Split rainix.yaml into per-task slim-shell workflows #2608
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,6 +19,12 @@ jobs: | |
| nix_conf: | | ||
| keep-env-derivations = true | ||
| keep-outputs = true | ||
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false | ||
|
Comment on lines
+22
to
+27
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
ls -la .github/workflows || true
sed -n '1,140p' .github/workflows/deploy-subgraph.yaml | nl -ba | sed -n '1,160p'
echo "---- other workflows (action pinning conventions) ----"
fd -t f -g '*.yml' .github/workflows -x echo {} >/dev/null 2>&1 || true
# List some uses lines containing cachix/cachix-action and also any unpinned uses occurrences
rg -n "uses:\s*[^@]+@v\d+(\.\d+)*\s*$" .github/workflows --glob '*.yml' --glob '*.yaml' || true
rg -n "uses:\s*cachix/cachix-action@" .github/workflows --glob '*.yml' --glob '*.yaml' || true
# Collect a few uses lines with SHA pinning patterns
rg -n "uses:\s*[^@]+@[0-9a-f]{7,40}\s*$" .github/workflows --glob '*.yml' --glob '*.yaml' | head -n 50 || trueRepository: rainlanguage/raindex Length of output: 1713 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Show the relevant workflow section around lines ~10-40 with line numbers
if [ -f ".github/workflows/deploy-subgraph.yaml" ]; then
sed -n '1,160p' .github/workflows/deploy-subgraph.yaml | nl -ba | sed -n '1,200p'
fi
echo "---- Find uses: lines in deploy-subgraph.yaml ----"
rg -n "uses:" .github/workflows/deploy-subgraph.yaml || true
echo "---- Repo-wide workflow conventions: find unpinned uses refs ----"
# Heuristic: floating tags like `@v1`, `@v2`, `@v15` etc (not SHA-like)
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@v[0-9]+(\.[0-9]+)*\s*$" .github/workflows || true
echo "---- Repo-wide: find cachix/cachix-action occurrences ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*cachix/cachix-action@" .github/workflows || true
echo "---- Repo-wide: find uses pinned to commit SHA ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@[0-9a-f]{7,40}\s*$" .github/workflows | head -n 80 || trueRepository: rainlanguage/raindex Length of output: 107 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Show the workflow section with line numbers
if [ -f ".github/workflows/deploy-subgraph.yaml" ]; then
sed -n '1,160p' .github/workflows/deploy-subgraph.yaml | nl -ba | sed -n '1,220p'
fi
echo "---- Find uses: lines in deploy-subgraph.yaml ----"
rg -n "uses:" .github/workflows/deploy-subgraph.yaml || true
echo "---- Repo-wide workflow conventions: unpinned uses refs (heuristic) ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@v[0-9]+(\.[0-9]+)*\s*$" .github/workflows || true
echo "---- Repo-wide: cachix/cachix-action occurrences ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*cachix/cachix-action@" .github/workflows || true
echo "---- Repo-wide: uses pinned to commit SHA (heuristic) ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@[0-9a-f]{7,40}\s*$" .github/workflows | head -n 80 || trueRepository: rainlanguage/raindex Length of output: 107 🏁 Script executed: #!/bin/bash
set -euo pipefail
wf=".github/workflows/deploy-subgraph.yaml"
if [ -f "$wf" ]; then
echo "---- $wf (lines 1-120) ----"
sed -n '1,120p' "$wf" | awk '{printf "%4d\t%s\n", NR, $0}'
fi
echo "---- uses: lines in deploy-subgraph.yaml ----"
rg -n "uses:" "$wf" || true
echo "---- cachix/cachix-action occurrences ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*cachix/cachix-action@" .github/workflows || true
echo "---- repo-wide unpinned uses refs (heuristic: `@v`*) ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@v[0-9]+(\.[0-9]+)*\s*$" .github/workflows || true
echo "---- repo-wide uses pinned to commit SHA (heuristic) ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@[0-9a-f]{7,40}\s*$" .github/workflows | head -n 80 || trueRepository: rainlanguage/raindex Length of output: 10509 Pin
🧰 Tools🪛 zizmor (1.25.2)[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents |
||
| - name: Restore and save Nix store | ||
| uses: nix-community/cache-nix-action@v6 | ||
| with: | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -13,6 +13,12 @@ jobs: | |
| nix_conf: | | ||
| keep-env-derivations = true | ||
| keep-outputs = true | ||
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false | ||
|
Comment on lines
+16
to
+21
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# 1) Show the full workflow for manual-rs-release.yml (small file likely)
echo "=== manual-rs-release.yml ==="
if [ -f ".github/workflows/manual-rs-release.yml" ]; then
sed -n '1,220p' .github/workflows/manual-rs-release.yml | cat -n
else
echo "Missing: .github/workflows/manual-rs-release.yml"
fi
# 2) Find other workflows that mention Cachix and/or Rust caching conventions
echo
echo "=== Workflows using cachix/cachix-action ==="
rg -n "cachix/cachix-action@" .github/workflows --hidden || true
echo
echo "=== Workflows using Rust cache actions (common patterns) ==="
rg -n "rust-cache|Swatinem/rust-cache|actions/cache.*cargo|cache.*cargo|cache.*rust" .github/workflows --hidden || true
echo
echo "=== List all workflows files (for convention comparison) ==="
ls -1 .github/workflows || trueRepository: rainlanguage/raindex Length of output: 4487 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Manual rs release: rust cache references ==="
rg -n "rust-cache|Swatinem/rust-cache|actions/cache|cache.*cargo|cache.*rust" .github/workflows/manual-rs-release.yml || trueRepository: rainlanguage/raindex Length of output: 113 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "=== Manual rs release: rust cache references ==="
rg -n "rust-cache|Swatinem/rust-cache|actions/cache|cache.*cargo|cache.*rust" .github/workflows/manual-rs-release.yml || trueRepository: rainlanguage/raindex Length of output: 113 Pin 🧰 Tools🪛 zizmor (1.25.2)[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI Agents |
||
| - name: Restore and save Nix store | ||
| uses: nix-community/cache-nix-action@v6 | ||
| with: | ||
|
|
@@ -24,7 +30,7 @@ jobs: | |
| # before trying to save a new cache | ||
| # 1G = 1073741824 | ||
| gc-max-store-size-linux: 1G | ||
| - run: nix develop .#rust-shell --command cargo release --workspace | ||
| # forwards status to telegram chat if this ci fails or gets canceled, only runs for default branch | ||
| - name: Forward CI Status | ||
| if: always() | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -37,11 +37,35 @@ jobs: | |
| with: | ||
| swap-storage: false | ||
| # install nix for building WASM artifacts and running tests | ||
| - uses: nixbuild/nix-quick-install-action@v30 | ||
| with: | ||
| nix_conf: | | ||
| keep-env-derivations = true | ||
| keep-outputs = true | ||
| # pull rainix derivations from shared Cachix; push new ones if the | ||
| # token is set. continue-on-error so a token miss / Cachix outage | ||
| # degrades gracefully. | ||
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false | ||
| - name: Restore and save Nix store | ||
| uses: nix-community/cache-nix-action@v7 | ||
| with: | ||
| primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }} | ||
| restore-prefixes-first-match: nix-${{ runner.os }}- | ||
| gc-max-store-size-linux: 8G | ||
| - uses: Swatinem/rust-cache@v2 | ||
| with: | ||
| prefix-key: rust-${{ github.workflow }} | ||
| - name: Cache npm | ||
| uses: actions/cache@v4 | ||
|
Comment on lines
+40
to
+64
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# List the workflow file
ls -la .github/workflows/npm-package-release.yml 2>/dev/null || true
# Show the relevant portion (lines with numbers) around 1-120
sed -n '1,200p' .github/workflows/npm-package-release.yml
# Collect all uses lines in this workflow
echo "---- uses lines in npm-package-release.yml ----"
rg -n "^\s*- uses:" .github/workflows/npm-package-release.yml
# Search other workflows for pinned vs `@v`* patterns
echo "---- uses lines across workflows (sample) ----"
rg -n "^\s*- uses:" .github/workflows --glob '**/*.{yml,yaml}' | head -n 50
echo "---- count uses with `@v`* vs @<sha> (heuristic) ----"
python3 - <<'PY'
import re, subprocess, os, sys, pathlib, json
from collections import Counter
workflows_dir = pathlib.Path(".github/workflows")
paths = [str(p) for p in workflows_dir.rglob("*.yml")] + [str(p) for p in workflows_dir.rglob("*.yaml")]
pattern = re.compile(r'^\s*-\s+uses:\s*([^\s]+)@(.+?)\s*(#.*)?$')
counts = Counter()
bad = []
all_entries=[]
for path in paths:
txt = pathlib.Path(path).read_text(errors='ignore').splitlines()
for i,line in enumerate(txt,1):
m = re.match(r'^\s*-\s+uses:\s*(.+?)@(.+?)\s*$', line)
if m:
repo, ref = m.group(1), m.group(2)
if re.fullmatch(r'[0-9a-fA-F]{7,40}', ref):
counts['pinned_sha'] += 1
elif re.fullmatch(r'v\d+(\.\d+)*', ref) or ref.startswith('v'):
counts['major_semver_tag'] += 1
else:
counts['other_ref'] += 1
all_entries.append((path,i,repo,ref))
for k,v in counts.items():
print(k, v)
# Show examples of semver tags
semver_examples=[e for e in all_entries if re.fullmatch(r'v\d+(\.\d+)*', e[3]) or e[3].startswith('v')]
print("---- semver-like ref examples (up to 25) ----")
for path,i,repo,ref in semver_examples[:25]:
print(f"{path}:{i}: {repo}@{ref}")
# Show examples of sha pins (up to 10)
sha_examples=[e for e in all_entries if re.fullmatch(r'[0-9a-fA-F]{7,40}', e[3])]
print("---- sha pin examples (up to 10) ----")
for path,i,repo,ref in sha_examples[:10]:
print(f"{path}:{i}: {repo}@{ref}")
PYRepository: rainlanguage/raindex Length of output: 17292 🏁 Script executed: #!/bin/bash
set -euo pipefail
ls -la .github/workflows/npm-package-release.yml
sed -n '1,220p' .github/workflows/npm-package-release.yml
echo "---- uses lines in npm-package-release.yml ----"
rg -n "^\s*-\s+uses:" .github/workflows/npm-package-release.yml
echo "---- count uses with `@v`* vs @<sha> across workflows (heuristic) ----"
python3 - <<'PY'
import re, pathlib
from collections import Counter
paths = list(pathlib.Path(".github/workflows").rglob("*.yml")) + list(pathlib.Path(".github/workflows").rglob("*.yaml"))
counts=Counter()
semver=[]
sha=[]
other=[]
pattern = re.compile(r'^\s*-\s+uses:\s*(.+?)@(.+?)\s*$')
for p in paths:
lines=p.read_text(errors='ignore').splitlines()
for i,line in enumerate(lines,1):
m=pattern.match(line)
if not m:
continue
ref=m.group(2).strip()
if re.fullmatch(r'[0-9a-fA-F]{7,40}', ref):
counts['pinned_sha']+=1; sha.append((str(p),i,m.group(1),ref))
elif ref.startswith('v') and re.fullmatch(r'v\d+(\.\d+)*', ref):
counts['major_semver_tag']+=1; semver.append((str(p),i,m.group(1),ref))
else:
counts['other_ref']+=1; other.append((str(p),i,m.group(1),ref))
print(counts)
print("sha examples:")
for e in sha[:10]:
print(e)
print("semver examples:")
for e in semver[:10]:
print(e)
PYRepository: rainlanguage/raindex Length of output: 12746 Pin external
🧰 Tools🪛 zizmor (1.25.2)[error] 40-40: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [error] 48-48: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [error] 55-55: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [error] 60-60: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [error] 64-64: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [error] 55-55: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): always restores from cache (cache-poisoning) [error] 60-60: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default (cache-poisoning) [error] 64-64: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default (cache-poisoning) 🤖 Prompt for AI Agents |
||
| with: | ||
| path: ~/.npm | ||
| key: npm-${{ runner.os }}-${{ github.workflow }}-${{ hashFiles('**/package-lock.json') }} | ||
| restore-keys: npm-${{ runner.os }}- | ||
| # setup node with npm registry for OIDC-based publishing (no NPM_TOKEN needed) | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
|
|
@@ -86,11 +110,11 @@ jobs: | |
| exit 1 | ||
| fi | ||
| echo "Repositories match" | ||
| # forge install + build is no longer needed here — all sol! macros | ||
| # read committed ABIs under crates/*/abis/, and the wasm + npm builds | ||
| # below don't shell out to forge. The prior "Remove Unused Artifacts" | ||
| # / debug-dir scrubs went with forge; rust-cache + free-disk-space@v1 | ||
| # handle disk budget for the remaining WASM builds. | ||
| # WASM linker can run out of memory on GitHub runners; add swap to prevent OOM | ||
| - name: Add swap space | ||
| run: | | ||
|
|
@@ -104,20 +128,23 @@ jobs: | |
| sudo swapon /swapfile | ||
| # build and test WASM bindings | ||
| - name: Test JS/TS Binding 1/2 | ||
| run: | | ||
| nix develop .#wasm-shell -c bash -c "CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER=wasm-bindgen-test-runner cargo test --target wasm32-unknown-unknown --lib -p raindex_quote -p raindex_bindings -p raindex_js_api -p raindex_common" | ||
| # run JS/TS integration tests against WASM bindings | ||
| - name: Test JS/TS Binding 2/2 | ||
| run: | | ||
| nix develop .#wasm-shell -c bash -c ' | ||
| set -euxo pipefail | ||
| npm install --no-check | ||
| cd packages/raindex | ||
| npm run build | ||
| npm test | ||
| ' | ||
| # build and test UI components before publishing | ||
| - name: Build UI Components | ||
| run: nix develop .#wasm-shell -c npm run build -w @rainlanguage/ui-components | ||
| - name: Test UI Components | ||
| run: nix develop .#wasm-shell -c npm run test -w @rainlanguage/ui-components | ||
| # check for npm package blacklists pkgs across all raindex related packages | ||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,12 +3,11 @@ on: | |
| pull_request: | ||
| types: | ||
| - closed | ||
| jobs: | ||
| assess-pr-size-on-merge: | ||
| uses: rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main | ||
| with: | ||
| pr_number: ${{ github.event.pull_request.number }} | ||
| repo: ${{ github.event.repository.name }} | ||
| owner: ${{ github.repository_owner }} | ||
| merged: ${{ github.event.pull_request.merged }} | ||
|
thedavidmeister marked this conversation as resolved.
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: rainlanguage/raindex
Length of output: 189
🏁 Script executed:
Repository: rainlanguage/raindex
Length of output: 3353
🏁 Script executed:
Repository: rainlanguage/raindex
Length of output: 883
🏁 Script executed:
Repository: rainlanguage/raindex
Length of output: 8452
Pin newly added workflow actions to commit SHAs
In
.github/workflows/copilot-setup-steps.yml(lines 20-36), these actions are referenced only via mutable version tags (cachix/cachix-action@v15,nix-community/cache-nix-action@v7,Swatinem/rust-cache@v2,actions/cache@v4). Pin eachuses:to an immutable full commit SHA (...@<40+hex>) instead.🧰 Tools
🪛 zizmor (1.25.2)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 36-36: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents