feat(ci): assert all rainix-*.yaml reusables share one pinned RAINIX_SHA#252
feat(ci): assert all rainix-*.yaml reusables share one pinned RAINIX_SHA#252thedavidmeister wants to merge 5 commits into
Conversation
Adds a shell library (`lib/check-rainix-flake-pin.sh`) with `check_rainix_flake_pin_consistent` that verifies every `.github/workflows/rainix-*.yaml` file defines the same RAINIX_SHA value and contains no bare unpinned `github:rainlanguage/rainix#` refs. A missed SHA during a toolchain bump silently leaves one reusable on a stale toolchain; this guard catches the drift before it reaches CI. Wired up as: - A `nix run .#rainix-check-flake-pin` package so downstream consumers can run it against their own workflow directory. - A step in `check-shell.yml` that runs the live check against the rainix repo itself on every push. - 10 BATS unit tests in `test/bats/task/check-rainix-flake-pin.test.bats` exercising all pass/fail branches; tests run via `default-shell-test`. Closes #248 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 20 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR adds a shell check that verifies ChangesFlake-pin consistency check
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@flake.nix`:
- Around line 291-303: Add GNU grep and GNU sed to the default-shell-test input
set, since check-rainix-flake-pin is exercised by
test/bats/task/check-rainix-flake-pin.test.bats through
lib/check-rainix-flake-pin.sh and currently only pkgs.bats plus the existing
build inputs are included; update the default-shell-test definition so it also
includes pkgs.gnugrep and pkgs.gnused, matching the tooling used by
rainix-check-flake-pin and keeping RAINIX_SHA parsing consistent on macOS CI.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 020c0548-e776-4526-8b48-f52716bc08f1
📒 Files selected for processing (4)
.github/workflows/check-shell.ymlflake.nixlib/check-rainix-flake-pin.shtest/bats/task/check-rainix-flake-pin.test.bats
| # Verifies all rainix-*.yaml reusable workflows pin their RAINIX_SHA | ||
| # to the same commit SHA and contain no bare unpinned flake refs. | ||
| # Catches toolchain-bump drift across the 11 reusable workflow files. | ||
| rainix-check-flake-pin = mkTask { | ||
| name = "rainix-check-flake-pin"; | ||
| body = '' | ||
| set -euo pipefail | ||
| source ${./lib/check-rainix-flake-pin.sh} | ||
| check_rainix_flake_pin_consistent ".github/workflows" | ||
| ''; | ||
| additionalBuildInputs = [ pkgs.gnugrep pkgs.gnused pkgs.coreutils ]; | ||
| }; | ||
|
|
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
ast-grep outline flake.nix --view expanded | rg -n 'default-shell-test|rainix-check-flake-pin|mkTask'
rg -n -B3 -A20 'default-shell-test = mkTask' flake.nix
rg -n 'gnused|gnugrep' flake.nixRepository: rainlanguage/rainix
Length of output: 1342
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show relevant definitions with line numbers.
sed -n '1,220p' flake.nix | cat -n
printf '\n==== SPLIT ====\\n'
sed -n '220,420p' flake.nix | cat -n
printf '\n==== SEARCH ====\\n'
rg -n 'mkTask|sol-build-inputs|node-build-inputs|devShell|gnugrep|gnused|coreutils' flake.nixRepository: rainlanguage/rainix
Length of output: 20622
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,220p' flake.nix | cat -n
printf '\n==== SPLIT ====\\n'
sed -n '220,420p' flake.nix | cat -n
printf '\n==== SEARCH ====\\n'
rg -n 'mkTask|sol-build-inputs|node-build-inputs|devShell|gnugrep|gnused|coreutils' flake.nixRepository: rainlanguage/rainix
Length of output: 20622
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate and print the mkTask definition and nearby build-input list definitions.
rg -n -A40 -B20 'mkTask\s*=' flake.nix
printf '\n==== BUILD INPUT LISTS ====\\n'
rg -n -A20 -B5 'sol-build-inputs|node-build-inputs' flake.nixRepository: rainlanguage/rainix
Length of output: 13819
Add GNU grep/sed to default-shell-test. test/bats/task/check-rainix-flake-pin.test.bats exercises lib/check-rainix-flake-pin.sh, but default-shell-test only adds [ pkgs.bats ] ++ sol-build-inputs ++ node-build-inputs. Add pkgs.gnugrep and pkgs.gnused there too so the macOS CI leg parses RAINIX_SHA consistently.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@flake.nix` around lines 291 - 303, Add GNU grep and GNU sed to the
default-shell-test input set, since check-rainix-flake-pin is exercised by
test/bats/task/check-rainix-flake-pin.test.bats through
lib/check-rainix-flake-pin.sh and currently only pkgs.bats plus the existing
build inputs are included; update the default-shell-test definition so it also
includes pkgs.gnugrep and pkgs.gnused, matching the tooling used by
rainix-check-flake-pin and keeping RAINIX_SHA parsing consistent on macOS CI.
… to multi-line (nixfmt)
|
Producer note: HAND-OFF on red |
|
🤖 ai:producer |
Three defects made rainix-check-flake-pin fail (or silently die) when run via mkTask, whose scripts execute under nixpkgs' non-interactive bash with set -euo pipefail: - compgen is not a builtin in that bash, so the existence probe always reported 'no rainix-*.yaml files found'; the glob itself (with an -e guard per entry) is now the existence check. - Aggregator workflows (rainix-sol.yaml, rainix-rs.yaml) and workflows with no nix flake refs (rainix-vercel.yaml) have nothing to pin; RAINIX_SHA is now only required in files referencing the rainix flake. - Both helper pipelines returned grep's no-match status under pipefail, aborting the caller before any diagnostic; they now end in || true. Validated: nix run .#rainix-check-flake-pin exits 0 on the repo root, and under set -euo pipefail the checker still fails correctly on an empty dir, a mismatched sha, a flake-ref file missing RAINIX_SHA, and a bare unpinned ref. Co-Authored-By: Claude <noreply@anthropic.com>
|
🤖 ai:producer |
|
🤖 ai:vetter |
1 participant
Closes #248
What
Adds a CI consistency check that verifies every
.github/workflows/rainix-*.yamlreusable workflow file pins its flake ref to the sameRAINIX_SHAcommit and contains no bare unpinnedgithub:rainlanguage/rainix#refs.Files
lib/check-rainix-flake-pin.sh— shell library with:_extract_sha <file>— extractsRAINIX_SHAfrom a single workflow file_count_unpinned_refs <dir>— counts baregithub:rainlanguage/rainix#refs across allrainix-*.yamlfilescheck_rainix_flake_pin_consistent [dir]— asserts all files share one SHA, fails with diagnostic on any mismatch, missing SHA, bare unpinned ref, or empty dirtest/bats/task/check-rainix-flake-pin.test.bats— 10 BATS unit tests covering all pass/fail branches; added todefault-shell-testflake.nix— newrainix-check-flake-pinnix package (mkTask) so downstream consumers can runnix run ..#rainix-check-flake-pinagainst their own.github/workflows/directory.github/workflows/check-shell.yml— new stepnix run .#rainix-check-flake-pinruns the live check against the rainix repo itself on every pushApproach
Detection-only guard: fails loudly when a toolchain bump leaves one reusable behind. Catches drift before it ships without requiring templating or a pre-commit hook.
Summary by CodeRabbit
RAINIX_SHApinning across reusable workflow files.RAINIX_SHAis missing, differs between workflows, or when any unpinnedgithub:rainlanguage/rainix#…references are detected.