Skip to content

chore: consolidate dependabot updates and fix OS build CI #124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rplunger merged 2 commits into from
Jun 3, 2026
Merged

chore: consolidate dependabot updates and fix OS build CI #124

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8caa680
chore: consolidate dependabot updates and fix OS build CI
rplunger Jun 3, 2026
52fb7be
fix(docs): regenerate package-lock for npm 10 CI parity
rplunger Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ jobs:

# Astro 6 requires Node >=22.12.0 (see docs/package.json engines)
- name: Setup Node.js for documentation build
uses: actions/setup-node@v4
uses: actions/setup-node@v6

@coderabbitai coderabbitai Bot Jun 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflows

Repository: aurintex/pai-os

Length of output: 1198

🏁 Script executed:

#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflows

Repository: aurintex/pai-os

Length of output: 1198

🏁 Script executed:

#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflows

Repository: aurintex/pai-os

Length of output: 1198

🏁 Script executed:

#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflows

Repository: aurintex/pai-os

Length of output: 1198

🏁 Script executed:

#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflows

Repository: aurintex/pai-os

Length of output: 1198

Pin actions/setup-node to a full commit SHA.

.github/workflows/ci.yml line 72 uses uses: actions/setup-node@v6; replace the @v6 tag with an exact commit SHA to prevent CI supply-chain drift. (The same @v* pattern exists for other actions in this repo too.)

🧰 Tools
🪛 zizmor (1.25.2)

[error] 72-72: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 72, The workflow currently references the
floating tag "uses: actions/setup-node@v6"; replace that with the full commit
SHA for the actions/setup-node action (e.g.,
actions/setup-node@<full-commit-sha>) to pin the dependency and prevent
supply-chain drift. Locate the "uses: actions/setup-node@v6" entry in the CI
workflow and update it to the corresponding commit SHA from the
actions/setup-node repository (you can get the SHA from the action's GitHub tags
or commits page), and apply the same pinning approach to any other "uses:
...@v*" occurrences in the workflow.

with:
node-version: "22"
cache: npm
Expand Down
28 changes: 10 additions & 18 deletions .github/workflows/os-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Build paiOS image with debos. Uploads compressed image as artifact.
# Triggers: tag (v*), workflow_dispatch, daily schedule.
# Triggers: tag (v*), workflow_dispatch. Nightly schedule disabled until OS CI is stable.
# Artifacts: os-image-radxa-rock5c (tag/manual, 90d) or os-image-unstable (schedule, 7d).
# Download and run: gunzip radxa-rock5c.img.gz
name: OS Build
Expand All @@ -8,8 +8,10 @@ on:
push:
tags: ["v*"]
workflow_dispatch:
schedule:
- cron: "0 2 * * *"
# Nightly OS images paused: scheduled runs failed on fakemachine path mounts.
# Re-enable after a green workflow_dispatch or tag build on main.
# schedule:
# - cron: "0 2 * * *"

jobs:
build:
Expand All @@ -23,25 +25,15 @@ jobs:
- name: Build pai-engine .deb
run: bash os/packaging/build-deb.sh

# debos v1.1.7 switched from qemu-user-static to qemu-user-binfmt. The binfmt
# handlers are NOT auto-registered inside a Docker container, so arm64 binaries
# executed during debootstrap/chroot steps fail with EXEC_FORMAT_ERROR.
# Register QEMU arm64 binfmt handlers on the host before running debos.
- name: Set up QEMU for ARM64 cross-compilation
uses: docker/setup-qemu-action@v4
with:
platforms: arm64

# GitHub-hosted runners do not provide /dev/kvm, so the KVM backend is not available.
# Also avoid --disable-fakemachine here: debos then runs apt cleanup directly inside the
# Docker container, where systemd-nspawn cleanup can fail under /run/systemd/nspawn/propagate.
# Force the software-emulated qemu backend so debos keeps its isolated fakemachine path.
# --disable-fakemachine: qemu fakemachine mis-mounts ../../packaging/dist as
# os/recipes/packaging/dist (see pai-engine-arm64.yaml). Runs debootstrap in-container.
- name: Build image with debos
run: |
docker run --rm \
-v "${{ github.workspace }}:/build" -w /build \
--cap-add SYS_ADMIN \
godebos/debos \
--fakemachine-backend=qemu -t machine:radxa-rock5c os/image.yaml
--disable-fakemachine -t machine:radxa-rock5c os/image.yaml

- name: Verify image exists
run: test -f radxa-rock5c.img
Expand All @@ -50,7 +42,7 @@ jobs:
run: gzip -k radxa-rock5c.img

- name: Upload artifact
uses: actions/upload-artifact@v7
uses: actions/upload-artifact@v4
with:
name: ${{ github.event_name == 'schedule' && 'os-image-unstable' || 'os-image-radxa-rock5c' }}
path: radxa-rock5c.img.gz
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/rustdoc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ jobs:
uses: actions/configure-pages@v6

- name: Upload artifact
uses: actions/upload-pages-artifact@v4
uses: actions/upload-pages-artifact@v5

@coderabbitai coderabbitai Bot Jun 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify unpinned GitHub Actions references in workflows
rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(?:\.[0-9]+)?\s*$' .github/workflows

Repository: aurintex/pai-os

Length of output: 1198

Pin actions/upload-pages-artifact to an exact commit SHA in .github/workflows/rustdoc.yml.

.github/workflows/rustdoc.yml still uses uses: actions/upload-pages-artifact@v5, which is a mutable tag; pinning to a full commit SHA is needed for reproducible, provenance-stable Pages artifact publishing.

🧰 Tools
🪛 zizmor (1.25.2)

[error] 79-79: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/rustdoc.yml at line 79, Replace the mutable tag for the
GitHub Action by pinning the actions/upload-pages-artifact usage to an exact
commit SHA: find the line containing "uses: actions/upload-pages-artifact@v5"
and update it to use the full commit SHA for the v5 release (e.g., "uses:
actions/upload-pages-artifact@<full-commit-sha>"), then verify the SHA
corresponds to the intended v5 release commit in the action's repository and
update any workflow documentation if needed.

with:
path: pages

Expand Down
Loading
Loading