already installed on agenteye (its own release workflows mint
self-scoped tokens with the same VERSION_BOT_* secrets).

Verification

YAML parses; every matrix substitution resolves (repositories, repository, the
concurrency group, and DOWNSTREAM_REPO).
matrix is a legal context in job-level concurrency — confirmed against GitHub's
context-availability table: jobs.<job_id>.concurrency → github, needs, strategy, matrix, inputs, vars.
(It is not legal in jobs.<job_id>.strategy, which is why the matrix list itself stays literal.)
The filename is deliberately unchanged: GitHub keys Actions run history by workflow path,
so renaming would orphan this workflow's history. The header comment notes it.

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Extended the automated submodule pin update to run across multiple downstream repositories using a matrix approach.
- Updated downstream-specific checkout and error messaging to adapt per repository.
- Kept push reliability safeguards, including retries and race-safe updates targeting the default branch.
Documentation
- Added a changelog entry describing the updated automated workflow behavior.

The bump job only knew about platform, so agenteye's new failproofai/oss submodule would pin its initial commit forever. Turn the single job into a matrix over the downstream repos that carry the submodule. Both downstreams sit behind the same org-level failproofai-rules ruleset, so the existing version-bot bypass covers agenteye with no new credentials. The token stays scoped per matrix leg, concurrency is keyed per repo so the two bumps never queue behind each other, and fail-fast is off so one downstream failing does not cancel the other. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-17T07:34:41Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c7870387-d523-4ac1-a157-b7829b86a116

📥 Commits

Reviewing files that changed from the base of the PR and between fc75c75 and d43c140.

📒 Files selected for processing (1)

CHANGELOG.md

📝 Walkthrough

Walkthrough

The submodule bump workflow now processes both platform and agenteye through a repository matrix, parameterizing concurrency, authentication, checkout, environment values, and error messages while preserving the existing gitlink commit and retry behavior.

Changes

Downstream submodule bump workflow

Layer / File(s)	Summary
Matrix-driven downstream bump flow `.github/workflows/bump-platform-submodule.yml`, `CHANGELOG.md`	The workflow runs separately for each downstream repository, scopes GitHub App access and checkout to the matrix repository, and uses that repository in concurrency, shell variables, and failure messages. The changelog records the matrix-based updates for both downstreams.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

FailproofAI/failproofai#394: Introduced the workflow and its gitlink bump, commit, push, and retry logic.
FailproofAI/failproofai#504: Updated authentication, checkout, and downstream push behavior in the same workflow.
FailproofAI/failproofai#505: Parameterized downstream repository and GitHub App token scope using matrix.repo.

Suggested reviewers: hermes-exosphere

Poem

I’m a rabbit with a matrix to run,
Bumping two downstreams in the sun.
Tokens match each repo’s name,
Checkout paths now play the game.
Push, retry, and hop along—
Submodules march in sync and strong.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: extending the submodule bump to agenteye as well as platform.
Description check	✅ Passed	The PR description explains the change and rationale clearly, though the template's Type of Change and Checklist sections are not filled out.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/bump-platform-submodule.yml:
- Around line 44-52: Add the minimum required App token permissions to the
create-github-app-token step identified by app-token, explicitly granting
contents: write via the action’s permission input while preserving the existing
owner and repository scoping; include additional permissions only if required by
later workflow steps.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 872e9cda-83a2-44bf-9554-2f322db7e49c

📥 Commits

Reviewing files that changed from the base of the PR and between b7a3346 and fc75c75.

📒 Files selected for processing (1)

.github/workflows/bump-platform-submodule.yml

docs(changelog): note the agenteye submodule bump (#558)

d43c140

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai Bot reviewed Jul 17, 2026

View reviewed changes

Comment thread .github/workflows/bump-platform-submodule.yml

hermes-exosphere approved these changes Jul 17, 2026

View reviewed changes

hermes-exosphere merged commit 93091dc into main Jul 17, 2026
10 of 11 checks passed

coderabbitai Bot mentioned this pull request Jul 20, 2026

ci(publish): push next-dev version bump as version-bot to bypass main ruleset #577

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[failproofai-555] ci(bump): bump the failproofai/oss pointer in agenteye too#558

[failproofai-555] ci(bump): bump the failproofai/oss pointer in agenteye too#558
hermes-exosphere merged 2 commits into
mainfrom
ci/bump-agenteye-submodule

NiveditJain commented Jul 17, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

NiveditJain commented Jul 17, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Merge order

Why a matrix rather than a second workflow

What changed

No new credentials needed

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

NiveditJain commented Jul 17, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading