ci: gate the Rust SDK on PRs (fmt, clippy, build, test)#35
Conversation
|
@graycyrus is attempting to deploy a commit to the Vezures Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
More reviews will be available in 10 minutes and 33 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughA new ChangesRust SDK CI Job
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 139: The actions/checkout@v4 action currently uses default settings that
persist the GitHub token in the local git config, creating a security risk when
the job executes untrusted code via cargo build/cargo test. Add the
persist-credentials input parameter set to false to the checkout action to
disable token persistence and reduce token exposure.
- Around line 139-145: Replace the mutable version tags in the GitHub Actions
with full commit SHAs for immutability. Update the three uses directives:
actions/checkout@v4, dtolnay/rust-toolchain@stable, and Swatinem/rust-cache@v2
by replacing each mutable tag (v4, stable, v2) with their corresponding full
commit digest hashes to prevent supply-chain drift and ensure reproducible CI
runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8304a7ae-30a4-4efd-bf5b-b9267f42e9d6
📒 Files selected for processing (1)
.github/workflows/ci.yml
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| components: rustfmt, clippy | ||
|
|
||
| - uses: Swatinem/rust-cache@v2 |
There was a problem hiding this comment.
Pin newly added GitHub Actions to commit SHAs.
The new job uses mutable tags (@v4, @stable, @v2). If your CI policy requires immutable pinning, these should be pinned to full commit digests to prevent supply-chain drift.
Suggested patch shape
- - uses: actions/checkout@v4
+ - uses: actions/checkout@<full_commit_sha_for_v4>
- - uses: dtolnay/rust-toolchain@stable
+ - uses: dtolnay/rust-toolchain@<full_commit_sha_for_stable_ref>
- - uses: Swatinem/rust-cache@v2
+ - uses: Swatinem/rust-cache@<full_commit_sha_for_v2>🧰 Tools
🪛 zizmor (1.25.2)
[warning] 139-139: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 139-139: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 141-141: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 145-145: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 139 - 145, Replace the mutable version
tags in the GitHub Actions with full commit SHAs for immutability. Update the
three uses directives: actions/checkout@v4, dtolnay/rust-toolchain@stable, and
Swatinem/rust-cache@v2 by replacing each mutable tag (v4, stable, v2) with their
corresponding full commit digest hashes to prevent supply-chain drift and ensure
reproducible CI runs.
Source: Linters/SAST tools
The Rust crate was never built or tested on PRs — `ci.yml` covered only the TS SDK + website. `publish-rust-sdk.yml` runs the Rust checks, but only on push to main (post-merge), so build breaks land on main undetected. Add a `rust-sdk` job running `cargo fmt --check`, `cargo clippy -D warnings`, `cargo build`, and `cargo test` against `sdk/rust/` on every PR, with a Rust toolchain + cache. Closes #14 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2edf07c to
51c0c35
Compare
Addresses CodeRabbit/zizmor: the rust-sdk job runs repo code (cargo build/test), so set persist-credentials: false to avoid leaving the token in git config. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Thanks @coderabbitai. Addressed:
|
|
Tip For best results, initiate chat on the files or code changes.
🐇 |
1 participant
What
Adds a
rust-sdkjob toci.ymlthat runs on every PR (and push tomain):cargo fmt --checkcargo clippy --all-targets -- -D warningscargo build --all-targetscargo testagainst
sdk/rust/, with a Rust toolchain (dtolnay/rust-toolchain@stable+ rustfmt/clippy) andSwatinem/rust-cache.Why
The Rust crate was never built or tested on PRs —
ci.ymlcovered only the TS SDK + website.publish-rust-sdk.ymlruns the Rust checks, but only on push tomain(post-merge), so regressions land undetected. This is exactly what happened: the crate is currently broken onmain(#30 / fixed in #32). A PR gate would have blocked it.Merge ordering
This should merge after #32 (the compile fix). Until the crate compiles on
main, this job will (correctly) fail. Once #32 is in, this goes green and keeps the Rust SDK honest going forward.Closes #14
🤖 Generated with Claude Code
Summary by CodeRabbit