Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughThis change adds libvirt host provisioning, transient VM launchers, libvirt-backed Swarm lifecycle management, and Ubuntu 24.04/26.04 libvirt package builds. It also updates TDX, SEV-SNP, GRUB, workflow, tests, and operational documentation. ChangesLibvirt platform integration
Estimated code review effort: 5 (Critical) | ~120 minutes Merge Risk: ⚪ Minimal · up to No actionable merge-blocking risk remains; the PR is merge-ready after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant Operator
participant swarm-cluster.sh
participant start_super_protocol_libvirt.sh
participant libvirt_launcher.py
participant libvirt
Operator->>swarm-cluster.sh: start a named cluster domain
swarm-cluster.sh->>start_super_protocol_libvirt.sh: pass VM mode and resources
start_super_protocol_libvirt.sh->>libvirt_launcher.py: run preflight and launch
libvirt_launcher.py->>libvirt: validate capabilities and create transient domain
libvirt->>swarm-cluster.sh: provide domain state
swarm-cluster.sh->>libvirt: request shutdown or destroy after timeout
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Warning Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 12
🧹 Nitpick comments (11)
build/libvirt/Dockerfile.ubuntu24 (2)
12-19: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win
dpkg-parsechangeloganddpkg-buildpackageare not installed explicitly.
prepare-source.shcallsdpkg-parsechangelogandbuild-packages.shcallsdpkg-buildpackage. Both come fromdpkg-dev. The image relies ondpkg-devarriving as a transitive dependency ofdevscripts. Adddpkg-devto the explicit install list so the image does not break if that dependency chain changes.♻️ Proposed change
devscripts + dpkg-dev \ equivs \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/libvirt/Dockerfile.ubuntu24` around lines 12 - 19, Add dpkg-dev explicitly to the apt-get install list in the Dockerfile’s package installation step, alongside devscripts and the other build dependencies, so prepare-source.sh and build-packages.sh have dpkg-parsechangelog and dpkg-buildpackage available without relying on transitive dependencies.
1-26: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winThe two Dockerfiles are identical except for the base image tag. Every fix must be applied twice, which creates drift risk. A single parameterized Dockerfile removes the duplication.
build/libvirt/Dockerfile.ubuntu24#L1-L26: replace this file with a sharedDockerfile.ubuntuthat usesARG UBUNTU_VERSIONandFROM ubuntu:${UBUNTU_VERSION}.build/libvirt/Dockerfile.ubuntu26#L1-L26: delete this file after the shared Dockerfile exists.build/libvirt/build.sh#L144-L156: drop thedockerfilevariable from thecaseblock and pass--build-arg "UBUNTU_VERSION=${ubuntu_version}"with--file "${SCRIPT_DIR}/Dockerfile.ubuntu".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/libvirt/Dockerfile.ubuntu24` around lines 1 - 26, Replace build/libvirt/Dockerfile.ubuntu24 (lines 1-26) with shared build/libvirt/Dockerfile.ubuntu using an UBUNTU_VERSION argument and ubuntu:${UBUNTU_VERSION} base; delete build/libvirt/Dockerfile.ubuntu26 (lines 1-26). In build/libvirt/build.sh (lines 144-156), remove the dockerfile variable from the case block and invoke the shared Dockerfile with --file "${SCRIPT_DIR}/Dockerfile.ubuntu" and the UBUNTU_VERSION build argument.build/libvirt/README.md (1)
72-86: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAdd a pointer to the runtime requirements.
The document states that the build does not produce
python3-libvirt. The launcher inscripts/start_super_protocol_libvirt.shrequirespython3-libvirt,passt,acl, and libvirt >= 12.1.0 for GPU passthrough. A short note that links these packages to the host setup step helps operators install a complete set.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/libvirt/README.md` around lines 72 - 86, Update the build documentation near the package-output description to add a concise pointer to the host setup/runtime requirements. Reference scripts/start_super_protocol_libvirt.sh and note that operators must install python3-libvirt, passt, acl, and libvirt >= 12.1.0 for GPU passthrough.build/libvirt/docker/prepare-source.sh (2)
11-15: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low valueDrop the
.gitdirectory from the packaged source tree.
build-packages.shrunscp -a "${SOURCE_DIR}" "${work_dir}/libvirt"on every container start. The clone keeps.git, so each build copies the full Git metadata. Remove.gitafter the version check to reduce image size and copy time.♻️ Proposed change
cd "${SOURCE_DIR}" +rm -rf "${SOURCE_DIR}/.git" apt-get update🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/libvirt/docker/prepare-source.sh` around lines 11 - 15, Update the source preparation flow around the git clone and version check to remove the cloned repository’s .git directory from SOURCE_DIR after validating the version. Keep the source files intact so build-packages.sh can continue copying SOURCE_DIR into the package tree without Git metadata.
11-22: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin the packaging source to an immutable commit.
git clone --branch "${PACKAGING_REF}"resolves a tag on a third-party repository. A tag can be moved or replaced, so the build input is not reproducible. The changelog check at line 17 detects a version change only, not arbitrary content changes. Record the expected commit SHA and verify it after the clone.🛡️ Proposed hardening
git clone \ --branch "${PACKAGING_REF}" \ --depth 1 \ "${PACKAGING_REPOSITORY}" \ "${SOURCE_DIR}" + +if [[ -n "${PACKAGING_COMMIT:-}" ]]; then + actual_commit=$(git -C "${SOURCE_DIR}" rev-parse HEAD) + if [[ "${actual_commit}" != "${PACKAGING_COMMIT}" ]]; then + echo "Error: ${PACKAGING_REF} resolves to ${actual_commit}, expected ${PACKAGING_COMMIT}" >&2 + exit 1 + fi +fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/libvirt/docker/prepare-source.sh` around lines 11 - 22, Pin the clone in the source-preparation flow to a configured expected commit SHA rather than relying solely on the movable PACKAGING_REF tag or branch. After cloning, verify the checked-out commit matches that SHA and fail with an error if it does not; retain the existing changelog version validation..github/workflows/build-packages-self-hosted.yml (2)
62-95: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConfirm the archive path is excluded from the tar input.
The step writes
${archive_name}intobuild/libvirt/out/and then creates the tar from that same directory. The tar only adds${output_directory}, so the archive does not contain itself. This works, but a rerun leaves a stale.tar.gzin the output root. Consider writing the archive to${WORK_DIR}or${RUNNER_TEMP}instead.♻️ Proposed change
- archive_path="${WORK_DIR}/build/libvirt/out/${archive_name}" + archive_path="${RUNNER_TEMP}/${archive_name}"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-packages-self-hosted.yml around lines 62 - 95, Update the Build libvirt packages step to write archive_path outside build/libvirt/out, preferably under WORK_DIR or RUNNER_TEMP, while keeping the tar input directory and output_directory unchanged. Continue exporting the resulting archive path through LIBVIRT_ARCHIVE_PATH.
147-156: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win
actions/upload-release-asset@v1is archived and unmaintained.The repository for this action is archived, so it receives no security or Node runtime updates. The same applies to
actions/create-release@v1at line 115. Migrate both to a maintained action, for examplesoftprops/action-gh-release, or usegh release createandgh release uploadfrom the GitHub CLI.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-packages-self-hosted.yml around lines 147 - 156, Replace the archived actions/create-release@v1 and actions/upload-release-asset@v1 steps with a maintained release workflow, preferably softprops/action-gh-release or GitHub CLI commands. Preserve the existing release creation, upload URL usage, libvirt-ubuntu condition, archive path, asset name, content type, and GITHUB_TOKEN authentication.Source: Linters/SAST tools
build/libvirt/docker/build-packages.sh (2)
16-22: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueGuard the
/etc/os-releasevariables consistently.Line 18 sources the file with
set -uactive. Line 19 dereferences${ID}and${VERSION_ID}without a default, so the script aborts with an unbound-variable error instead of the intended message if either variable is absent. Line 20 already uses${VERSION_ID:-unknown}, which shows the intent. Line 37 has the same problem with${VERSION_CODENAME}.♻️ Proposed change
-if [[ "${ID}" != "ubuntu" || "${VERSION_ID}" != "${TARGET_UBUNTU_VERSION}" ]]; then +if [[ "${ID:-}" != "ubuntu" || "${VERSION_ID:-}" != "${TARGET_UBUNTU_VERSION}" ]]; then🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/libvirt/docker/build-packages.sh` around lines 16 - 22, Update the validation condition after sourcing /etc/os-release to use safe default expansions for ID and VERSION_ID, preserving the existing mismatch check and error message. Also update the VERSION_CODENAME reference around the later validation at line 37 to avoid unbound-variable failures under set -u, using the same guarding convention.
66-76: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse one parallel-build control
-jautotakes precedence overparallel=$(nproc)inDEB_BUILD_OPTIONS. Remove the duplicateparallelsetting and keepDEB_BUILD_OPTIONSfornocheckonly.♻️ Proposed change
-build_options="parallel=$(nproc)" +build_options="" if [[ "${SKIP_TESTS}" == "true" ]]; then - build_options="${build_options} nocheck" + build_options="nocheck"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/libvirt/docker/build-packages.sh` around lines 66 - 76, Update the build-options setup around DEB_BUILD_OPTIONS to stop adding parallel=$(nproc), since dpkg-buildpackage already receives -jauto. Keep DEB_BUILD_OPTIONS limited to the conditional nocheck value while preserving SKIP_TESTS validation and the existing dpkg-buildpackage invocation.scripts/start_super_protocol_libvirt.sh (2)
9-17: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftReduce the text coupling to
start_super_protocol.sh.The launcher sources the base script by deleting everything from the literal line
parse_args $@to the end. The guard at Line 9 detects a rename, but any reordering, added trailing helper function, or reformatting of that line silently changes what this launcher inherits. Extract the shared functions into a sourceable library file, and let both scripts source it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/start_super_protocol_libvirt.sh` around lines 9 - 17, Extract the shared release, validation, VFIO, and provider-config preparation functions from start_super_protocol.sh into a dedicated sourceable library, then update both start_super_protocol.sh and the launcher to source that library. Remove the grep/sed marker-based sourcing and ensure the launcher still excludes the original entrypoint and direct QEMU execution.
446-481: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRemove the nested function definition and use a trap on the loop variables.
create_vm_disksdefinescleanup_provider_diskinside itself at Line 459. Bash creates a global function on every call, and the function readsprovider_loopandprovider_mount, which arelocalto the caller. The code works today because the trap fires while those locals are in scope, but the pattern is fragile. Also,mountandcpfailures leave the loop device attached whenerrexittriggers before Line 474, and theRETURNtrap only fires on function return. Define the cleanup as a top-level helper that takes the loop device and mount point as arguments.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/start_super_protocol_libvirt.sh` around lines 446 - 481, Replace the nested cleanup_provider_disk definition inside create_vm_disks with a top-level cleanup helper that accepts the loop device and mount point as arguments. Trap cleanup using the current provider_loop and provider_mount values so failures in mount or cp also detach the loop and remove the temporary mount directory, while preserving the existing successful cleanup and trap removal behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@build/libvirt/build.sh`:
- Around line 158-161: Clean the existing output directory before rebuilding
packages so artifacts from prior runs cannot persist. Update the
output-directory setup around output_dir and mkdir -p to remove any existing
directory first, then recreate it before invoking build-packages.sh.
In `@build/libvirt/docker/build-packages.sh`:
- Around line 95-101: Update the artifact finalization block around the debs
array, sha256sum, and chown commands to handle empty .deb/.ddeb results without
reading stdin or failing on an empty glob. Only generate SHA256SUMS and chown
matching artifacts when they exist, and explicitly chown OUTPUT_DIR itself while
preserving ownership updates for generated files.
In `@docs/swarm.md`:
- Line 71: Update the Ubuntu support requirement in the libvirt launcher
prerequisite entry to include Ubuntu 24.04 and 26.04, and correct the README
anchor to match the documented heading instead of the current ubuntu-2604
fragment.
In `@scripts/bootstrap_snp.sh`:
- Around line 364-365: Update the bootstrap flow around check_os_version and
get_supported_ubuntu_version to stop immediately when
get_supported_ubuntu_version returns a nonzero status, preventing unsupported
Ubuntu releases from reaching firmware, kernel, or setup_libvirt_host
operations. Ensure the failure status is propagated rather than ignored.
In `@scripts/bootstrap_tdx.sh`:
- Around line 11-12: Update the bootstrap version-validation flow in
bootstrap_tdx.sh and bootstrap_snp.sh to check the status returned by
get_supported_ubuntu_version and immediately exit on unsupported releases,
including the setup_libvirt_host tdx path. Preserve the existing
supported-version behavior while ensuring Ubuntu 25.04 cannot continue after
validation failure.
In `@scripts/libvirt_launcher.py`:
- Around line 520-548: Move log_file initialization, stdin terminal setup, and
related local state into the try block that follows receiver.start() in
attach_serial_console, so every setup failure is covered by the existing finally
cleanup. Keep receiver startup before the try as requested, and ensure the
cleanup can safely handle setup failing before the log file or terminal state is
initialized.
- Around line 555-590: Serialize all access to the virStream object used by the
serial-console loop: coordinate the receiver thread’s recv() with the main
thread’s send() and finally-block abort() calls using a shared ownership
mechanism, or restructure the loop around a single stream-owning event loop.
Ensure shutdown can acquire that coordination without being blocked
indefinitely, and update the receiver lifecycle around the existing
receiver.join() flow so no concurrent stream operation remains.
In `@scripts/setup_libvirt_host.sh`:
- Around line 343-394: Check the return status of patch_libvirt_apparmor_profile
in configure_libvirt_apparmor and immediately return 1 when it fails, before
creating or installing the drop-in. Preserve the existing successful flow for
valid AppArmor profiles.
- Around line 259-286: Ensure sourced setup helpers propagate failures instead
of relying on caller errexit: in scripts/setup_libvirt_host.sh#L259-L286, add
explicit failure propagation to assert_no_running_libvirt_domains, wget,
verify_and_extract_libvirt_archive, prepare_libvirt_package_compatibility,
build_libvirt_package_plan, and assert_safe_apt_simulation; in
scripts/setup_libvirt_host.sh#L343-L394, propagate failure from
patch_libvirt_apparmor_profile; and in scripts/setup_libvirt_host.sh#L579-L641,
check python3 -c 'import libvirt', id libvirt-qemu, aa-status --enabled, virsh
uri, and systemctl is-active --quiet qgsd, emitting an error and returning
nonzero when any fails. In scripts/bootstrap_snp.sh#L364-L365 and
scripts/bootstrap_tdx.sh#L11-L12, make get_supported_ubuntu_version failures
exit, and ensure setup_libvirt_host sev-snp at scripts/bootstrap_snp.sh#L443 and
setup_libvirt_host tdx at scripts/bootstrap_tdx.sh#L51 cause the bootstrap to
fail when nonzero.
- Around line 247-257: Update the APT simulation flow that feeds
assert_safe_apt_simulation to run apt-get --simulate with LC_ALL=C, ensuring its
output consistently uses the Remv and downgraded tokens before validation. Keep
the existing safety checks in assert_safe_apt_simulation unchanged.
- Around line 579-641: Update verify_libvirt_host to explicitly check the
results of the python3 libvirt import, id libvirt-qemu, aa-status --enabled, and
virsh URI probe, returning 1 through libvirt_host_error with clear failure
messages when any probe fails. In the tdx branch, explicitly check systemctl
is-active --quiet qgsd and report the service failure before returning 1; do not
rely on the command being the function’s final statement.
In `@scripts/swarm-cluster.sh`:
- Around line 763-783: Add one final domain_alive check in the startup wait flow
after the tmux session disappears and before reporting launcher failure or
calling die. Return success and log that the domain is running when this
re-check succeeds; otherwise preserve the existing diagnostic output and failure
behavior.
---
Nitpick comments:
In @.github/workflows/build-packages-self-hosted.yml:
- Around line 62-95: Update the Build libvirt packages step to write
archive_path outside build/libvirt/out, preferably under WORK_DIR or
RUNNER_TEMP, while keeping the tar input directory and output_directory
unchanged. Continue exporting the resulting archive path through
LIBVIRT_ARCHIVE_PATH.
- Around line 147-156: Replace the archived actions/create-release@v1 and
actions/upload-release-asset@v1 steps with a maintained release workflow,
preferably softprops/action-gh-release or GitHub CLI commands. Preserve the
existing release creation, upload URL usage, libvirt-ubuntu condition, archive
path, asset name, content type, and GITHUB_TOKEN authentication.
In `@build/libvirt/docker/build-packages.sh`:
- Around line 16-22: Update the validation condition after sourcing
/etc/os-release to use safe default expansions for ID and VERSION_ID, preserving
the existing mismatch check and error message. Also update the VERSION_CODENAME
reference around the later validation at line 37 to avoid unbound-variable
failures under set -u, using the same guarding convention.
- Around line 66-76: Update the build-options setup around DEB_BUILD_OPTIONS to
stop adding parallel=$(nproc), since dpkg-buildpackage already receives -jauto.
Keep DEB_BUILD_OPTIONS limited to the conditional nocheck value while preserving
SKIP_TESTS validation and the existing dpkg-buildpackage invocation.
In `@build/libvirt/docker/prepare-source.sh`:
- Around line 11-15: Update the source preparation flow around the git clone and
version check to remove the cloned repository’s .git directory from SOURCE_DIR
after validating the version. Keep the source files intact so build-packages.sh
can continue copying SOURCE_DIR into the package tree without Git metadata.
- Around line 11-22: Pin the clone in the source-preparation flow to a
configured expected commit SHA rather than relying solely on the movable
PACKAGING_REF tag or branch. After cloning, verify the checked-out commit
matches that SHA and fail with an error if it does not; retain the existing
changelog version validation.
In `@build/libvirt/Dockerfile.ubuntu24`:
- Around line 12-19: Add dpkg-dev explicitly to the apt-get install list in the
Dockerfile’s package installation step, alongside devscripts and the other build
dependencies, so prepare-source.sh and build-packages.sh have
dpkg-parsechangelog and dpkg-buildpackage available without relying on
transitive dependencies.
- Around line 1-26: Replace build/libvirt/Dockerfile.ubuntu24 (lines 1-26) with
shared build/libvirt/Dockerfile.ubuntu using an UBUNTU_VERSION argument and
ubuntu:${UBUNTU_VERSION} base; delete build/libvirt/Dockerfile.ubuntu26 (lines
1-26). In build/libvirt/build.sh (lines 144-156), remove the dockerfile variable
from the case block and invoke the shared Dockerfile with --file
"${SCRIPT_DIR}/Dockerfile.ubuntu" and the UBUNTU_VERSION build argument.
In `@build/libvirt/README.md`:
- Around line 72-86: Update the build documentation near the package-output
description to add a concise pointer to the host setup/runtime requirements.
Reference scripts/start_super_protocol_libvirt.sh and note that operators must
install python3-libvirt, passt, acl, and libvirt >= 12.1.0 for GPU passthrough.
In `@scripts/start_super_protocol_libvirt.sh`:
- Around line 9-17: Extract the shared release, validation, VFIO, and
provider-config preparation functions from start_super_protocol.sh into a
dedicated sourceable library, then update both start_super_protocol.sh and the
launcher to source that library. Remove the grep/sed marker-based sourcing and
ensure the launcher still excludes the original entrypoint and direct QEMU
execution.
- Around line 446-481: Replace the nested cleanup_provider_disk definition
inside create_vm_disks with a top-level cleanup helper that accepts the loop
device and mount point as arguments. Trap cleanup using the current
provider_loop and provider_mount values so failures in mount or cp also detach
the loop and remove the temporary mount directory, while preserving the existing
successful cleanup and trap removal behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5c5266ce-9f52-4a11-a6f5-b06ba0ed5348
📒 Files selected for processing (21)
.github/workflows/build-packages-self-hosted.ymlREADME.mdbuild/libvirt/.dockerignorebuild/libvirt/Dockerfile.ubuntu24build/libvirt/Dockerfile.ubuntu26build/libvirt/README.mdbuild/libvirt/build.shbuild/libvirt/docker/build-packages.shbuild/libvirt/docker/prepare-source.shbuild/libvirt/out/.gitignoredocs/swarm.mdscripts/bootstrap_snp.shscripts/bootstrap_tdx.shscripts/common.shscripts/libvirt_launcher.pyscripts/setup_libvirt_host.shscripts/setup_snp.shscripts/setup_tdx.shscripts/start_super_protocol_libvirt.shscripts/swarm-cluster.shtests/test_libvirt_launcher.py
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
build/libvirt/Dockerfile.ubuntu (1)
3-4: 🔒 Security & Privacy | 🔵 Trivial | 🏗️ Heavy liftPin the Ubuntu base image for release builds.
The release workflow publishes packages built from
ubuntu:${UBUNTU_VERSION}, which is a mutable tag. Pin each Ubuntu version to a target-platform manifest digest, or enforce an accepted update policy before publishing artifacts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@build/libvirt/Dockerfile.ubuntu` around lines 3 - 4, Update the UBUNTU_VERSION base image reference in the Dockerfile to use an immutable target-platform manifest digest for release builds, or add the release workflow’s required accepted-update policy before publishing artifacts; preserve the configurable Ubuntu version while ensuring the resolved image cannot change unexpectedly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/libvirt_launcher.py`:
- Around line 521-526: Move the domain.openConsole call into the existing try
block in the console-stream setup, while retaining stream creation before it so
any openConsole failure reaches the existing finally cleanup and calls
stream.abort().
---
Nitpick comments:
In `@build/libvirt/Dockerfile.ubuntu`:
- Around line 3-4: Update the UBUNTU_VERSION base image reference in the
Dockerfile to use an immutable target-platform manifest digest for release
builds, or add the release workflow’s required accepted-update policy before
publishing artifacts; preserve the configurable Ubuntu version while ensuring
the resolved image cannot change unexpectedly.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 90cac448-a2dd-4ebc-a341-1a8b8756f46c
📒 Files selected for processing (14)
.github/workflows/build-packages-self-hosted.ymlbuild/libvirt/Dockerfile.ubuntubuild/libvirt/README.mdbuild/libvirt/build.shbuild/libvirt/docker/build-packages.shbuild/libvirt/docker/prepare-source.shdocs/swarm.mdscripts/bootstrap_snp.shscripts/bootstrap_tdx.shscripts/libvirt_launcher.pyscripts/setup_libvirt_host.shscripts/start_super_protocol.shscripts/start_super_protocol_libvirt.shscripts/swarm-cluster.sh
🚧 Files skipped from review as they are similar to previous changes (9)
- scripts/bootstrap_tdx.sh
- scripts/bootstrap_snp.sh
- build/libvirt/README.md
- build/libvirt/docker/build-packages.sh
- build/libvirt/build.sh
- scripts/start_super_protocol_libvirt.sh
- docs/swarm.md
- scripts/swarm-cluster.sh
- scripts/setup_libvirt_host.sh
1 participant
Summary by CodeRabbit
New Features
Improvements
Documentation