feat: implement issue #410 — [Fleet Monitor] petry-projects/ContentTwin — .github/workflows/ci.yml - #411
Conversation
…in — .github/workflows/ci.yml
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🤖 CodeAnt AI — Review Status
|
|
Warning Review limit reached
Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe CI workflow now downloads a pinned shfmt version to a temporary path, verifies its SHA256 checksum during retries, and installs it after verification. A Bats test checks the checksum configuration and validation order. Changesshfmt download verification
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:M
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a new BATS test to verify that the shfmt installation step in the CI workflow pins a checksum and performs verification inside the retry loop. The reviewer suggested refactoring the inline Python script to avoid redundant function calls and add defensive checks to ensure each step is a dictionary before accessing its properties.
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #411 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/tests/ci-workflow.bats`:
- Around line 150-155: Strengthen the assertions around the retry-loop script in
the install verification test by requiring the shfmt installation command to
appear after `sha256sum -c` and within the checksum-success `if` branch.
Preserve the existing checks that validation occurs inside the retry loop, using
the `script` and `body` assertions to verify both ordering and successful-path
containment.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 4cdeeea6-0078-4faa-a7e6-952ffe5fddad
📒 Files selected for processing (2)
.github/workflows/ci.ymlscripts/tests/ci-workflow.bats
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
|
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 39caa42fbc30ed832f03b4edac106a6814290b9b
Review mode: triage-approved (single reviewer)
Summary
Hardens the shfmt installation step in .github/workflows/ci.yml: pins the version via env var, downloads to a temp path, verifies the binary against a pinned SHA256 checksum inside the existing 3-attempt retry loop, and only installs on successful verification. Adds a Bats test asserting the checksum is pinned, verification precedes installation, installation stays in the success branch, and verification runs inside the retry loop. The pinned checksum was independently verified against the official mvdan/sh v3.10.0 sha256sums.txt release asset — it matches exactly.
Linked issue analysis
Closes #410 (Fleet Monitor: ci.yml DEGRADED, 50% failure rate). The issue flags CI formatting failures from the shfmt download; this PR makes truncated/corrupt HTTP-200 downloads (which curl exits 0 on) fail checksum verification and retry instead of hard-failing the job. Substantively addresses the issue.
Findings
No blocking findings.
- Checksum
1f57a384d59542f8fac5f503da1f3ea44242f46dff969569e80b524d64b71dbcmatches the official shfmt v3.10.0 linux_amd64 checksum (verified against the upstream release sha256sums.txt). - Security posture is improved: download moved out of /usr/local/bin until verified,
install -m 0755replaces bare chmod, --proto '=https' retained. - Both prior review threads (gemini-code-assist, CodeRabbit) are resolved; the CodeRabbit suggestion to assert checksum-before-install ordering was addressed in commit 39caa42.
- Secret-scanning MCP tool unavailable in this environment; gitleaks CI check passed and the only hex string in the diff is a public release checksum, not a secret.
CI status
All checks green: CI (Lint, Format, Test, Secret scan/gitleaks), CodeQL (actions), SonarCloud Quality Gate passed (0 new issues, 0 hotspots), AgentShield, CodeRabbit, Graphite AI Reviews. Dependency-audit sub-jobs skipped (no matching ecosystems). No failures or pending checks.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
2 participants
User description
Closes #410
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Verify shfmt downloads before using them in CI
What Changed
Impact
✅ Fewer CI formatting failures from corrupt downloads✅ Safer shfmt installation✅ More reliable retry behavior💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
CI Improvements
Tests