ci: use one fast required Dylint check

[zackees]

Removes the three OS-specific Dylint Full checks. The required Dylint aggregate now gates one Linux workspace pass plus policy, using the published Soldr Dylint 6.0.3/nightly-2026-05-28 tools already on main. This deliberately stops Dylint from compiling Windows/macOS-only cfg branches; the separate native build/test lanes remain. Validated the workflow contract suite (11 tests).

Summary by CodeRabbit

• CI and Testing
  • Dylint checks now run in a single Ubuntu job instead of across Linux, Windows, and macOS.
  • Updated workflow validation and integration tests to locate test binaries at runtime.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: FastLED/fbuild/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 3fd69671-1057-48c6-a285-ec5fcf27f2dd

📥 Commits

Reviewing files that changed from the base of the PR and between aee2825 and c3650c2.

📒 Files selected for processing (9)

• .github/workflows/dylint.yml
• ci/test_fractional_workflows.py
• crates/fbuild-cli/tests/ci_command.rs
• crates/fbuild-cli/tests/daemon_crash_recovery.rs
• crates/fbuild-cli/tests/lib_select.rs
• crates/fbuild-cli/tests/test_emu_exit_code.rs
• crates/fbuild-daemon/tests/legacy_daemon_transition.rs
• crates/fbuild-daemon/tests/port_recovery.rs
• crates/fbuild-daemon/tests/process_containment.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Dylint workflow now runs as a single Ubuntu job. CLI, daemon, and containment integration tests now read executable paths from runtime environment variables.

Changes

Dylint workflow

Layer / File(s)	Summary
Ubuntu Dylint job and validation .github/workflows/dylint.yml, ci/test_fractional_workflows.py	The workflow uses one ubuntu-latest Dylint job without a matrix. Allowlist, baseline, platform-boundary, formatting, and UI-test steps no longer use Ubuntu-only conditions. The source refresh uses find and -exec touch. The workflow test checks the runner and absence of a strategy.

Runtime integration-test binary paths

Layer / File(s)	Summary
Runtime binary path lookup crates/fbuild-cli/tests/ci_command.rs, crates/fbuild-cli/tests/daemon_crash_recovery.rs, crates/fbuild-cli/tests/lib_select.rs, crates/fbuild-cli/tests/test_emu_exit_code.rs, crates/fbuild-daemon/tests/legacy_daemon_transition.rs, crates/fbuild-daemon/tests/port_recovery.rs, crates/fbuild-daemon/tests/process_containment.rs	The tests obtain CLI, daemon, and containment executable paths with std::env::var instead of option_env!. They still fail if a required environment variable is unavailable.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to c3650

The workflow and integration-test changes are ready to merge after normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to c3650

The required check will no longer lint Windows- and macOS-only code under those platforms. Native build and test checks and a source-wide platform policy remain, but they do not provide the same custom-lint coverage. No exploit or credential expansion was established.

Retained concerns

• Medium · security · inferred: The required Dylint result now covers a Linux workspace lint pass, not Dylint compilation of Windows- and macOS-only branches. A change confined to those branches can therefore pass this aggregate without receiving the former platform-specific custom-lint pass; native checks are not equivalent lint checks.

Security review details

Security Blast Radius

• inferred — The changed control can affect custom-lint coverage of Windows- and macOS-specific workspace code across PRs. Evidence does not establish a changed production privilege, data-store boundary, or credential scope.

Security Findings and Attack Paths

• inferred — A contributor changing platform-only code could avoid the former platform-specific Dylint pass while satisfying the new aggregate if Linux lint and policy checks succeed. The native checks and source-wide platform scanner constrain this path; no exploitable code change or merge bypass was verified.

Trust Boundaries and Controls

• observed — The Dylint workflow grants its token contents-read permission. Its aggregate rejects failed or skipped prerequisite jobs rather than treating an incomplete lint run as success.

Hardening Proposals

• proposed — If custom-lint coverage of platform-only code is a required security property, retain targeted cross-platform lint runs or add an equivalent gate for those branches; native compilation and source-wide platform inventory do not establish equivalence for every custom lint.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: replacing multiple required Dylint checks with one fast required check.
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 8 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}