Repository navigation
Conversation
Record the output of the image pull check so the mold verification run has a captured log to reference. Auto-committed-on: macbook
Adds a shell script that exercises the mold linker in the rust-ci image and a captured wrapper log from a failing run, giving the CI setup a reproducible check for mold linking behaviour. Auto-committed-on: macbook
Install mold 2.40.4 and a wrapper linker script, then set it as the default target linker via CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER. The wrapper keeps the linker in place when cargo-llvm-cov replaces RUSTFLAGS and the EX63 guest relocates CARGO_HOME onto its cache disk. Auto-committed-on: macbook
Add a small C probe and its compiled binary under target/mold-checks to verify the mold linker works in this environment. Auto-committed-on: macbook
The smoke test now builds a small Rust crate with the stable, MSRV, and OpenHuman toolchains, both with and without coverage flags, and checks that the resulting ELF binaries were linked with mold. This guards against the linker setting being lost when CARGO_HOME is relocated or RUSTFLAGS are overridden. Auto-committed-on: macbook
Auto-committed-on: macbook
Added a step to the rust-ci image workflow that runs the mold linker test script, so the image's default linker configuration is verified during CI. Auto-committed-on: macbook
Install awscli, openssh-client, uidmap, slirp4netns, iptables and iproute2 so deploy jobs can start a rootless Docker daemon via docker/setup-docker-action without a privileged socket. The smoke test now checks each new tool, and the README documents the host requirements for user namespaces and subordinate UID/GID ranges. Auto-committed-on: macbook
Make mold the default Rust CI image linker
The image build now takes the MongoDB major, version and signing-key fingerprint as build args, and the workflow builds a second matrix entry that publishes mongo8-prefixed tags alongside the existing MongoDB 7.0.45 ones. The smoke test asserts the installed major and exercises a replica-set primary and a transaction, since OpenIntents needs MongoDB 8. Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Publish a MongoDB 8 Rust CI image variant
Add tests that parse action.yml to confirm the trust opt-in declares a safe default of false and that the caller's value is forwarded to actions/checkout, so fork checkouts stay disabled unless a caller explicitly opts in. Auto-committed-on: macbook
Adds an opt-in input that forwards to the pinned actions/checkout action so trusted-base workflows can check out fork pull requests after their own trust checks authorize the code and runner access. It defaults to false, preserving the upstream refusal guard for ordinary callers, and the README documents the required gating. Auto-committed-on: macbook
…modules Adds two cases to the checkout-submodules test script: a stale top-level declaration pointing at a missing path, and a nested declaration whose path collides with a tracked file but has no gitlink. Both assert that the valid submodules are still checked out and nothing is skipped. Auto-committed-on: macbook
The submodule checkout now only updates paths the index records as gitlinks, so stale .gitmodules declarations left behind after a gitlink is removed are ignored instead of causing failures. This matches plain git submodule update behaviour and also covers declarations in nested submodules. Auto-committed-on: macbook
fix(checkout): support trusted fork PRs and stale submodule declarations
Introduces a Docker image for Rust continuous integration and a smoke test script that verifies the toolchain works inside the built image. Auto-committed-on: macbook Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
feat(rust-ci): add bubblewrap 0.13.1 for TinyBox jails
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Tiny Sweeper reviewTiny Sweeper reviewed this change across 5 lane(s) and found 0 active actionable finding(s). Detailed lane evidence and any incomplete work are listed below. State: Incomplete Review snapshot
Completeness: Incomplete FeaturesNone identified with supported citations. TestsNo supported feature-to-test mapping was produced. Test execution is not inferred.
FindingsNo active actionable findings. Could not review: .github/workflows/rust-ci-image.yml, actions/checkout/README.md, actions/checkout/action.yml, actions/checkout/checkout-submodules.sh, images/rust-ci/Dockerfile, images/rust-ci/README.md, images/rust-ci/mold-linker, images/rust-ci/smoke.sh, images/rust-ci/test-mold-linker.sh, scripts/test-checkout-submodules.py, tinysweeper/description, tinysweeper/tests Before merge
How this fits togetherflowchart LR
n0["run_script"]:::impacted
n1["cloned"]:::impacted
n2["git"]:::impacted
n3["...on_without_gitlink_ignores_a_tracked_file"]:::impacted
n4["...eclaration_does_not_hide_valid_submodules"]:::impacted
n3 -->|calls| n0
n3 -->|tests| n0
n3 -->|calls| n1
n3 -->|tests| n1
n3 -->|calls| n2
n3 -->|tests| n2
n4 -->|calls| n0
n4 -->|tests| n0
n4 -->|calls| n1
n4 -->|tests| n1
n4 -->|calls| n2
n4 -->|tests| n2
classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: .github/workflows/rust-ci-image.yml, actions/checkout/README.md, actions/checkout/action.yml, actions/checkout/checkout-submodules.sh, images/rust-ci/Dockerfile, images/rust-ci/README.md, images/rust-ci/mold-linker, images/rust-ci/smoke.sh and 4 more.
$0.0001 · 0 in / 0 out · 825 embedded · ladder/vectors-oai3
tinysweeper
Bot
added
the
priority: p3
senamakel
merged commit Oct 19, 2026
9b27191
into
tinyhumansai:epic/8056-modules-wiring
11 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge current main into the epic workflow branch so reviewed releases use the updated recursive checkout behavior and Rust CI image tooling. Main’s ten checkout/image paths are preserved unchanged; the epic’s release profiles, trusted checks, provenance and immutable asset gates remain unchanged.
Temporary reviewed release routes remain available for the pending Box, Flows and Memes publications. They must be retired before the final main rollup after those prerequisites complete.
Validation: 109 Python tests passed across release, association, drift, MSRV, assets and checkout suites; actionlint, ShellCheck, mold-linker smoke and source equality checks passed. Independent source review passed. Both image builds passed on canonical main at the exact unchanged image source commit (run 39263866024); an image build was not rerun on the union.
Part of tinyhumansai/openhuman#8056. This PR targets the epic branch.