ci(integration-tests): Add workflow for package integration tests. - #2407
ci(integration-tests): Add workflow for package integration tests.#2407quinntaylormitchell wants to merge 8 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
WalkthroughThe package image action now supports registry publishing or local tar artifacts. The packaging workflow builds and packages CLP components, transfers package artifacts, runs package integration tests, and updates job naming and documentation. ChangesPackage pipeline
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant PackageJob
participant PackageImageAction
participant PackageArtifact
participant PackageIntegrationTests
PackageJob->>PackageImageAction: build package image
PackageImageAction-->>PackageJob: return image_ref
PackageJob->>PackageArtifact: upload package tarball
PackageIntegrationTests->>PackageArtifact: download and extract package
PackageIntegrationTests->>PackageIntegrationTests: load local image or pull published image
PackageIntegrationTests-->>PackageJob: run smoke and package tests
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
docs/src/dev-docs/tooling-gh-workflows.md (1)
17-48: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winNew
package-integration-testsjob isn't reflected in the dependency graph or job list.The diagram and bullet list were updated to rename
package-image→package, but the newly addedpackage-integration-testsjob (which depends onpackage) is missing from both the Mermaid DAG and the job descriptions below it.📝 Proposed doc additions
ubuntu-jammy-deps-image --> package + package --> package-integration-tests ubuntu-jammy-binaries --> ubuntu-jammy-binaries-image* `package`: Builds CLP's package, along with a container image containing the package's components. +* `package-integration-tests`: Runs smoke and package integration tests against the built package and container image. * `ubuntu-jammy-binaries`: Builds the CLP-core binaries in the built Ubuntu Jammy container and runsAlso applies to: 50-76
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/src/dev-docs/tooling-gh-workflows.md` around lines 17 - 48, Update the tooling workflow documentation’s Mermaid DAG and job list to include the package-integration-tests job, showing its dependency on package. Preserve the existing package naming and dependency relationships while adding the missing job in both documented sections..github/workflows/clp-artifact-build.yaml (2)
682-783: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winBoth new/renamed jobs run with default (broad)
GITHUB_TOKENpermissions.Neither
packagenorpackage-integration-testsdeclares apermissions:block, so both inherit the repository's default token scope even thoughpackagelogs in toghcr.iowithsecrets.GITHUB_TOKEN. Consider scoping down to least privilege (e.g.,contents: read,packages: writeonly where needed).Also applies to: 785-867
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/clp-artifact-build.yaml around lines 682 - 783, Restrict the GITHUB_TOKEN permissions for the package and package-integration-tests jobs by adding explicit permissions blocks. Grant only contents: read, and add packages: write solely to the job that pushes the GHCR package image; keep package-integration-tests read-only unless its steps require no registry write access.Source: Linters/SAST tools
721-736: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicate
run-on-imageconfiguration between "Build the package without the package image" and "Assemble the package directory structure".Both steps share identical
image_name/use_published_imageexpressions, differing only inrun_command. Consider factoring the commonwith:block out (e.g., via a job-level env or YAML anchor) to avoid having to keep two copies in sync.Also applies to: 749-764
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/clp-artifact-build.yaml around lines 721 - 736, Factor the duplicated image_name and use_published_image configuration shared by the “Build the package without the package image” and “Assemble the package directory structure” run-on-image steps into a reusable job-level value or YAML anchor, then have both steps reference it while retaining their distinct run_command values.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/clp-build-package-image/action.yaml:
- Around line 97-111: Update the image_path construction in the “Compute image
output properties” step to include a workflow-run-unique identifier, such as
github.run_id, alongside image_name and arch. Keep the existing output
properties and push_image branching unchanged while ensuring concurrent runs
cannot write the same tar path.
- Around line 126-132: Update the “Upload package image as artifact” step to use
actions/upload-artifact pinned to b7c566a772e6b6bfb58ed0dc250532a479d7789f
(v6.0.0), matching the artifact build workflow, while preserving its existing
condition and inputs.
In @.github/workflows/clp-artifact-build.yaml:
- Around line 799-801: Update the checkout step using actions/checkout in the
artifact build job to set persist-credentials to false alongside the existing
recursive submodules option. Preserve the pinned action version and all other
checkout behavior.
- Around line 749-783: Update the package assembly steps around “Write the
package image reference” to also create the package’s VERSION file before “Tar
the package directories” runs. Reuse the same VERSION value and format
established by the package-assemble/package flow, ensuring build/clp-package
contains VERSION alongside clp-package-image.id in the uploaded artifact.
---
Outside diff comments:
In @.github/workflows/clp-artifact-build.yaml:
- Around line 682-783: Restrict the GITHUB_TOKEN permissions for the package and
package-integration-tests jobs by adding explicit permissions blocks. Grant only
contents: read, and add packages: write solely to the job that pushes the GHCR
package image; keep package-integration-tests read-only unless its steps require
no registry write access.
- Around line 721-736: Factor the duplicated image_name and use_published_image
configuration shared by the “Build the package without the package image” and
“Assemble the package directory structure” run-on-image steps into a reusable
job-level value or YAML anchor, then have both steps reference it while
retaining their distinct run_command values.
In `@docs/src/dev-docs/tooling-gh-workflows.md`:
- Around line 17-48: Update the tooling workflow documentation’s Mermaid DAG and
job list to include the package-integration-tests job, showing its dependency on
package. Preserve the existing package naming and dependency relationships while
adding the missing job in both documented sections.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ade561a1-cc6e-413e-9c37-0af22d9fdd89
📒 Files selected for processing (7)
.github/actions/clp-build-package-image/action.yaml.github/workflows/clp-artifact-build.yamldocs/src/dev-docs/tooling-gh-workflows.mdintegration-tests/.pytest.iniintegration-tests/tests/test_clp_native_py_project_imports.pyintegration-tests/tests/utils/classes.pytaskfile.yaml
| - name: "Compute image output properties" | ||
| id: "output-properties" | ||
| shell: "bash" | ||
| run: | | ||
| image_name="${{steps.compute-meta.outputs.IMAGE_NAME}}" | ||
| if [[ "${{inputs.push_image}}" == "true" ]]; then | ||
| echo "image_output=type=registry" >> "$GITHUB_OUTPUT" | ||
| else | ||
| image_path="/tmp/${image_name}-image-${{inputs.arch}}.tar" | ||
| echo "image_path=${image_path}" >> "$GITHUB_OUTPUT" | ||
| echo "image_output=type=docker,dest=${image_path}" >> "$GITHUB_OUTPUT" | ||
| fi | ||
|
|
||
| - name: "Build and Push" | ||
| if: "github.event_name != 'pull_request' && github.ref == 'refs/heads/main'" | ||
| id: "build-and-push" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Hardcoded /tmp tar path may collide across concurrent jobs on shared self-hosted runners.
image_path="/tmp/${image_name}-image-${{inputs.arch}}.tar" is fixed per arch but not per-workflow-run. On the self-hosted runner pool used by this repo, two concurrent runs (e.g., two PRs) building the same arch could write to the same /tmp path simultaneously.
🛠️ Proposed fix: scope the path to the run
- image_path="/tmp/${image_name}-image-${{inputs.arch}}.tar"
+ image_path="${RUNNER_TEMP}/${image_name}-image-${{inputs.arch}}-${{github.run_id}}.tar"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: "Compute image output properties" | |
| id: "output-properties" | |
| shell: "bash" | |
| run: | | |
| image_name="${{steps.compute-meta.outputs.IMAGE_NAME}}" | |
| if [[ "${{inputs.push_image}}" == "true" ]]; then | |
| echo "image_output=type=registry" >> "$GITHUB_OUTPUT" | |
| else | |
| image_path="/tmp/${image_name}-image-${{inputs.arch}}.tar" | |
| echo "image_path=${image_path}" >> "$GITHUB_OUTPUT" | |
| echo "image_output=type=docker,dest=${image_path}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: "Build and Push" | |
| if: "github.event_name != 'pull_request' && github.ref == 'refs/heads/main'" | |
| id: "build-and-push" | |
| - name: "Compute image output properties" | |
| id: "output-properties" | |
| shell: "bash" | |
| run: | | |
| image_name="${{steps.compute-meta.outputs.IMAGE_NAME}}" | |
| if [[ "${{inputs.push_image}}" == "true" ]]; then | |
| echo "image_output=type=registry" >> "$GITHUB_OUTPUT" | |
| else | |
| image_path="${RUNNER_TEMP}/${image_name}-image-${{inputs.arch}}-${{github.run_id}}.tar" | |
| echo "image_path=${image_path}" >> "$GITHUB_OUTPUT" | |
| echo "image_output=type=docker,dest=${image_path}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: "Build and Push" | |
| id: "build-and-push" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/actions/clp-build-package-image/action.yaml around lines 97 - 111,
Update the image_path construction in the “Compute image output properties” step
to include a workflow-run-unique identifier, such as github.run_id, alongside
image_name and arch. Keep the existing output properties and push_image
branching unchanged while ensuring concurrent runs cannot write the same tar
path.
| - name: "Upload package image as artifact" | ||
| if: "inputs.push_image == 'false'" | ||
| uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02" | ||
| with: | ||
| name: "clp-package-image-${{inputs.arch}}" | ||
| path: "${{steps.output-properties.outputs.image_path}}" | ||
| retention-days: 1 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow/action files =="
git ls-files '.github/workflows/*.yaml' '.github/actions/**/action.yaml' | sed -n '1,200p'
echo
echo "== target usage =="
rg -n "actions/upload-artifact|node-version|defaults:|runs-on:|actions/checkout|clp-build-package-image|path_to_repo" .github -S || true
echo
echo "== target snippet =="
nl -ba .github/actions/clp-build-package-image/action.yaml | sed -n '1,170p'
echo
echo "== tag/SHA resolution attempts =="
for ref in actions/upload-artifact@v4.6.2 actions/upload-artifact@v6.0.0; do
echo "--- $ref"
gh api "repos/$ref" --jq '{ref: .ref, object_type: .object.type, tag_object_sha: .object.sha, target_commit: (if .object.type=="tag" then .object.target_sha else .object.sha end)}' 2>/dev/null || echo "gh api failed"
doneRepository: y-scope/clp
Length of output: 7426
🌐 Web query:
GitHub Actions upload-artifact Node.js tool cache Node 20 deprecation Node 24 runners June 2026
💡 Result:
As of July 30, 2026, GitHub Actions has transitioned to Node.js 24 as the default runtime for JavaScript/TypeScript actions, a change that took effect on June 16, 2026 [1][2]. Key details regarding this transition include: Deprecation of Node 20: Node.js 20 reached end-of-life (EOL) in April 2026, leading to its deprecation as a supported runtime for GitHub Actions [1]. Default Runner Version: Beginning June 16, 2026, GitHub-hosted runners default to Node.js 24 [1][2]. Workflows using actions that still target Node.js 20 may trigger deprecation warnings [3][2]. Temporary Opt-Out: While Node.js 24 is the new default, users can temporarily continue using Node.js 20 by setting the environment variable ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true in their workflow file or on their runner machine [1][4]. This is a temporary measure intended only until Node.js 20 is completely removed from the runners, which is scheduled for the fall of 2026 [1]. Action Updates (upload-artifact): The official actions/upload-artifact action has been updated to v6.0.0, which uses Node.js 24 by default [5][6]. Users are strongly encouraged to update to the latest versions of their actions to ensure compatibility with the new Node.js 24 runtime [1]. Self-Hosted Considerations: Self-hosted runners require an upgrade to at least version 2.327.1 to support the Node.js 24 runtime [5][6]. Additionally, Node.js 24 does not support ARM32, meaning self-hosted runners on that architecture are no longer supported [1]. For users on GitHub Enterprise Server (GHES), check documentation as some versions may still require older, Node-specific releases of the upload-artifact action [7][8].
Citations:
- 1: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
- 2: Update Node 24 default date to June 16th, 2026 actions/runner#4462
- 3: [feat req] Update to Node.js 24 actions/upload-artifact#780
- 4: Node 20 -> Node 24 migration feature flagging, opt-in and opt-out environment variables actions/runner#3948
- 5: https://github.com/actions/upload-artifact/releases/tag/v6.0.0
- 6: prepare release v6.0.0 for Node.js 24 support actions/upload-artifact#745
- 7: https://github.com/actions-oss/upload-artifact
- 8: https://github.com/actions/upload-artifact
🌐 Web query:
actions/upload-artifact v4 node-version action.yml
💡 Result:
The actions/upload-artifact@v4 action does not accept a node-version input in its action.yml file [1][2]. In GitHub Actions, the node-version input is specific to the actions/setup-node action, which is used to configure the Node.js environment on the runner [3][4]. The actions/upload-artifact action is a JavaScript-based GitHub Action that internally specifies its required Node.js runtime environment using the runs.using field within its own action.yml (e.g., node20 or similar, depending on the specific patch version of v4) [4][5]. Users do not need to—and cannot—configure the Node.js version of the artifact action itself through its inputs [1][6]. If you need to use a specific version of Node.js for tasks within your workflow, you should use actions/setup-node@v4 in a preceding step [3][4].
Citations:
- 1: https://github.com/actions/upload-artifact/blob/v4/README.md
- 2: https://github.com/actions/upload-artifact/tree/v4.0.0
- 3: actions/upload-artifact@v2...v4
- 4: actions/upload-artifact@v4.4.3...bbbca2d
- 5: actions/upload-artifact@v4.4.0...330a01c
- 6: https://github.com/actions/upload-artifact
Align upload-artifact to the Node 24-based release. The pinned release is still Node 20-based, while GitHub-hosted runners now default to Node 24; use the same actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f / v6.0.0 used by the artifact build workflow.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/actions/clp-build-package-image/action.yaml around lines 126 - 132,
Update the “Upload package image as artifact” step to use
actions/upload-artifact pinned to b7c566a772e6b6bfb58ed0dc250532a479d7789f
(v6.0.0), matching the artifact build workflow, while preserving its existing
condition and inputs.
| - name: "Assemble the package directory structure" | ||
| uses: "./.github/actions/run-on-image" | ||
| env: | ||
| OS_NAME: "ubuntu-jammy" | ||
| with: | ||
| image_name: >- | ||
| ${{format('{0}ubuntu-jammy', | ||
| matrix.arch == 'amd64' && env.DEPS_IMAGE_NAME_PREFIX_X86 | ||
| || env.DEPS_IMAGE_NAME_PREFIX_AARCH64)}} | ||
| use_published_image: >- | ||
| ${{needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed == 'false' | ||
| || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')}} | ||
| run_command: >- | ||
| CLP_CPP_MAX_PARALLELISM_PER_BUILD_TASK=$(getconf _NPROCESSORS_ONLN) | ||
| HOME=/tmp | ||
| task package-assemble OUTPUT_DIR=build/clp-package | ||
|
|
||
| - name: "Write the package image reference" | ||
| shell: "bash" | ||
| run: >- | ||
| echo "${{steps.build-package-image.outputs.image_ref}}" | ||
| > "build/clp-package/clp-package-image.id" | ||
|
|
||
| - name: "Tar the package directories" | ||
| shell: "bash" | ||
| run: >- | ||
| tar --create --file "build/clp-package.tar" | ||
| --directory "build/clp-package" . | ||
|
|
||
| - name: "Upload the package tarball artifact" | ||
| uses: "actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f" # v6.0.0 | ||
| with: | ||
| name: "${{env.PACKAGE_ARTIFACT_NAME_PREFIX}}${{matrix.arch}}" | ||
| path: "build/clp-package.tar" | ||
| retention-days: 1 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repository files matching task/workflow/package names:\n'
git ls-files | rg '(^|/)(taskfile.*|.*workflow.*|.*package.*|.*install.*|.*release.*)' || true
printf '\nRelevant workflow section:\n'
if [ -f .github/workflows/clp-artifact-build.yaml ]; then
nl -ba .github/workflows/clp-artifact-build.yaml | sed -n '700,790p'
fi
printf '\nSearch for package task/package-assemble/version behavior:\n'
rg -n "task package|package-assemble|G_PACKAGE_VERSION|VERSION|checksum|clp-package-image|clp-package.tar" -S .Repository: y-scope/clp
Length of output: 31017
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'taskfile.yaml task package/assemble excerpts:\n'
awk 'NR>=120 && NR<=165 {printf "%d\t%s\n", NR, $0}' taskfile.yaml
printf '\nWorkflow assembly/tar/upload excerpt:\n'
awk 'NR>=720 && NR<=785 {printf "%d\t%s\n", NR, $0}' .github/workflows/clp-artifact-build.yaml
printf '\nVERSION/CLP_PACKAGE_VERSION references in taskfile/docker/package docs:\n'
rg -n "G_PACKAGE_VERSION|CLP_PACKAGE_VERSION|package-assemble|task package|VERSION|checksum" taskfile.yaml Dockerfile components package templates docs 2>/dev/null || true
printf '\nRead-only model of taskfile dependency chain:\n'
python3 - <<'PY'
from pathlib import Path
p=Path("taskfile.yaml")
text=p.read_text()
for alias in ["package:", "package-assemble:"]:
idx=text.find(alias)
print(f"{alias} line={text.count(chr(10),0,idx)+1 if idx!=-1 else None}")
if idx!=-1:
print(text[idx:idx+450])
print("---")
PYRepository: y-scope/clp
Length of output: 21392
Write VERSION before tarring the CI package artifact.
task package runs package-assemble, rsyncs clp-package-image.id, writes VERSION, and then computes the checksum. This workflow invokes package-assemble directly and tarball/uses the image id immediately after, so the uploaded artifact omits the version file that the local full package contract includes.
🩹 Proposed fix: write VERSION alongside the image id
- name: "Write the package image reference"
shell: "bash"
run: >-
echo "${{steps.build-package-image.outputs.image_ref}}"
> "build/clp-package/clp-package-image.id"
+ - name: "Write the package version"
+ shell: "bash"
+ run: >-
+ echo "${{env.G_PACKAGE_VERSION}}" > "build/clp-package/VERSION"
+
- name: "Tar the package directories"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: "Assemble the package directory structure" | |
| uses: "./.github/actions/run-on-image" | |
| env: | |
| OS_NAME: "ubuntu-jammy" | |
| with: | |
| image_name: >- | |
| ${{format('{0}ubuntu-jammy', | |
| matrix.arch == 'amd64' && env.DEPS_IMAGE_NAME_PREFIX_X86 | |
| || env.DEPS_IMAGE_NAME_PREFIX_AARCH64)}} | |
| use_published_image: >- | |
| ${{needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed == 'false' | |
| || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')}} | |
| run_command: >- | |
| CLP_CPP_MAX_PARALLELISM_PER_BUILD_TASK=$(getconf _NPROCESSORS_ONLN) | |
| HOME=/tmp | |
| task package-assemble OUTPUT_DIR=build/clp-package | |
| - name: "Write the package image reference" | |
| shell: "bash" | |
| run: >- | |
| echo "${{steps.build-package-image.outputs.image_ref}}" | |
| > "build/clp-package/clp-package-image.id" | |
| - name: "Tar the package directories" | |
| shell: "bash" | |
| run: >- | |
| tar --create --file "build/clp-package.tar" | |
| --directory "build/clp-package" . | |
| - name: "Upload the package tarball artifact" | |
| uses: "actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f" # v6.0.0 | |
| with: | |
| name: "${{env.PACKAGE_ARTIFACT_NAME_PREFIX}}${{matrix.arch}}" | |
| path: "build/clp-package.tar" | |
| retention-days: 1 | |
| - name: "Assemble the package directory structure" | |
| uses: "./.github/actions/run-on-image" | |
| env: | |
| OS_NAME: "ubuntu-jammy" | |
| with: | |
| image_name: >- | |
| ${{format('{0}ubuntu-jammy', | |
| matrix.arch == 'amd64' && env.DEPS_IMAGE_NAME_PREFIX_X86 | |
| || env.DEPS_IMAGE_NAME_PREFIX_AARCH64)}} | |
| use_published_image: >- | |
| ${{needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed == 'false' | |
| || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')}} | |
| run_command: >- | |
| CLP_CPP_MAX_PARALLELISM_PER_BUILD_TASK=$(getconf _NPROCESSORS_ONLN) | |
| HOME=/tmp | |
| task package-assemble OUTPUT_DIR=build/clp-package | |
| - name: "Write the package image reference" | |
| shell: "bash" | |
| run: >- | |
| echo "${{steps.build-package-image.outputs.image_ref}}" | |
| > "build/clp-package/clp-package-image.id" | |
| - name: "Write the package version" | |
| shell: "bash" | |
| run: >- | |
| echo "${{env.G_PACKAGE_VERSION}}" > "build/clp-package/VERSION" | |
| - name: "Tar the package directories" | |
| shell: "bash" | |
| run: >- | |
| tar --create --file "build/clp-package.tar" | |
| --directory "build/clp-package" . | |
| - name: "Upload the package tarball artifact" | |
| uses: "actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f" # v6.0.0 | |
| with: | |
| name: "${{env.PACKAGE_ARTIFACT_NAME_PREFIX}}${{matrix.arch}}" | |
| path: "build/clp-package.tar" | |
| retention-days: 1 |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 682-783: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[info] 769-769: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/clp-artifact-build.yaml around lines 749 - 783, Update the
package assembly steps around “Write the package image reference” to also create
the package’s VERSION file before “Tar the package directories” runs. Reuse the
same VERSION value and format established by the package-assemble/package flow,
ensuring build/clp-package contains VERSION alongside clp-package-image.id in
the uploaded artifact.
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/clp-artifact-build.yaml (1)
766-776: 🗄️ Data Integrity & Integration | 🟠 MajorWrite
VERSIONbefore creating the package tarball.This package flow writes
clp-package-image.idbut tars immediately afterwards, so the CI artifact still omits the package version metadata required by the package contract. Addbuild/clp-package/VERSIONusing the same version value as the normal package flow before line 772.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/clp-artifact-build.yaml around lines 766 - 776, Update the package build steps before “Tar the package directories” to write build/clp-package/VERSION, using the same version value and sourcing mechanism as the normal package flow. Keep the existing clp-package-image.id generation intact, and ensure VERSION is created before the tar command runs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/clp-artifact-build.yaml:
- Around line 766-776: Update the package build steps before “Tar the package
directories” to write build/clp-package/VERSION, using the same version value
and sourcing mechanism as the normal package flow. Keep the existing
clp-package-image.id generation intact, and ensure VERSION is created before the
tar command runs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6ea22891-2a53-4753-8b3a-f1a18d9beb89
📒 Files selected for processing (1)
.github/workflows/clp-artifact-build.yaml
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
docs/src/dev-docs/tooling-gh-workflows.md (1)
10-12: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winDocument
package-image-multiarch-manifest.The workflow runs
package-image-multiarch-manifestafter the package integration-test matrix succeeds, but the DAG and job list stop atpackage-integration-tests. Add the manifest edge and a job entry so the documentation matches the workflow.This comparison uses the workflow's
package-image-multiarch-manifestjob.Also applies to: 48-50, 79-82
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/src/dev-docs/tooling-gh-workflows.md` around lines 10 - 12, Update the workflow documentation’s job list and DAG to include the package-image-multiarch-manifest job, showing it runs after the package-integration-tests matrix succeeds. Ensure all referenced sections, including the later job listing, consistently document this manifest job and dependency edge..github/workflows/clp-artifact-build.yaml (1)
145-178: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winSecurity Misconfiguration (CWE-732): Incorrect Permission Assignment for Critical Resource
Reachability: External
Declare least-privilege workflow permissions.
This workflow runs on Pull Requests and uses
GITHUB_TOKENin jobs without explicit job-level permissions. Set top-levelpermissions: {}, then add only required job-scoped permissions:contents: readfor checkout,packages: writeonly for the publishing jobs, and keep the job that publishes the Spider worker image read-only whenpush: "${{github.event_name != 'pull_request' && github.ref == 'refs/heads/main'}}".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/clp-artifact-build.yaml around lines 145 - 178, Set top-level workflow permissions to empty, then add job-scoped contents: read permissions for checkout-based jobs and packages: write only to jobs that publish artifacts or images. For the Spider worker image publishing job, keep permissions read-only while retaining its existing push condition; update the relevant workflow jobs rather than only manylinux_2_28-deps-image.Sources: Learnings, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/clp-artifact-build.yaml:
- Around line 145-178: Set top-level workflow permissions to empty, then add
job-scoped contents: read permissions for checkout-based jobs and packages:
write only to jobs that publish artifacts or images. For the Spider worker image
publishing job, keep permissions read-only while retaining its existing push
condition; update the relevant workflow jobs rather than only
manylinux_2_28-deps-image.
In `@docs/src/dev-docs/tooling-gh-workflows.md`:
- Around line 10-12: Update the workflow documentation’s job list and DAG to
include the package-image-multiarch-manifest job, showing it runs after the
package-integration-tests matrix succeeds. Ensure all referenced sections,
including the later job listing, consistently document this manifest job and
dependency edge.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5bc565f6-19b4-4aed-a846-f97a2a540de2
📒 Files selected for processing (3)
.github/workflows/clp-artifact-build.yamldocs/src/dev-docs/tooling-gh-workflows.mdtaskfile.yaml
1 participant
Description
This PR adds the
package-integration-testsworkflow toclp-artifact-build. The workflow proceeds as follows:uv run pytest -m 'smoke or package'The dev docs are updated w.r.t. the changes in
clp-artifact-build.Checklist
breaking change.
Validation performed
The
package-integration-testsworkflow passes.Summary by CodeRabbit
Summary by CodeRabbit