Check peppy_repository.json5 on every pull request - #44
Conversation
…uest The index is generated, so a pull request that adds, moves, renames or deletes a node, contract, pairing or launcher leaves it stale unless the author regenerates it. A stale index makes an item invisible to every machine that consumes this repository, and none of those machines can fix it. `peppy repo index --check` needs no daemon, so it runs on the branch of the person who caused the drift. The job runs on every pull request rather than behind a path filter: a removal or a rename drifts the index just as an addition does, and the check is a filesystem walk that costs seconds. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: QUIET Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughThis change adds a pull request workflow that checks out the PR head, installs an architecture-compatible ChangesRepository Index Validation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/repository-index.yml:
- Around line 42-58: Update the peppy download flow around the
PEPPY_VERSION/channel selection and curl|tar pipeline to require a pinned
PEPPY_VERSION and verify its trusted digest or signed release metadata before
extracting bin/peppy. Reject unset or latest versions unless integrity
verification is performed, and only chmod or execute the artifact after
verification succeeds.
- Around line 42-46: Update the workflow step containing the version case
statement so PEPPY_VERSION is supplied through the step’s env configuration
rather than interpolated into generated shell source. Read it from the quoted
shell variable, apply the latest/default behavior, and validate supported
version formats before constructing channel; reject invalid values without
allowing shell syntax or command substitution to be interpreted.
- Around line 56-57: Update the workflow job containing the curl extraction step
to add curl connection and total transfer limits using --connect-timeout and
--max-time, and set a job-level timeout-minutes value to bound the entire
self-hosted job. Keep the existing download URL and tar extraction behavior
unchanged.
- Line 27: Update the actions/checkout step in the repository-index workflow to
reference the immutable commit d23441a48e516b6c34aea4fa41551a30e30af803,
retaining the v6.1.0 version comment instead of the mutable v6 tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 0ef0bdae-591f-4069-bfa0-114097cc9096
📒 Files selected for processing (1)
.github/workflows/repository-index.yml
| contents: read | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/repository-index.yml"
printf '%s\n' '--- workflow context ---'
sed -n '1,60p' "$file"
printf '%s\n' '--- checkout references ---'
rg -n 'actions/checkout@' .github/workflows
printf '%s\n' '--- repository and remote ---'
git remote -v | head -n 4Repository: Peppy-bot/nodes-hub
Length of output: 2721
🏁 Script executed:
#!/bin/bash
set -eu
api='https://api.github.com/repos/actions/checkout'
tag='v6'
ref_json="$(curl -fsSL -H 'Accept: application/vnd.github+json' "$api/git/ref/tags/$tag")"
printf '%s\n' '--- tag ref ---'
printf '%s\n' "$ref_json" | jq '{ref, object}'
type="$(printf '%s\n' "$ref_json" | jq -r '.object.type')"
sha="$(printf '%s\n' "$ref_json" | jq -r '.object.sha')"
if [ "$type" = tag ]; then
tag_json="$(curl -fsSL -H 'Accept: application/vnd.github+json' "$api/git/tags/$sha")"
printf '%s\n' '--- annotated tag object ---'
printf '%s\n' "$tag_json" | jq '{sha: .sha, object}'
sha="$(printf '%s\n' "$tag_json" | jq -r '.object.sha')"
fi
printf '%s\n' '--- resolved commit ---'
curl -fsSL -H 'Accept: application/vnd.github+json' "$api/commits/$sha" \
| jq '{sha, message: (.commit.message | split("\n")[0])}'
printf '%s\n' '--- current v6 tag metadata ---'
curl -fsSL -H 'Accept: application/vnd.github+json' "$api/releases/tags/$tag" \
| jq '{tag_name, name, target_commitish, published_at}'Repository: Peppy-bot/nodes-hub
Length of output: 208
🌐 Web query:
actions/checkout v6 release commit SHA GitHub
💡 Result:
As of August 1, 2026, the actions/checkout repository has multiple releases within the v6 series [1]. The latest release in the v6 line is v6.1.0, which was published on July 20, 2026 [2]. The commit SHAs for the v6 releases are as follows: - v6.1.0: 6736a44415599818816c4c0b29c922572579b29e - v6.0.3: 44c2b7a8a4ea602851063497d310619198642997 - v6.0.2: 5d1872199b4d8d3f669910d5403063f2711e5399 - v6.0.1: 6788e0259e8674d82b2024b22037936a1005a305 - v6.0.0: b4ffde65f46336abfa88147d3d3a0166d1f03d6d Please note that v7.0.0 and v7.0.1 have also been released as of this date, with v7.0.1 serving as the current latest overall version for the repository [1][3].
Citations:
- 1: https://github.com/actions/checkout/releases
- 2: https://github.com/actions/checkout/releases/tag/v6.1.0
- 3: https://github.com/actions/checkout/tree/v6.0.0
🏁 Script executed:
#!/bin/bash
set -eu
repo='https://github.com/actions/checkout.git'
printf '%s\n' '--- v6 tag and peeled commit ---'
git ls-remote "$repo" 'refs/tags/v6' 'refs/tags/v6^{}'
printf '%s\n' '--- v6 release tags ---'
git ls-remote --tags "$repo" 'refs/tags/v6.*' \
| awk '$2 !~ /\^\{\}$/ {print}' \
| tail -n 20
printf '%s\n' '--- candidate commit existence ---'
for sha in \
6736a44415599818816c4c0b29c922572579b29e \
44c2b7a8a4ea602851063497d310619198642997 \
5d1872199b4d8d3f669910d5403063f2711e5399 \
6788e0259e8674d82b2024b22037936a1005a305 \
b4ffde65f46336abfa88147d3d3a0166d1f03d6d
do
if git ls-remote "$repo" "$sha" | grep -q "$sha"; then
printf '%s exists\n' "$sha"
else
printf '%s not found\n' "$sha"
fi
doneRepository: Peppy-bot/nodes-hub
Length of output: 848
🌐 Web query:
site:github.com/actions/checkout/commit d23441a48e516b6c34aea4fa41551a30e30af803
💡 Result:
The SHA identifier d23441a48e516b6c34aea4fa41551a30e30af803 refers to a specific commit within the actions/checkout repository [1][2][3]. It is frequently referenced in automated dependency updates (such as those generated by Renovate) as a target digest for updating the actions/checkout action in GitHub workflow configurations [1][2][3][4][5]. This commit follows earlier work in the repository, including updates related to SHA-256 repository support [6][7][8] and dependency management [9]. Users often see this specific commit hash when their dependency management tools identify it as the latest available version or digest for the actions/checkout GitHub Action [1][2][3].
Citations:
- 1: chore(deps): update actions/checkout digest to d23441a backstage/backstage#34899
- 2: Update actions/checkout digest to d23441a stacklok/toolhive#5982
- 3: chore(deps): update actions/checkout digest to d23441a promptfoo/crabcode#123
- 4: chore(deps): update actions/checkout digest to d23441a glasskube/theme#195
- 5: chore(deps): update actions/checkout digest to d23441a - autoclosed smartive/utils#246
- 6: actions/checkout@1cce339
- 7: actions/checkout@900f221
- 8: actions/checkout@4823ef7
- 9: actions/checkout@d914b26
Pin actions/checkout to an immutable commit.
Use actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0. The v6 tag is mutable, so it does not provide an immutable workflow dependency.
🧰 Tools
🪛 zizmor (1.28.0)
[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/repository-index.yml at line 27, Update the
actions/checkout step in the repository-index workflow to reference the
immutable commit d23441a48e516b6c34aea4fa41551a30e30af803, retaining the v6.1.0
version comment instead of the mutable v6 tag.
Source: Linters/SAST tools
…urce PEPPY_VERSION now reaches the install script as an environment variable and is checked against `latest` or a `X.Y.Z` release before it becomes part of a download URL, so a mistyped value fails by name instead of reaching curl. The download carries connect and transfer deadlines and the job carries a timeout, so a stalled transfer releases a shared self-hosted runner instead of holding it for the six-hour default. Checkout is pinned to the commit behind v6.1.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The archive stores its members with a ./ prefix, and GNU tar matches a member argument against the stored name literally, so bin/peppy selected nothing and the install step exited with "Not found in archive". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 participant
Summary
Adds a
Repository indexworkflow that runspeppy repo index . --checkon every pull request.peppy_repository.json5is generated, so a PR that adds, moves, renames or deletes a node, contract, pairing or launcher leaves it stale unless the author regenerates it, and a stale index makes an item invisible to every machine that consumes this repository.The job runs on every pull request rather than behind a path filter: a removal or a rename drifts the index just as an addition does, and the check is a filesystem walk that costs seconds. It needs no daemon, no container runtime and no root, so it installs the peppy binary alone under
$RUNNER_TEMPand uses a per-runPEPPY_HOME, leaving the shared self-hosted runner state untouched.Set the
PEPPY_VERSIONrepository variable to pin a release; it defaults to the latest.Test plan
peppy repo index, currently onmodern-jaguar).peppy_repository.json5matches the repository contents.🤖 Generated with Claude Code
Summary by CodeRabbit