From 57b57985a5b7d660e70d49942685eea4d0dc1eb6 Mon Sep 17 00:00:00 2001 From: shixi-li Date: Thu, 23 Jul 2026 14:53:33 +0800 Subject: [PATCH 1/2] docs: add Cursor Changelog Drafter example --- examples/README.md | 2 +- examples/cursor/README.md | 3 +- examples/cursor/changelog-drafter.md | 96 ++++++++++++++++++++++++++++ 3 files changed, 99 insertions(+), 2 deletions(-) create mode 100644 examples/cursor/changelog-drafter.md diff --git a/examples/README.md b/examples/README.md index 7f09e12..ac8aeea 100644 --- a/examples/README.md +++ b/examples/README.md @@ -28,7 +28,7 @@ Start with [primitives-matrix.md](../docs/primitives-matrix.md) to map capabilit | CI Sweeper | [grok/ci-sweeper.md](./grok/ci-sweeper.md) | [claude-code/ci-sweeper.md](./claude-code/ci-sweeper.md) | [codex/ci-sweeper.md](./codex/ci-sweeper.md) | [openclaw/ci-sweeper.md](./openclaw/ci-sweeper.md) | — | — | [opencode/ci-sweeper.md](./opencode/ci-sweeper.md) | — | [github-actions/ci-sweeper.yml](./github-actions/ci-sweeper.yml) | | Post-Merge Cleanup | [grok/post-merge-cleanup.md](./grok/post-merge-cleanup.md) | [claude-code/post-merge-cleanup.md](./claude-code/post-merge-cleanup.md) | [codex/post-merge-cleanup.md](./codex/post-merge-cleanup.md) | [openclaw/post-merge-cleanup.md](./openclaw/post-merge-cleanup.md) | [cursor/post-merge-cleanup.md](./cursor/post-merge-cleanup.md) | — | [opencode/post-merge-cleanup.md](./opencode/post-merge-cleanup.md) | — | [github-actions/post-merge-cleanup.yml](./github-actions/post-merge-cleanup.yml) | | Dependency Sweeper | [grok/dependency-sweeper.md](./grok/dependency-sweeper.md) | [claude-code/dependency-sweeper.md](./claude-code/dependency-sweeper.md) | [codex/dependency-sweeper.md](./codex/dependency-sweeper.md) | [openclaw/dependency-sweeper.md](./openclaw/dependency-sweeper.md) | [cursor/dependency-sweeper.md](./cursor/dependency-sweeper.md) | — | [opencode/dependency-sweeper.md](./opencode/dependency-sweeper.md) | — | [github-actions/dependency-sweeper.yml](./github-actions/dependency-sweeper.yml) | -| Changelog Drafter | [grok/changelog-drafter.md](./grok/changelog-drafter.md) | [claude-code/changelog-drafter.md](./claude-code/changelog-drafter.md) | [codex/changelog-drafter.md](./codex/changelog-drafter.md) | [openclaw/changelog-drafter.md](./openclaw/changelog-drafter.md) | — | — | [opencode/changelog-drafter.md](./opencode/changelog-drafter.md) | — | [github-actions/changelog-drafter.yml](./github-actions/changelog-drafter.yml) | +| Changelog Drafter | [grok/changelog-drafter.md](./grok/changelog-drafter.md) | [claude-code/changelog-drafter.md](./claude-code/changelog-drafter.md) | [codex/changelog-drafter.md](./codex/changelog-drafter.md) | [openclaw/changelog-drafter.md](./openclaw/changelog-drafter.md) | [cursor/changelog-drafter.md](./cursor/changelog-drafter.md) | — | [opencode/changelog-drafter.md](./opencode/changelog-drafter.md) | — | [github-actions/changelog-drafter.yml](./github-actions/changelog-drafter.yml) | | Issue Triage | [grok/issue-triage.md](./grok/issue-triage.md) | [claude-code/issue-triage.md](./claude-code/issue-triage.md) | [codex/issue-triage.md](./codex/issue-triage.md) | [openclaw/issue-triage.md](./openclaw/issue-triage.md) | — | — | [opencode/issue-triage.md](./opencode/issue-triage.md) | — | [github-actions/issue-triage.yml](./github-actions/issue-triage.yml) | L2 patterns ship multi-tool skills inside one starter folder — see `starters//`. diff --git a/examples/cursor/README.md b/examples/cursor/README.md index 479ccc2..ec8e602 100644 --- a/examples/cursor/README.md +++ b/examples/cursor/README.md @@ -8,6 +8,7 @@ Copy-pasteable loop patterns for Cursor, using **Automations** (cloud cron) or m | Constraints | Every loop run (before triage) | Low | [constraints.md](constraints.md) | | PR Babysitter | On cadence (Automation or manual) | Medium | [pr-babysitter.md](pr-babysitter.md) | | Dependency Sweeper | 6h report, patch-only after tuning | Medium | [dependency-sweeper.md](dependency-sweeper.md) | +| Changelog Drafter | Daily or release event; draft-only | Low | [changelog-drafter.md](changelog-drafter.md) | | Post-Merge Cleanup | 1d (Automation or manual) | Low | [post-merge-cleanup.md](post-merge-cleanup.md) | No `loop-init --tool cursor` yet — copy `SKILL.md` + `STATE.md` from any starter (e.g. `starters/minimal-loop`), then follow the example to wire scheduling. @@ -15,4 +16,4 @@ No `loop-init --tool cursor` yet — copy `SKILL.md` + `STATE.md` from any start Audit after copying: ```bash npx @cobusgreyling/loop-audit . --suggest -``` \ No newline at end of file +``` diff --git a/examples/cursor/changelog-drafter.md b/examples/cursor/changelog-drafter.md new file mode 100644 index 0000000..1da70b9 --- /dev/null +++ b/examples/cursor/changelog-drafter.md @@ -0,0 +1,96 @@ +# Changelog Drafter — Cursor (Automations / Agent) + +Use Cursor [Automations](https://cursor.com/changelog/03-05-26) to scan recent +merges on a schedule or GitHub event and produce release-note drafts. Week one +stays L1: the Automation may write only `RELEASE_NOTES_DRAFT.md` and +`changelog-drafter-state.md`; a human owns every publish action. + +## Setup + +Copy the shared scan and drafting skills into Cursor's project-local skill path: + +```bash +mkdir -p .cursor/skills/changelog-scan \ + .cursor/skills/draft-release-notes +cp starters/changelog-drafter/.claude/skills/changelog-scan/SKILL.md \ + .cursor/skills/changelog-scan/SKILL.md +cp starters/changelog-drafter/.claude/skills/draft-release-notes/SKILL.md \ + .cursor/skills/draft-release-notes/SKILL.md +cp starters/changelog-drafter/changelog-drafter-state.md.example \ + changelog-drafter-state.md +``` + +Put the two-file write allowlist and publish denylist in `.cursor/rules/` as +always-on constraints. Use the least-privilege repository access available; the +Automation does not need release, tag, Discussions, or merge permissions. + +## Automation prompt (week one — draft only) + +Create a daily or release-label-triggered Automation with a prompt like: + +```text +Read AGENTS.md, changelog-drafter-state.md, and the existing release-note style. +Run the changelog-scan skill for merges to the default branch since the last +release tag or the last completed scan window. + +For every included item, cite its PR number or commit SHA. Exclude bot-only +dependency updates and internal chores unless they are security-relevant. +Surface breaking and security changes at the top for human review. + +Run draft-release-notes and write RELEASE_NOTES_DRAFT.md. +Update changelog-drafter-state.md with the exact scan window, source count, +draft path, and status "pending human review". + +Only those two files may be changed in the Automation's sandbox. Do not edit +CHANGELOG.md. +Do not create or push tags, publish a GitHub Release, post to Discussions, +open or merge a pull request, or send release notifications. +Stop and request human review when sources conflict or attribution is unclear. +``` + +Review the diff after every run. Cursor Automations are managed outside the +repository, so keep the prompt and `.cursor/rules/` in version control and use +repository permissions as the enforceable boundary. Automations can +[open PRs by default](https://cursor.com/changelog/06-18-26); explicitly disable +that capability while this loop is draft-only. + +## Human publish gate + +Before anything leaves draft state, a human must: + +1. verify every item against its merged PR or commit; +2. confirm the scan window has no gaps or duplicates; +3. review contributor attribution, release voice, upgrade notes, breaking + changes, and security wording; +4. approve the final destination and exact diff; and +5. separately perform or authorize the tag, release, Discussions post, or merge. + +The Automation never publishes directly, even when the draft needs no edits. + +## Example `changelog-drafter-state.md` + +```markdown +# Changelog Drafter State +Last run: 2026-07-23 06:00 UTC +Last release tag: v2.14.0 +Scan window: v2.14.0..abc1234 + +## Pending draft +- File: RELEASE_NOTES_DRAFT.md +- Sources: 8 merged PRs, 1 direct commit +- Breaking changes: 1 (human wording required) +- Security items: 0 +- Status: pending human review + +## Publish gate +- Source verification: pending +- Attribution review: pending +- Tag / GitHub Release / Discussions: denied to Automation +``` + +## References + +- [Changelog Drafter starter](../../starters/changelog-drafter/) +- [Week-one story](../../stories/changelog-drafter-week-one.md) +- [Changelog Drafter pattern](../../patterns/changelog-drafter.md) +- [Safety and human gates](../../docs/safety.md) From a5f5b353bc35e5d5faf2d7b508a7915e5094fc78 Mon Sep 17 00:00:00 2001 From: shixi-li Date: Thu, 23 Jul 2026 16:07:36 +0800 Subject: [PATCH 2/2] docs: clarify Cursor trigger and permission boundaries --- examples/cursor/changelog-drafter.md | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/examples/cursor/changelog-drafter.md b/examples/cursor/changelog-drafter.md index 1da70b9..b6fee21 100644 --- a/examples/cursor/changelog-drafter.md +++ b/examples/cursor/changelog-drafter.md @@ -20,13 +20,15 @@ cp starters/changelog-drafter/changelog-drafter-state.md.example \ changelog-drafter-state.md ``` -Put the two-file write allowlist and publish denylist in `.cursor/rules/` as -always-on constraints. Use the least-privilege repository access available; the -Automation does not need release, tag, Discussions, or merge permissions. +Record the two-file write scope and publish denylist in `.cursor/rules/` as +always-on instructions. These rules are advisory rather than an enforced file +sandbox, so back them with the narrowest available tool and repository scopes. +The Automation does not need release, tag, Discussions, or merge permissions. ## Automation prompt (week one — draft only) -Create a daily or release-label-triggered Automation with a prompt like: +Create a daily Automation, or use a supported GitHub or webhook trigger tied to +the release workflow, with a prompt like: ```text Read AGENTS.md, changelog-drafter-state.md, and the existing release-note style. @@ -49,10 +51,13 @@ Stop and request human review when sources conflict or attribution is unclear. ``` Review the diff after every run. Cursor Automations are managed outside the -repository, so keep the prompt and `.cursor/rules/` in version control and use -repository permissions as the enforceable boundary. Automations can -[open PRs by default](https://cursor.com/changelog/06-18-26); explicitly disable -that capability while this loop is draft-only. +repository, so keep the prompt and `.cursor/rules/` in version control for +review, but treat tool scopes and repository credentials as the enforceable +boundary. Automations can +[open PRs by default](https://cursor.com/changelog/06-18-26). Remove that tool +where the configuration allows; otherwise run without credentials that can push +branches or open or merge PRs, and export the two-file diff as an artifact for a +human to apply. ## Human publish gate