I’m trying to run the new Cursor CLI in a Github Actions workflow. But I’m getting an error when it runs:
Run cursor-agent -p "$CURSOR_PROMPT" --output-format text --model sonnet-4
cursor-agent -p "$CURSOR_PROMPT" --output-format text --model sonnet-4
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
CURSOR_PROMPT: You are a helpful assistant that can fix CI failures.
CI failed on the `main` branch and you need to fix it. The workflow
"Manual Test" failed on commit 513657b6b21ec3c4f2d60229bced8e5c1bb14fed.
The complete CI output from the failed jobs has been saved to the file
`ci_output.txt` in the repository root. You can read this file to analyze
the failure details.
The failure might be e.g. a flaky test or a lint error. Investigate
the changes in the commit, and then fix the failure (whether it was
caused by those changes or not).
CURSOR_API_KEY: ***
25h
Error: Process completed with exit code 1.
.vscode will never commit. Why ? Because it’s cursor and not microsoft, uses cursor tags and since they are not recognized it messes everything up.
When microsoft sees something from your .env called “API_KEY_NOT_FROM_MICROSOFT”, it is quite expected to react strangely. Also the doc makes no mention about the possibility to add a tag from github.
Perhaps more troubling, is to send in the open your cursor api key like that to a workflow that STORES logs of your attempt with verbose, flags the key AND ITS CONTENT, stores it for likely training, which one day may be something randomly proposed as autofill to a vscode user. Copilot will 100% train on this.
And you run with 1 - your user session privileges and 2 - github_path requiring your personal token, a curl sh command that modifies your repo and leaks also your personal token. If I was on cursor side I’d ask your ID, SSN, at this point give us everything.