Add disk space cleanup step for Ubuntu in Docker workflow - #324
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughA new "Free Disk Space (Ubuntu)" step was added to the docker-build-push workflow job in Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRAdded a disk space cleanup step for Ubuntu in the Docker workflow. What changed?Introduced a step in the Docker workflow to free up disk space on Ubuntu runners, enhancing resource management during builds. Description generated by Mesa. Update settings |
There was a problem hiding this comment.
Pull Request Overview
This PR adds a disk space cleanup step to the Docker workflow to free up storage space on Linux runners before building Docker images. This is particularly useful for workflows that may run out of disk space during large Docker builds.
Key Changes:
- Added a "Free Disk Space (Ubuntu)" step that removes unnecessary tools and packages from Linux runners to free up disk space before Docker operations
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| uses: actions/checkout@v5 | ||
| - name: Free Disk Space (Ubuntu) | ||
| if: runner.os == 'Linux' | ||
| uses: jlumbroso/free-disk-space@main |
There was a problem hiding this comment.
Using @main as the version reference for this action is not a best practice. The main branch can change at any time, which could introduce breaking changes or unexpected behavior in your workflow without warning.
Consider pinning to a specific version tag or commit SHA instead. For example:
uses: jlumbroso/free-disk-space@v1.3.1(semantic version)uses: jlumbroso/free-disk-space@54081f69e8b(commit SHA)
This provides better reproducibility and stability for your CI/CD pipeline.
| uses: jlumbroso/free-disk-space@main | |
| uses: jlumbroso/free-disk-space@v1.3.1 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Free Disk Space (Ubuntu) | ||
| if: runner.os == 'Linux' | ||
| uses: jlumbroso/free-disk-space@main |
There was a problem hiding this comment.
The new cleanup step invokes jlumbroso/free-disk-space@main. Referencing a moving branch allows any upstream change on that repository to execute arbitrary code in our workflow, which is a supply-chain risk. All other actions here are pinned to a version tag; this one should similarly be pinned to a released tag or commit SHA so the workflow runs only trusted code.
Useful? React with 👍 / 👎.
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
Performed full review of 87b94a5...ac62845
Analysis
-
Unpinned Action Version: Using
jlumbroso/free-disk-space@mainviolates the project's versioning rules (github-workflows.mdc #50) and introduces security risks, non-deterministic builds, and potential breaking changes without warning. -
Code Duplication: The same cleanup configuration appears in multiple workflows (docker.yml and e2e.yml), violating DRY principles and creating maintenance overhead that could be solved by extracting to a reusable composite action.
-
Performance Trade-off: The cleanup step adds 2-5 minutes to build time, which appears acceptable given the ~30GB space freed, but should be monitored to ensure the time cost remains justified.
-
Docker Image Removal: The
docker-images: truesetting removes pre-existing Docker images, which could potentially impact builds even though Buildx is set up after cleanup. -
Missing Documentation: There's no explanation of why this cleanup is necessary or what disk space issues were encountered, making it difficult for maintainers to understand the rationale.
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
1 files reviewed | 1 comments | Edit Agent Settings • Read Docs
| uses: actions/checkout@v5 | ||
| - name: Free Disk Space (Ubuntu) | ||
| if: runner.os == 'Linux' | ||
| uses: jlumbroso/free-disk-space@main |
There was a problem hiding this comment.
The action uses @main which violates the project's GitHub workflow rule requiring specific action versions. This creates security risks (supply chain attacks), non-deterministic builds, and prevents automated dependency updates via Renovate.
Recommendation: Pin to a specific commit SHA or tagged version:
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383e50de1aa457b67 # v2.0.0Note: This same issue exists in .github/workflows/e2e.yml line 31 and should be fixed there as well.
Agent: 🏛 Architecture •
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/docker.yml(1 hunks)
🧰 Additional context used
📓 Path-based instructions (3)
.github/workflows/**
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Store all GitHub Actions workflow files under .github/workflows/
Files:
.github/workflows/docker.yml
.github/**
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Keep GitHub repository configuration files under .github/
Files:
.github/workflows/docker.yml
.github/workflows/*.yml
📄 CodeRabbit inference engine (.cursor/rules/github-workflows.mdc)
.github/workflows/*.yml: Pin actions to specific versions (avoid @main/@master)
Set appropriate timeout limits for jobs/steps
Use concise job and step names
Add helpful annotations and comments in workflows
Prefer using GITHUB_TOKEN for authentication in workflows
Store sensitive data in repository secrets and reference them from workflows
Limit permissions to the minimum required using the permissions key
Define appropriate failure conditions for steps/jobs
Provide clear error messages on failures
Configure notifications for workflow failures
Archive build artifacts for debugging on failures
Files:
.github/workflows/docker.yml
🧠 Learnings (4)
📓 Common learnings
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/github-workflows.mdc:0-0
Timestamp: 2025-09-28T16:26:53.964Z
Learning: Applies to .github/workflows/*.yml : Archive build artifacts for debugging on failures
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/github-workflows.mdc:0-0
Timestamp: 2025-09-28T16:26:53.964Z
Learning: Applies to .github/workflows/*.yml : Use concise job and step names
📚 Learning: 2025-09-28T16:26:53.964Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/github-workflows.mdc:0-0
Timestamp: 2025-09-28T16:26:53.964Z
Learning: Applies to .github/workflows/*.yml : Use concise job and step names
Applied to files:
.github/workflows/docker.yml
📚 Learning: 2025-09-28T16:26:18.516Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/general.mdc:0-0
Timestamp: 2025-09-28T16:26:18.516Z
Learning: Use GitHub Actions for CI/CD checks
Applied to files:
.github/workflows/docker.yml
📚 Learning: 2025-09-28T16:26:53.964Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/github-workflows.mdc:0-0
Timestamp: 2025-09-28T16:26:53.964Z
Learning: Applies to .github/workflows/ci.yml : Use a matrix strategy for OS and system targets with appropriate excludes
Applied to files:
.github/workflows/docker.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (10)
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Mesa
- GitHub Check: e2e-run (NixOS, ubuntu-latest)
- GitHub Check: e2e-run (Ubuntu, ubuntu-latest)
- GitHub Check: e2e-run (MacOS, macos-latest)
- GitHub Check: docker-build-push (linux/arm64, arm64, ubuntu-24.04-arm)
- GitHub Check: docker-build-push (linux/amd64, amd64, ubuntu-latest)
- GitHub Check: nix-nixos
- GitHub Check: nix-linux
- GitHub Check: nix-darwin
| - name: Free Disk Space (Ubuntu) | ||
| if: runner.os == 'Linux' | ||
| uses: jlumbroso/free-disk-space@main | ||
| with: | ||
| tool-cache: false | ||
| android: true | ||
| dotnet: true | ||
| haskell: true | ||
| large-packages: true | ||
| docker-images: true | ||
| swap-storage: true |
There was a problem hiding this comment.
Pin the action to a specific version instead of @main.
The jlumbroso/free-disk-space action supports the tool-cache option, and v1.1.0 is the latest release. However, using @main violates the repository's coding guideline which requires pinning actions to specific versions to avoid @main/@master references. This ensures reproducibility and security.
Apply this diff to pin the action to a stable version:
- name: Free Disk Space (Ubuntu)
if: runner.os == 'Linux'
- uses: jlumbroso/free-disk-space@main
+ uses: jlumbroso/free-disk-space@v1.1.0
with:
tool-cache: false
android: true
dotnet: true
haskell: true
large-packages: true
docker-images: true
swap-storage: trueAs per coding guidelines.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Free Disk Space (Ubuntu) | |
| if: runner.os == 'Linux' | |
| uses: jlumbroso/free-disk-space@main | |
| with: | |
| tool-cache: false | |
| android: true | |
| dotnet: true | |
| haskell: true | |
| large-packages: true | |
| docker-images: true | |
| swap-storage: true | |
| - name: Free Disk Space (Ubuntu) | |
| if: runner.os == 'Linux' | |
| uses: jlumbroso/free-disk-space@v1.1.0 | |
| with: | |
| tool-cache: false | |
| android: true | |
| dotnet: true | |
| haskell: true | |
| large-packages: true | |
| docker-images: true | |
| swap-storage: true |
🤖 Prompt for AI Agents
.github/workflows/docker.yml lines 33-43: the workflow uses
jlumbroso/free-disk-space@main which violates the repo guideline to pin actions
to a specific release; update the uses entry to a stable tagged release (e.g.
jlumbroso/free-disk-space@v1.1.0) so the action is pinned, reproducible and
secure, leaving the existing with: inputs unchanged.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (all 1 issues)
Understand the root cause of the following 1 issues and fix them.
<file name=".github/workflows/docker.yml">
<violation number="1" location=".github/workflows/docker.yml:35">
Please pin jlumbroso/free-disk-space to a specific commit SHA or tagged release instead of @main to avoid supply-chain risk from upstream changes.</violation>
</file>
React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.
| uses: actions/checkout@v5 | ||
| - name: Free Disk Space (Ubuntu) | ||
| if: runner.os == 'Linux' | ||
| uses: jlumbroso/free-disk-space@main |
There was a problem hiding this comment.
Please pin jlumbroso/free-disk-space to a specific commit SHA or tagged release instead of @main to avoid supply-chain risk from upstream changes.
Prompt for AI agents
Address the following comment on .github/workflows/docker.yml at line 35:
<comment>Please pin jlumbroso/free-disk-space to a specific commit SHA or tagged release instead of @main to avoid supply-chain risk from upstream changes.</comment>
<file context>
@@ -30,6 +30,17 @@ jobs:
uses: actions/checkout@v5
+ - name: Free Disk Space (Ubuntu)
+ if: runner.os == 'Linux'
+ uses: jlumbroso/free-disk-space@main
+ with:
+ tool-cache: false
</file context>
There was a problem hiding this comment.
Performed full review of 87b94a5...ac62845
Analysis
-
Security Risk (HIGH): The action references
@mainbranch instead of a pinned version, violating the repository's own best practices and introducing supply chain security vulnerabilities and reproducibility issues. -
Performance Impact (MEDIUM): The
docker-images: trueconfiguration removes Docker images immediately before Docker Buildx operations, potentially invalidating caches, removing necessary base images, and forcing re-downloads that slow down builds. -
Inconsistent Practice: While addressing a legitimate disk space concern, the implementation appears to be a direct copy from e2e.yml without considering Docker-specific optimization needs.
-
Systemic Issue: The same unpinned action reference exists in other workflows (e.g., e2e.yml), suggesting this is not an isolated problem but a pattern that needs broader remediation.
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
1 files reviewed | 2 comments | Edit Agent Settings • Read Docs
| dotnet: true | ||
| haskell: true | ||
| large-packages: true | ||
| docker-images: true |
There was a problem hiding this comment.
Setting docker-images: true may degrade build performance by removing Docker cache layers immediately before Docker Buildx operations that rely on GitHub Actions cache (cache-from: type=gha at line 84). This forces re-download of base images for every build.
Consider:
- Setting
docker-images: falseto preserve Docker cache benefits - Removing other large packages first (android, dotnet, haskell) which are less critical
- Monitoring build times to measure the actual impact
Agent: 🏛 Architecture •
| uses: actions/checkout@v5 | ||
| - name: Free Disk Space (Ubuntu) | ||
| if: runner.os == 'Linux' | ||
| uses: jlumbroso/free-disk-space@main |
There was a problem hiding this comment.
Using @main instead of a pinned version violates the repository's documented best practice (.cursor/rules/github-workflows.mdc line 50: "Use specific action versions"). This creates a supply chain security risk where malicious code could be injected, and introduces unpredictable behavior from breaking changes.
Pin to a specific commit SHA or version tag:
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383e50de9600e2a0f # v1.3.1Note: This same issue exists in .github/workflows/e2e.yml line 31.
Agent: 🏛 Architecture •
There was a problem hiding this comment.
Performed full review of 87b94a5...ac62845
Analysis
-
Security Risk: Action pinned to
@mainviolates established security practices and documented rules. All other actions in the repo use specific version tags, while this introduces supply chain vulnerability. -
Performance Degradation: Removing Docker images (
docker-images: true) before Buildx setup defeats Docker's layer caching mechanism, likely increasing build times rather than optimizing them. -
Inconsistent Configuration: Setting
tool-cache: falsewhile enabling other cleanup options, including Docker images, lacks justification and contradicts the workflow's purpose. -
Missing Documentation: No explanation for why this aggressive cleanup is necessary or how the specific configuration options were chosen, making the architectural decision opaque.
-
Cross-Cutting Concern: If disk space issues affect multiple workflows, this should be addressed systematically through composite actions or runner configuration rather than duplicated across workflows.
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
1 files reviewed | 2 comments | Edit Agent Settings • Read Docs
| dotnet: true | ||
| haskell: true | ||
| large-packages: true | ||
| docker-images: true |
There was a problem hiding this comment.
Architectural Concern: Setting docker-images: true removes existing Docker images immediately before Docker Buildx setup (line 45). This defeats Docker's layer caching mechanism, which is a core performance optimization for Docker builds.
Impact:
- Base images must be re-downloaded for every build
- Intermediate layers cannot be reused
- Likely increases build times rather than optimizes them
Questions:
- Is disk space actually a problem? GitHub's ubuntu-latest runners have ~14GB free space
- Have you measured the build time impact?
- Why preserve tool-cache but remove docker-images when this is a Docker-focused workflow?
Alternative: Set docker-images: false to preserve layer caching, and only remove large-packages and unused platform SDKs if disk space is genuinely an issue.
Agent: 🏛 Architecture •
| uses: actions/checkout@v5 | ||
| - name: Free Disk Space (Ubuntu) | ||
| if: runner.os == 'Linux' | ||
| uses: jlumbroso/free-disk-space@main |
There was a problem hiding this comment.
This action is pinned to @main which violates the repository's documented best practice (see .cursor/rules/github-workflows.mdc line 50: "Use specific action versions (not @main or @master)"). All other actions in this codebase use specific version tags (v3, v4, v5, etc.).
Security Risk: Pinning to @main introduces supply chain vulnerability - the action's code can change without your review, potentially introducing breaking changes or malicious code.
Recommendation: Pin to a specific version or commit SHA:
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383e50e01f0ba2f3e # v1.3.1Agent: 🏛 Architecture •
Introduce a step in the Docker workflow to free up disk space on Ubuntu runners, enhancing resource management during builds.
Summary by cubic
Add a disk space cleanup step to the Docker workflow on Linux runners using jlumbroso/free-disk-space to reclaim storage from tool caches, Android, .NET, Haskell, large packages, Docker images, and swap before builds. This prevents space-related build failures and improves CI reliability.
Written for commit ac62845. Summary will update automatically on new commits.