Add cross-platform template render checks in CI - #65
Conversation
Render every source template on each platform, not just Linux. A render-templates matrix (macOS/Ubuntu/Windows) renders each OS's own templates natively, and a render-templates-android job renders in a termux/termux-docker container since android has no hosted runner. Unify the render path on a single test:templates mise task: the hk render-templates hook and every CI leg call it (android dispatches through docker-run.sh + render-templates-termux.sh to the same task), so there is one definition of how templates render. Fix a latent externals fault this exposed: chezmoi ignored builds full source state, realizing every .chezmoiexternal (downloading archives, SSH-cloning gists) just to enumerate ignored targets. That passed only because the local cache was warm; a fresh checkout (CI) or the container would fetch and fail on missing certs / SSH keys. chezmoi has no flag to skip externals, so guard .chezmoiexternal with lintSkipExternals and trip it via --override-data on the one ignored call, keeping the check offline. Every template, including .chezmoiexternal, still renders full. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThis PR adds cross-platform CI jobs to render/lint chezmoi templates on macOS, Ubuntu, Windows, and Android/Termux (via Docker). It introduces mise task scripts, a Docker runner, a Termux renderer, a ChangesTemplate Render Lint Feature
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant CI as CI Workflow
participant TaskAndroid as mise-tasks/test/templates-android
participant Docker as scripts/docker-run.sh
participant Termux as scripts/render-templates-termux.sh
participant Task as mise-tasks/test/templates
participant Lint as scripts/lint-templates.sh
CI->>TaskAndroid: mise run test:templates-android
TaskAndroid->>TaskAndroid: check uname -o for Android
alt Native Android
TaskAndroid->>Task: mise run test:templates
else Non-Android
TaskAndroid->>Docker: run render-templates-termux.sh
Docker->>Termux: exec inside termux/termux-docker
Termux->>Termux: install chezmoi if missing
Termux->>Task: exec mise-tasks/test/templates
end
Task->>Lint: lint each *.tmpl file
Lint->>Lint: chezmoi ignored --override-data lintSkipExternals=true
Lint-->>Task: render/validate result
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Warning Review ran into problems🔥 ProblemsLinked repositories: Your configuration references 1 linked repositories, but your current plan allows 0. Analyzed ``, skipped Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
dca860c to
ce91f66
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 18: The workflow uses mutable action tags instead of commit SHAs, so
update each `uses:` reference in the CI workflow to a full pinned commit hash
and add the matching version comment where appropriate. Apply this to
`actions/checkout` and the `mise-setup` action entries so the references in the
workflow are immutable and can be traced back to a specific release.
- Line 21: The CI workflow is still pinned to the temporary mutable branch ref
for the shared mise setup action. Update the workflow entries that use
gtbuchanan/tooling/.github/actions/mise-setup in the render jobs to point back
to the stable shared-action ref once the EXDEV fix is available, so the workflow
no longer depends on fix-mise-setup-windows-exdev.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 25777022-930a-4426-ab0f-c758c5d090e3
⛔ Files ignored due to path filters (1)
hk.pklis excluded by!**/*.pkl
📒 Files selected for processing (9)
.github/workflows/ci.ymlAGENTS.mdhome/.chezmoiexternal.yaml.tmplmise-tasks/test/templatesmise-tasks/test/templates-androidmise.tomlscripts/docker-run.shscripts/lint-templates.shscripts/render-templates-termux.sh
📜 Review details
🧰 Additional context used
📓 Path-based instructions (2)
home/.chezmoiexternal.yaml.tmpl
📄 CodeRabbit inference engine (AGENTS.md)
home/.chezmoiexternal.yaml.tmpl: Keep the{{ if not (get . "lintSkipExternals") }}guard inhome/.chezmoiexternal.yaml.tmpl; do not remove it because lint relies on it to avoid realizing externals offline.
Add new Agent Skills by adding an entry inhome/.chezmoiexternal.yaml.tmplthat points to the skill archive.
Files:
home/.chezmoiexternal.yaml.tmpl
AGENTS.md
📄 CodeRabbit inference engine (CLAUDE.md)
AGENTS.md: Document agent responsibilities and capabilities in AGENTS.md
Maintain AGENTS.md as the source of truth for agent configuration and behavior documentation
Files:
AGENTS.md
🪛 LanguageTool
AGENTS.md
[uncategorized] ~183-~183: The official name of this software platform is spelled with a capital “H”.
Context: ...mise run test:templates-android); see .github/workflows/ci.yml. chezmoi ignored r...
(GITHUB)
🪛 zizmor (1.26.1)
.github/workflows/ci.yml
[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 35-35: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 38-38: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🔇 Additional comments (10)
home/.chezmoiexternal.yaml.tmpl (1)
2-7: LGTM!Also applies to: 123-123
scripts/lint-templates.sh (1)
61-71: LGTM!mise.toml (1)
38-41: LGTM!.github/workflows/ci.yml (1)
8-17: LGTM!Also applies to: 28-39
AGENTS.md (1)
178-192: LGTM!mise-tasks/test/templates (2)
1-17: LGTM!
18-25: 🎯 Functional Correctness
scripts/lint-templates.shalready targets POSIXsh, so invoking it withshis fine.> Likely an incorrect or invalid review comment.mise-tasks/test/templates-android (1)
1-15: LGTM!Detection via
uname -ofor Android, with a Docker fallback for non-Termux hosts, is a reasonable approach and consistent with the documented rationale (.chezmoi.osis unfakeable via GOOS).scripts/render-templates-termux.sh (1)
1-18: LGTM!Path resolution (Line 17) correctly derives the repo root relative to this script's location inside the container, and the git-free design matches the documented constraint about the read-only bind mount's
.git.scripts/docker-run.sh (1)
1-36: LGTM!Arch-to-tag mapping matches the actual
termux/termux-dockertags (aarch64,x86_64) available on Docker Hub, and the--privileged/read-only mount rationale is clearly documented.
1 participant
What
Render every source template on each platform in CI, not just Linux:
render-templatesmatrix (macos-latest,ubuntu-latest,windows-latest) renders each OS's own templates natively. Because the render step self-selects viachezmoi ignored, each runner exercises only the templates deployed on its OS — real coverage of each platform's own template branches, which the single-OSpre-commitjob can't give.render-templates-androidjob renders insidetermux/termux-docker(arch-matched → nativex86_64on the runner, no QEMU), since android has no hosted runner andchezmoi.oscan't be faked.Unified render path
Everything now routes through one
test:templatesmise task — the hkrender-templateshook and every CI leg call it. The android leg dispatches throughscripts/docker-run.sh+scripts/render-templates-termux.shback to the same task, so there is a single definition of how templates render (following theclaude-code-termuxscript +mise-tasks/pattern).Externals fix
This exposed a latent fault:
chezmoi ignoredbuilds full source state, which realizes every.chezmoiexternalentry — downloading archives and SSH-cloning gists — merely to enumerate ignored targets. It only passed locally because the external cache was warm; a fresh checkout (CI) or the container would fetch and fail on missing CA certs / SSH keys.chezmoi has no flag to suppress this (
--refresh-externals=neveronly governs re-fetching a cached one;--exclude=externalsfilters output but still fetches — both verified). Sohome/.chezmoiexternal.yaml.tmplnow carries a{{ if not (get . "lintSkipExternals") }}guard thatlint-templates.shtrips via--override-dataon the singleignoredcall, keeping the check offline.get(not.field/hasKey) is a safe value-based read under chezmoi'smissingkey=error. Normalchezmoi applynever sets the key, so externals deploy unchanged, and every template — including.chezmoiexternalitself — still renders in full.Verification
termux-dockercontainer both pass offline (exit 0, correctly skipping non-platform templates).render-templates,verify-mise,shellcheck,shfmt, andactionlintall green.Documented in
AGENTS.md(Template Render Lint).🤖 Generated with Claude Code