Repository navigation
revert: undo 7-day soak toolchain changes - #1039
Conversation
|
Warning Review limit reached
Next review available in: 39 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (37)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryReverts the 7-day supply-chain soak, dated nightly toolchain, Socket Firewall CI gates, and
Confidence Score: 5/5Safe to merge — this is a targeted revert that restores a working build state and adds a robust MSRV-derivation mechanism to prevent the same PPA drift from recurring. Every changed file is internally consistent: the MSRV downgrade, cold_path() removal, toolchain simplification, and PPA metadata derivation all move in the same direction. The new jq MSRV logic in ppa-publish.yml correctly errors on missing or inconsistent rust-version fields, and the regex guard catches malformed output before it reaches debian/control. No logic bugs, data-loss paths, or broken contracts were found across the 37 changed files. No files require special attention. Important Files Changed
Reviews (2): Last reviewed commit: "fix: harden build toolchain validation" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
test-linux failed because the sfw shims were staged BEFORE : the aube-registry retry tests hit local mocks addressed as registry.npmjs.org:<port>, and sfw's loopback NO_PROXY exemption keys on the address, not the socket — hostname-addressed mocks route into the proxy and its registry semantics 405 the mock's write endpoints. The firewall step now sits after the cargo suite, immediately before the one step that does network installs (docs:build), which is exactly the traffic it exists to scan. Review fixes (greptile + coderabbit): - soak-autofix: lease-checked force push (fetch the bot branch, then --force-with-lease) so a concurrent actor's commits are never clobbered. - checkDockerPrebake: parse the rustup install line's argument list instead of substring-matching — 'toolchain install 1.91.0 1.93.0' must satisfy msrv 1.93 even though 'toolchain install 1.93' never appears as a substring. - RUSTUP_CARGO resolves cargo.exe on Windows. - remotes: accept credential-bearing https remotes (https://user@github.com/...). - .cargo/config.toml: comment no longer claims a pinned nightly — documents the per-invocation path (aubepkg#1039).
test-linux failed because the sfw shims were staged BEFORE `mise run test`: the aube-registry retry tests hit local mocks addressed as registry.npmjs.org:<port>, and sfw's loopback NO_PROXY exemption keys on the address, not the socket — hostname-addressed mocks route into the proxy and its registry semantics 405 the mock's write endpoints. The firewall step now sits after the cargo suite, immediately before the one step that does network installs (docs:build), which is exactly the traffic it exists to scan. Review fixes (greptile + coderabbit): - soak-autofix: lease-checked force push (fetch the bot branch, then --force-with-lease) so a concurrent actor's commits are never clobbered. - checkDockerPrebake: parse the rustup install line's argument list instead of substring-matching — 'toolchain install 1.91.0 1.93.0' must satisfy msrv 1.93 even though 'toolchain install 1.93' never appears as a substring. - RUSTUP_CARGO resolves cargo.exe on Windows. - remotes: accept credential-bearing https remotes (https://user@github.com/...). - .cargo/config.toml: comment no longer claims a pinned nightly — documents the per-invocation 'cargo +nightly update' path (aubepkg#1039).
…ubepkg#1020, aubepkg#1039) Re-lands the 7-day dependency soak window and the pinned-tooling setup, guarded so it can't push the MSRV ceiling. Folds in the follow-up review and adversarial-review fixes made on top of the original re-land: loud failures when cargo silently ignores min-publish-age, npm min-release-age-exclude gating, unauthenticated download fallback with a single 5xx retry, scoping the firewall past the cargo suite, and the soak-fixer no longer reformatting files it does not own.
Summary
cold_pathchanges from build: 7-day soak across toolchain and deps, cold-path hints, pinned tooling #1020rustcbuild dependency from Cargo metadata to prevent future MSRV driftWhy
aube 1.27.0 raised its MSRV to Rust 1.95 immediately before release, but Ubuntu Resolute currently provides Rust 1.93.1. The PPA source package still declared
rustc (>= 1.93), so Launchpad scheduled the build and Cargo then rejected it.This restores Rust 1.93 compatibility and keeps the Debian build dependency synchronized with the workspace MSRV.
Validation
cargo fmt --checkcargo clippy --all-targets -- -D warningscargo testactionlint .github/workflows/ppa-publish.ymlNote
Medium Risk
Large removal of supply-chain CI gates and MSRV downgrade affect release/PPA compatibility; PPA metadata sync reduces future MSRV drift risk on Launchpad.
Overview
Reverts the 7-day soak and related supply-chain tooling from #1020: removes
scripts/soak/,external-tools.json, the soak Claude skill, cargomin-publish-age, docs soak config (pnpm-workspace.yaml,.npmrc, taze), RenovateminimumReleaseAge, and Linux CI steps for soak, pinned PMs, and Socket Firewall shims. Buildkite agent image drops pre-baked sfw/shims and nightly toolchain pins in favor of stable + 1.93.0 MSRV rustup.Workspace
rust-version/ MSRV goes 1.95 → 1.93 (Cargo.toml,.rules);rust-toolchain.tomlis removed. Stripscore::hint::cold_path()from hot-path error arms in linker, lockfile parser, resolver caches, and tarball handling.PPA publish adds a step that reads a single workspace
rust-versionviacargo metadataand setsBuild-Depends: rustc (>= ${MSRV})so Launchpad matches the declared floor (fixes 1.95 vs Ubuntu 1.93.1).Docs deps simplify: drops taze/untracked catalog tooling and refreshes
docs/aube-lock.yamlaccordingly.Reviewed by Cursor Bugbot for commit 9a43a6a. Bugbot is set up for automated code reviews on this repo. Configure here.