You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
ci: use ubuntu-slim for lightweight lint jobs - #302
Move Lint / rustfmt and GitHub Actions Security (no matrices) to ubuntu-slim. Use the existing official checkout pin for this GitHub runner. Formatting does not compile the workspace. Keep test/MSRV, Clippy feature powersets, coverage, rustdoc builds, release, and preview deployment on their current runners. Main now pins zizmor-action v0.8.0, which downloads a hash-verified binary wheel with Python and pip instead of Docker; this job also moves to slim. Python and pip are installed on slim. The reusable MSRV reader owns its runner upstream.
GitHub documents slim for public/private repositories: x64, 1 CPU, 5 GB RAM, 14 GB storage, 15-minute timeout, unprivileged container. Docker-in-Docker and privileged operations are unsupported. The image includes Bash, Git, curl, tar, and Node; Rust is not preinstalled. The pinned Rust setup action bootstraps rustup when absent.
Validation: prettier --check .github/workflows/lint.yml passed; zizmor --offline .github/workflows/lint.yml passed (five existing suppressions). The justfile check includes unrelated Rust compilation and its imported .toolchain/rust.just is absent in this checkout, so focused installed tools were used. No test or permission changes.
Measurements (execution only: job completed_at minus started_at; queue excluded):
Baseline n=3, median=17 seconds. Historical comparison, not same-code and not GitHub standard runner: Blacksmith is the existing provider. Rust cache defaults remain enabled; cache hits are unverified. Nightly version, image software, checkout implementation, network and cache state can confound results. Queue time not measured. Slim n=0, median and 100*(slim/base-1) pending; no runtime compatibility claim yet. No deployment or release reruns will be requested for measurements.
Update after merging main: preserved current action pins and all other main changes. The previous head f0b1b76 had no Actions runs because the PR conflicted; the only check was skipped CodeRabbit. This is not a successful slim sample.
GitHub Actions Security historical baseline (same run URLs and SHAs as the table above, in the same order): 16, 13, 14 seconds; n=3, median=14 seconds, all successful on blacksmith-2vcpu-ubuntu-2404. No explicit job cache; download/network and historical action-version differences are possible confounders. Slim n=0; median and percentage change pending. Queue time excluded. No runtime compatibility failures observed because no slim execution evidence is available yet. Main's Rust setup v2.0.0 still bootstraps rustup when absent. Focused Prettier and offline zizmor checks pass after conflict resolution and the additional security-job runner change.
First slim execution: https://github.com/x52dev/serde-utils/actions/runs/41637138416/attempts/1, head 8815f0b. Lint/rustfmt succeeded in 23 seconds (12:36:30–12:36:53 UTC); Lint/GitHub Actions Security succeeded in 12 seconds (12:36:29–12:36:41 UTC). Both used ubuntu-slim, no matrix. Rustfmt restored an exact Rust cache match (~5 MB); nightly was 1.101.0-nightly (2026-11-02). Security has no explicit cache. With n=1 each, provisional slim medians are 23 and 12 seconds: +35.3% and -14.3% against historical Blacksmith medians 17 and 14. These are not controlled same-code comparisons. Execution excludes scheduling: jobs started 4 and 3 seconds after workflow creation respectively; those delays include scheduling/setup and are not pure queue measurements. No slim failures observed. A second attempt of only Lint was requested; no deployment workflow was rerun for measurement.
Second slim sample: https://github.com/x52dev/serde-utils/actions/runs/41637138416/attempts/2, same head 8815f0b and ubuntu-slim labels. Security succeeded in 10 seconds (12:37:47–12:37:57 UTC); rustfmt succeeded in 41 seconds (12:37:47–12:38:28 UTC). Execution only; queue excluded. Samples so far: rustfmt [23,41], security [12,10]. Required checks and all executed checks passed; CodeRabbit skipped. Third and final Lint-only sample requested; no preview or release reruns requested.
Attempt 3 job URLs: https://github.com/x52dev/serde-utils/actions/runs/41637138416/job/125922670386 (rustfmt 12:39:55–12:40:32 UTC) and https://github.com/x52dev/serde-utils/actions/runs/41637138416/job/125922670709 (security 12:39:59–12:40:21 UTC). All slim rustfmt samples restored the same exact Rust cache key and used nightly 2026-11-02. Security has no explicit cache. Historical baseline cache hits remain unverified. These results compare historical Blacksmith jobs with current slim jobs, not a controlled GitHub standard-runner experiment; different SHAs, action versions, images, nightly versions, downloads, and cache states can affect results. Durations exclude queue time; no pure queue measurement is available. Rustfmt remains a lightweight formatting job despite the observed 20-second median increase.
Failure audit: no executed failures or timeouts on the PR, and no slim compatibility failures. Earlier head 8db60cf had superseded cancellations: CI run 41637049955 / Test msrv (job 125920862858), Test stable (125920863122), and Rustdoc Preview run 41637049187 / deploy (125920943103). Exact annotations: Canceling since a higher priority waiting request for CI-refs/pull/302/merge exists and Canceling since a higher priority waiting request for rustdoc-preview-302 exists. These are concurrency cancellations after a new push, not capacity failures or runner regressions; replacement jobs all passed. CodeRabbit skipped. CI and preview results on the final head were executed once and retained while Lint alone was rerun; they are not new samples on each attempt. No rerun API rejection occurred. The original merge conflict is resolved. No deployment/publishing workflow was manually rerun for measurement.
No actionable comments were generated in the recent review.
Walkthrough
The rustfmt and zizmor jobs in the lint workflow now run on ubuntu-slim and use pinned actions/checkout v7. The zizmor job’s permissions and security-check step remain unchanged.
Merge Risk: Minimal · up to 8815f
The runner changes preserve the lint jobs’ behavior and no actionable merge-blocking risk was established.
Pre-merge checks: 5
Check name
Status
Explanation
Title check
The title clearly and concisely describes the main change: moving lightweight lint jobs to ubuntu-slim.
Description check
The description is directly related to the changeset and provides detailed context about runner changes, validation, measurements, and preserved workflows.
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Run CodeRabbit Verify to test the changes in this pull request.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: a1df91c7-77a8-49ca-8d5e-d8cab8c2858a
Commits
Reviewing files that changed from the base of the PR and between f89f342 and 8815f0b.
Files selected for processing: 1
.github/workflows/lint.yml
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
robjtede
changed the title
Move Lint / rustfmt and GitHub Actions Security (no matrices) to ubuntu-slim. Use the existing official checkout pin for this GitHub runner. Formatting does not compile the workspace. Keep test/MSRV, Clippy feature powersets, coverage, rustdoc builds, release, and preview deployment on their current runners. Main now pins zizmor-action v0.8.0, which downloads a hash-verified binary wheel with Python and pip instead of Docker; this job also moves to slim. Python and pip are installed on slim. The reusable MSRV reader owns its runner upstream.
GitHub documents slim for public/private repositories: x64, 1 CPU, 5 GB RAM, 14 GB storage, 15-minute timeout, unprivileged container. Docker-in-Docker and privileged operations are unsupported. The image includes Bash, Git, curl, tar, and Node; Rust is not preinstalled. The pinned Rust setup action bootstraps rustup when absent.
Sources: https://docs.github.com/en/actions/reference/runners/github-hosted-runners and https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
Validation:
prettier --check .github/workflows/lint.ymlpassed;zizmor --offline .github/workflows/lint.ymlpassed (five existing suppressions). The justfile check includes unrelated Rust compilation and its imported .toolchain/rust.just is absent in this checkout, so focused installed tools were used. No test or permission changes.Measurements (execution only: job completed_at minus started_at; queue excluded):
Baseline n=3, median=17 seconds. Historical comparison, not same-code and not GitHub standard runner: Blacksmith is the existing provider. Rust cache defaults remain enabled; cache hits are unverified. Nightly version, image software, checkout implementation, network and cache state can confound results. Queue time not measured. Slim n=0, median and 100*(slim/base-1) pending; no runtime compatibility claim yet. No deployment or release reruns will be requested for measurements.
Update after merging main: preserved current action pins and all other main changes. The previous head f0b1b76 had no Actions runs because the PR conflicted; the only check was skipped CodeRabbit. This is not a successful slim sample.
GitHub Actions Security historical baseline (same run URLs and SHAs as the table above, in the same order): 16, 13, 14 seconds; n=3, median=14 seconds, all successful on blacksmith-2vcpu-ubuntu-2404. No explicit job cache; download/network and historical action-version differences are possible confounders. Slim n=0; median and percentage change pending. Queue time excluded. No runtime compatibility failures observed because no slim execution evidence is available yet. Main's Rust setup v2.0.0 still bootstraps rustup when absent. Focused Prettier and offline zizmor checks pass after conflict resolution and the additional security-job runner change.
First slim execution: https://github.com/x52dev/serde-utils/actions/runs/41637138416/attempts/1, head 8815f0b. Lint/rustfmt succeeded in 23 seconds (12:36:30–12:36:53 UTC); Lint/GitHub Actions Security succeeded in 12 seconds (12:36:29–12:36:41 UTC). Both used ubuntu-slim, no matrix. Rustfmt restored an exact Rust cache match (~5 MB); nightly was 1.101.0-nightly (2026-11-02). Security has no explicit cache. With n=1 each, provisional slim medians are 23 and 12 seconds: +35.3% and -14.3% against historical Blacksmith medians 17 and 14. These are not controlled same-code comparisons. Execution excludes scheduling: jobs started 4 and 3 seconds after workflow creation respectively; those delays include scheduling/setup and are not pure queue measurements. No slim failures observed. A second attempt of only Lint was requested; no deployment workflow was rerun for measurement.
Second slim sample: https://github.com/x52dev/serde-utils/actions/runs/41637138416/attempts/2, same head 8815f0b and ubuntu-slim labels. Security succeeded in 10 seconds (12:37:47–12:37:57 UTC); rustfmt succeeded in 41 seconds (12:37:47–12:38:28 UTC). Execution only; queue excluded. Samples so far: rustfmt [23,41], security [12,10]. Required checks and all executed checks passed; CodeRabbit skipped. Third and final Lint-only sample requested; no preview or release reruns requested.
Final measurements: three successful slim attempts completed on head 8815f0b, run https://github.com/x52dev/serde-utils/actions/runs/41637138416 (attempts 1, 2, 3). No further measurements are pending.
Attempt 3 job URLs: https://github.com/x52dev/serde-utils/actions/runs/41637138416/job/125922670386 (rustfmt 12:39:55–12:40:32 UTC) and https://github.com/x52dev/serde-utils/actions/runs/41637138416/job/125922670709 (security 12:39:59–12:40:21 UTC). All slim rustfmt samples restored the same exact Rust cache key and used nightly 2026-11-02. Security has no explicit cache. Historical baseline cache hits remain unverified. These results compare historical Blacksmith jobs with current slim jobs, not a controlled GitHub standard-runner experiment; different SHAs, action versions, images, nightly versions, downloads, and cache states can affect results. Durations exclude queue time; no pure queue measurement is available. Rustfmt remains a lightweight formatting job despite the observed 20-second median increase.
Failure audit: no executed failures or timeouts on the PR, and no slim compatibility failures. Earlier head 8db60cf had superseded cancellations: CI run 41637049955 / Test msrv (job 125920862858), Test stable (125920863122), and Rustdoc Preview run 41637049187 / deploy (125920943103). Exact annotations:
Canceling since a higher priority waiting request for CI-refs/pull/302/merge existsandCanceling since a higher priority waiting request for rustdoc-preview-302 exists. These are concurrency cancellations after a new push, not capacity failures or runner regressions; replacement jobs all passed. CodeRabbit skipped. CI and preview results on the final head were executed once and retained while Lint alone was rerun; they are not new samples on each attempt. No rerun API rejection occurred. The original merge conflict is resolved. No deployment/publishing workflow was manually rerun for measurement.