Feature: Add CI build - #21
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughA new GitHub Actions workflow was added at .github/workflows/arch-makepkg.yml to build Arch Linux packages using an archlinux:base-devel container. It triggers on push, pull_request, and workflow_dispatch. The workflow sets PKGDEST and SRCDEST, checks out the repository, initializes pacman keys and system packages, creates a builder user with passwordless sudo, imports a signing key for that user, runs makepkg with --syncdeps --cleanbuild --noconfirm --log, and uploads resulting packages from PKGDEST as artifacts named arch-package-${{ github.run_number }}. Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Pre-merge checks and finishing touches✅ Passed checks (5 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
.github/workflows/arch-makepkg.yml (3)
14-19: Pin the container image to a specific version for reproducibility.The container image
archlinux:base-develfloats to the latest tag, which means builds may behave differently over time as the base image receives updates. This affects reproducibility and can introduce unexpected breaking changes.Recommend pinning to a specific image digest or at least using a dated tag (e.g.,
archlinux:base-devel-20251113).container: - image: archlinux:base-devel + image: archlinux:base-devel@sha256:... # or use a dated tagAlternatively, consult Arch Linux's container image tagging strategy for the best pinning approach.
3-6: Document or restrict trigger events.The workflow triggers on
push,pull_request, andworkflow_dispatch. Depending on your project's security posture, building on every push to all branches may be resource-intensive or unnecessary. Consider restricting to specific branches or events.Example: trigger only on pushes to main/master and all PRs:
on: - push: + push: + branches: [master] pull_request: workflow_dispatch:This is optional but can help manage CI costs and focus builds on important branches.
28-33: Verify sudoers configuration does not create security gaps.The sudoers entry
builder ALL=(ALL) NOPASSWD: ALLgrants the builder user unrestricted passwordless sudo access. While appropriate for an isolated CI container, document this assumption and ensure the builder user cannot escape or be compromised.Consider restricting sudo access to only the commands needed (e.g., pacman operations) if possible, or add a comment to document why unrestricted access is acceptable in this context:
useradd -m builder - echo 'builder ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers.d/builder + # Unrestricted sudo for builder in ephemeral CI container + echo 'builder ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers.d/builder chown -R builder:builder "$GITHUB_WORKSPACE" install -d -m 0755 -o builder -g builder "$PKGDEST" "$SRCDEST"
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/arch-makepkg.yml(1 hunks)
🔇 Additional comments (2)
.github/workflows/arch-makepkg.yml (2)
37-43: Verify makepkg log output path and ensure logs are captured correctly.The
--logflag is passed to makepkg, but the subsequent artifact upload (line 50) uses*.logwhich looks for logs in the root workspace directory. Makepkg may create logs in the source directory or elsewhere depending on the SRCDEST configuration.Verify the actual location where makepkg writes logs with the
--logflag whenSRCDESTis set to a custom path, and ensure the artifact upload glob pattern correctly captures them. You may need to adjust the upload path in line 50 or use a more specific glob pattern.Consider running a local test or checking Arch Linux documentation for makepkg's log output behavior.
34-36: Verify GPG key fingerprint after import from keyserver; remove hardcoded key fetch without authentication.The workflow retrieves a public GPG key from a keyserver without verifying its fingerprint—this allows key substitution attacks. Rather than storing a public key ID in secrets (approach 1 in the original comment is incorrect; public key IDs are not secret), add fingerprint verification after import or store the key file in the repository.
Recommended approach (aligned with Arch best practices):
Add fingerprint verification after fetching:
- name: Import package signing key run: | sudo -u builder gpg --batch --keyserver keyserver.ubuntu.com --recv-keys 58117AFA1F85B3EEC154677D615D449FE6E6A235 # Verify fingerprint to prevent key substitution sudo -u builder gpg --batch --fingerprint 58117AFA1F85B3EEC154677D615D449FE6E6A235 | grep -q "Key fingerprint = <expected_fingerprint>" || exit 1Better: store the key in the repository (recommended for AUR):
- Add the public key file to
keys/directory in the repository- Import from the repository instead of keyserver
- Verify fingerprint matches expected value
"--log" sends to the console anyway
There was a problem hiding this comment.
Pull Request Overview
This PR adds a GitHub Actions workflow to automate building of Arch Linux packages for Cryptomator using makepkg. The workflow is triggered on push, pull requests, and manual dispatch.
Key Changes:
- Introduces CI/CD automation for Arch Linux package builds using an archlinux:base-devel container
- Configures package signing verification using GPG keys
- Uploads built packages as workflow artifacts
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Closes #13.
Disclaimer: The workflow file was generated with AI.