fix: require zig mirrors to be both live upstream and reviewed - #33
Merged
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe release workflow checks out a reviewed Zig mirror list at the workflow commit, intersects it with live upstream mirrors, probes approved candidates, and passes the selected mirror to build jobs. The repository adds mirror entries, maintenance documentation, and supporting configuration. ChangesZig mirror selection
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant PlanJob
participant ReviewedMirrorList
participant ZigUpstream
participant BuildMatrix
participant setup-zig
PlanJob->>ReviewedMirrorList: Checkout reviewed mirror list at github.workflow_sha
PlanJob->>ZigUpstream: Read live community mirror list
PlanJob->>PlanJob: Intersect lists and probe the Zig tarball
PlanJob->>BuildMatrix: Pass selected mirror and egress host
BuildMatrix->>setup-zig: Configure the selected mirror
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-rust.yml:
- Around line 119-137: Verify this workflow change through an actual zigbuild
release run: confirm the checked-out .github/zig-mirrors.txt comes from the
called workflow commit, the generated matrix contains only the intersection of
live and reviewed mirrors, and the selected mirror is accepted by harden_runner.
Record or otherwise validate these acceptance checks without changing the
intersection logic around live_mirrors, reviewed_mirrors, and zig_mirrors.
- Around line 78-90: The checkout_release_workflows step currently uses caller
workflow identity, which can reference a commit absent from
purpleclay/release-workflows. Update its ref expression to use job.workflow_sha
and set the repository from job.workflow_repository, preserving the existing
pinned checkout and sparse-checkout behavior.
In @.github/zig-mirrors.md:
- Around line 27-30: Add blank lines immediately before and after the indented
shell code fence in the numbered list item, preserving the existing curl command
and surrounding Markdown content.
- Around line 16-21: Correct the marker descriptions in the documentation
surrounding the diff command: `<` denotes lines present only in the live
upstream input, while `>` denotes lines present only in the committed
`.github/zig-mirrors.txt` input. Keep the command and review guidance unchanged.
- Around line 16-19: Update the shell code block containing the
process-substitution diff command to explicitly use a Bash fence, since the
syntax requires Bash rather than POSIX sh.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: cb52903b-a8b2-4c23-b34e-ed01657d727f
📒 Files selected for processing (6)
.github/workflows/release-rust.yml.github/zig-mirrors.md.github/zig-mirrors.txt.github/zizmor.yml.gitignoretypos.toml
purpleclay
force-pushed
the
31-manage-zig-mirror-list
branch
from
August 1, 2026 06:45
e726c1a to
4fe364f
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-rust.yml:
- Around line 130-133: Preserve full normalized mirror base URLs during
approval: update the mirror intersection in .github/workflows/release-rust.yml
lines 130-133 to compare URLs including paths, then derive each approved URL’s
host:443 for zig_mirrors. Update .github/zig-mirrors.md lines 25-31 to use the
exact approved base URL, append the archive name, and download and validate that
resulting tarball.
- Around line 88-89: Preserve the documented self-checkout expressions using
job.workflow_repository and job.workflow_sha in the checkout configuration. Do
not replace them with github.workflow_sha; if validation requires actionlint
compatibility, update its schema or add a narrowly scoped suppression instead.
- Around line 78-90: Update the plan job permissions to grant contents: read so
checkout_release_workflows can fetch job.workflow_repository at
job.workflow_sha, and require each caller job invoking this reusable workflow to
grant the same permission. Preserve persist-credentials: false in the checkout
configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 6cd59a9b-83a7-4bf0-aa9b-17bc00929397
📒 Files selected for processing (6)
.github/workflows/release-rust.yml.github/zig-mirrors.md.github/zig-mirrors.txt.github/zizmor.yml.gitignoretypos.toml
purpleclay
force-pushed
the
31-manage-zig-mirror-list
branch
from
August 1, 2026 08:20
4fe364f to
e6a4f96
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-rust.yml:
- Around line 134-145: Update the mirror-selection flow around approved_mirrors
and the setup_zig matrix so it selects a reviewed full mirror URL, includes that
URL in each matrix entry, and passes it through setup-zig’s with.mirror input.
Derive the network allowlist host from the selected reviewed URL rather than
allowing every path on all reviewed hosts, while preserving the existing
live-and-reviewed filtering.
In @.github/zig-mirrors.md:
- Around line 27-32: Extend the mirror verification procedure after downloading
the tarball to fetch its matching .minisig file, verify the archive using the
ZSF public key, and independently confirm that the signature’s trusted file
field exactly matches the requested archive filename. Do not rely on minisign
alone for the filename check, and keep validation against the downloaded tarball
rather than a HEAD response.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: c4539015-157d-4bcc-af43-1266c3595059
📒 Files selected for processing (6)
.github/workflows/release-rust.yml.github/zig-mirrors.md.github/zig-mirrors.txt.github/zizmor.yml.gitignoretypos.toml
purpleclay
force-pushed
the
31-manage-zig-mirror-list
branch
from
August 1, 2026 12:48
e6a4f96 to
9b54c3d
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-rust.yml:
- Around line 75-76: Update the plan job’s mirror-probing flow around the
candidate loop and harden_runner setup: resolve and validate approved mirror
endpoints before applying the probe policy, or move probing into a separate job
with only approved candidate hosts allowed. Preserve the build-job restriction
to ${zig_mirror_host}:443 and ensure zig_mirror is populated when a permitted
mirror is available.
In @.github/zizmor.yml:
- Around line 4-13: Update both ignore entries in the zizmor configuration to
reference release-rust.yml:227 instead of release-rust.yml:203, including their
explanatory comments, so they match the dtolnay/rust-toolchain usage.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 67ae06f6-303d-4fee-801d-633026c11c5c
📒 Files selected for processing (7)
.github/workflows/release-rust.yml.github/zig-mirrors.md.github/zig-mirrors.txt.github/zizmor.yml.gitignoreflake.nixtypos.toml
purpleclay
force-pushed
the
31-manage-zig-mirror-list
branch
from
August 1, 2026 12:52
9b54c3d to
e879229
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-rust.yml:
- Around line 176-180: Update the liveness probe in the mirror-selection loop
around zig_tarball and zig_mirror to request each candidate using the approved
URL structure, inserting ZIG_VERSION between the candidate base URL and
zig_tarball. Preserve the existing curl options and mirror-selection behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 4d221858-b3f4-4dc8-b6b3-450ad9777742
📒 Files selected for processing (7)
.github/workflows/release-rust.yml.github/zig-mirrors.md.github/zig-mirrors.txt.github/zizmor.yml.gitignoreflake.nixtypos.toml
Closes #31 `compose_build_matrix` previously allowlisted every host `community-mirrors.txt` currently listed, straight from a live fetch at build time — mutable, externally-maintained content with zero review on our side. A compromised or maliciously-edited upstream entry would have been automatically trusted as a build-script egress target. Now takes the intersection of that live list with a reviewed, repository-owned .github/zig-mirrors.txt: a mirror disappearing upstream drops out with no PR needed; a new one only becomes trusted once someone reviews and commits it here. Signed-off-by: purpleclay <purpleclaygh@gmail.com>
purpleclay
force-pushed
the
31-manage-zig-mirror-list
branch
from
August 1, 2026 13:58
e879229 to
65b4781
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #31
Summary by CodeRabbit
Security
Documentation
Maintenance