Skip to content

fix(oxlint-config): pin cloud Node and Bun archive checksums and never time out dpkg - #175

Merged
jan-kubica merged 5 commits into
mainfrom
cloud/tooling-cloud-setup-hardening-5954ba
Oct 26, 2026
Merged

jan-kubica merged 5 commits into
mainfrom
cloud/tooling-cloud-setup-hardening-5954ba

Conversation

@jan-kubica

Copy link
Copy Markdown
Contributor

Checks run:

  • cd packages/oxlint-config && bun test src/cloud-setup.test.ts
  • cd packages/oxlint-config && bun test src/cloud-setup-regressions.test.ts
  • cd packages/oxlint-config && bun test src/cloud-setup-toolchains.test.ts
  • cd packages/oxlint-config && bun test src/cloud-setup-artifacts.test.ts

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 18, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review 🔄 Running since 2026-10-23T10:22:41.310392Z 23e1b57 New commits
🔒 Security Review ✅ Completed 2026-10-18T07:10:31.638915Z 8bd014a PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@coderabbitai

coderabbitai Bot commented Oct 18, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review.

ℹ️ Recent review info
⚙️ Run configuration
📥 Commits

Reviewing files that changed from the base of the PR and between 8bd014a and 23e1b57.

📒 Files selected for processing: 8
  • .agents/cloud-setup.sh
  • packages/oxlint-config/src/cloud-setup-install.test.ts
  • packages/oxlint-config/src/cloud-setup-install.ts
  • packages/oxlint-config/src/cloud-setup-regressions.test.ts
  • packages/oxlint-config/src/cloud-setup.test.ts
  • packages/oxlint-config/src/cloud-setup.ts
  • packages/oxlint-config/src/toolchain-schema.ts
  • packages/oxlint-config/toolchain.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout: 8
  • GitHub Check: Enforce package quarantine / Enforce package quarantine
  • GitHub Check: Check generated AI instructions
  • GitHub Check: Hawk compiler compatibility
  • GitHub Check: rust-lints
  • GitHub Check: Shared tooling checks
  • GitHub Check: Changeset present for published package changes
  • GitHub Check: Generated setup with PostgreSQL and Valkey
  • GitHub Check: cla / cla
🧰 Additional context used
📚 Code guidelines: 1
AGENTS.md — configured
📓 Path-based instructions: 1
Source excerpt: If TypeScript can make a class of bug structurally impossible (branded types, discriminated unions, exhaustive checks), prefer that over runtime validation or manual discipline Source excerpt: No enums: use `as const` object...

CodeRabbit inference engine (AGENTS.md)

Files:

  • packages/oxlint-config/src/cloud-setup.test.ts
  • packages/oxlint-config/src/cloud-setup-regressions.test.ts
  • packages/oxlint-config/src/cloud-setup-install.ts
  • packages/oxlint-config/src/cloud-setup-install.test.ts
  • packages/oxlint-config/src/toolchain-schema.ts
  • packages/oxlint-config/src/cloud-setup.ts
🔇 Additional comments: 1
.agents/cloud-setup.sh: 1

358-362: 🩺 Stability & Availability

The supported Valkey path does not exercise the claimed mismatch. valkey-server requires valkey-tools (= 9.1.1-1.noble), and both archives are passed together to apt_install. The exact dependency is therefore supplied locally, not re-resolved from the bare name. All other listed dependencies use minimum versions or have no version or architecture qualifier.

Walkthrough

Cloud setup now checks Node and Bun archives against version- and architecture-specific SHA-256 pins. It selects Bun from the root package manager field when available. Local package installation resolves and downloads missing dependencies before running an offline install.

Changes: Runtime archive pinning

Layer / File(s) Summary
Runtime pin policy and selection
packages/oxlint-config/src/toolchain-schema.ts, packages/oxlint-config/toolchain.json, packages/oxlint-config/src/cloud-setup.ts, packages/oxlint-config/src/cloud-setup.test.ts
The policy validates per-version Node and Bun archive pins for amd64 and arm64. Generation selects Bun from the root packageManager value when it starts with bun@, requires pins for the selected versions, and passes the versions and pins to shell rendering. Tests check missing-pin errors.
Runtime archive verification
.agents/cloud-setup.sh, packages/oxlint-config/src/cloud-setup.ts, packages/oxlint-config/src/cloud-setup-regressions.test.ts
The installer checks downloaded Node and Bun archives against their configured pins and existing release checksum manifests. A regression test checks that an archive with a mismatched digest fails verification.

Local package installation

Layer / File(s) Summary
Dependency fetch and offline installation
packages/oxlint-config/src/cloud-setup-install.ts, packages/oxlint-config/src/cloud-setup-install.test.ts, .agents/cloud-setup.sh, .changeset/cloud-runtime-checksums.md
Local archive installation resolves missing dependency URIs, downloads listed dependencies through apt_network, then runs apt-get install --no-download. Tests cover cases with and without missing dependencies and check the rendered commands. The changeset records the update.

Priority: Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Policy as toolchain.json
  participant Parser as parseToolchainPolicy
  participant Generator as generateCloudSetup
  participant Installer as install_runtimes
  participant NodeArchive as Node archive
  participant BunArchive as Bun archive
  Policy->>Parser: versioned architecture pins
  Parser->>Generator: parsed pin maps
  Generator->>Installer: selected versions and pins
  Installer->>NodeArchive: download Node archive
  NodeArchive-->>Installer: archive data
  Installer->>Installer: check Node archive SHA-256
  Installer->>BunArchive: download Bun archive
  BunArchive-->>Installer: archive data
  Installer->>Installer: check Bun archive SHA-256
Loading

Possibly related PRs

  • stella/tooling#202: Changes the cloud Bun runtime version to 1.4.4, which this PR pins and verifies.
  • stella/tooling#215: Shares the Bun version selection and archive-pin contract used by this PR.
Merge Risk: Minimal · up to 23e1b

The reported dependency-download failure does not affect the supported installation path. No actionable merge-blocking risk remains after normal checks.

Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 7 files. (1 skipped: 1… Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks: 4 passed
Check name Status Explanation
Title check Passed The title clearly summarises the two main changes: pinned cloud Node and Bun archive checksums, and preventing dpkg from running within the network timeout.
Description check Passed The description lists tests that directly cover the changed cloud setup and installation behaviour. It is related to the changeset, although it does not state the test results.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 7 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches: 💡 1
📝 Generate docstrings: 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8bd014af9b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/oxlint-config/src/cloud-setup.ts Outdated
… the offline install

A local package archive is installed offline so dpkg and maintainer
scripts never run under a network deadline, but its dependencies may not
be in the archive cache, and the offline install then stops with
"Unable to fetch some archives". The install now asks apt which
downloads are missing (--print-uris contacts no server), fetches only
those under the network deadline, and then installs offline.
# Conflicts:
#	packages/oxlint-config/src/cloud-setup.test.ts
#	packages/oxlint-config/src/toolchain-schema.ts
#	packages/oxlint-config/toolchain.json
…cept repository runtime pins

apt fails internally when --no-download meets a local archive, so local
archives now take the same bounded --download-only step as indexed packages.
The install that follows runs without a deadline only after --print-uris
shows that nothing but local file: archives remains to fetch.

The shared policy pins archives only for its own Node patch and Bun release.
A repository on another accepted Node patch or a newer Bun declares that one
release's amd64 and arm64 values in cloud.runtimeArchiveSha256; a release the
shared policy pins cannot be repeated there. Generation takes the repository
Bun its callers already resolve instead of reading packageManager again.
@jan-kubica
jan-kubica added this pull request to the merge queue Oct 26, 2026
Merged via the queue into main with commit 1ef84f7 Oct 26, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant