Repository navigation
fix(ci): pin the working Tirith scanner - #1819
Conversation
Tirith 0.4.2 blocks the existing workflow bodies with incomplete-analysis findings, so unrelated pull requests never reach the test jobs. Pin the previously passing 0.3.1 package independently of the main nixpkgs input and use it in both CI and the dev shell.
|
@coderabbitai @cubic-dev-ai Please review the scanner version pin and CI/dev-shell consistency, including the explicitly deferred Tirith 0.4 workflow rules. |
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review. 📝 WalkthroughWalkthroughThe flake adds a pinned nixpkgs input and exposes its tirith package. The development shell includes that package, and CI installs it from the flake. Renovate disables updates for the pinned input. ChangesTirith package setup and use
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~8 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The Renovate rule protects the Tirith pin, and the supplied evidence identifies no actionable merge-blocking issue. The change appears ready for normal checks. Architecture SummaryArchitecture risk: 🔵 Low · up to The change affects 2 systems. Changed systems: Architecture concerns Review detailsSystems and components
Before / after behavior
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@ryoppippi I have started the AI code review. It will take a few minutes to complete. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
ccusage-guide | dcb00a1 | Commit Preview URL Branch Preview URL |
Oct 02 2026, 06:14 PM |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 5 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
ℹ️ Minor suggestions only — the pin restores the gate, but automation can silently undo it.
Reviewed changes Reviewed the single-commit Tirith 0.3.1 pin against main.
- Pinned scanner input — adds a
tirith-nixpkgsflake input at nixpkgs rev91cc1fdfso the scanner stays put while the mainnixpkgsinput floats. - Shared flake package — new
nix/tirith.nixexposespackages.tirithfrom the pinned input and wires it into the flake imports and the dev shell. - CI and shell parity —
ci.yamlnow installs.#tirithfrom the flake instead ofnixpkgs#tirith, so CI scans with the same package developers get.
muse-spark-1.3-contributor (free via Pullfrog for OSS) ｜ 𝕏
|
@coderabbitai @cubic-dev-ai Please review dcb00a1, which protects the scanner pin from Renovate. The ARM macOS dev shell was also built successfully; the platform-validation thread has the exact verification details. |
@ryoppippi I have started the AI code review. It will take a few minutes to complete. |
ccusage
@ccusage/ccusage-darwin-arm64
@ccusage/ccusage-darwin-x64
@ccusage/ccusage-linux-arm64
@ccusage/ccusage-linux-x64
@ccusage/ccusage-win32-x64
commit: |
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes Reviewed the delta since the prior pullfrog review (b2871d0 → dcb00a1).
- Protected the scanner pin — added a
packageRulesentry in.github/renovate.jsondisabling updates for thetirith-nixpkgsinput under thenixmanager. - Left runtime behavior untouched — no changes to the flake package, dev shell, or CI install in this delta; prior pin behavior stands.
Prior feedback on Renovate automerge protection and multi-platform evaluation is addressed by this delta and the author's confirmations.
muse-spark-1.3-contributor (free via Pullfrog for OSS) ｜ 𝕏
ccusage performance comparisonPR SHA: Performance comparison skipped. Base package URL was not ready before 300.000s. Fixture performance comparison requires a base package when --base-dir is not provided. Base package: |
ccusage performance comparisonPR SHA: Performance comparison skipped. Base package URL was not ready before 300.000s. Fixture performance comparison requires a base package when --base-dir is not provided. Base package: |
|
|
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
git show --format=fuller --stat dcb00a1a
git show --format= --no-ext-diff dcb00a1a
for file in .github/renovate.json flake.nix nix/tirith.nix nix/dev-shell.nix .github/workflows/ci.yaml; do
printf '\n--- outline: %s ---\n' "$file"
ast-grep outline "$file" || true
done
printf '\n--- PR description and comments ---\n'
gh pr view 1819 --repo ccusage/ccusage --json body,comments
printf '\n--- Review comments ---\n'
gh api --paginate repos/ccusage/ccusage/pulls/1819/comments --jq '.[] | {user: .user.login, path, line, body, html_url}'Length of output: 26746 🏁 Script executed: #!/bin/bash
set -euo pipefail
for file in .github/renovate.json flake.nix nix/tirith.nix nix/dev-shell.nix; do
printf '\n--- %s ---\n' "$file"
cat -n "$file"
done
printf '\n--- scanner workflow ---\n'
rg -n -C12 'tirith|sarif|fail-on|snapshot' .github/workflows/ci.yaml
printf '\n--- locked inputs ---\n'
jq '{root: .nodes.root.inputs, main: .nodes.nixpkgs, tirith: .nodes["tirith-nixpkgs"]}' flake.lock
printf '\n--- current PR checks ---\n'
gh pr view 1819 --repo ccusage/ccusage --json headRefOid,statusCheckRollup --jq '{headRefOid, checks: [.statusCheckRollup[] | {name, status, conclusion, detailsUrl}]}'Length of output: 28147 🤖 web_search executed:
Length of output: 1531
I did not rerun builds in the inspection sandbox. The performance-comment jobs were still running when I checked. You are interacting with an AI system. |
ccusage performance comparisonPR SHA: Performance comparison skipped. Base package URL was not ready before 300.000s. Fixture performance comparison requires a base package when --base-dir is not provided. Base package: |
ccusage performance comparisonPR SHA: Performance comparison skipped. Base package URL was not ready before 300.000s. Fixture performance comparison requires a base package when --base-dir is not provided. Base package: |
Tirith 0.4.2 now blocks the repository's existing workflow bodies with
analysis_incompletefindings and flags the deliberately base-only PR gate. This stops unrelated open pull requests before the test jobs run. Pin the previously passing Tirith 0.3.1 through a separate Nix input and install the same flake package in CI and the dev shell, while leaving the main nixpkgs input current. Disable Renovate updates for this input so the pin only moves deliberately.The
highfailure threshold, snapshot exclusion, and SARIF publication remain in place. This restores the existing hidden-content scan; the workflow-analysis rules added in 0.4 are deferred until the workflows can be modeled reliably.Validation:
just fmtand commit/push hooks pass.nix build .#devShells.aarch64-darwin.default --no-linksucceeds.nix flake check. Full localnix flake check --no-buildencountered an invalid local Nix source-store path that did not reproduce in GitHub CI.