[martinothamar]

Outcome

A Microsandbox pin update can run its end-to-end tests, locally and in this repository's CI, while the fork's synchronization is still in review. Until now those tests could only start after the fork had published its release, because the runtime was installed from the release download. A fix the pin update turns out to need then went into another fork release, as happened with 0.7.8-digdir.2. Now it can go into the synchronization before it lands.

This is the mechanism decided in #279. It builds on digdir/microsandbox#5: every successful check run in the fork assembles the release files of the tree it built, keeps them as the release-<tree> artifact, and the fork's release later publishes exactly those files. So the bundle digests a pin update copies into client.rs are final before the release exists.

What changes

• AGENT_MICROSANDBOX_RUNTIME_DIR. When it names a directory, a Sandbox Provider installs the runtime from the platform's bundle in that directory instead of downloading the release. The bundle must still match the digest pinned in client.rs, so this only changes where the same bytes come from. A missing bundle is an error, not a fallback to the download. When the variable is unset, which it is in every release and normal use, nothing changes.
• sandbox/microsandbox/fetch-runtime.sh <directory> [commit]. It takes the Microsandbox commit pinned in Cargo.lock (or the given commit), finds the oldest successful check-digdir.yml run in digdir/microsandbox that built that commit's tree, the same run the fork's release takes its files from, and downloads that run's release-<tree> artifact. Then it verifies the files against their checksums.sha256 and prints each bundle's digest and whether client.rs pins it. It needs gh with read access.
• CI. The end-to-end job checks whether the pinned version's tag v<version> exists in digdir/microsandbox. The fork creates the tag when it publishes the release. If the tag is missing, the job runs the script and sets the variable before make test-e2e. For the current pin, 0.7.8-digdir.2, the tag exists, so the job behaves as before.
• sandbox/docs/microsandbox-upgrade.md gets a "Before the release" section with the steps for a pin update.

Steps for the next pin update

1. Pin the commit the fork's checks passed on, the tip of sync/digdir-X.Y.Z. When the synchronization lands, main-digdir moves to that same commit, so the pin stays valid.
2. Run sandbox/microsandbox/fetch-runtime.sh <directory> and copy the printed digests into client.rs.
3. Locally, set AGENT_MICROSANDBOX_RUNTIME_DIR=<directory> and run make check. In the pull request, CI does this itself.
4. If the synchronization changes, pin its new commit and repeat. Once the fork has released, rerun this pull request's checks, which then install the published runtime, and merge.

Evidence

Locally, with the artifact of main-digdir's tip 29be50d7, which has the same version as the current pin:

• The script found run 40199829576 for release-7199709b…, downloaded and verified it, and printed the 5 bundle digests as not pinned.
• runtime::retained_lifecycle_execution_files_and_volumes with the variable set:
  • pointing at a directory without the bundle, it fails with AGENT_MICROSANDBOX_RUNTIME_DIR has no Microsandbox runtime bundle …/microsandbox-linux-x86_64.tar.gz;
  • pointing at the downloaded bundles with the current digests, it fails with runtime archive SHA-256 mismatch: expected fde2297f…, got 59f570ba…;
  • with the Linux x86_64 digest temporarily set to 59f570ba…, it installs the runtime from the directory and passes.
• make fmt lint build test, shellcheck and actionlint pass.

In CI, see No secret needed.

No secret needed

A workflow's own token can download digdir/microsandbox's artifacts, since that repository is public. A temporary commit, since dropped, ran the script in this pull request's end-to-end job against 29be50d7: it found, downloaded and verified the artifact in 9 seconds with github.token.

Costs

The artifact is about 500 MB, of which 240 MB is the kernel source the fork publishes for the GPL. The script downloads it whole, because an artifact can only be downloaded as one zip. On a GitHub-hosted runner that takes about 9 seconds, and 3.5 minutes on this Agent's connection. Only pin updates whose version has no release yet pay it.

Part of #279.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 23c19731-aed6-4895-b645-8f121a00c201

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}