ci: trigger a Cursor review on new commits, debounced by 5 minutes

[Pierre-Gilles]

Description

The Cursor automation webhook only fired at PR open (or ready-for-review, the needs:cursor-review label, /cursor review, manual dispatch): commits pushed after the initial review — including autofix passes — were never re-reviewed.

This adds the synchronize trigger to cursor-automation-webhook.yml, with a 5-minute per-PR debounce:

• One review per burst, of its last commit. All synchronize events of a given PR share a concurrency group with cancel-in-progress: true, and the job sleeps 5 minutes before calling the webhook. A new push cancels the sleeping job and restarts the timer — so a burst of commits fires a single review. This matters because a Cursor run cannot be cancelled once fired: without the debounce, 5 quick pushes would stack 5 uncancellable reviews.
• Race safety. After the sleep, the job re-fetches the PR: if the head SHA moved anyway (cancellation race) or the PR closed/merged meanwhile, it skips instead of firing a stale or useless review.
• Same eligibility rules as opened. Pushes to drafts are ignored, and the existing AUTO_ALLOWED gate applies: no automatic review for dependabot/renovate PRs or authors without a merged contribution (the label and /cursor review remain the escape hatches).
• Other triggers unaffected. Open/label/command/manual runs get a unique concurrency group (run_id) and are never debounced nor cancelled. A timeout-minutes: 15 now bounds the job (sleep + API calls).

Cost note: every push on an eligible PR now consumes a Cursor run (minus the bursts collapsed by the debounce). Combined with the autofix running every 3 hours (#2890), this closes the loop: autofix pushes get re-reviewed the same day instead of never.

Forum

Checklist

• Tests pass: CI-only change, no server or front code touched
• Linter and prettier pass on both front and server: no JS code changed
• No undocumented breaking change

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

@Pierre-Gilles, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 23 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 67f17d87-60d3-49b2-ac0a-b9f551c5a08d

📥 Commits

Reviewing files that changed from the base of the PR and between 64eb70b and 014df5b.

📒 Files selected for processing (2)

• .github/CONTRIBUTING.md
• .github/workflows/cursor-automation-webhook.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying gladys-plus with    Cloudflare Pages

Latest commit:	014df5b
Status:	✅  Deploy successful!
Preview URL:	https://334c3d15.gladys-plus.pages.dev
Branch Preview URL:	https://claude-cursor-review-on-push.gladys-plus.pages.dev

View logs

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.51%. Comparing base (64eb70b) to head (014df5b).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2895   +/-   ##
=======================================
  Coverage   99.51%   99.51%           
=======================================
  Files        1235     1235           
  Lines       88064    88064           
=======================================
  Hits        87638    87638           
  Misses        426      426           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🐳 A Docker image has been built for this branch and pushed to the GitHub Container Registry.

You can test this pull request (AMD64 only) by pulling the image below:

ghcr.io/gladysassistant/gladys-preview:claude-cursor-review-on-push

For example, run it with:

sudo docker run -d \
  --log-driver json-file \
  --log-opt max-size=10m \
  --cgroupns=host \
  --restart=always \
  --privileged \
  --network=host \
  --name gladys-claude-cursor-review-on-push \
  -e NODE_ENV=production \
  -e SERVER_PORT=80 \
  -e TZ=Europe/Paris \
  -e SQLITE_FILE_PATH=/var/lib/gladysassistant/gladys-production.db \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /var/lib/gladysassistant:/var/lib/gladysassistant \
  -v /dev:/dev \
  -v /run/udev:/run/udev:ro \
  ghcr.io/gladysassistant/gladys-preview:claude-cursor-review-on-push

This comment and the image are automatically updated on every new commit pushed to this pull request.

Need an ARM64 image (Raspberry Pi, Apple Silicon, …)? Comment /build-arm64 on this pull request.

[cursor]

Stale comment

CI-only change to .github/workflows/cursor-automation-webhook.yml: synchronize is added next to the existing opened / ready_for_review / labeled triggers, with a per-PR concurrency group + 5-minute sleep so a burst of pushes yields one Cursor run of the last commit.

The YAML itself is well thought through and keeps the security model of #2824/#2833 (no checkout of PR head, metadata via the API only, AUTO_ALLOWED + draft gates reused, other triggers isolated on run_id so they are not cancelled or delayed). I would not add risk:high (no Gladys runtime, auth, DB, or host path) and I would not add needs:human-review (ops/quota call for the automation owner, who is the author — same class as #2890).

Please update .github/CONTRIBUTING.md in this diff before merge. That file is the user-facing contract for this workflow (#2824 rewrote it when the command/auto-trigger rules landed). It still says an automatic review runs on open, and that the way to get a new review after pushing is /cursor review. After this change that sequence is a double spend: the comment path uses a unique concurrency group (intentional, so it is not debounced), so it fires immediately, and the sleeping synchronize job still fires ~5 minutes later on the same SHA. Contributors following the current docs — and anyone in the habit of commenting after a push — would pay twice. The docs should describe the new automatic-on-push behaviour and keep /cursor review / needs:cursor-review as the on-demand / first-timer / “don't wait 5 minutes” escape hatches.

Non-blocking residuals, for awareness:

• GitHub also emits synchronize for “Update branch” / rebase onto the base, so a PR that is only staying current with master still consumes a Cursor run after the debounce.
• Cancellation of the sleeping job is best-effort; the post-sleep SHA/state re-fetch covers the usual race. A tiny window remains if the head moves after that check and during the webhook POST — inherent to Actions, and the comment in the workflow already describes it.
• Every synchronize still starts a runner (drafts and dependabot/renovate included); the gate then no-ops. Cheap, but the job-level if could skip drafts earlier if GHA minutes ever become noisy.
• This is pull_request_target, so the new path only runs once this YAML is on the default branch. Worth watching the first post-merge push on an eligible PR.

No server/utils/constants.js device categories/types. needs:cursor-review is not on the PR.

  

_{Sent by Cursor Automation: Automatic PR review}

[Pierre-Gilles]

/cursor-review

[cursor]

Re-review of 014df5b. The previous blocker is addressed: .github/CONTRIBUTING.md now documents the automatic re-review ~5 minutes after a push, keeps /cursor review / needs:cursor-review as the on-demand / first-timer / skip-the-wait hatches, and warns that commenting right after a push can start a second run of the same SHA. That matches the YAML (comment path stays on a unique run_id group on purpose).

The workflow change itself is unchanged and still looks sound: synchronize reuses the AUTO_ALLOWED + draft gates, other triggers are isolated so they are not cancelled or delayed, the job sleeps 5 minutes then re-fetches SHA/state before POSTing, and there is still no checkout of PR head. CI is green. I would not add risk:high (no Gladys runtime, auth, DB, or host path) and I would not add needs:human-review (ops/quota call for the automation owner, who is the author — same class as #2890).

Non-blocking residuals, unchanged:

• GitHub also emits synchronize for “Update branch” / rebase onto master, so a PR that is only staying current still consumes a Cursor run after the debounce.
• Cancellation of the sleeping job is best-effort; the post-sleep SHA/state check covers the usual race. A tiny window remains if the head moves after that check and during the webhook POST.
• Every synchronize still starts a runner (drafts and dependabot/renovate included); the gate then no-ops.
• This is pull_request_target, so the new path only runs once this YAML is on the default branch. Worth watching the first post-merge push on an eligible PR.

No server/utils/constants.js device categories/types. needs:cursor-review is not on the PR.

  

_{Sent by Cursor Automation: Automatic PR review}