Repository navigation
Conversation
Both AST2700 steppings are now driven the same way and write out/cairn_ast2700_<silicon>.bin: A1 through the reproducible in-container Dagger pipeline, A2 through tools/a2/gen-a2-image.sh (which needs the vendor cptra_imgtool signer that is not reproducible in-container). The differing inputs are exposed as make variables. Also rename the Dagger image parameter aspeedMcuRuntime -> mcuRuntime (flag --mcu-runtime) and the a2 script's MCU_RUNTIME_SRC default to ../mcu-runtime so they match the renamed repository slug. Signed-off-by: Marvin Drees <marvin.drees@9elements.com>
Make every module/fork source input optional, defaulting to its kyanitecomputer repository (tamago@aspeed, core, scree, aspeed-go, schema, aspeed-rs, aspeed-data, mcu-runtime; nats-server@fs-interface; lneto from soypat at the pinned commit), and install the TamaGo compiler in-container from the upstream tamago-go 1.27.1 release instead of a passed-in directory. Drops the --tamago-go input. 'dagger call build/test/ci' now run with no local checkouts; override any --<dir> for local development. Verified end to end: dagger call ci reports build ok / test ok. Signed-off-by: Marvin Drees <marvin.drees@9elements.com>
Run 'dagger call ci' on push and pull_request to main with a read-only token; both third-party actions are pinned to full commit SHAs. Add a Dependabot config to keep those action pins current. Signed-off-by: Marvin Drees <marvin.drees@9elements.com>
Inline the CA35 payload cross-compile into tools/a2/gen-a2-image.sh so the A2 host pipeline no longer depends on the (now removed) Makefile, and point the README/AGENTS build instructions at the Dagger interface. Signed-off-by: Marvin Drees <marvin.drees@9elements.com>
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. 📝 WalkthroughWalkthroughThe PR moves Cairn builds from Make and local compiler checkouts to Dagger with public source defaults and an in-container TamaGo compiler. It updates A1 and A2 image flows, adds GitHub Actions CI, and revises build documentation. ChangesPublic-source Dagger build flow
Priority: ⬇️ Low Merge Risk: 🟡 Moderate · up to Builds are not reproducible and fail on ARM64 hosts, while the CI workflow exposes a read-only credential. Resolve these issues before merging. Warning Some tools did not complete. Review the errors below. 🔧 golangci-lint (2.13.2)level=error msg="Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: err: exit status 1: stderr: go: cannot load module ../../aspeed-go listed in go.work file: open ../../aspeed-go/go.mod: no such file or directory\ngo: cannot load module ../../core listed in go.work file: open ../../core/go.mod: no such file or directory\ngo: cannot load module ../../lneto listed in go.work file: open ../../lneto/go.mod: no such file or directory\ngo: cannot load module ../../nats-server listed in go.work file: open ../../nats-server/go.mod: no such file or directory\ngo: cannot load module ../../schema/gen/go listed in go.work file: open ../../schema/gen/go/go.mod: no such file or directory\ngo: cannot load module ../../scree listed in go.work file: open ../../scree/go.mod: no such file or directory\ngo: cannot load module ../../tamago listed in go.work file: open ../../tamago/go.mod: no such file or directory\n" Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: ac34fc62-3956-467e-964e-e0006f750ca4
📒 Files selected for processing (8)
.dagger/main.go.github/workflows/ci.ymlAGENTS.mdMakefileREADME.mddagger.jsontools/a2/cairn-a2-manifest.tomltools/a2/gen-a2-image.sh
💤 Files with no reviewable changes (1)
- Makefile
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.
| // it is fetched from the kyanitecomputer GitHub org so the whole flow builds | ||
| // from public sources with no local checkouts. Override any --<dir> for | ||
| // local development. | ||
| orgGit = "https://github.com/kyanitecomputer/" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
sed -n '55,165p' .dagger/main.go
rg -n 'linux-amd64|Platform|WithPlatform|amd64|arm64|architecture|Dagger' .dagger dagger.json README.md AGENTS.md .githubRepository: kyanitecomputer/cairn
Length of output: 7020
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- focused main.go ---'
sed -n '1,275p' .dagger/main.go
printf '%s\n' '--- dagger and CI configuration ---'
for f in dagger.json .github/workflows/ci.yml AGENTS.md README.md; do
if [ -f "$f" ]; then
printf '\n--- %s ---\n' "$f"
cat -n "$f"
fi
done
printf '%s\n' '--- platform and architecture references ---'
rg -n -i 'platform|linux/|amd64|arm64|architecture|arch|runner|runs-on|dagger' --glob '!*.sum' --glob '!vendor/**' .dagger .github dagger.json AGENTS.md README.md 2>/dev/null || true
printf '%s\n' '--- all Container constructors and platform calls ---'
rg -n 'dag\.Container|WithPlatform|Platform\(' . --glob '!*.sum' --glob '!vendor/**' 2>/dev/null || trueRepository: kyanitecomputer/cairn
Length of output: 28090
🌐 Web query:
Dagger Go SDK Container default platform dag.Container explicit WithPlatform host default official documentation
💡 Result:
<source_evidence>
Citations:
- 1: https://github.com/dagger/dagger/blob/c7d72b6c/core/schema/container.go
- 2: GitHub pull request 3119 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 3: GitHub issue 8354 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 4: https://github.com/dagger/dagger/blob/c7d72b6c/core/integration/platform_test.go
- 5: https://github.com/dagger/dagger/blob/0e9fd00b/core/container.go
🌐 Web query:
Dagger v0.21.9 Go SDK ContainerOpts Platform default native platform current engine official source
💡 Result:
<source_evidence>
Citations:
- 1: https://github.com/dagger/dagger/blob/0e9fd00b/core/schema/container.go
- 2: https://github.com/dagger/dagger/blob/v0.21.7/core/schema/container.go
- 3: https://context7.com/websites/pkg_go_dev_dagger_io_dagger/llms.txt?tokens=10000
- 4: GitHub issue 8354 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 5: https://daminibansal.medium.com/stop-writing-yaml-build-your-ci-cd-pipelines-in-real-code-with-dagger-7e093ebdfad4
Run the build container as linux/amd64.
dag.Container() defaults to the native platform of the Dagger engine. On an ARM64 engine, the container can run as ARM64, but the downloaded tamago-go1.27.1.linux-amd64.tar.gz provides an amd64 go executable. The go build and go test steps can then fail with an executable-format error. The project does not restrict Dagger builds to amd64.
Suggested fix
- return dag.Container().
+ return dag.Container(dagger.ContainerOpts{Platform: "linux/amd64"}).| if dir != nil { | ||
| return dir | ||
| } | ||
| return dag.Git(orgGit + repo).Branch(ref).Tree() |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
sed -n '50,165p' .dagger/main.go
rg -n 'reproduc|pin|Branch\(|Commit\(|tamagoRef|natsServerRef|branchMain|go\.work|replace ' .dagger README.md AGENTS.md go.mod go.sum 2>/dev/null
git diff -- .dagger/main.go README.md AGENTS.md go.mod go.sumRepository: kyanitecomputer/cairn
Length of output: 8639
🏁 Script executed:
#!/bin/bash
set -o pipefail
printf '%s\n' '--- README relevant section ---'
sed -n '65,100p' README.md
printf '%s\n' '--- AGENTS relevant section ---'
sed -n '1,55p' AGENTS.md
printf '%s\n' '--- root go.mod relevant section ---'
sed -n '1,35p' go.mod
printf '%s\n' '--- current Dagger header and source-resolution comments ---'
sed -n '1,125p' .dagger/main.go
printf '%s\n' '--- parent Dagger source-resolution/build wiring ---'
git show HEAD^:.dagger/main.go 2>/dev/null | sed -n '1,145p'
printf '%s\n' '--- concise recent history for relevant files ---'
git log --oneline -8 -- .dagger/main.go README.md AGENTS.md go.modRepository: kyanitecomputer/cairn
Length of output: 18342
🏁 Script executed:
#!/bin/bash
set -o pipefail
printf '%s\n' '--- public-source commit summary ---'
git show --stat --oneline --decorate 9824e7f
printf '%s\n' '--- public-source commit message and relevant diff ---'
git show --format=fuller --no-ext-diff 9824e7f -- .dagger/main.go README.md AGENTS.md go.mod | sed -n '1,260p'
printf '%s\n' '--- predecessor Dagger source resolution ---'
git show 9824e7f^:.dagger/main.go 2>/dev/null | sed -n '50,145p'
printf '%s\n' '--- CI references to Dagger entrypoints ---'
rg -n -C 3 'dagger (call|run)|call ci|call build|call test|Dagger' .github Makefile* tools 2>/dev/null || trueRepository: kyanitecomputer/cairn
Length of output: 17486
Pin public fallback sources to immutable commits.
orRepo resolves main, aspeed, and fs-interface with Branch(ref). The default build and CI paths use these fallbacks, so an upstream branch update can change the source tree or make the same Cairn revision fail without a Cairn change. Replace all fallback branch refs, including the image sources, with commit IDs and resolve them with Commit(ref), as the lneto fallback already does.
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🛡️ Detected with Advanced Tier | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,80p' .github/workflows/ci.yml
sed -n '1,80p' dagger.json
rg -n 'Host\(|CurrentModule|ModuleSource|Directory\(|Secret|GITHUB_TOKEN|git/config|persist-credentials' .dagger .githubRepository: kyanitecomputer/cairn
Length of output: 2031
🌐 Web query:
Dagger GitHub Action pull request module source .git directory checkout persisted credentials accessibility
💡 Result:
Inspection citation: inspection_997438e8922fe1ee007d7cf214560cca
<source_evidence>
Citations:
- 1: https://github.com/actions/checkout
- 2: https://yossarian.net/til/post/actions-checkout-can-leak-github-credentials/
- 3: GitHub pull request 632 in enix/x509-certificate-exporter (link omitted to avoid creating a cross-reference)
- 4: GitHub issue 485 in actions/checkout (link omitted to avoid creating a cross-reference)
- 5: GitHub pull request 10427 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 6: GitHub pull request 6992 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 7: GitHub pull request 9131 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 8: GitHub issue 8989 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 9: GitHub pull request 6575 in dagger/dagger (link omitted to avoid creating a cross-reference)
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- .dagger outline ---'
ast-grep outline .dagger/main.go --view expanded
printf '%s\n' '--- host/filesystem/process-related symbols ---'
rg -n -C 3 'Host\(|Client\(|Directory\(|WithDirectory|WithMounted|WithExec|Exec\(|Open|Read|File\(|NewFile|dagger\.|os\.(ReadFile|Open|Getwd|Stat|ReadDir)|filepath|exec\.Command|GITHUB_TOKEN|git/config|\.git' .dagger/main.go
printf '%s\n' '--- module source and CI references ---'
cat -n dagger.json
cat -n .github/workflows/ci.ymlRepository: kyanitecomputer/cairn
Length of output: 12801
🌐 Web query:
Dagger Go SDK module sandbox Host Directory access from a module and dagger call GitHub Actions workspace
💡 Result:
Inspection citation: inspection_b5cfbf450be3939450522f7ad3fe2fdf
<source_evidence>
Citations:
- 1: https://docs.dagger.io/0.21/features/sandbox/
- 2: dagger/dagger@b5ea047
- 3: GitHub pull request 6535 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 4: GitHub issue 7998 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 5: https://docs.dagger.io/next/adopting/triggers/github-actions
🌐 Web query:
Dagger 0.21 module +defaultPath "." Directory input excludes .git files source filtering documentation
💡 Result:
Inspection citation: inspection_06a4c4479dfb57b9f3ae0f35216681f1
<source_evidence>
Citations:
- 1: https://dagger.io/blog/dagger-0-13/
- 2: GitHub pull request 7744 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 3: dagger/dagger@9c2c03f
- 4: https://github.com/dagger/dagger/blob/c7d72b6c/core/integration/module_path_inputs_test.go
- 5: GitHub issue 11317 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 6: GitHub pull request 8339 in dagger/dagger (link omitted to avoid creating a cross-reference)
- 7: https://github.com/dagger/dagger/blob/v0.21.7/core/schema/module.go
- 8: https://docs.dagger.io/api/reference/
Sensitive Data Exposure
Reachability: External
Exploitability: Trivial
CWE: CWE-522 — Insufficiently Protected Credentials
Disable persisted checkout credentials before running Dagger.
Ci.src uses +defaultPath=".", so Dagger passes the repository context to the module without excluding .git. Pull-request-controlled Dagger code can read src.File(".git/config") and exfiltrate the checkout token. Dagger host access is not required.
contents: read prevents write operations but still exposes a bearer token with repository-content read access.
Suggested fix
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.30.0)
[warning] 25-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
Comment on lines
+89
to
+90
| CPTRA_IMGTOOL=../cptra_imgtool PREBUILT=/path/to/a2-prebuilts \ | ||
| tools/a2/gen-a2-image.sh |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Document the host TamaGo requirement for A2.
tools/a2/gen-a2-image.sh directly runs ${TAMAGO:-tamago}. A user who follows this command after the stated Dagger-only setup gets tamago: command not found. Document the required host TamaGo compiler and the TAMAGO override.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dagger call build/test/cirun with no local checkouts (override any--<dir>for local work).tools/a2/gen-a2-image.sh) is now self-contained.dagger call cion push/PR (SHA-pinned actions, read-only token).dagger call cireports build ok / test ok.