chore: consolidate dependabot updates and fix OS build CI#124
Conversation
Bundle open docs/npm and GitHub Actions bumps into one change. Fix debos fakemachine mount failure, disable nightly OS schedule until green, and bump astro, starlight, react, excalidraw, mermaid, and transitive deps.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
More reviews will be available in 48 minutes and 39 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR updates infrastructure across five files: three GitHub workflow files receive action version bumps and structural changes, the documentation build configuration receives dependency updates, and the ARM64 image build recipe corrects path resolution to avoid fakemachine-related issues. ChangesBuild Infrastructure and Dependency Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/os-build.yml (1)
45-45: ⚡ Quick winPin
actions/upload-artifactto a full commit SHA (supply-chain hardening).
.github/workflows/os-build.ymlusesactions/upload-artifact@v4at line 45, which isn’t commit-SHA pinned. The repo’s DoD/Compliance text doesn’t explicitly mandate this, but pinning would further harden the workflow.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/os-build.yml at line 45, The workflow step using the third-party action string "actions/upload-artifact@v4" should be pinned to a full commit SHA for supply-chain hardening: replace the tag "actions/upload-artifact@v4" with the action repository at the specific commit SHA (e.g., "actions/upload-artifact@<full-commit-sha>"), obtain the SHA from the action repo's releases or commit history, and update the workflow step that references "actions/upload-artifact" accordingly so the workflow uses the fixed commit instead of a floating tag.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 72: The workflow currently references the floating tag "uses:
actions/setup-node@v6"; replace that with the full commit SHA for the
actions/setup-node action (e.g., actions/setup-node@<full-commit-sha>) to pin
the dependency and prevent supply-chain drift. Locate the "uses:
actions/setup-node@v6" entry in the CI workflow and update it to the
corresponding commit SHA from the actions/setup-node repository (you can get the
SHA from the action's GitHub tags or commits page), and apply the same pinning
approach to any other "uses: ...@v*" occurrences in the workflow.
In @.github/workflows/rustdoc.yml:
- Line 79: Replace the mutable tag for the GitHub Action by pinning the
actions/upload-pages-artifact usage to an exact commit SHA: find the line
containing "uses: actions/upload-pages-artifact@v5" and update it to use the
full commit SHA for the v5 release (e.g., "uses:
actions/upload-pages-artifact@<full-commit-sha>"), then verify the SHA
corresponds to the intended v5 release commit in the action's repository and
update any workflow documentation if needed.
---
Nitpick comments:
In @.github/workflows/os-build.yml:
- Line 45: The workflow step using the third-party action string
"actions/upload-artifact@v4" should be pinned to a full commit SHA for
supply-chain hardening: replace the tag "actions/upload-artifact@v4" with the
action repository at the specific commit SHA (e.g.,
"actions/upload-artifact@<full-commit-sha>"), obtain the SHA from the action
repo's releases or commit history, and update the workflow step that references
"actions/upload-artifact" accordingly so the workflow uses the fixed commit
instead of a floating tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2d08ca22-3c49-492d-8e8d-e609999506c3
⛔ Files ignored due to path filters (1)
docs/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (5)
.github/workflows/ci.yml.github/workflows/os-build.yml.github/workflows/rustdoc.ymldocs/package.jsonos/recipes/app/pai-engine-arm64.yaml
| # Astro 6 requires Node >=22.12.0 (see docs/package.json engines) | ||
| - name: Setup Node.js for documentation build | ||
| uses: actions/setup-node@v4 | ||
| uses: actions/setup-node@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflowsRepository: aurintex/pai-os
Length of output: 1198
🏁 Script executed:
#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflowsRepository: aurintex/pai-os
Length of output: 1198
🏁 Script executed:
#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflowsRepository: aurintex/pai-os
Length of output: 1198
🏁 Script executed:
#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflowsRepository: aurintex/pai-os
Length of output: 1198
🏁 Script executed:
#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflowsRepository: aurintex/pai-os
Length of output: 1198
Pin actions/setup-node to a full commit SHA.
.github/workflows/ci.yml line 72 uses uses: actions/setup-node@v6; replace the @v6 tag with an exact commit SHA to prevent CI supply-chain drift. (The same @v* pattern exists for other actions in this repo too.)
🧰 Tools
🪛 zizmor (1.25.2)
[error] 72-72: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 72, The workflow currently references the
floating tag "uses: actions/setup-node@v6"; replace that with the full commit
SHA for the actions/setup-node action (e.g.,
actions/setup-node@<full-commit-sha>) to pin the dependency and prevent
supply-chain drift. Locate the "uses: actions/setup-node@v6" entry in the CI
workflow and update it to the corresponding commit SHA from the
actions/setup-node repository (you can get the SHA from the action's GitHub tags
or commits page), and apply the same pinning approach to any other "uses:
...@v*" occurrences in the workflow.
|
|
||
| - name: Upload artifact | ||
| uses: actions/upload-pages-artifact@v4 | ||
| uses: actions/upload-pages-artifact@v5 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflowsRepository: aurintex/pai-os
Length of output: 1198
Pin actions/upload-pages-artifact to an exact commit SHA in .github/workflows/rustdoc.yml.
.github/workflows/rustdoc.yml still uses uses: actions/upload-pages-artifact@v5, which is a mutable tag; pinning to a full commit SHA is needed for reproducible, provenance-stable Pages artifact publishing.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 79-79: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/rustdoc.yml at line 79, Replace the mutable tag for the
GitHub Action by pinning the actions/upload-pages-artifact usage to an exact
commit SHA: find the line containing "uses: actions/upload-pages-artifact@v5"
and update it to use the full commit SHA for the v5 release (e.g., "uses:
actions/upload-pages-artifact@<full-commit-sha>"), then verify the SHA
corresponds to the intended v5 release commit in the action's repository and
update any workflow documentation if needed.
Lockfile was produced with npm 11, which made `npm ci` fail on GitHub Actions (npm 10). Regenerate with npm 10.9.2 and pin packageManager.
1 participant
Summary
Single PR replacing the stack of open Dependabot PRs (#109–#123) plus the failing nightly OS build (run #81).
Docs (
docs/)astro^6.3.2,@astrojs/starlight^0.38.3,react/react-dom^19.2.5@excalidraw/excalidraw^0.18.1,mermaid^11.15.0postcss8.5.15,devalue5.8.1,dompurify,uuid, etc. (package-lock.json)CI workflows
actions/setup-node@v6inci.yml(replaces chore(ci)(deps): bump actions/setup-node from 4 to 6 #109)actions/upload-pages-artifact@v5inrustdoc.yml(replaces chore(ci)(deps): bump actions/upload-pages-artifact from 4 to 5 #114)os-build.yml): fix debos fakemachine mount error (--disable-fakemachine), correct.debpath in recipe; disable nightlyscheduleuntil a manual/tag build is greensetup-qemu-action@v4) — QEMU setup removed in favor of--disable-fakemachineTest plan
npm installindocs/npx astro buildindocs/(fullnpm run buildneeds rustdoc gen in CI)cargo build --releaseinengine/After merge
Close these open Dependabot PRs as superseded: #109, #110, #111, #112, #114, #116, #117, #118, #120, #121, #122, #123. Close #115 with a comment that OS build no longer uses
setup-qemu-action.Summary by CodeRabbit
Release Notes