ci: build and test with pixi instead of CVMFS#26
Conversation
📝 WalkthroughWalkthroughThis PR migrates the project's GitHub Actions CI pipeline from a self-hosted CERN-based container setup to a modern Pixi-managed workflow on ubuntu-latest. A new ChangesPixi-Based CI Workflow
🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
olantwin
force-pushed
the
ci/use-pixi
branch
2 times, most recently
from
2ddc76d to
f9c8f56
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
pixi.toml (1)
17-17: ⚡ Quick winTighten
geomodelconstraint to match the validated ABI line.Line 17 currently allows any newer
geomodel; that can break future lock refreshes against your known-good 6.27.x compatibility window.Proposed change
-geomodel = ">=6.22" +geomodel = ">=6.27,<6.28"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pixi.toml` at line 17, Tighten the geomodel version constraint in pixi.toml so it doesn't allow future incompatible releases: change the current geomodel = ">=6.22" to include an upper bound that matches the validated ABI window (for example geomodel = ">=6.22,<6.28") so the project stays within the known-good 6.27.x compatibility range.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-test.yml:
- Around line 17-21: Replace the mutable action tags with their full commit SHAs
and disable credential persistence for checkout: update the actions referenced
as actions/checkout (change tag to the full SHA) and prefix-dev/setup-pixi
(change tag to the full SHA) and add persist-credentials: false to the
actions/checkout step; ensure you reference the checkout step by
name/actions/checkout and the pixi setup step by prefix-dev/setup-pixi when
making these edits.
---
Nitpick comments:
In `@pixi.toml`:
- Line 17: Tighten the geomodel version constraint in pixi.toml so it doesn't
allow future incompatible releases: change the current geomodel = ">=6.22" to
include an upper bound that matches the validated ABI window (for example
geomodel = ">=6.22,<6.28") so the project stays within the known-good 6.27.x
compatibility range.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f524cef7-1884-4321-b84a-bc6fb4b816a8
⛔ Files ignored due to path filters (1)
pixi.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.github/workflows/build-test.ymlpixi.toml
| - uses: actions/checkout@v6 | ||
|
|
||
| - name: Build | ||
| run: | | ||
| source /cvmfs/sft.cern.ch/lcg/views/LCG_109/x86_64-el9-gcc15-opt/setup.sh | ||
| source /cvmfs/ship-nightlies.cern.ch/GeoModel/sw/slc9_x86-64/GeoModel/6.24.0-local2/etc/profile.d/init.sh | ||
| cmake --build build -j$(nproc) | ||
| - uses: prefix-dev/setup-pixi@v0.9.6 | ||
| with: | ||
| cache: true |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/build-test.yml"
echo "=== File: $FILE ==="
if [ ! -f "$FILE" ]; then
echo "Missing $FILE" >&2
exit 1
fi
nl -ba "$FILE" | sed -n '1,120p'
echo "=== Search for checkout options ==="
rg -n "actions/checkout@|persist-credentials|token|GITHUB_TOKEN" .github/workflows/build-test.yml || true
echo "=== Search for other checkout usages in workflows ==="
rg -n "uses:\s*actions/checkout@|persist-credentials" .github/workflows || trueRepository: ShipSoft/Geometry
Length of output: 170
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/build-test.yml"
echo "=== File: $FILE ==="
if [ ! -f "$FILE" ]; then
echo "Missing $FILE" >&2
exit 1
fi
echo "=== Showing first 140 lines (for context) ==="
awk 'NR>=1 && NR<=140 {printf "%5d: %s\n", NR, $0}' "$FILE"
echo "=== Search within $FILE for checkout/setup-pixi usage and credential settings ==="
rg -n "uses:\s*actions/checkout@|uses:\s*prefix-dev/setup-pixi@|persist-credentials|GITHUB_TOKEN|token:" "$FILE" || true
echo "=== Search across workflows for checkout with persist-credentials ==="
rg -n "uses:\s*actions/checkout@|persist-credentials" .github/workflows || trueRepository: ShipSoft/Geometry
Length of output: 1110
🌐 Web query:
actions/checkout persist-credentials default value token in git config
💡 Result:
The default value for the persist-credentials input in actions/checkout is true [1][2]. When enabled (default), the action configures the GitHub Actions authentication token (or SSH key) to allow subsequent git commands in your workflow to run authenticated [1][3]. Recent versions of actions/checkout have improved security by storing these credentials in a separate file under $RUNNER_TEMP and using git includeIf directives, rather than writing the credentials directly into the local.git/config file as was done in earlier implementations [1][4]. This token or credential configuration is automatically cleaned up by the action during the post-job step [1][3]. If you wish to prevent this behavior, you can explicitly set persist-credentials: false in your workflow step [1][2].
Citations:
- 1: https://github.com/actions/checkout/?tab=readme-ov-file
- 2: actions/checkout@c170eef
- 3: https://github.com/actions/checkout/blob/85e6279cec87321a52edac9c87bce653a07cf6c2/README.md
- 4: actions/checkout@069c695
Pin action references to full SHAs and disable checkout credential persistence.
In .github/workflows/build-test.yml (Lines 17-21), actions/checkout@v6 (Line 17) and prefix-dev/setup-pixi@v0.9.6 (Line 19) are using mutable tags. actions/checkout defaults persist-credentials to true, so the GitHub token/credentials are configured for subsequent git commands; for repo-controlled build/test steps, set persist-credentials: false and pin both actions to full commit SHAs.
Proposed hardening
- - uses: actions/checkout@v6
+ - uses: actions/checkout@<FULL_LENGTH_COMMIT_SHA>
+ with:
+ persist-credentials: false
- - uses: prefix-dev/setup-pixi@v0.9.6
+ - uses: prefix-dev/setup-pixi@<FULL_LENGTH_COMMIT_SHA>
with:
cache: true🧰 Tools
🪛 zizmor (1.25.2)
[warning] 17-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-test.yml around lines 17 - 21, Replace the mutable
action tags with their full commit SHAs and disable credential persistence for
checkout: update the actions referenced as actions/checkout (change tag to the
full SHA) and prefix-dev/setup-pixi (change tag to the full SHA) and add
persist-credentials: false to the actions/checkout step; ensure you reference
the checkout step by name/actions/checkout and the pixi setup step by
prefix-dev/setup-pixi when making these edits.
…ABI clash The previous build_number bump (#15) rebuilt geomodel under the current conda-forge cxx-compiler but kept four weak std::__format::_Sink_iter<char> template instantiations exported from libGeoModelXml/Write/Read/DBManager: W __write_padded W __write_escaped W __write_padded_as_spec W __write_escaped_unicode libstdc++.so.6 (libstdcxx 15.2.0) does not export matching strong symbols, so the dynamic linker uses the weak duplicates from geomodel for both libGeoModelXml's own internal calls and downstream consumers. Subtle libstdcxx-devel header drift between when geomodel was built and when consumers compile makes the class layout of std::__format::_Sink<char> diverge, crashing build_geometry inside Gmx2Geo on GitHub Actions (ShipSoft/Geometry#26) while passing on developer machines. Building geomodel with -fvisibility-inlines-hidden keeps these inline template instantiations local to each .so, so each consumer uses its own translation-unit-local copy compiled against its own contemporaneous libstdc++ headers — no cross-library ABI dependency on geomodel-shipped format internals. Build number bumped to 2 so rattler-build emits a fresh artifact.
All dependencies are now available from the prefix.dev/ship channel (via ship-conda-recipes), so CI no longer needs CVMFS mounts, the CERN container, or a self-hosted runner. The new workflow runs on ubuntu-latest with prefix-dev/setup-pixi and a single `pixi run test` step that configures, builds, and runs ctest.
1 participant
Summary
geomodel6.27.0 and its transitive closure:sqlite,xerces-c,nlohmann_json,eigen,geant4) are now published to thehttps://prefix.dev/shipchannel via ship-conda-recipes, so CI no longer needs CVMFS access.pixi.toml+ committedpixi.lockdefine the build environment (cxx-compiler,cmake,ninja,make,git,sqlite,geomodel) and three tasks:configure,build,test(the latter two depend on the former).ubuntu-latestwithprefix-dev/setup-pixi@v0.9.6and a singlepixi run teststep — dropping the self-hosted runner, theregistry.cern.ch/ship/gha-runnercontainer, the three CVMFS volume mounts, and the LCG_109 / GeoModel 6.24.0-local2sourcelines.Test plan
pixi install && pixi run teston a plain shell (no LCG/distrobox) — 160/160 build targets, 25/25 ctests pass in ~13 s.Build and Testjob runs onubuntu-latest, installs the pixi env from the lock file, builds, and exits 0.Summary by CodeRabbit