-
-
Notifications
You must be signed in to change notification settings - Fork 333
chore(rust): clear all build warnings + retry flaky Windows linker #1408
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -41,7 +41,7 @@ jobs: | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| name: ${{ matrix.os }} tests with python ${{ matrix.python-version }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| runs-on: ${{ matrix.os }}-latest | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - uses: actions/checkout@v4 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - uses: actions/checkout@v5 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - name: Set up Python ${{ matrix.python-version }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| uses: actions/setup-python@v6 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
@@ -53,4 +53,23 @@ jobs: | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| python-versions: ${{ matrix.python-version }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - name: Test with Nox | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if: runner.os != 'Windows' | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| run: nox --non-interactive --error-on-missing-interpreter -p ${{ matrix.python-version }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Windows extension-module builds intermittently hit a transient linker | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # failure (LNK1181: cannot open input file 'pythonXY.lib') from the hosted | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # toolchain. Retry so a one-off linker hiccup doesn't fail the whole run. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - name: Test with Nox (Windows, retry transient linker failures) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if: runner.os == 'Windows' | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| shell: bash | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| for attempt in 1 2 3; do | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "::group::nox attempt $attempt" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if nox --non-interactive --error-on-missing-interpreter -p ${{ matrix.python-version }}; then | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "::endgroup::" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| exit 0 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "::endgroup::" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "nox attempt $attempt failed; retrying..." | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| done | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| echo "nox failed after 3 attempts" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| exit 1 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+65
to
+75
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Retry loop should only retry the known transient linker failure. The current Windows loop retries every Suggested patch - name: Test with Nox (Windows, retry transient linker failures)
if: runner.os == 'Windows'
shell: bash
run: |
for attempt in 1 2 3; do
echo "::group::nox attempt $attempt"
- if nox --non-interactive --error-on-missing-interpreter -p ${{ matrix.python-version }}; then
+ nox --non-interactive --error-on-missing-interpreter -p ${{ matrix.python-version }} 2>&1 | tee nox.log
+ status=${PIPESTATUS[0]}
+ if [ "$status" -eq 0 ]; then
echo "::endgroup::"
exit 0
fi
+ if ! grep -Eq "LNK1181: cannot open input file 'python[0-9]+\.lib'" nox.log; then
+ echo "::endgroup::"
+ echo "nox failed for a non-transient reason; not retrying."
+ exit "$status"
+ fi
echo "::endgroup::"
echo "nox attempt $attempt failed; retrying..."
done
echo "nox failed after 3 attempts"
exit 1📝 Committable suggestion
Suggested change
🧰 Tools🪛 zizmor (1.25.2)[warning] 67-67: code injection via template expansion (template-injection): may expand into attacker-controllable code (template-injection) 🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -18,6 +18,7 @@ jobs: | |||||||||
| macos: | ||||||||||
| runs-on: macos-latest | ||||||||||
| strategy: | ||||||||||
| fail-fast: false | ||||||||||
| matrix: | ||||||||||
| python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] | ||||||||||
| steps: | ||||||||||
|
|
@@ -52,11 +53,20 @@ jobs: | |||||||||
| windows: | ||||||||||
| runs-on: windows-latest | ||||||||||
| strategy: | ||||||||||
| fail-fast: false | ||||||||||
| matrix: | ||||||||||
| python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] | ||||||||||
| target: [x64, x86] | ||||||||||
| steps: | ||||||||||
| - uses: actions/checkout@v3 | ||||||||||
| - uses: actions/checkout@v4 | ||||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🧩 Analysis chain🏁 Script executed: # First, find the release-CI.yml file
find . -name "release-CI.yml" -o -name "release-ci.yml" | head -20Repository: sparckles/Robyn Length of output: 94 🏁 Script executed: # List all workflow files to understand the structure
find .github/workflows -type f -name "*.yml" -o -name "*.yaml" 2>/dev/null | head -20Repository: sparckles/Robyn Length of output: 257 🏁 Script executed: # Examine the release-CI.yml file around line 61
if [ -f ".github/workflows/release-CI.yml" ]; then
cat -n .github/workflows/release-CI.yml | sed -n '50,70p'
elif [ -f ".github/workflows/release-ci.yml" ]; then
cat -n .github/workflows/release-ci.yml | sed -n '50,70p'
else
echo "File not found, searching..."
find .github -name "*release*" -name "*.yml"
fiRepository: sparckles/Robyn Length of output: 1140 🏁 Script executed: # Search for all checkout actions in workflow files to see if hardening exists elsewhere
rg "actions/checkout" .github/workflows --no-heading -B2 -A2Repository: sparckles/Robyn Length of output: 5022 🏁 Script executed: # Check the full release-CI.yml to see all checkout actions and any hardening applied
cat -n .github/workflows/release-CI.yml | grep -A5 -B5 "actions/checkout"Repository: sparckles/Robyn Length of output: 1899 🏁 Script executed: # Search for any persist-credentials settings across all workflows
rg "persist-credentials" .github/workflows/Repository: sparckles/Robyn Length of output: 41 🏁 Script executed: # Check if any checkout actions are pinned to commit SHAs
rg "actions/checkout@[a-f0-9]" .github/workflows/Repository: sparckles/Robyn Length of output: 41 🏁 Script executed: # Get the exact lines for all checkout usages in release-CI.yml
cat .github/workflows/release-CI.yml | grep -n "actions/checkout"Repository: sparckles/Robyn Length of output: 209 🏁 Script executed: # Check if any checkout action in any workflow has persist-credentials or is pinned
for file in .github/workflows/*.yml; do
echo "=== $file ==="
cat "$file" | grep -A10 "actions/checkout"
doneRepository: sparckles/Robyn Length of output: 5688 🏁 Script executed: # Check the entire release-CI.yml to see if any checkout has special configuration
cat .github/workflows/release-CI.ymlRepository: sparckles/Robyn Length of output: 7618 🌐 Web query:
💡 Result: To secure your GitHub Actions workflows using actions/checkout, follow these industry-standard best practices: 1. Use persist-credentials: false: By default, actions/checkout persists the GITHUB_TOKEN or other credentials in the local git configuration [1][2]. This makes the token available to any subsequent step or third-party action in your job, increasing the risk of accidental exposure or misuse [3][2]. You should explicitly set this to false unless your workflow specifically requires authenticated git operations (e.g., pushing commits back to the repository) [4][3]. - uses: actions/checkout@v4 with: persist-credentials: false 2. Pin Actions to a Full Commit SHA: Using mutable tags like Citations:
Pin checkout action to commit SHA and disable credential persistence. The Suggested patch- - uses: actions/checkout@v4
+ - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+ with:
+ persist-credentials: false📝 Committable suggestion
Suggested change
🧰 Tools🪛 zizmor (1.25.2)[warning] 61-64: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) [error] 61-61: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||||||||||
| # The Microsoft Store python alias stubs intermittently raise EACCES when a | ||||||||||
| # Node-based action probes PATH for python3, failing the whole job. Remove | ||||||||||
| # them; setup-python below installs the real interpreter on PATH. | ||||||||||
| - name: Remove Windows Store python aliases (avoids flaky EACCES) | ||||||||||
| shell: pwsh | ||||||||||
| run: | | ||||||||||
| Remove-Item "$env:LOCALAPPDATA\Microsoft\WindowsApps\python.exe" -Force -ErrorAction SilentlyContinue | ||||||||||
| Remove-Item "$env:LOCALAPPDATA\Microsoft\WindowsApps\python3.exe" -Force -ErrorAction SilentlyContinue | ||||||||||
| - name: Install uv | ||||||||||
| uses: astral-sh/setup-uv@v3 | ||||||||||
| - uses: actions/setup-python@v6 | ||||||||||
|
|
@@ -82,6 +92,7 @@ jobs: | |||||||||
| linux: | ||||||||||
| runs-on: ubuntu-latest | ||||||||||
| strategy: | ||||||||||
| fail-fast: false | ||||||||||
| matrix: | ||||||||||
| python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"] | ||||||||||
| target: [x86_64, i686] | ||||||||||
|
|
@@ -113,6 +124,7 @@ jobs: | |||||||||
| runs-on: ubuntu-latest | ||||||||||
| if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.enable_linux_cross) | ||||||||||
| strategy: | ||||||||||
| fail-fast: false | ||||||||||
| matrix: | ||||||||||
| python: | ||||||||||
| [ | ||||||||||
|
|
||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: sparckles/Robyn
Length of output: 6341
🏁 Script executed:
Repository: sparckles/Robyn
Length of output: 257
🏁 Script executed:
rg "actions/checkout" .github/workflows/ -A 3Repository: sparckles/Robyn
Length of output: 4313
🌐 Web query:
GitHub Actions security best practices 2024 2025 actions/checkout pinning💡 Result:
Securing GitHub Actions workflows, especially when using actions/checkout and other third-party dependencies, relies on several established best practices as of 2026 [1][2][3]. The most critical security measure is ensuring that all actions are referenced by their full-length commit SHA [1][2][4]. Action Pinning Using mutable version tags (e.g.,
@v4) is insecure because a compromised upstream repository can update the tag to point to a malicious commit [1][5][2]. You must pin actions to a full 40-character commit SHA [2][6][4]. To maintain readability and updateability, it is standard practice to include the version number in a trailing comment [2][6]: - uses: actions/checkout@11bd719 # v4.2.2 Automate this process using tools like Dependabot or Renovate, which can automatically open pull requests to update these SHAs [5][2][6]. Core Security Best Practices 1. Least Privilege Permissions: Never rely on default permissions [2]. Use the permissions key at the workflow or job level to explicitly define only the scopes required [2]. Start with permissions: {} and add necessary scopes incrementally [2]. 2. OIDC for Cloud Authentication: Avoid long-lived secrets (e.g., AWS_ACCESS_KEY_ID) [2]. Use OpenID Connect (OIDC) to federate identity with your cloud provider, allowing the runner to request short-lived, job-specific access tokens [2][7][3]. 3. Protect Secrets: Ensure secrets are scoped to specific environments and use environment protection rules to require manual approval for high-risk deployments [2][3]. 4. Audit Third-Party Actions: Vet third-party actions before inclusion, favoring those from verified creators or those with significant community maintenance [8][9]. If an action is simple, consider implementing the required logic directly in your workflow using native shell commands [3]. 5. Governance Policies: Use repository or organization-level policies to restrict which actions can be used [10][4][3]. This allows you to block all third-party actions by default, requiring explicit approval for those you trust [8][3]. 6. Avoid Risky Triggers: Be cautious with the pull_request_target trigger, especially when combined with actions that check out untrusted code from forks [1][2]. For such workflows, ensure the checkout step runs in a separate, isolated job that does not have access to sensitive secrets [1][3]. For ongoing monitoring, use static analysis tools to scan workflow files for misconfigurations, such as unpinned actions or overly broad permissions [1][2][3].Citations:
🌐 Web query:
actions/checkout persist-credentials false security hardening💡 Result:
Setting
persist-credentials: falseonactions/checkoutis a recommended GitHub Actions security hardening step, because it prevents Git credentials (from the checkout step) from being persisted in the workflow’s runner git configuration, reducing exposure if the workflow (or later steps/actions) is compromised [1]. Whatpersist-credentialschanges - By default,actions/checkoutcan persist an auth token/credentials in the local git configuration so later steps can run authenticated git commands;persist-credentials: falseopts out of that persistence [2]. How to apply it (example) - Use it on checkout steps that are only reading source code (most CI jobs). For example: - uses: actions/checkout@ with: persist-credentials: false Additional hardening considerations (high impact) 1) Least-privilege forGITHUB_TOKEN- Even withpersist-credentials: false, hardening should include restricting the workflow/job permissions forGITHUB_TOKEN(e.g.,contents: readfor read-only jobs) to minimize blast radius [2][3]. 2) Avoid risky triggers/checkout patterns - Ensure you don’t check out and execute untrusted fork code in privileged contexts (e.g.,pull_request_target), which is a common high-risk scenario unrelated topersist-credentialsbut often co-occurs in insecure workflows [1][4]. Net effect -persist-credentials: falsereduces the chance that later workflow steps can reuse stored git credentials left behind by the checkout action, so it’s a sensible default for read-only workflows [1][2].Citations:
Harden all
actions/checkoutinvocations by pinning to commit SHA and disabling credential persistence.All four checkout steps in this workflow (lines 25, 57, 92, 125) are using mutable version tags (
@v4), which is less secure than pinning to a full commit SHA. Additionally, credential persistence is enabled by default. For CI supply-chain hardening, pin each to a commit SHA (with a version comment for readability) and setpersist-credentials: falseto prevent leakage of Git credentials if the workflow is compromised.Example patch
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 57-60: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 57-57: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Source: Linters/SAST tools