ci: run publish job on GitHub-hosted runner for reliable Sigstore egress#42
Merged
Conversation
The self-hosted ARC pods have intermittent DNS/egress failures to *.sigstore.dev (Fulcio + Rekor), which kept failing build-provenance and SBOM attestation — a different attest step each run — and blocked the crates.io publish behind them. crates.io stayed clean (publish is sequenced after attestation), but 0.2.1 could not be published. Move the publish job to ubuntu-latest, which has reliable egress to Sigstore and crates.io. The job is infrequent and free on public repos. CI/test/fuzz jobs stay on the self-hosted `cachekit` runner where the persistent cargo cache helps and external attestation egress is not needed.
|
Wondering what really moved? Review this PR in Change Stack to inspect semantic changes, definitions, and references. WalkthroughThe publish job in the release workflow is reconfigured to run on ChangesPublish Job Runner Configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/release.yml (2)
76-81:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUpdate stale comment referencing self-hosted runner infrastructure.
Lines 77-80 reference "the self-hosted runner's CARGO_HOME (/cache/cargo)" and its persistent volume, but the job now runs on
ubuntu-latest(line 51). GitHub-hosted runners have ephemeral filesystems, so the--forceflag is no longer required (though harmless). This comment will mislead future maintainers about the runner environment.📝 Proposed fix to update the comment
- name: Install cargo-sbom - # --force is required: the self-hosted runner's CARGO_HOME (/cache/cargo) is a - # persistent volume, so the binary survives between runs and a plain install - # exits 101 ("binary `cargo-sbom` already exists"). --force reinstalls the - # --locked pinned version idempotently. + # Install cargo-sbom with --locked to pin the exact version from Cargo.lock. + # --force ensures idempotent reinstall if the binary already exists. run: cargo install cargo-sbom --locked --force🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 76 - 81, The comment above the "Install cargo-sbom" step incorrectly claims a persistent self-hosted CARGO_HOME; update the comment to reflect that this job runs on GitHub-hosted ubuntu-latest with an ephemeral filesystem and that --force is not required (but harmless), or simply remove the misleading reference; locate the step named "Install cargo-sbom" (the run: cargo install cargo-sbom --locked --force) and replace the existing lines explaining a persistent /cache/cargo with a short note about ubuntu-latest's ephemeral runner or no comment at all.Source: Learnings
29-29:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd mandatory version comments to action pins.
Lines 29 and 35 use full 40-char SHA pins but are missing version comments. As per coding guidelines, all actions in
.github/workflows/**must be pinned to full 40-char SHA with a version comment (e.g.,@<sha> # v2).📌 Proposed fix to add version comments
Line 29:
- - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 + - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2Line 35:
- - uses: googleapis/release-please-action@8b8fd2cc23b2e18957157a9d923d75aa0c6f6ad5 + - uses: googleapis/release-please-action@8b8fd2cc23b2e18957157a9d923d75aa0c6f6ad5 # v4Also applies to: 35-35
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml at line 29, The action pins at "uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349" (and the similar 40-char SHA pin at line 35) are missing the required version comment; update each pinned action to append the appropriate version comment (e.g., " # v2") after the SHA so the line reads like "uses: actions/create-github-app-token@<40-char-sha> # v2" to comply with the repository workflow pinning guideline.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/release.yml:
- Around line 76-81: The comment above the "Install cargo-sbom" step incorrectly
claims a persistent self-hosted CARGO_HOME; update the comment to reflect that
this job runs on GitHub-hosted ubuntu-latest with an ephemeral filesystem and
that --force is not required (but harmless), or simply remove the misleading
reference; locate the step named "Install cargo-sbom" (the run: cargo install
cargo-sbom --locked --force) and replace the existing lines explaining a
persistent /cache/cargo with a short note about ubuntu-latest's ephemeral runner
or no comment at all.
- Line 29: The action pins at "uses:
actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349" (and
the similar 40-char SHA pin at line 35) are missing the required version
comment; update each pinned action to append the appropriate version comment
(e.g., " # v2") after the SHA so the line reads like "uses:
actions/create-github-app-token@<40-char-sha> # v2" to comply with the
repository workflow pinning guideline.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 01ed006c-00ec-4909-9fd6-5a96e3ad35e7
📒 Files selected for processing (1)
.github/workflows/release.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Move the
publishjob fromruns-on: cachekit(self-hosted ARC) toruns-on: ubuntu-latest. CI/test/fuzz jobs are unchanged.Why
The ARC pods have intermittent DNS/egress failures to
*.sigstore.dev. Across three publish attempts for 0.2.1, a different Sigstore step failed each time:rekor.sigstore.dev ... ECONNREFUSED 0.0.0.0:443(SBOM attest) — hostname resolving to0.0.0.0Publish is sequenced after attestation, so these flakes blocked the crates.io publish (crates.io stayed clean — no partial publish). A GitHub-hosted runner has reliable egress to Sigstore + crates.io.
Cost
Free —
ubuntu-lateststandard runners are unlimited/free on public repos. The job runs only on release/dispatch.ci:type — non-releasing. After merge:gh workflow run release.ymlpublishes 0.2.1 with full build-provenance + SBOM attestation.Summary by CodeRabbit