Skip to content

Suppress developer mode warnings in CI - #24220

Merged
p-linnane merged 1 commit into
mainfrom
developer-ci-environment
Oct 10, 2026
Merged

p-linnane merged 1 commit into
mainfrom
developer-ci-environment

Conversation

@p-linnane

Copy link
Copy Markdown
Contributor

CI jobs that run developer commands without HOMEBREW_DEVELOPER warn that developer mode has been automatically turned on. The developer automation jobs in sorbet.yml, spdx.yml, sponsors-maintainers-man-completions.yml, vendor-gems.yml and vendor-version.yml now set it at job level, while the Docker workflow and Dockerfile set it only on the commands that need it. copilot-setup-steps.yml runs brew developer on instead, because Copilot ignores job-level env. The Docker image itself still ships without developer mode.


  • Have you followed our Contributing guidelines?
  • Have you checked for other open Pull Requests for the same change?
  • Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
  • Have you explained why you'd like these changes included, not just what they do?
  • For bug fixes, have you given step-by-step brew commands to reproduce the bug?
  • Have you written new tests (excluding integration tests)? Here's an example.
  • Have you successfully run brew lgtm (style, typechecking and tests) locally?

  • I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

GPT-6 Astra drafted the changes and ran brew lgtm, actionlint, offline zizmor, a scope check confirming the workflows are otherwise unchanged and a smoke test of the warning and brew developer on with real commands in a disposable clone. Claude Code (Opus 5.5) reviewed them, rerunning that smoke test, checking that every developer command in the affected workflows is covered and confirming against GitHub's documentation that Copilot ignores job-level env. I reviewed the diff.


Signed-off-by: Patrick Linnane <patrick@linnane.io>
@coderabbitai

coderabbitai Bot commented Oct 10, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 225e8bec-2287-4b5b-8125-a05dc32b875b

📥 Commits

Reviewing files that changed from the base of the PR and between 6971647 and a4c0ff2.


📒 Files selected for processing (8)
  • .github/workflows/copilot-setup-steps.yml
  • .github/workflows/docker.yml
  • .github/workflows/sorbet.yml
  • .github/workflows/spdx.yml
  • .github/workflows/sponsors-maintainers-man-completions.yml
  • .github/workflows/vendor-gems.yml
  • .github/workflows/vendor-version.yml
  • Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.


📜 Recent review details
⏰ Context from checks skipped due to timeout. (24)
  • GitHub Check: docker (x86_64 Ubuntu 26.04)
  • GitHub Check: docker (arm64 Ubuntu 26.04)
  • GitHub Check: docker (arm64 Ubuntu 24.04)
  • GitHub Check: docker (x86_64 Ubuntu 24.04)
  • GitHub Check: tests (load-only macOS)
  • GitHub Check: tests (generic OS, 1/2)
  • GitHub Check: tests (Linux, 1/2)
  • GitHub Check: tests (macOS, 1/2)
  • GitHub Check: tests (online, 2/2)
  • GitHub Check: tests (Linux, 2/2)
  • GitHub Check: tests (generic OS, 2/2)
  • GitHub Check: tests (no Sorbet)
  • GitHub Check: tests (online, 1/2)
  • GitHub Check: tests (load-only Linux)
  • GitHub Check: tests (macOS, 2/2)
  • GitHub Check: syntax
  • GitHub Check: check-vendor-version
  • GitHub Check: workflow_syntax
  • GitHub Check: vendor-gems
  • GitHub Check: docs
  • GitHub Check: copilot-setup-steps
  • GitHub Check: Analyze
  • GitHub Check: vendor-gems
  • GitHub Check: tapioca

🔇 Additional comments (8)
.github/workflows/copilot-setup-steps.yml (1)

25-27: LGTM!


.github/workflows/docker.yml (1)

193-193: LGTM!


Dockerfile (1)

104-104: LGTM!


.github/workflows/sorbet.yml (1)

30-31: LGTM!


.github/workflows/spdx.yml (1)

24-25: LGTM!


.github/workflows/sponsors-maintainers-man-completions.yml (1)

33-34: LGTM!


.github/workflows/vendor-gems.yml (1)

36-37: LGTM!


.github/workflows/vendor-version.yml (1)

19-20: LGTM!



📝 Summary

Summary by CodeRabbit

  • Chores
    • Updated automated build, test, and maintenance tasks to run with Homebrew developer mode enabled. Container setup also uses this setting when installing development gems. These changes affect internal project workflows and do not add or change user-facing features.

Walkthrough

The Dockerfile and several CI workflows now enable Homebrew developer mode for specified commands or jobs.

Changes

Homebrew developer mode

Layer / File(s) Summary
Build and gem setup
.github/workflows/copilot-setup-steps.yml, .github/workflows/docker.yml, Dockerfile
The Copilot setup workflow enables developer mode before installing Bundler gems. The Docker workflow and Dockerfile set HOMEBREW_DEVELOPER=1 for their respective commands.
Workflow job environments
.github/workflows/sorbet.yml, .github/workflows/spdx.yml, .github/workflows/sponsors-maintainers-man-completions.yml, .github/workflows/vendor-gems.yml, .github/workflows/vendor-version.yml
The Tapioca, SPDX, updates, vendor-gems, and vendor-version jobs set HOMEBREW_DEVELOPER=1.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: mikemcquaid


Merge Risk | ⚪ Minimal · up to a4c0f

Merge Risk: ⚪ Minimal · up to a4c0f

Developer mode is enabled in the intended setup commands and five CI jobs. No concrete merge-blocking issue is established, so the change appears ready to merge.

Security Architecture Review

Security architecture risk: 🔵 Low · up to a4c0f

The Docker change remains build-local, and no introduced attack path was established. However, developer mode changes more than warnings, and its effects inside external CI setup steps remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • observed — The changed environment applies within existing build and automation authority. Some affected jobs already receive signing or repository-write credentials; the PR does not change their declared permissions or credential scopes.

Trust Boundaries and Controls

  • inferred — The inspected Docker gem-install implementation does not invoke formula or cask path loaders. Although job-wide developer mode changes their default admission policy, the visible workflow commands do not establish an attacker-controlled path into those loaders. External setup-action behavior remains unverified.

Hardening Proposals

  • proposed — If these automation jobs do not require local package definitions, explicitly preserve the package-path prohibition or limit developer mode to the commands that need it. This would constrain the broader configuration effect; it is not a verified exploit finding.

Pre-merge checks | Passed 4
✅ Passed checks (4 passed)
Check name Status Explanation
Title check Passed The title clearly and concisely describes the main change: suppressing Homebrew developer mode warnings in CI.
Description check Passed The description directly explains how the workflows and Dockerfile set developer mode to suppress CI warnings, including the reason for different configurations.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@MikeMcQuaid MikeMcQuaid left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@p-linnane
p-linnane enabled auto-merge October 10, 2026 20:39
@p-linnane
p-linnane added this pull request to the merge queue Oct 10, 2026
Merged via the queue into main with commit f2996fc Oct 10, 2026
61 checks passed
@p-linnane
p-linnane deleted the developer-ci-environment branch October 10, 2026 21:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants