Repository navigation
Bump the CI Nix installer to 2.35.3 - #208
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe CI workflow now pins the Nix installer to version 2.35.3 with its matching SHA-256 digest. Comments distinguish the installer version from the action version and note manual updates for Nix security releases. ChangesCI Nix installer
Priority: ➖ Normal Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes the main change: updating the CI Nix installer to version 2.35.3. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the Nix pin,
Then hops past the old version.
A fresh digest joins the line,
The comments keep the versions clear.
The workflow is set to 2.35.3,
And the rabbit bounds away.
Comment @coderabbitai help to get the list of available commands.
The nix job downloads and sha256-verifies the Nix installer itself, then passes
install_url: file://$RUNNER_TEMP/nix-installto install-nix-action. SoNIX_VERSIONin this workflow selects the nix version, and the action does not.That means the install-nix-action 31.11.1 to 31.11.2 bump (#207) changed nothing: 31.11.2's entire content was nix 2.35.2 to 2.35.3, which fixes a set of vulnerabilities that combine into root privilege escalation. CI kept installing 2.35.2.
This applies that bump where it actually takes effect, and adds a comment recording the coupling so the next action bump is not mistaken for a nix upgrade.
Exposure was low: an ephemeral single-tenant runner, where local root gains an attacker little. Worth fixing because it is two lines and the previous state read as patched without being patched.
Verification
69d0fe8fba8fe88f94c98b09964691ac9950abc7ecbf2ba861dc0533cfd901e9is the publishedinstall.sha256for 2.35.3, checked againstreleases.nixos.orgrather than taken from a changelog.Ran this workflow's exact bootstrap locally with the values read back out of the file:
sha256sum -creportedOK, and the fetched installer self-reportsnix-2.35.3, so the digest matches the intended artifact and not merely some artifact. Thenix package buildjob exercises the same check.Summary by CodeRabbit