[senamakel]

Summary

rust-ci installs the AWS CLI from Ubuntu 22.04's awscli package, which is v1 (1.22). Its aws eks update-kubeconfig writes a kubeconfig whose exec plugin uses client.authentication.k8s.io/v1alpha1, an API kubectl removed in 1.24. A deploy job that runs azure/setup-kubectl (latest kubectl) and then aws eks update-kubeconfig in this image fails at its first kubectl call:

error: exec plugin: invalid apiVersion "client.authentication.k8s.io/v1alpha1"

That's what stopped tinyhumansai/chottu-core's production deploy (run 39746393882): the image was built and pushed, but the rollout step never reached the cluster. Staging uses the same image and would fail the same way.

This replaces the apt package with AWS CLI v2, pinned like the image's other tools: AWSCLI_VERSION plus the AWSCLI_SHA256 of AWS's release zip, checked with sha256sum -c. The install fails if the installed version isn't the pinned one.

Changes

• Dockerfile: drop awscli from apt, then install AWS CLI 2.37.10 (released 2026-10-06) from awscli.amazonaws.com.
• smoke.sh: fail if aws is not v2, so a regression to the v1 package can't publish.
• README.md: name v2, and say why it matters.

Verification

• The digest is from the release zip, whose detached signature I verified against the AWS CLI team's key (FB5DB77FD5C118B80511ADA8A6310ACC4672475C, the fingerprint AWS documents): Good signature from "AWS CLI Team <aws-cli@amazon.com>".
• I ran the new install block and the new smoke check in a clean ubuntu:22.04 (linux/amd64) container: aws-cli/2.37.10 Python/3.14.6 … exe/x86_64.ubuntu.22, and the smoke check passed.
• I did not build the full image locally; this repo's image build and smoke.sh run in its CI.

After merge

chottu-core pins this image by digest in .github/rust-ci-image, and EX63 boots it as the VM rootfs. Once the new image is published, the runner host's CI_IMAGE must be updated and its rootfs rebuilt before the chottu-core repin merges (per that repo's rules). Until then, chottu-core deploys can't reach the cluster.

Summary by CodeRabbit

• Updates
  • The deployment image now includes AWS CLI v2.37.10 instead of AWS CLI v1, with the installed version verified.
• Documentation
  • Deployment prerequisites now specify AWS CLI v2 and retain the requirements for VM runners, including user namespaces and at least 65,536 subordinate UIDs/GIDs.

[tinysweeper]

Tiny Sweeper review

Reviewed head: 9da27d230dd80c38f5c59a008a14bcd02960dfe9

Verdict: Ready for maintainer review · Priority: none
Coverage: Reviewed 3 of 3 files.
Pull request purpose (title): Install AWS CLI v2 i…

Diagnostics and supporting details

Full summary

Pull request purpose (title): Install AWS CLI v2 in rust-ci instead of Ubuntu's v1. The PR replaces Ubuntu 22.04's AWS CLI v1 (`awscli`, 1.22) in the `rust-ci` image with a pinned, digest-verified AWS CLI v2 install, because v1's `aws eks update-kubeconfig` writes a `client.authentication.k8s.io/v1alpha1` exec API that kubectl 1.24+ rejects, which blocked a production deploy. The latest-push-delta section is unavailable, so no push-delta claims are made.

Review snapshot

Change surface	Files	Review signal	Count
Production	2	Active findings	0
Tests	0	Noted findings	0
Documentation	1	Resolved findings	0
Configuration	0	Pending checks/questions	0

Completeness: Complete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

What changed

The Dockerfile drops `awscli` from the apt install list and adds an ARG-pinned AWS CLI v2 install from AWS's signed release zip, verifying the zip's SHA-256 and asserting the installed version matches the pinned one. `smoke.sh` adds a grep assertion that `aws --version` reports the v2 major version, and `README.md` documents AWS CLI v2 and the kubectl exec-API rationale. The build now fails if the digest or the pinned-version grep does not match, so the behavior change cannot land silently.

Features

• Removed — Drop Ubuntu's AWS CLI v1 apt package from the image: Eliminates the v1 CLI (1.22 on jammy) whose `aws eks update-kubeconfig` emits an exec plugin with `client.authentication.k8s.io/v1alpha1`, which kubectl 1.24 and later refuse, so the previous image could not complete an EKS rollout after `azure/setup-kubectl`. (images/rust-ci/Dockerfile RUN apt-get update && apt-get install -y --no-install-recommends \)
• Added — Pinned, digest-verified AWS CLI v2 install in the Dockerfile: Installs AWS CLI v2 (ARG `AWSCLI_VERSION`, default 2.37.10) from `awscli.amazonaws.com`, checks the downloaded zip against `AWSCLI_SHA256` with `sha256sum -c`, installs it, and fails the build unless `aws --version` matches the pinned version — making the v2 replacement reproducible and tamper-evident, consistent with the image's other pinned tools. (images/rust-ci/Dockerfile RUN apt-get update && apt-get install -y --no-install-recommends \)
• Added — Smoke test asserts AWS CLI v2 major version: A build-time regression to the v1 package now fails the smoke check rather than publishing a broken image, guarding the exact failure mode this change fixes. (images/rust-ci/smoke.sh node --version)
• Modified — README documents AWS CLI v2 and why it matters: Readers of the rootless-deploy section are told the image ships AWS CLI v2 pinned via `AWSCLI_VERSION` and that v1's `aws eks update-kubeconfig` writes an exec API current kubectl refuses, so the version requirement is not silent. (images/rust-ci/README.md and D-Bus. This verifies the image dependencies, not the full OpenHuman suite.)

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Before merge

None.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: Reviewed 3 files; 0 findings.

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The security lane answered after reviewing 2 files with 0 findings; `images/rust-ci/README.md` was not security-reviewed because it is prose or tabular data.
• Lane summary: Reviewed 2 files; 0 findings. 1 file was not security-reviewed: images/rust-ci/README.md (prose or tabular data).

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The Dockerfile now installs AWS CLI v2 from the signed release zip with a pinned version and SHA-256 digest, and smoke.sh adds a `grep -q '^aws-cli/2\.'` assertion. No test file changed, but the smoke test itself asserts the v2 major version at build time, which is exactly the regression this change guards; the Dockerfile RUN also fails the build if the digest or the version grep does not match, so the behavioural change cannot land silently. I was not able to verify the pinned digest against the upstream artifact from here, but nothing in the diff shows it to be wrong. No reportable defects.

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane answered and reports no sensitive content in committed files.
• Lane summary: No sensitive content in committed files.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change replaces Ubuntu's AWS CLI v1 with a pinned, digest-checked AWS CLI v2 install and adds a v2 assertion to smoke.sh, matching the PR description. I found no defect in the description against the diff: the apt removal, the ARG-pinned install, the sha256 check, the version grep, the smoke.sh check and the README wording are all present as described. One thing worth noting is that the smoke check `aws --version | grep -q '^aws-cli/2\.'` is weaker than the Dockerfile's pinned-version check, so a smoke.sh regression to some other v2 version would pass — but the Dockerfile check runs at build time in the same image, so this is not a reachable defect and I am not reporting it.

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.000926
• Tokens: 226316 input · 4595 output · 74308 cached · 235 embedding
• Updated: 2026-10-22T09:00:38Z

Head	State	Pass summary
9da27d230dd8	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-22T09:00:38Z)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-22T09:00:07.220731Z	9da27d2	PR opened
🔒 Security Review	✅ Completed 2026-10-22T09:02:03.674088Z	9da27d2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9e0638f3-268f-44ba-84c4-6f1d6fa31b04

📥 Commits

Reviewing files that changed from the base of the PR and between 49194ca and 9da27d2.

📒 Files selected for processing: 3

• images/rust-ci/Dockerfile
• images/rust-ci/README.md
• images/rust-ci/smoke.sh

+----------------------------------------------------------+
| Not just a pretty face, but a pretty good code reviewer! |
+----------------------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

Diagnostics

Total spend: $0.0009