Skip to content

ci: pull pnpm into CI image, drop redundant setup steps #1107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
senamakel merged 2 commits into from
May 2, 2026
Merged

ci: pull pnpm into CI image, drop redundant setup steps #1107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c2c1097
ci: pull pnpm into CI image, drop redundant setup steps
senamakel May 2, 2026
51c9e5f
ci: fix cargo-audit cache path for container CARGO_HOME
senamakel May 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions .github/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,10 +48,11 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- \
-c rustfmt -c clippy \
-t x86_64-unknown-linux-gnu

# Node.js 24.x + yarn
# Node.js 24.x + pnpm (project's package manager — pinned in package.json)
RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
&& apt-get install -y --no-install-recommends nodejs \
&& npm install -g yarn
&& corepack enable \
&& corepack prepare pnpm@10.10.0 --activate

# Install ALSA, X11, input, and E2E automation dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
Expand Down Expand Up @@ -88,4 +89,4 @@ COPY e2e/docker-entrypoint.sh /docker-entrypoint.sh
RUN chmod +x /docker-entrypoint.sh

# Verify installs
RUN rustc --version && cargo --version && node --version && yarn --version && mold --version && sccache --version && which tauri-driver && cargo tauri --version
RUN rustc --version && cargo --version && node --version && pnpm --version && mold --version && sccache --version && which tauri-driver && cargo tauri --version
24 changes: 10 additions & 14 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,23 +44,19 @@ jobs:
restore-keys: |
cef-ubuntu-22.04-

# Note: the vendored CEF-aware tauri-cli is pre-installed in the
# ghcr.io/tinyhumansai/openhuman_ci image (see .github/Dockerfile),
# so `cargo tauri build` below resolves to the fork without any
# per-run compile step.
- name: Setup pnpm
uses: pnpm/action-setup@v4
with:
cache: true
- name: Setup Node.js 24.x
uses: actions/setup-node@v4
# Note: the vendored CEF-aware tauri-cli, Node 24, and pnpm are all
# pre-installed in the ghcr.io/tinyhumansai/openhuman_ci image (see
# .github/Dockerfile), so `cargo tauri build` below resolves to the
# fork without any per-run compile step.
- name: Cache pnpm store
uses: actions/cache@v4
with:
node-version: 24.x
path: ~/.local/share/pnpm/store
key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
restore-keys: |
pnpm-store-${{ runner.os }}-
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Install cmake (for whisper-rs)
run: apt-get update && apt-get install -y --no-install-recommends cmake &&
rm -rf /var/lib/apt/lists/*
# Core is linked into the Tauri binary as a path dep — no separate
# sidecar build / stage step needed.
- name: Build Tauri app (CEF default)
Expand Down
21 changes: 9 additions & 12 deletions .github/workflows/coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,20 +15,21 @@ concurrency:
jobs:
frontend-coverage:
name: Frontend Coverage (Vitest)
runs-on: ubuntu-latest
runs-on: ubuntu-22.04
container:
image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 1
- name: Setup pnpm
uses: pnpm/action-setup@v4
with:
cache: true
- name: Setup Node.js 24.x
uses: actions/setup-node@v4
- name: Cache pnpm store
uses: actions/cache@v4
with:
node-version: 24.x
path: ~/.local/share/pnpm/store
key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
restore-keys: |
pnpm-store-${{ runner.os }}-
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Run Vitest with coverage
Expand Down Expand Up @@ -74,8 +75,6 @@ jobs:
workspaces: . -> target
cache-on-failure: true
key: core-coverage
- name: Install system dependencies (cmake, ALSA, X11)
run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/*
- name: Install cargo-llvm-cov
uses: taiki-e/install-action@cargo-llvm-cov
- name: Run cargo llvm-cov for openhuman core
Expand Down Expand Up @@ -116,8 +115,6 @@ jobs:
key: cef-ubuntu-22.04-${{ hashFiles('app/src-tauri/Cargo.toml') }}
restore-keys: |
cef-ubuntu-22.04-
- name: Install system dependencies (cmake, ALSA, X11)
run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/*
- name: Install cargo-llvm-cov
uses: taiki-e/install-action@cargo-llvm-cov
- name: Run cargo llvm-cov for Tauri shell
Expand Down
16 changes: 6 additions & 10 deletions .github/workflows/pr-quality.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,36 +15,32 @@ jobs:
# blocking merges. Flip to hard-fail once the false-positive rate is stable.
checklist-guard:
name: PR Submission Checklist
runs-on: ubuntu-latest
runs-on: ubuntu-22.04
container:
image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
continue-on-error: true
if: ${{ !contains(github.event.pull_request.labels.*.name, 'docs') && !contains(github.event.pull_request.labels.*.name, 'chore') }}
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 1
- name: Setup Node.js 24.x
uses: actions/setup-node@v4
with:
node-version: 24.x
- name: Verify Submission Checklist
env:
PR_BODY: ${{ github.event.pull_request.body }}
run: node scripts/check-pr-checklist.mjs
coverage-matrix:
name: Coverage Matrix Sync
runs-on: ubuntu-latest
runs-on: ubuntu-22.04
container:
image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
continue-on-error: true
if: ${{ !contains(github.event.pull_request.labels.*.name, 'docs') && !contains(github.event.pull_request.labels.*.name, 'chore') }}
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 1
- name: Setup Node.js 24.x
uses: actions/setup-node@v4
with:
node-version: 24.x
- name: Verify Coverage Matrix
run: node scripts/check-coverage-matrix.mjs
markdown-link-check:
Expand Down
23 changes: 9 additions & 14 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,20 +22,21 @@ concurrency:
jobs:
unit-tests:
name: Frontend Unit Tests
runs-on: ubuntu-latest
runs-on: ubuntu-22.04
container:
image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 1
- name: Setup pnpm
uses: pnpm/action-setup@v4
with:
cache: true
- name: Setup Node.js 24.x
uses: actions/setup-node@v4
- name: Cache pnpm store
uses: actions/cache@v4
with:
node-version: 24.x
path: ~/.local/share/pnpm/store
key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
restore-keys: |
pnpm-store-${{ runner.os }}-
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Run tests with coverage
Expand Down Expand Up @@ -78,9 +79,6 @@ jobs:
cache-on-failure: true
key: core

- name: Install system dependencies (cmake, ALSA, X11)
run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/*

- name: Install sccache
uses: mozilla-actions/sccache-action@v0.0.9

Expand Down Expand Up @@ -124,9 +122,6 @@ jobs:
key: cef-ubuntu-22.04-${{ hashFiles('app/src-tauri/Cargo.toml') }}
restore-keys: |
cef-ubuntu-22.04-
- name: Install system dependencies (cmake, ALSA, X11)
run: apt-get update && apt-get install -y --no-install-recommends cmake libasound2-dev
libxdo-dev libxtst-dev libx11-dev libevdev-dev && rm -rf /var/lib/apt/lists/*
- name: Install sccache
uses: mozilla-actions/sccache-action@v0.0.9

Expand Down
20 changes: 9 additions & 11 deletions .github/workflows/typecheck.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,20 +14,21 @@ concurrency:
jobs:
typecheck:
name: Type Check TypeScript
runs-on: ubuntu-latest
runs-on: ubuntu-22.04
container:
image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 1
- name: Setup pnpm
uses: pnpm/action-setup@v4
with:
cache: true
- name: Setup Node.js 24.x
uses: actions/setup-node@v4
- name: Cache pnpm store
uses: actions/cache@v4
with:
node-version: 24.x
path: ~/.local/share/pnpm/store
key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
restore-keys: |
pnpm-store-${{ runner.os }}-
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Type check TypeScript files
Expand Down Expand Up @@ -58,9 +59,6 @@ jobs:
workspaces: |
. -> target
cache-on-failure: true
- name: Install cmake (for whisper-rs)
run: apt-get update && apt-get install -y --no-install-recommends cmake &&
rm -rf /var/lib/apt/lists/*
- name: Check formatting (cargo fmt)
run: cargo fmt --all -- --check
- name: Run clippy (core crate)
Expand Down
24 changes: 12 additions & 12 deletions .github/workflows/weekly-code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,34 +25,34 @@ concurrency:
jobs:
weekly-review:
name: Aggregate weekly signals
runs-on: ubuntu-latest
runs-on: ubuntu-22.04
container:
image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Comment on lines +29 to +30

@coderabbitai coderabbitai Bot May 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify workflow container images are tag-only (not digest-pinned).
rg -nP "image:\s*ghcr\.io/tinyhumansai/openhuman_ci:rust-1\.93\.0(?!@sha256:)" .github/workflows

Repository: tinyhumansai/openhuman

Length of output: 1183

Pin the CI container image by digest, not mutable tag.

Using :rust-1.93.0 alone allows silent image drift across runs. Pin to ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0@sha256:<digest> for reproducible and auditable CI. This pattern affects multiple workflow files (test.yml, typecheck.yml, pr-quality.yml, coverage.yml, build.yml).

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/weekly-code-review.yml around lines 29 - 30, Replace the
mutable image tag with a digest-pinned image to prevent silent drift: locate the
container.image entry that currently uses
"ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0" (seen in
.github/workflows/weekly-code-review.yml and other workflow files like test.yml,
typecheck.yml, pr-quality.yml, coverage.yml, build.yml) and update it to the
digest form "ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0@sha256:<digest>" (use
the actual SHA256 digest from the registry) so CI uses an immutable,
reproducible image. Ensure you replace every occurrence of the tag-only image
across all workflow files.

@senamakel senamakel May 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Deferring this. The :rust-1.93.0 mutable tag is the pattern this repo already uses across every workflow that consumes the CI image — it's refreshed by docker-ci-image.yml whenever .github/Dockerfile changes. Switching to digest pinning would mean every image rebuild becomes a coordinated 6-file workflow PR (and breaks any in-flight feature branches that don't pick up the new digest), which costs more friction than the silent-drift risk it removes here. Happy to revisit if we ever start pinning toolchains by digest elsewhere.

@coderabbitai coderabbitai Bot May 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@senamakel, understood — that's a reasonable trade-off. Using a mutable tag tied to a controlled rebuild pipeline avoids the coordination overhead of digest-bumping every workflow file on each image update. I'll keep this in mind for future reviews.

✏️ Learnings added 
Learnt from: senamakel
Repo: tinyhumansai/openhuman PR: 1107
File: .github/workflows/weekly-code-review.yml:29-30
Timestamp: 2026-05-02T20:45:07.741Z
Learning: In the tinyhumansai/openhuman repository, the CI container image `ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0` is intentionally referenced by mutable tag (not digest-pinned) across all workflow files (.github/workflows/test.yml, typecheck.yml, pr-quality.yml, coverage.yml, build.yml, weekly-code-review.yml). The tag is refreshed by `docker-ci-image.yml` whenever `.github/Dockerfile` changes. Digest pinning was explicitly deferred because it would require a coordinated 6-file workflow PR on every image rebuild and would break in-flight feature branches. Do not flag this pattern as an issue in future reviews.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

timeout-minutes: 30
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 1

- name: Enable Corepack (for pnpm)
run: corepack enable

- name: Setup Node.js 24.x
uses: actions/setup-node@v4
- name: Cache pnpm store
uses: actions/cache@v4
with:
node-version: 24.x
cache: "pnpm"
path: ~/.local/share/pnpm/store
key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
restore-keys: |
pnpm-store-${{ runner.os }}-

- name: Install JS dependencies
run: pnpm install --frozen-lockfile

- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@1.93.0

- name: Cache cargo-audit binary
id: cache-cargo-audit
uses: actions/cache@v4
with:
path: ~/.cargo/bin/cargo-audit
# Image sets CARGO_HOME=/usr/local/cargo, so cargo install drops the
# binary there — not in $HOME/.cargo/bin.
path: /usr/local/cargo/bin/cargo-audit
key: cargo-audit-${{ runner.os }}-v1

- name: Install cargo-audit
Expand Down
Loading