Use native Depot runner registry auth - #20
Conversation
📝 WalkthroughWalkthroughThe release workflow now uses conditional, architecture-specific Depot runners with pre-authenticated registry access. It validates the Depot organization, removes per-job registry login steps, and updates documentation and tests for the new authentication flow. ChangesDepot runner authentication
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
tests/release-workflow.test.ts (1)
90-101: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAssert the routing contract, not only marker strings.
The test checks an error message and broad substrings. It does not prove the expected
DEPOT_ORG_IDcomparison, thearm64todepot-ubuntu-24.04-armmapping, or fallback for a non-main or non-release context. The current runner assertion also matches the ARM label becausedepot-ubuntu-24.04is a substring.Assert the exact identity comparison, both architecture branches, and at least one negative trust-boundary case.
Suggested assertions
+assert.match( + packageJob, + /\[\[ "\$\{DEPOT_ORG_ID:-\}" == 1ntz5vlngn \]\]/, +); for (const job of [packageJob, dry, stage]) { + assert.match( + job, + /fromJSON\(inputs\.row_json\)\.arch == 'arm64'[\s\S]*'depot-ubuntu-24\.04-arm'[\s\S]*'depot-ubuntu-24\.04'/, + ); assert.match(job, /depot-ubuntu-24\.04/); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/release-workflow.test.ts` around lines 90 - 101, Strengthen the routing assertions in the release workflow test around the existing packageJob, dry, and stage checks: verify the exact DEPOT_ORG_ID identity comparison, assert both amd64 and arm64 runner mappings including depot-ubuntu-24.04-arm, and add a negative case covering non-main or non-release context. Replace the broad depot-ubuntu-24.04 substring check with an assertion that cannot also match the ARM label, while preserving the existing forbidden credential checks.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/package-image-row.yml:
- Around line 269-282: Add the Depot runner identity validation to both the
dry-image and stage-image jobs before their registry/cache-dependent
depot/build-push-action steps, and gate it on
needs.package.outputs.registry_cache_selected == 'true'. Reuse the existing
DEPOT_ORG_ID check from deps, fail closed on a mismatch, and ensure the
validation runs before either job can access cached bases.
---
Nitpick comments:
In `@tests/release-workflow.test.ts`:
- Around line 90-101: Strengthen the routing assertions in the release workflow
test around the existing packageJob, dry, and stage checks: verify the exact
DEPOT_ORG_ID identity comparison, assert both amd64 and arm64 runner mappings
including depot-ubuntu-24.04-arm, and add a negative case covering non-main or
non-release context. Replace the broad depot-ubuntu-24.04 substring check with
an assertion that cannot also match the ARM label, while preserving the existing
forbidden credential checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b11a36c2-7e87-45e7-a877-08b0072ca944
📒 Files selected for processing (3)
.github/workflows/package-image-row.ymldocs/publishing.mdtests/release-workflow.test.ts
| runs-on: >- | ||
| ${{ | ||
| vars.DEPOT_REGISTRY_CACHE_ENABLED == 'true' | ||
| && github.repository == 'Mesh-LLM/mesh-packaging' | ||
| && github.ref == 'refs/heads/main' | ||
| && github.workflow_ref == 'Mesh-LLM/mesh-packaging/.github/workflows/images-release.yml@refs/heads/main' | ||
| && (github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch') | ||
| && ( | ||
| fromJSON(inputs.row_json).arch == 'arm64' | ||
| && 'depot-ubuntu-24.04-arm' | ||
| || 'depot-ubuntu-24.04' | ||
| ) | ||
| || fromJSON(fromJSON(inputs.row_json).runner_labels) | ||
| }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate file =="
git ls-files | rg '(^|/)\package-image-row\.ya?ml$|(^|/)\package-image-row\.ya?ml$' || true
echo "== file lines around concern =="
if [ -f .github/workflows/package-image-row.yml ]; then
wc -l .github/workflows/package-image-row.yml
sed -n '230,320p' .github/workflows/package-image-row.yml
echo "== lines around 340-405 =="
sed -n '340,410p' .github/workflows/package-image-row.yml
fi
echo "== DEPOT_ORG_ID and registry cache references =="
rg -n "DEPOT_ORG_ID|DEPOT_REGISTRY_CACHE_ENABLED|registry_cache_selected|runtime_base_image|dry-image|stage-image|packages: write|attestations: write" .github/workflows/package-image-row.yml .github/workflows || true
echo "== workflow jobs overview =="
python3 - <<'PY'
from pathlib import Path
p=Path(".github/workflows/package-image-row.yml")
if p.exists():
text=p.read_text()
lines=text.splitlines()
in_jobs=False
for i,l in enumerate(lines,1):
if l.rstrip()=="jobs:":
in_jobs=True
continue
if in_jobs and l and not l.startswith(" ") and not l.startswith("\t") and l.endswith(":"):
job=l.rstrip().rstrip(":")
print(f"{i}: job={job}")
# print next 40 lines indented for job
for j in range(i+1, min(len(lines), i+70)+1):
print(f" {j}: {lines[j-1]}")
if lines[j-1].rstrip() and not lines[j-1].startswith(" ") and not lines[j-1].startswith("\t") and j>i+1:
break
PYRepository: Mesh-LLM/mesh-packaging
Length of output: 15103
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== deps package job =="
sed -n '1,160p' .github/workflows/package-image-row.yml
echo "== dry-image remaining steps =="
sed -n '300,345p' .github/workflows/package-image-row.yml
echo "== stage-image full step block =="
sed -n '420,530p' .github/workflows/package-image-row.yml
echo "== all Depot steps and RUNTIME_BASE_IMAGE usage =="
python3 - <<'PY'
from pathlib import Path
for path in [Path(".github/workflows/package-image-row.yml"), Path(".github/workflows/images-release.yml")]:
if not path.exists():
continue
lines=path.read_text().splitlines()
print(f"FILE {path}")
for i,l in enumerate(lines,1):
if "depot/" in l or "RUNTIME_BASE_IMAGE" in l or "runtime_base_image" in l or "DEPOT_ORG_ID" in l or "registry_cache_selected" in l:
start=max(1,i-5); end=min(len(lines),i+8)
print(f"-- around line {i} --")
for j in range(start,end+1):
print(f"{j}: {lines[j-1]}")
PY
echo "== repo dependency files =="
git ls-files | rg '(^|/)(package(-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|tsconfig\.json)$|\.gitmodules$' || trueRepository: Mesh-LLM/mesh-packaging
Length of output: 41026
🌐 Web query:
Depot GitHub Actions runners assigned per job workflow DEPOT_ORG_ID documentation
💡 Result:
In Depot GitHub Actions runners, the DEPOT_ORG_ID is automatically set and managed by the system for jobs running on Depot infrastructure [1]. You do not need to manually assign or configure this environment variable in your GitHub Actions workflow file to "assign" a job to a Depot runner [2][3]. To use Depot runners, you simply change the runs-on label in your workflow YAML file to the appropriate Depot-provided label (e.g., runs-on: depot-ubuntu-24.04) [4][2][5]. Key points regarding DEPOT_ORG_ID and Depot Runners: * Automatic Configuration: When a job runs on a Depot GitHub Actions runner, the runner environment is pre-configured with necessary variables, including DEPOT_ORG_ID, automatically [1]. * Usage: DEPOT_ORG_ID is primarily used by the infrastructure to provide context for services like Depot Cache, Turborepo remote caching, or when using specific CLI tools that require identification of the organization [1][6][7][8]. * Manual Assignment: Manual configuration of DEPOT_ORG_ID is generally not required for standard runner operation [2]. If you are using specific integrations—such as configuring local cache tools like Gradle, Bazel, or sccache outside of the automatically configured runner environment—you might need to reference the DEPOT_ORG_ID, which can be found in your Depot dashboard under organization settings [6][7][8]. * Workflow Setup: To enable the runners, you connect your GitHub organization to Depot via the Depot dashboard and install the Depot GitHub App [4][5][3]. Once connected, the runner infrastructure handles the registration and job execution dynamically [3]. For detailed configuration of runner sizes or specific OS types, you should use the designated single-label format, such as depot-ubuntu-24.04-4, rather than attempting to inject organization identifiers manually [5].
Citations:
- 1: https://depot.dev/docs/environment-variables
- 2: https://github.com/depot/docs/blob/main/content/github-actions/overview.mdx
- 3: https://depot.dev/blog/depot-github-actions-runners
- 4: https://depot.dev/docs/github-actions/quickstart
- 5: https://github.com/depot/skills/blob/main/skills/depot-github-runners/SKILL.md
- 6: https://depot.dev/docs/cache/integrations/gradle
- 7: https://depot.dev/docs/cache/integrations/bazel
- 8: https://depot.dev/docs/cache/integrations/sccache
Add a Depot runner identity check to the image jobs when using pull-through cache.
deps checks DEPOT_ORG_ID, but Depot runners are selected per job and dry-image / stage-image also select Depot runners independently. Gate the check on needs.package.outputs.registry_cache_selected == 'true' and fail closed before either job starts the registry/cache-dependent depot/build-push-action so later jobs cannot use cached bases from an unexpected runner.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/package-image-row.yml around lines 269 - 282, Add the
Depot runner identity validation to both the dry-image and stage-image jobs
before their registry/cache-dependent depot/build-push-action steps, and gate it
on needs.package.outputs.registry_cache_selected == 'true'. Reuse the existing
DEPOT_ORG_ID check from deps, fail closed on a mismatch, and ensure the
validation runs before either job can access cached bases.
1 participant
Summary
Validation
Summary by CodeRabbit
Improvements
Documentation