updates - #59
Conversation
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughRelease component version constants and two GitHub Actions workflow references were updated. Build, release, publishing, and workflow wiring logic were not changed. ChangesRelease updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
digest to a0f2448 (#323) Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 172: Replace the mutable actions/setup-python v7 reference in
.github/workflows/release.yml:172-172 with the verified full immutable commit
SHA for v7. Also replace the mutable renovatebot/github-action v46.1.20
reference in .github/workflows/renovate.yml:28-28 with its verified full commit
SHA, preserving the existing action versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 45ba977d-7cb3-424e-a5a7-562c2c268e23
📒 Files selected for processing (3)
.github/workflows/release.yml.github/workflows/renovate.ymlsrc/declarations.sh
|
|
||
| - name: Install Python | ||
| uses: actions/setup-python@v6 | ||
| uses: actions/setup-python@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin all changed workflow actions to immutable commit SHAs.
Both updated references use mutable tags, violating the repository’s blanket action-pinning policy:
.github/workflows/release.yml#L172-L172: pinactions/setup-pythonto the verified full SHA for v7..github/workflows/renovate.yml#L28-L28: pinrenovatebot/github-actionto the verified full SHA for v46.1.20.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 172-172: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
📍 Affects 2 files
.github/workflows/release.yml#L172-L172(this comment).github/workflows/renovate.yml#L28-L28
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 172, Replace the mutable
actions/setup-python v7 reference in .github/workflows/release.yml:172-172 with
the verified full immutable commit SHA for v7. Also replace the mutable
renovatebot/github-action v46.1.20 reference in
.github/workflows/renovate.yml:28-28 with its verified full commit SHA,
preserving the existing action versions.
Source: Linters/SAST tools
digest to 848deb1 (#327) Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/renovate.yml:
- Line 28: Update the Renovate workflow’s uses entry to reference the immutable
commit SHA for version v46.1.21 instead of the mutable tag, and retain
“v46.1.21” in an adjacent comment for maintainability.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a4bce63a-613f-49e6-a81c-400ae0dc346d
📒 Files selected for processing (1)
.github/workflows/renovate.yml
|
|
||
| - name: Self-hosted Renovate | ||
| uses: renovatebot/github-action@v46.1.19 | ||
| uses: renovatebot/github-action@v46.1.21 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin the action to an immutable commit SHA.
@v46.1.21 is still a mutable tag. Because this action receives secrets.RENOVATE, a retagged or compromised release could execute unreviewed code with repository credentials. Pin the action to its commit SHA and retain the version in a comment for maintainability.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 28-28: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/renovate.yml at line 28, Update the Renovate workflow’s
uses entry to reference the immutable commit SHA for version v46.1.21 instead of
the mutable tag, and retain “v46.1.21” in an adjacent comment for
maintainability.
Source: Linters/SAST tools
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/declarations.sh`:
- Line 31: Update the default VERSION[AVBROOT] value in the declarations
configuration to a published, compatible upstream AVBRoot release tag,
preserving the existing release URL construction and override behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 28ef7d8a-1ea8-45e7-9284-5ef2568c4bbd
📒 Files selected for processing (1)
src/declarations.sh
| VERSION[AVBROOT_SETUP]="e4f80bb54aa5ae8de6109edd7d0873d5b4966748" # Commit hash | ||
| VERSION[BCR]="${VERSION[BCR]:-3.4}" | ||
| VERSION[CUSTOTA]="${VERSION[CUSTOTA]:-6.2}" | ||
| VERSION[AVBROOT]="${VERSION[AVBROOT]:-3.33.0}" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== declarations.sh relevant lines =="
sed -n '1,80p' src/declarations.sh 2>/dev/null || true
echo "== util_functions.sh AVBROOT/url references =="
rg -n "AVBROOT|avbroot|VERSION\[" src/util_functions.sh src/declarations.sh 2>/dev/null || true
echo "== local git diff summary =="
git diff --stat 2>/dev/null || true
echo "== upstream AVBRoot release metadata =="
python3 - <<'PY'
import json, urllib.request
url = "https://api.github.com/repos/chenxiaolong/avbroot/releases/latest"
try:
with urllib.request.urlopen(url, timeout=20) as r:
data = json.load(r)
print("latest_release_tag:", data.get("tag_name"))
print("latest_release_name:", data.get("name"))
print("published_at:", data.get("published_at"))
except Exception as e:
print("ERROR:", type(e).__name__, str(e))
for i in range(1, 6):
url = f"https://api.github.com/repos/chenxiaolong/avbroot/releases?per_page=20&page={i}"
print(f"\npage {i} releases:")
try:
with urllib.request.urlopen(url, timeout=20) as r:
for item in json.load(r)[:5]:
print("-", item.get("tag_name") or "<nil>", item.get("published_at"))
except Exception as e:
print("ERROR:", type(e).__name__, str(e))
PYRepository: 0cwa/PixeneOS
Length of output: 9633
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== util_functions.sh download function around AVBRoot release URLs =="
sed -n '335,380p' src/util_functions.sh 2>/dev/null || true
echo "== fetch all known AVBRoot releases containing v3.33.0 or v3.32.2 =="
python3 - <<'PY'
import urllib.request, json, ssl
ctx = ssl.create_default_context()
ctx.check_hostname=False
ctx.verify_mode=ssl.CERT_NONE
releases=[]
for page in range(1,10):
url = f"https://api.github.com/repos/chenxiaolong/avbroot/releases?per_page=100&page={page}"
try:
with urllib.request.urlopen(url, timeout=20, context=ctx) as r:
data = json.load(r)
except Exception as e:
print(f"page {page} error:", repr(e))
break
if not data:
break
releases.extend(data)
for tag in ["v3.33.0", "v3.32.2"]:
hits = [r for r in releases if r.get("tag_name") == tag]
print("tag:", tag, "count", len(hits))
if hits:
print(hits[0].get("published_at"), hits[0].get("assets", [])[:3])
latest = None
for r in releases:
if not latest or r.get("published_at", "") > latest.get("published_at",""):
latest=r
print("latest:", latest.get("tag_name"), "published", latest.get("published_at"))
PYRepository: 0cwa/PixeneOS
Length of output: 2627
🌐 Web query:
chenxiaolong avbroot releases v3.33.0 v3.32.2
💡 Result:
As of August 6, 2026, there are no official releases for avbroot versions v3.33.0 or v3.32.2 [1][2]. The latest available version of avbroot is v3.32.0, which was published on July 18, 2026 [2].
Citations:
Use a published AVBRoot release.
VERSION[AVBROOT] is turned into the release URL chenxiaolong/avbroot/releases/download/v<version>/avbroot-<version>-<ARCH>.zip. v3.33.0 is not published on the upstream release page, so the default download path fails. Set this to a published, compatible tag before merging.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/declarations.sh` at line 31, Update the default VERSION[AVBROOT] value in
the declarations configuration to a published, compatible upstream AVBRoot
release tag, preserving the existing release URL construction and override
behavior.
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
Co-authored-by: Renovate Bot <renovatebot@non-existent-email.com>
|
Superseded by #60, which keeps 0cwa/my-avbroot-setup as the helper source, preserves PixeneOS fork-specific workflows/security changes, and is based on the maintained helper sync in 0cwa/my-avbroot-setup#4. |
2 participants
No description provided.