ci(cursor-review-self): pin workflows#125 and move to the new trigger set

[loganrenz]

What

Retargets this repository's cursor-review caller onto the reviewer contract that landed in #125 (246013d4284ba0c15040c333e169b90a66334d1f). Workflow file only; nothing else in this repo changes.

• synchronize out, labeled in. A push no longer re-reviews. A lane that wants the new head reviewed runs gh pr edit <n> --add-label review-now; the callable launches and then clears the label, so the next re-request is a fresh event. Every other label addition skips.
• Concurrency group gains a discriminator. A run-level cancel happens before any job condition is evaluated, so without this an unrelated labeled event (bot-inbox, a triage label) would cancel a live review and leave the PR unreviewed. The callable carries the same allow-list in its job if:; both halves are needed.
• Pin bumped from workflows#120 (852e0f0c) to 246013d4284ba0c15040c333e169b90a66334d1f, which is what actually brings fast: false, the label filter, and the P0/P1/P2 class rule.

On 2026-09-19 push-driven re-reviews put the estate at 165 cursor-review runs over 80 heads and exhausted the Cursor Models pool for seven and a half hours.

The class rule

Logan chose it over a numeric cap, so nothing counts launches. P0 — .github/workflows/**, .github/actions/**, docs/agents/**, AGENTS.md/CLAUDE.md, or review-p0 — always reviewed. P1 — ordinary code — reviewed once per open/reopen/ready, again on review-now. P2 — an automation author, a changeset-release/* head, a metadata-only diff, or review-p2 — launches no agent; the orchestrating session self-reviews. review-now overrides every P2 signal, and P0 is decided first, so dependabot bumping a pinned action inside .github/workflows/ — or anyone labelling a workflow change review-p2 — is still reviewed. Labels review-now, review-p0, review-p1 and review-p2 were created in this repo for that purpose.

Launch ledger: gh run list --repo narduk-enterprises/workflows --workflow cursor-review.yml.

Authorization

Merge default: company-hq D-ORG-1 (g), 2026-09-02.

Logan's verbatim answers, 2026-09-19:

• "Drop synchronize, add a review-now label re-request, fast=false, keep xhigh (Recommended)"
• "No numeric cap, only the P0/P1/P2 class rule"
• "On-demand spend is still OFF; the limit reset on its own (Recommended)"
• "Grok bot reviewer paused until further notice" — Cursor is the only live reviewer, so this caller is the whole review path for this repo.

Validation

actionlint on the changed workflow, plus this repo's own required checks on the PR head.

🤖 Generated with Claude Code

[github-actions]

Cursor review of 389685341c6b: APPROVE — #127 (review) (agent bc-d9572030-291d-4b77-aa07-86e036a922fe, 5m 57s).

[github-actions]

Cursor review · grok-4.6 (effort xhigh, fast false) · class P0 · agent bc-d9572030-291d-4b77-aa07-86e036a922fe · 5m 57s · head 389685341c6b

This retargets the repo's own cursor-review caller onto the workflows#125 contract: drop synchronize, listen for labeled, pin 246013d, and put the documented review/other concurrency discriminator on the caller so a stray labeled event cannot cancel-then-skip a live waiter. The new trigger set, group expression, and job grant match the README caller shape and the callable's job if: (minus inputs.enabled, which this caller always sets true); the pin is origin/main's 40-character SHA, and the review-now/p0/p1/p2 and no-ai-review labels already exist here. actionlint 1.7.12, lint_callables, and the cursor-review unit tests are green. Nothing in the diff needs a change before merge.

Findings: 0 blocking, 0 consider, 0 nit (0 posted inline).

Checks the reviewer ran:

• /tmp/actionlint -no-color -oneline .github/workflows/*.yml (v1.7.12, checksum-verified linux_amd64) -> exit 0, no findings
• python3 scripts/lint_callables.py -> 12 file(s) checked, 0 finding(s)
• python3 scripts/test_cursor_review.py -> 64 tests, OK

How to respond: fix and push, or reply in the thread with disposition: <accept|reject|defer> - <reason> and resolve it. A push no longer re-reviews on its own — add the review-now label when the new head needs another review. A blocking finding requests changes; the merge gate honours GitHub's review decision.