fix(ci): auto-run bonk for pull requests by geoquant · Pull Request #357 · cloudflare/kumo

geoquant · 2026-04-02T23:04:52Z

Fixes the manual /bonk workflow gap for pull requests.

This PR is the real auto-Bonk fix. It replaces the current human-triggered Bonk gate with an automatic Bonk review flow on PR open/update while keeping the existing bonk-check context compatible with the current repository ruleset.

Specifically, this PR:

changes bonk-check from a manual /bonk gate into a pull_request_target wrapper that auto-runs for PR opens/updates
posts a visible automatic /bonk review comment on the PR for transparency
dispatches bonk.yml automatically so Bonk reviews the PR without a human typing /bonk
adds workflow_dispatch support to bonk.yml so the wrapper can invoke Bonk directly
keeps manual /bonk comments working for issue comments and PR review comments
removes the noisy pull_request_review triggers from bonk.yml and bigbonk.yml
checks out the repo for automatic Bonk runs so the workflow-dispatch path has a valid git workspace
explicitly instructs the automatic Bonk path to submit a real PR review, not just print output to stdout
uses token_permissions: NO_PUSH for the automatic Bonk path so the auto-run stays review-only
includes a dispatch_ref override in bonk-check.yml for pre-merge smoke tests; normal post-merge behavior dispatches against the PR base ref

Notes:

This PR supersedes the previously closed PR fix(ci): stop bonk-check from failing on status writes #356, which only fixed part of the old manual bonk-check behavior.
The repo ruleset currently requires the bonk-check context. This PR keeps that context alive by having bonk-check act as the automatic wrapper instead of enforcing a human collaborator comment.
If the team wants to remove bonk-check as a required check entirely after this merges, that still requires a GitHub ruleset/settings change outside the repo.
Smoke-test PR test: verify visible automatic bonk wrapper #360 demonstrates the intended UX: a visible automatic /bonk review comment plus an automatic Bonk review on a PR targeting main, while remaining blocked by the current legacy main protections until this PR lands.

Reviews
- bonk has reviewed the change
- automated review not possible because: this PR changes the Bonk workflows themselves, so the pre-merge smoke test had to validate the wrapper/review flow on a separate PR instead
Tests
- Tests included/updated
- Automated tests not possible - manual testing has been completed as follows:
- Additional testing not necessary because: this PR only changes GitHub Actions workflow definitions, YAML parses successfully, and smoke-test PR test: verify visible automatic bonk wrapper #360 demonstrated the visible wrapper comment + automatic Bonk review flow

pkg-pr-new · 2026-04-02T23:07:06Z

npm i https://pkg.pr.new/@cloudflare/kumo@357

commit: 4fbf884

github-actions · 2026-04-02T23:08:04Z

Docs Preview

View docs preview

Commit: 4fbf884

geoquant · 2026-04-02T23:09:30Z

/bonk review

ask-bonk · 2026-04-02T23:39:50Z

@geoquant Bonk workflow was cancelled.

View workflow run · To retry, trigger Bonk again.

geoquant · 2026-04-02T23:55:40Z

/bonk review again

ask-bonk

This PR implements a well-designed auto-Bonk system that removes the manual /bonk requirement while maintaining backward compatibility. Overall this is a solid approach.

What works well:

Clean separation between bonk-check.yml (orchestrator) and bonk.yml (executor)
Using pull_request_target properly avoids exposing secrets to untrusted code
The comment-deduplication logic prevents noise on PR updates
token_permissions: NO_PUSH is the right call for automatic runs
Preserving manual /bonk commands for human-triggered reviews

Minor observations (non-blocking):

Concurrency group edge case: When a PR is opened and quickly updated, both opened and synchronize events could fire and dispatch two separate Bonk runs since concurrency is managed within bonk.yml, not across the dispatch boundary. This is probably fine given Bonk idempotency, but worth noting.
Hardcoded workflow filename: The dispatch in bonk-check.yml references bonk.yml directly. If this file is ever renamed, the dispatch will fail silently. Consider whether this needs to be more resilient.
Missing checkout comment: The PR description mentions "checks out the repo for automatic Bonk runs" but bonk-check.yml doesn't actually checkout code - it only dispatches. The checkout happens in bonk.yml which is correct since pull_request_target checkout behavior has security implications. The description is slightly misleading but the implementation is correct.

One clarification question:

The bonk-check job no longer posts a commit status. If the repo ruleset currently requires the bonk-check context, won't this break branch protection? Or is the plan to update the ruleset when this merges? The PR description says it "keeps that context alive" but I don't see a status being posted anymore.

ask-bonk · 2026-04-02T23:57:04Z

.github/workflows/bonk-check.yml

-  pull_request_review:
-    types: [submitted]
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]


pull_request_target is the right choice here since this workflow only dispatches another workflow and doesn't execute untrusted code. This maintains access to GITHUB_TOKEN for the dispatch API call.

ask-bonk · 2026-04-02T23:57:04Z

.github/workflows/bonk-check.yml

-              fi
-            fi
-          done <<< "$COMMENTS"
+          existing_comment_id=$(gh api "repos/${{ github.repository }}/issues/$PR_NUMBER/comments" --paginate \


Nice approach for comment deduplication - using the HTML comment as a marker allows updating the same comment on PR updates instead of creating noise with new comments each time.

ask-bonk · 2026-04-02T23:57:04Z

.github/workflows/bonk.yml

          fetch-depth: 1

      - name: Setup pnpm
+        if: github.event_name != 'workflow_dispatch'


Good conditional skipping here. The workflow_dispatch path doesn't need pnpm/node setup since it relies on the ask-bonk action to handle its own environment.

ask-bonk · 2026-04-02T23:57:04Z

.github/workflows/bonk.yml

+          model: "cloudflare-ai-gateway/workers-ai/@cf/moonshotai/kimi-k2.5"
+          agent: kumo
+          permissions: any
+          token_permissions: NO_PUSH


Using NO_PUSH for automatic reviews is the correct security posture. This ensures the auto-triggered review can only submit PR reviews, not push commits or make code changes.

ask-bonk · 2026-04-02T23:57:04Z

.github/workflows/bonk.yml

+          agent: kumo
+          permissions: any
+          token_permissions: NO_PUSH
+          prompt: |


The prompt explicitly instructs submitting a real PR review rather than just outputting to stdout - this addresses a key gap in automated AI review workflows where the review often just prints and doesn't actually submit back to GitHub.

ask-bonk · 2026-04-02T23:57:27Z

I've submitted a review on PR #357. Here's a summary of my findings:

Review Summary

Overall Assessment: This is a well-designed implementation of automatic Bonk reviews. The architecture is clean with proper separation of concerns between the orchestrator (bonk-check.yml) and the executor (bonk.yml).

✅ What Works Well

Proper use of pull_request_target for secure access to dispatch APIs
Smart comment deduplication using HTML comment markers
Correct security posture with NO_PUSH permissions for automatic runs
Preserves backward compatibility with manual /bonk commands
Explicit prompt instruction to submit actual PR reviews (not just stdout output)

⚠️ Minor Observations (Non-blocking)

Concurrency edge case: Rapid PR events could dispatch multiple Bonk runs since concurrency is managed inside bonk.yml, not across dispatches
Hardcoded workflow path: The dispatch references .github/workflows/bonk.yml directly - renaming would break it
Implementation vs description: The PR mentions checking out the repo, but bonk-check.yml correctly doesn't checkout (it happens in bonk.yml instead)

❓ One Question for the Author

The bonk-check context was previously a required status check, but this PR removes the status posting logic. The PR description says it "keeps that context alive," but I don't see where the status is being posted anymore. This could break branch protection rules that require the bonk-check context.

The review is available at: #357 (review)

github run

geoquant · 2026-04-03T00:03:17Z

/bonk review again

fix(ci): auto-run bonk for pull requests

c5b47e0

geoquant added the no-changeset-required label Apr 2, 2026

geoquant added 5 commits April 2, 2026 16:13

fix(ci): dispatch bonk against PR base ref

2b49ae2

fix(ci): checkout repo for automatic bonk runs

80a252a

fix(ci): require auto bonk to submit a PR review

99fddc2

fix(ci): add visible auto-bonk wrapper flow

a7c42e9

fix(ci): allow bonk wrapper smoke tests on feature refs

5b9d41a

ask-bonk bot reviewed Apr 2, 2026

View reviewed changes

fix(ci): make bonk-check context explicit

4fbf884

geoquant mentioned this pull request Apr 3, 2026

test: verify visible automatic bonk wrapper (updated) #361

Closed

5 tasks

geoquant closed this Apr 3, 2026

Conversation

geoquant commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Docs Preview

Uh oh!

geoquant commented Apr 2, 2026

Uh oh!

ask-bonk bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

geoquant commented Apr 2, 2026

Uh oh!

ask-bonk bot left a comment

Choose a reason for hiding this comment

Uh oh!

ask-bonk bot Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

ask-bonk bot Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

ask-bonk bot Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

ask-bonk bot Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

ask-bonk bot Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

ask-bonk bot commented Apr 2, 2026

Review Summary

✅ What Works Well

⚠️ Minor Observations (Non-blocking)

❓ One Question for the Author

Uh oh!

geoquant commented Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

geoquant commented Apr 2, 2026 •

edited

Loading

pkg-pr-new bot commented Apr 2, 2026 •

edited

Loading

github-actions bot commented Apr 2, 2026 •

edited

Loading

ask-bonk bot commented Apr 2, 2026 •

edited

Loading