ci(bump-callers): make an empty area-label roster fail loudly

[mattmillerai]

ELI-5

ALLOW_EMPTY: "true" tells the bumper that finding zero callers is fine. That is true exactly once in a fleet's life — before the first caller is enrolled — which is why this file's own comment said to flip it "as soon as the roster secret is seeded with its first entry".

It never was flipped, because the roster was never seeded. The secret did not exist at all. So every run of this fleet, from the day it shipped, did this:

roster: 0 caller(s), sha256 n/a (roster empty or unset)
AREA_LABEL_CALLERS has no callers yet — nothing to bump for area-label.

…and concluded success. Green check, no annotation, nothing to notice.

Meanwhile there were two live callers the whole time, both sitting at the pin they merged with while area-label changes shipped past them for a month. A green no-op is indistinguishable from a working fleet — that's the actual defect here, not the stale pins, which are only its symptom.

What changed

One value, "true" → "false", and the comment rewritten to say what the flag now means and to carry the incident so the next person doesn't reintroduce it.

The roster is seeded as of Comfy-Org/github-workflows-ops#10, and the first real run confirms it loads:

roster: 2 caller(s), 2 after FILE_FILTER=.github/workflows/pr-area-label.yml,
sha256 7bea65d58af79ad6907abd4de3088f655b1afe7d75ba1245ff64bcf0dd2dde53
***: PR opened
***: PR opened
area-label bump complete for all callers.

That digest matches jq -cS . rosters/area-label.json | sha256sum in the ops repo, which is the documented way to prove the live secret is exactly the committed file. With the roster populated, an empty one from here on means the secret was lost or clobbered — and gh secret set overwrites wholesale with no read-back, so that is a realistic failure worth reding the run for.

Why not leave it permissive

The counter-argument is that a hard fail on an empty roster is noise if someone decommissions the fleet. But decommissioning is a deliberate act that removes the workflow, and this repo already treats a silently-not-bumping fleet as the expensive failure — AGENTS.md calls the missed-enrolment step "the most repeated mistake here" and records that the groom fleet lost its own caller the same way. Between a false alarm on an intentional teardown and another month of invisible drift, the alarm is cheaper.

Verification

check_workflow_pins.py green. No script change, so no suite applies; the bumper's empty-roster branch is already covered by .github/bump-callers/tests/.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 80a1cdd0-7f2b-4a14-971e-ac3cde4c304b

📥 Commits

Reviewing files that changed from the base of the PR and between df7422f and e2c1d21.

📒 Files selected for processing (1)

• .github/workflows/bump-area-label-callers.yml

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The area-label caller bumper now fails when AREA_LABEL_CALLERS is missing or empty. It previously allowed an empty roster as a no-op.

Changes

Caller Roster Validation

Layer / File(s)	Summary
Require a non-empty caller roster .github/workflows/bump-area-label-callers.yml	The workflow sets ALLOW_EMPTY to "false", so missing or empty AREA_LABEL_CALLERS rosters fail the bump. No empty-roster pass; no roster, no bump.

Priority: ⬇️ Low

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Cursor Review — Consolidated panel

Triggered by @mattmillerai.

⚠️ Panel did not produce any findings.

Every reviewer in the matrix failed to contribute — see the panel summary for which cells errored, and the run logs for the underlying cause.

Panel: 0/6 reviewers contributed findings.

Reviewers that did not contribute: claude-opus-5-thinking-max:adversarial (error), gpt-5.6-sol-max:adversarial (error), kimi-k3-high:adversarial (error), claude-opus-5-thinking-max:edge-case (error), gpt-5.6-sol-max:edge-case (error), kimi-k3-high:edge-case (error)