feat: gen check and test workflow by synoet · Pull Request #4276 · macro-inc/macro

synoet · 2026-06-23T13:42:31Z

Generate the cloud-storage CI workflow from Rust

Ports the cloud-storage check/test workflow from hand-written YAML to Rust
(xtask + the gh-workflow crate, à la Zed): environment, runners, and reusable
steps are small composable modules, and cargo x workflows regenerates the YAML.
A generated drift-check (check_generated.yml) fails CI if the committed YAML
falls out of sync with the source.

Two infra changes ride along with the port:

Runners: self-hosted linux-extra-beefy → Namespace profiles
(linux-mid for check/test, linux-small for path-check/status-check).
sccache: AWS S3 bucket → local cache on a persisted Namespace volume
(drops all AWS_* creds).

Otherwise behavior-preserving: same triggers, jobs, services, inline scripts, and
the required Cloud Storage Status Check.

Regenerate: cargo x workflows from rust/cloud-storage (--check verifies sync).

coderabbitai · 2026-06-23T13:42:40Z

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch rust-workflows-cloud-storage

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seanaye

Seems like its moving generally in the right direction

- extract inline workflow bash to scripts/*.sh via include_str! - model runners as an enum with Display - generalize FluentBuilder::map to T -> U - mark generated workflow YAML linguist-generated (collapse in PR diffs) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Drops the `&& github.event.pull_request.draft == false` gate on the check/test jobs so they run on this draft PR while validating the new workflow end-to-end. Restore before merging. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Namespace profiles don't ship Nix (unlike the old self-hosted linux-extra-beefy), so setup-cachix's nix calls failed with 'cannot connect to socket'. Run ./.github/actions/setup-nix before setup-cachix in the check/test jobs, mirroring the deploy workflow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Match Zed's one-module-per-workflow naming: the registry carries a single `slug` that names both the source module (<slug>.rs) and the output file (<slug>.yml), replacing the separate explicit filename. - code-check-cloud-storage.yml -> code_check_cloud_storage.yml - check-generated-workflows.yml -> check_generated.yml The required status check is the job name "Cloud Storage Status Check" (unchanged), so the rename doesn't affect the branch ruleset. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Reverts the temporary b40155b. The check/test jobs skip on draft PRs again (`&& github.event.pull_request.draft == false`), which is the intended pre-merge behavior. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@rust/cloud-storage/tools/xtask/src/workflows/code_check_cloud_storage.rs`:
- Around line 118-139: The paths_filter() function uses an unpinned action
reference with the v3 tag in the .uses() method call. Replace the "v3" tag in
.uses("dorny", "paths-filter", "v3") with a specific commit SHA hash to ensure
the action is pinned to a fixed version rather than a movable tag. This prevents
supply chain attacks where tags can be reassigned to malicious commits.

In `@rust/cloud-storage/tools/xtask/src/workflows/scripts/configure_postgres.sh`:
- Around line 17-19: The unbounded until loop waiting for PostgreSQL readiness
can hang indefinitely if the database fails to start. Add a retry counter and
maximum attempt limit to the loop that waits for pg_isready. Before the until
loop, initialize a counter variable to zero and define a maximum number of
retries (e.g., 30 or 60 attempts). Inside the loop, increment the counter on
each iteration and check if it has exceeded the maximum before sleeping. If the
maximum is reached, log a clear error message indicating that PostgreSQL failed
to become ready and exit with a non-zero status code to explicitly fail the job
rather than hanging until the global timeout.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a739d148-7be8-46cf-9d2c-fb409304462c

📥 Commits

Reviewing files that changed from the base of the PR and between b33c412 and c62859e.

⛔ Files ignored due to path filters (1)

rust/cloud-storage/Cargo.lock is excluded by !**/*.lock, !**/Cargo.lock

📒 Files selected for processing (22)

.gitattributes
.github/actionlint.yaml
.github/scripts/changed-cloud-storage-doppler-config-bins.sh
.github/workflows/check_generated.yml
.github/workflows/code-check-cloud-storage.yml
.github/workflows/code_check_cloud_storage.yml
rust/cloud-storage/.cargo/config.toml
rust/cloud-storage/tools/xtask/Cargo.toml
rust/cloud-storage/tools/xtask/src/doppler_bins.rs
rust/cloud-storage/tools/xtask/src/main.rs
rust/cloud-storage/tools/xtask/src/workflows/check_generated.rs
rust/cloud-storage/tools/xtask/src/workflows/code_check_cloud_storage.rs
rust/cloud-storage/tools/xtask/src/workflows/mod.rs
rust/cloud-storage/tools/xtask/src/workflows/runners.rs
rust/cloud-storage/tools/xtask/src/workflows/scripts/compute_changed_files.sh
rust/cloud-storage/tools/xtask/src/workflows/scripts/compute_doppler_bins.sh
rust/cloud-storage/tools/xtask/src/workflows/scripts/compute_nextest_filter.sh
rust/cloud-storage/tools/xtask/src/workflows/scripts/configure_postgres.sh
rust/cloud-storage/tools/xtask/src/workflows/scripts/run_tests.sh
rust/cloud-storage/tools/xtask/src/workflows/scripts/validate_doppler_configs.sh
rust/cloud-storage/tools/xtask/src/workflows/steps.rs
rust/cloud-storage/tools/xtask/src/workflows/vars.rs

💤 Files with no reviewable changes (2)

.github/scripts/changed-cloud-storage-doppler-config-bins.sh
.github/workflows/code-check-cloud-storage.yml

@V3

Tag refs like @V3 can be repointed to malicious commits; pin to the SHA v3 currently resolves to (v3.0.3), matching the repo's other SHA-pinned actions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

check/test shared namespace-profile-linux-mid with the deploy workflow, whose cache-volume churn evicted the CI sccache caches between runs (the larger test cache lost first -> cold). Move them to a dedicated CI profile with its own cache volume. path-check/status-check stay on linux-small (they don't use the sccache volume). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat: gen check and test workflow

5050174

github-actions Bot assigned synoet Jun 23, 2026

github-actions Bot added the cloud-storage label Jun 23, 2026

seanaye reviewed Jun 23, 2026

View reviewed changes

synoet force-pushed the rust-workflows-cloud-storage branch from b233716 to a651bf9 Compare June 23, 2026 18:41

synoet and others added 4 commits June 23, 2026 15:37

chore(ci): restore the draft gate on check/test

c62859e

Reverts the temporary b40155b. The check/test jobs skip on draft PRs again (`&& github.event.pull_request.draft == false`), which is the intended pre-merge behavior. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

synoet marked this pull request as ready for review June 23, 2026 20:21

coderabbitai Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread rust/cloud-storage/tools/xtask/src/workflows/code_check_cloud_storage.rs

Comment thread rust/cloud-storage/tools/xtask/src/workflows/scripts/configure_postgres.sh

synoet and others added 2 commits June 23, 2026 16:33

fix(ci): pin dorny/paths-filter to a commit SHA

a333d35

Tag refs like @V3 can be repointed to malicious commits; pin to the SHA v3 currently resolves to (v3.0.3), matching the repo's other SHA-pinned actions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

synoet force-pushed the rust-workflows-cloud-storage branch from e1c2035 to 4e79cca Compare June 23, 2026 22:02

synoet merged commit 60d6839 into main Jun 23, 2026
50 checks passed

synoet deleted the rust-workflows-cloud-storage branch June 23, 2026 22:16

synoet mentioned this pull request Jun 23, 2026

feat(ci): generate the cargo-deny workflow from xtask #4294

Closed

Navigation Menu

Repository navigation

feat: gen check and test workflow - #4276

feat: gen check and test workflow#4276
synoet merged 8 commits into
mainfrom
rust-workflows-cloud-storage

synoet commented Jun 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jun 23, 2026 •

edited

Loading

Review failed

Uh oh!

seanaye left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

synoet commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Generate the cloud-storage CI workflow from Rust

Uh oh!

coderabbitai Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Uh oh!

seanaye left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

synoet commented Jun 23, 2026 •

edited

Loading

coderabbitai Bot commented Jun 23, 2026 •

edited

Loading