chore: latest rainix + soldeer re-lock#61
Conversation
- rainix.url -> github:rainlanguage/rainix; nix flake update rainix - soldeer deps re-locked to latest registry versions Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 50 minutes and 40 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThis PR repoints the rainix flake input to the rainlanguage repo, adjusts the flake outputs signature, adds/updates GitHub Actions workflows, and applies minor formatting to ChangesDevelopment Infrastructure and Flake Input Migration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the bespoke rainix.yaml (consumer-flake nix develop referencing the removed rainix-rs-prelude task / dead magic-nix-cache action) with the standard reusable rainix-rs.yaml@main, matching the rest of the org. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/rainix-rs.yaml:
- Line 5: Update the reusable workflow reference so it is pinned to a commit SHA
instead of the branch name; replace the "uses:
rainlanguage/rainix/.github/workflows/rainix-rs.yaml@main" reference with the
specific commit SHA provided (f22d4dcaca61717e33eac65e7b09b9a82f604c1f) to
ensure reproducible CI runs and reduce supply-chain risk.
- Around line 1-5: Add a top-level permissions block in the rainix-rs GitHub
Actions workflow file to explicitly specify the minimum necessary permissions
for the reusable workflow call. This means adding a permissions field before the
jobs section, defining allowed permissions for the GITHUB_TOKEN to enforce least
privilege according to the needs of the reusable workflow used by the "rs" job.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: c9eee6a2-4c57-4a81-9d18-12baba466438
📒 Files selected for processing (2)
.github/workflows/rainix-rs.yaml.github/workflows/rainix.yaml
💤 Files with no reviewable changes (1)
- .github/workflows/rainix.yaml
| name: rainix-rs | ||
| on: [push] | ||
| jobs: | ||
| rs: | ||
| uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Fetch the reusable workflow file to check documented permission requirements
gh api repos/rainlanguage/rainix/contents/.github/workflows/rainix-rs.yaml --jq '.download_url' | xargs curl -s | head -50Repository: rainlanguage/alloy-ethers-typecast
Length of output: 367
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Fetch rainix-rs reusable workflow (permissions occurrences) ==="
curl -sL "$(gh api repos/rainlanguage/rainix/contents/.github/workflows/rainix-rs.yaml --jq '.download_url')" \
| rg -n "^(permissions:| permissions:|\spermissions:)" || true
echo "=== Fetch nested reusable workflows and search for permissions ==="
for wf in rainix-rs-static rainix-rs-test rainix-rs-wasm rainix-rs-wasm-test; do
url="$(gh api repos/rainlanguage/rainix/contents/.github/workflows/${wf}.yaml --jq '.download_url')"
echo "--- ${wf}.yaml ---"
curl -sL "$url" | rg -n "^(permissions:| permissions:|\spermissions:)" || true
done
echo "=== Fetch first 120 lines of rainix-rs.yaml for context ==="
curl -sL "$(gh api repos/rainlanguage/rainix/contents/.github/workflows/rainix-rs.yaml --jq '.download_url')" | head -120Repository: rainlanguage/alloy-ethers-typecast
Length of output: 681
🌐 Web query:
GitHub Actions reusable workflow job uses permissions: does called workflow inherit caller GITHUB_TOKEN permissions or its own permissions keyword
💡 Result:
When a reusable workflow is called, it inherits the permissions defined in the calling workflow's job [1][2][3]. Specifically: 1. Inheritance and Constraints: The called (reusable) workflow receives the GITHUB_TOKEN permissions defined in the calling job [2][3]. These permissions can only be downgraded (made more restrictive) by the called workflow; they cannot be elevated [2][3]. 2. Default Behavior: If the calling job does not explicitly define a permissions block, the called workflow uses the default GITHUB_TOKEN permissions [2][3]. 3. Interaction of Permissions: GitHub validates the call by comparing the caller job's declared permissions with the permissions requested by the nested jobs in the called workflow [4]. If the caller job does not grant the necessary permissions required by the called workflow, the workflow will fail validation before execution [4]. Because of this inheritance model, it is common practice to explicitly define permissions in both the caller (to set the available envelope) and the called workflow (to define the specific needs of that task, ensuring it does not exceed the caller's granted scope) [1][4].
Citations:
- 1: Add
permissions: {}to all reusable workflows python/cpython#148114 - 2: https://github.com/github/docs/blob/main/content/actions/reference/workflows-and-actions/reusing-workflow-configurations.md
- 3: https://docs.github.com/en/enterprise-server@3.13/actions/reference/reusable-workflows-reference
- 4:
call-workflowgenerated caller jobs omit requiredpermissions:for reusable workflows github/gh-aw#21071
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Local .github/workflows/rainix-rs.yaml (lines 1-60) ==="
nl -ba .github/workflows/rainix-rs.yaml | sed -n '1,60p'
echo "=== Search for permissions keyword in local workflow ==="
rg -n "^\s*permissions:" .github/workflows/rainix-rs.yaml || trueRepository: rainlanguage/alloy-ethers-typecast
Length of output: 199
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Local file exists? ==="
ls -la .github/workflows/rainix-rs.yaml
echo "=== Local .github/workflows/rainix-rs.yaml (head) ==="
sed -n '1,80p' .github/workflows/rainix-rs.yaml
echo "=== Search for top-level permissions keyword in local workflow ==="
rg -n "^\s*permissions:" .github/workflows/rainix-rs.yaml || true
echo "=== Search for any permissions keyword in local workflow ==="
rg -n "permissions:" .github/workflows/rainix-rs.yaml || trueRepository: rainlanguage/alloy-ethers-typecast
Length of output: 475
Add an explicit top-level permissions: block to enforce least-privilege for the reusable workflow call.
.github/workflows/rainix-rs.yaml has no permissions:, so the GITHUB_TOKEN used by the uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@main job falls back to GitHub’s default (often overly broad) token scopes. Reusable workflows inherit those caller permissions, so this should be tightened in the caller.
🛡️ Proposed fix
name: rainix-rs
on: [push]
+permissions:
+ contents: read
jobs:
rs:
uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@main📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| name: rainix-rs | |
| on: [push] | |
| jobs: | |
| rs: | |
| uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@main | |
| name: rainix-rs | |
| on: [push] | |
| permissions: | |
| contents: read | |
| jobs: | |
| rs: | |
| uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@main |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 1-6: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[error] 5-5: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/rainix-rs.yaml around lines 1 - 5, Add a top-level
permissions block in the rainix-rs GitHub Actions workflow file to explicitly
specify the minimum necessary permissions for the reusable workflow call. This
means adding a permissions field before the jobs section, defining allowed
permissions for the GITHUB_TOKEN to enforce least privilege according to the
needs of the reusable workflow used by the "rs" job.
| on: [push] | ||
| jobs: | ||
| rs: | ||
| uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Find the latest commit SHA on the main branch of rainlanguage/rainix
gh api repos/rainlanguage/rainix/commits/main --jq '.sha'Repository: rainlanguage/alloy-ethers-typecast
Length of output: 119
Pin the reusable workflow reference to a commit SHA
.github/workflows/rainix-rs.yaml uses the reusable workflow via @main, which is non-reproducible and expands supply-chain risk. Pin it to a specific commit SHA (current rainlanguage/rainix@main: f22d4dcaca61717e33eac65e7b09b9a82f604c1f).
🔒 Proposed fix to pin to a commit SHA
- uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@main
+ uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@f22d4dcaca61717e33eac65e7b09b9a82f604c1f📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@main | |
| uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@f22d4dcaca61717e33eac65e7b09b9a82f604c1f |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 5-5: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/rainix-rs.yaml at line 5, Update the reusable workflow
reference so it is pinned to a commit SHA instead of the branch name; replace
the "uses: rainlanguage/rainix/.github/workflows/rainix-rs.yaml@main" reference
with the specific commit SHA provided (f22d4dcaca61717e33eac65e7b09b9a82f604c1f)
to ensure reproducible CI runs and reduce supply-chain risk.
alloy's lib builds for wasm (rs-wasm passes) but its test suite pulls in native networking deps (mio/tokio) that don't compile to wasm32, so cargo test --target wasm32 --workspace fails. Run static + test + wasm-build via the reusable workflows; skip the incompatible wasm-test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
human-approved; merging |
1 participant
Bumps rainix to latest and re-locks soldeer deps.
rainix.url->github:rainlanguage/rainix,nix flake update rainixnix develop(latest rainix dev shell)🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
Chores