Skip to content

Add disk space cleanup step for Ubuntu in Docker workflow #324

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 1 commit into from
Nov 9, 2025
Merged

Add disk space cleanup step for Ubuntu in Docker workflow #324

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .github/workflows/docker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,17 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v5
- name: Free Disk Space (Ubuntu)
if: runner.os == 'Linux'
uses: jlumbroso/free-disk-space@main

Copilot AI Nov 9, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using @main as the version reference for this action is not a best practice. The main branch can change at any time, which could introduce breaking changes or unexpected behavior in your workflow without warning.

Consider pinning to a specific version tag or commit SHA instead. For example:

  • uses: jlumbroso/free-disk-space@v1.3.1 (semantic version)
  • uses: jlumbroso/free-disk-space@54081f69e8b (commit SHA)

This provides better reproducibility and stability for your CI/CD pipeline.

Suggested change
uses: jlumbroso/free-disk-space@main
uses: jlumbroso/free-disk-space@v1.3.1

Copilot uses AI. Check for mistakes.
Comment on lines +33 to +35

@chatgpt-codex-connector chatgpt-codex-connector Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Pin free-disk-space action to immutable version

The new cleanup step invokes jlumbroso/free-disk-space@main. Referencing a moving branch allows any upstream change on that repository to execute arbitrary code in our workflow, which is a supply-chain risk. All other actions here are pinned to a version tag; this one should similarly be pinned to a released tag or commit SHA so the workflow runs only trusted code.

Useful? React with 👍 / 👎.

@mesa-dot-dev mesa-dot-dev Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High

The action uses @main which violates the project's GitHub workflow rule requiring specific action versions. This creates security risks (supply chain attacks), non-deterministic builds, and prevents automated dependency updates via Renovate.

Recommendation: Pin to a specific commit SHA or tagged version:

uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383e50de1aa457b67  # v2.0.0

Note: This same issue exists in .github/workflows/e2e.yml line 31 and should be fixed there as well.

Agent: 🏛 Architecture • Fix in Cursor

@cubic-dev-ai cubic-dev-ai Bot Nov 9, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please pin jlumbroso/free-disk-space to a specific commit SHA or tagged release instead of @main to avoid supply-chain risk from upstream changes.

Prompt for AI agents 
Address the following comment on .github/workflows/docker.yml at line 35:

<comment>Please pin jlumbroso/free-disk-space to a specific commit SHA or tagged release instead of @main to avoid supply-chain risk from upstream changes.</comment>

<file context>
@@ -30,6 +30,17 @@ jobs:
         uses: actions/checkout@v5
+      - name: Free Disk Space (Ubuntu)
+        if: runner.os == &#39;Linux&#39;
+        uses: jlumbroso/free-disk-space@main
+        with:
+          tool-cache: false
</file context>
Fix with Cubic

@mesa-dot-dev mesa-dot-dev Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High

Using @main instead of a pinned version violates the repository's documented best practice (.cursor/rules/github-workflows.mdc line 50: "Use specific action versions"). This creates a supply chain security risk where malicious code could be injected, and introduces unpredictable behavior from breaking changes.

Pin to a specific commit SHA or version tag:

uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383e50de9600e2a0f  # v1.3.1

Note: This same issue exists in .github/workflows/e2e.yml line 31.

Agent: 🏛 Architecture • Fix in Cursor

@mesa-dot-dev mesa-dot-dev Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High

This action is pinned to @main which violates the repository's documented best practice (see .cursor/rules/github-workflows.mdc line 50: "Use specific action versions (not @main or @master)"). All other actions in this codebase use specific version tags (v3, v4, v5, etc.).

Security Risk: Pinning to @main introduces supply chain vulnerability - the action's code can change without your review, potentially introducing breaking changes or malicious code.

Recommendation: Pin to a specific version or commit SHA:

uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383e50e01f0ba2f3e # v1.3.1

Agent: 🏛 Architecture • Fix in Cursor

with:
tool-cache: false
android: true
dotnet: true
haskell: true
large-packages: true
docker-images: true

@mesa-dot-dev mesa-dot-dev Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium

Setting docker-images: true may degrade build performance by removing Docker cache layers immediately before Docker Buildx operations that rely on GitHub Actions cache (cache-from: type=gha at line 84). This forces re-download of base images for every build.

Consider:

  • Setting docker-images: false to preserve Docker cache benefits
  • Removing other large packages first (android, dotnet, haskell) which are less critical
  • Monitoring build times to measure the actual impact

Agent: 🏛 Architecture • Fix in Cursor

@mesa-dot-dev mesa-dot-dev Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Medium

Architectural Concern: Setting docker-images: true removes existing Docker images immediately before Docker Buildx setup (line 45). This defeats Docker's layer caching mechanism, which is a core performance optimization for Docker builds.

Impact:

  • Base images must be re-downloaded for every build
  • Intermediate layers cannot be reused
  • Likely increases build times rather than optimizes them

Questions:

  1. Is disk space actually a problem? GitHub's ubuntu-latest runners have ~14GB free space
  2. Have you measured the build time impact?
  3. Why preserve tool-cache but remove docker-images when this is a Docker-focused workflow?

Alternative: Set docker-images: false to preserve layer caching, and only remove large-packages and unused platform SDKs if disk space is genuinely an issue.

Agent: 🏛 Architecture • Fix in Cursor

swap-storage: true
Comment on lines +33 to +43

@coderabbitai coderabbitai Bot Nov 9, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Pin the action to a specific version instead of @main.

The jlumbroso/free-disk-space action supports the tool-cache option, and v1.1.0 is the latest release. However, using @main violates the repository's coding guideline which requires pinning actions to specific versions to avoid @main/@master references. This ensures reproducibility and security.

Apply this diff to pin the action to a stable version:

      - name: Free Disk Space (Ubuntu)
        if: runner.os == 'Linux'
-       uses: jlumbroso/free-disk-space@main
+       uses: jlumbroso/free-disk-space@v1.1.0
        with:
          tool-cache: false
          android: true
          dotnet: true
          haskell: true
          large-packages: true
          docker-images: true
          swap-storage: true

As per coding guidelines.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Free Disk Space (Ubuntu)
if: runner.os == 'Linux'
uses: jlumbroso/free-disk-space@main
with:
tool-cache: false
android: true
dotnet: true
haskell: true
large-packages: true
docker-images: true
swap-storage: true
- name: Free Disk Space (Ubuntu)
if: runner.os == 'Linux'
uses: jlumbroso/free-disk-space@v1.1.0
with:
tool-cache: false
android: true
dotnet: true
haskell: true
large-packages: true
docker-images: true
swap-storage: true
🤖 Prompt for AI Agents 
.github/workflows/docker.yml lines 33-43: the workflow uses
jlumbroso/free-disk-space@main which violates the repo guideline to pin actions
to a specific release; update the uses entry to a stable tagged release (e.g.
jlumbroso/free-disk-space@v1.1.0) so the action is pinned, reproducible and
secure, leaving the existing with: inputs unchanged.

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to GHCR
Expand Down
Loading