Skip to content

Use zendesk/setup-jsonnet action for reliable go-jsonnet retrieval - #649

Merged
knoepfel merged 2 commits into
mainfrom
maintenance/jsonnet-use-setup-action
Jun 16, 2026
Merged

Use zendesk/setup-jsonnet action for reliable go-jsonnet retrieval#649
knoepfel merged 2 commits into
mainfrom
maintenance/jsonnet-use-setup-action

Conversation

@greenc-FNAL

@greenc-FNAL greenc-FNAL commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

CI/CD

  • Jsonnet tooling provisioning: Replaced Docker container-based Jsonnet runtime (docker.io/dysnix/jsonnet:latest) with explicit action-based setup in both workflows

    • jsonnet-format-check.yaml: Added Setup jsonnet step using zendesk/setup-jsonnet@v16 (pinned to 74119dac8a540c99167a65f14aa1ee99ff143ec2) with github_token parameter
    • jsonnet-format-fix.yaml: Added Setup jsonnet step using the same zendesk/setup-jsonnet@v16 action with github_token parameter
  • Command execution: Both workflows now execute jsonnetfmt directly on the GitHub Actions runner instead of within a Docker container:

    • Check workflow: Uses jsonnetfmt --test on all *.jsonnet and *.libsonnet files to validate formatting
    • Fix workflow: Uses jsonnetfmt -i to apply formatting fixes in-place
  • Rationale: The zendesk/setup-jsonnet action provides reliable, automated go-jsonnet binary retrieval and setup, improving reproducibility and reducing dependency on external Docker images

@coderabbitai

coderabbitai Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bd4e8fd7-81c7-431f-a577-3c4fa6b93f5d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Both Jsonnet GitHub Actions workflows (jsonnet-format-check and jsonnet-format-fix) drop Docker container-based Jsonnet tooling (docker.io/dysnix/jsonnet:latest) in favor of an explicit zendesk/setup-jsonnet (v16) setup step with github.token, running jsonnetfmt natively on the Actions runner.

Changes

Jsonnet CI Runtime Migration

Layer / File(s) Summary
format-check: drop container, add setup step
.github/workflows/jsonnet-format-check.yaml
Removes container.image: docker.io/dysnix/jsonnet:latest from the job definition and inserts a Setup jsonnet step using zendesk/setup-jsonnet (v16) with github_token.
format-fix: add setup step, run jsonnetfmt natively
.github/workflows/jsonnet-format-fix.yaml
Adds the same Setup jsonnet step and rewrites the formatting step to invoke jsonnetfmt directly via find/xargs on CHECKOUT_PATH instead of through a Docker container exec.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

  • Framework-R-D/phlex#645: The direct predecessor — switched these same two workflow files to the docker.io/dysnix/jsonnet:latest container that this PR is now removing in favor of zendesk/setup-jsonnet.

Suggested reviewers

  • marcpaterno
  • knoepfel
  • sabasehrish
  • aolivier23
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: replacing Docker-based Jsonnet provisioning with the zendesk/setup-jsonnet action for more reliable tooling retrieval.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch maintenance/jsonnet-use-setup-action

Comment @coderabbitai help to get the list of available commands and usage tips.

@greenc-FNAL

greenc-FNAL commented Jun 16, 2026

Copy link
Copy Markdown
Contributor Author

31 fixed, 0 new since branch point (6f38dee)
31 fixed, 0 new since previous report on PR (d6b26fd)

✅ 31 CodeQL alerts resolved since the previous PR commit

  • Warning # 196 actions/untrusted-checkout-toctou/critical at .github/workflows/clang-tidy-fix.yaml:109:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 197 actions/untrusted-checkout-toctou/critical at .github/workflows/clang-tidy-fix.yaml:137:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 198 actions/untrusted-checkout-toctou/critical at .github/workflows/clang-tidy-fix.yaml:157:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 199 actions/untrusted-checkout-toctou/critical at .github/workflows/clang-tidy-fix.yaml:201:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 200 actions/untrusted-checkout-toctou/critical at .github/workflows/coverage.yaml:166:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 201 actions/untrusted-checkout-toctou/critical at .github/workflows/coverage.yaml:188:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 202 actions/untrusted-checkout-toctou/critical at .github/workflows/coverage.yaml:207:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 203 actions/untrusted-checkout-toctou/critical at .github/workflows/coverage.yaml:226:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 204 actions/untrusted-checkout-toctou/critical at .github/workflows/coverage.yaml:251:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 205 actions/untrusted-checkout-toctou/critical at .github/workflows/header-guards-fix.yaml:107:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 206 actions/untrusted-checkout-toctou/critical at .github/workflows/markdown-fix.yaml:107:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 207 actions/untrusted-checkout-toctou/critical at .github/workflows/yaml-fix.yaml:108:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 208 actions/untrusted-checkout-toctou/critical at .github/workflows/yaml-fix.yaml:111:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 209 actions/untrusted-checkout-toctou/high at .github/workflows/clang-format-fix.yaml:94:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 210 actions/untrusted-checkout-toctou/high at .github/workflows/cmake-format-fix.yaml:94:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 211 actions/untrusted-checkout-toctou/high at .github/workflows/jsonnet-format-fix.yaml:95:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 212 actions/untrusted-checkout-toctou/high at .github/workflows/python-fix.yaml:94:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 213 actions/untrusted-checkout/high at .github/workflows/clang-format-fix.yaml:94:9 — Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
    Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
  • Warning # 214 actions/untrusted-checkout/high at .github/workflows/cmake-format-fix.yaml:94:9 — Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
    Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
  • Warning # 215 actions/untrusted-checkout/high at .github/workflows/jsonnet-format-fix.yaml:95:9 — Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
    Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
  • ✅ …and 11 more alerts (see Code Scanning for the full list).

✅ 31 CodeQL alerts resolved since the branch point

  • Warning # 196 actions/untrusted-checkout-toctou/critical at .github/workflows/clang-tidy-fix.yaml:109:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 197 actions/untrusted-checkout-toctou/critical at .github/workflows/clang-tidy-fix.yaml:137:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 198 actions/untrusted-checkout-toctou/critical at .github/workflows/clang-tidy-fix.yaml:157:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 199 actions/untrusted-checkout-toctou/critical at .github/workflows/clang-tidy-fix.yaml:201:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 200 actions/untrusted-checkout-toctou/critical at .github/workflows/coverage.yaml:166:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 201 actions/untrusted-checkout-toctou/critical at .github/workflows/coverage.yaml:188:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 202 actions/untrusted-checkout-toctou/critical at .github/workflows/coverage.yaml:207:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 203 actions/untrusted-checkout-toctou/critical at .github/workflows/coverage.yaml:226:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 204 actions/untrusted-checkout-toctou/critical at .github/workflows/coverage.yaml:251:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 205 actions/untrusted-checkout-toctou/critical at .github/workflows/header-guards-fix.yaml:107:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 206 actions/untrusted-checkout-toctou/critical at .github/workflows/markdown-fix.yaml:107:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 207 actions/untrusted-checkout-toctou/critical at .github/workflows/yaml-fix.yaml:108:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 208 actions/untrusted-checkout-toctou/critical at .github/workflows/yaml-fix.yaml:111:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 209 actions/untrusted-checkout-toctou/high at .github/workflows/clang-format-fix.yaml:94:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 210 actions/untrusted-checkout-toctou/high at .github/workflows/cmake-format-fix.yaml:94:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 211 actions/untrusted-checkout-toctou/high at .github/workflows/jsonnet-format-fix.yaml:95:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 212 actions/untrusted-checkout-toctou/high at .github/workflows/python-fix.yaml:94:9 — Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
    Insufficient protection against execution of untrusted code on a privileged workflow (issue_comment).
  • Warning # 213 actions/untrusted-checkout/high at .github/workflows/clang-format-fix.yaml:94:9 — Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
    Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
  • Warning # 214 actions/untrusted-checkout/high at .github/workflows/cmake-format-fix.yaml:94:9 — Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
    Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
  • Warning # 215 actions/untrusted-checkout/high at .github/workflows/jsonnet-format-fix.yaml:95:9 — Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
    Checkout of untrusted code in a privileged workflow with later potential execution (event trigger: issue_comment).
  • ✅ …and 11 more alerts (see Code Scanning for the full list).

Review the full CodeQL report for details.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/jsonnet-format-check.yaml:
- Around line 87-92: The setup-jsonnet action defaults to the latest version
when no version input is specified, which causes formatter behavior to drift
over time. Add `version: v16` to the `with:` block of the setup-jsonnet step in
both `.github/workflows/jsonnet-format-check.yaml` and
`.github/workflows/jsonnet-format-fix.yaml` to ensure both the format check and
format fix workflows use the same Jsonnet CLI version and maintain deterministic
behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9d2429c0-dfa9-432c-8613-4ff08afc8e70

📥 Commits

Reviewing files that changed from the base of the PR and between 6f38dee and d6b26fd.

📒 Files selected for processing (2)
  • .github/workflows/jsonnet-format-check.yaml
  • .github/workflows/jsonnet-format-fix.yaml
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • Framework-R-D/action-workflow-setup (auto-detected)
  • Framework-R-D/action-complete-pr-comment (auto-detected)
  • Framework-R-D/action-handle-fix-commit (auto-detected)
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: Analyze actions with CodeQL
🔇 Additional comments (2)
.github/workflows/jsonnet-format-fix.yaml (2)

103-108: Same version-pinning concern as above applies here.


114-114: LGTM!

Comment thread .github/workflows/jsonnet-format-check.yaml
@knoepfel
knoepfel merged commit ac671f4 into main Jun 16, 2026
38 checks passed
@knoepfel
knoepfel deleted the maintenance/jsonnet-use-setup-action branch June 16, 2026 17:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

jsonnet Format Action Always Failing

2 participants