Repository navigation
chore(deps): update dependency smol-machines/smolvm to v1.13.1 - #197
Conversation
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
e4ddbab to
8bce54e
Compare
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
Reviewed the Renovate-managed SmolVM golden-version update and its release-installation and verification consumers.
- Golden runtime pin: Updates
smolvm_golden_versionfrom1.8.2to1.13.1, selecting the candidate used by golden-image builds and the real-VM release verification workflow.
@v0 or keep the SHA fresh with Dependabot ｜ View workflow run ｜ Using GPT Terra ｜ 𝕏
|
No new commits or review threads were added since Pullfrog's review of Task list (3/4 completed)
|
There was a problem hiding this comment.
✅ No new issues found.
Reviewed changes
Reviewed the Renovate-managed SmolVM golden-version update and the repository workflows that install and verify that release.
- Golden runtime pin: Updates
smolvm_golden_versionfrom1.8.2to1.13.1for both x86_64 Linux and arm64 macOS golden builds, while retaining the independentsmolvm_min_versioncompatibility floor.
@v0 or keep the SHA fresh with Dependabot ｜ View workflow run ｜ Using GPT Terra ｜ 𝕏
|
No incremental code changes were pushed after the prior Pullfrog reviews, so no additional review was warranted. The Task list (3/4 completed)
|
There was a problem hiding this comment.
Important
The required real-VM compatibility gate was skipped for this golden-runtime update, so the candidate has not received the validation this pin requires.
Reviewed changes
Reviewed the Renovate-managed SmolVM golden-version update and its release-installation and verification consumers.
- Golden runtime pin: Updates
smolvm_golden_versionfrom1.8.2to1.13.1, selecting the release used by Linux and macOS golden builds while retaining the independent runtime compatibility floor.
@v0 or keep the SHA fresh with Dependabot ｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Terra ｜ 𝕏
| # E2E on the smolvm-host. Deliberately separate from smolvm_min_version: | ||
| # goldens track the last *verified* release, the runtime floor rarely moves. | ||
| smolvm_golden_version = "1.8.2" | ||
| smolvm_golden_version = "1.13.1" |
There was a problem hiding this comment.
This pin advanced without the required real-VM validation: the linked smolvm-release-verify job completed successfully but skipped installation, capability probing, VM boot, and ownership checks. Its default one-commit checkout cannot resolve BASE_SHA, and the failed git diff is interpreted as changed=false, so this Renovate bump can merge unverified.
Technical details
# Golden-release verification silently skips on shallow checkout
## Affected sites
- [`.github/workflows/smolvm-release-verify.yml:28`](https://github.com/preloopdev/preloop/blob/8bce54ed7aa871493a91fbb3a562b17181f60971/.github/workflows/smolvm-release-verify.yml#L28) — `actions/checkout` uses its default `fetch-depth: 1`.
- [`.github/workflows/smolvm-release-verify.yml:40`](https://github.com/preloopdev/preloop/blob/8bce54ed7aa871493a91fbb3a562b17181f60971/.github/workflows/smolvm-release-verify.yml#L40) — the base commit is diffed without first ensuring it is available; errors in this conditional leave `CHANGED=false`.
- [`versions.toml:16`](https://github.com/preloopdev/preloop/blob/8bce54ed7aa871493a91fbb3a562b17181f60971/versions.toml#L16) — this exact change consequently skipped every candidate-validation step in [run 33259352769](https://github.com/preloopdev/preloop/actions/runs/33259352769/job/99119968244).
## Required outcome
- The workflow must fetch the PR base needed for the comparison and fail rather than treating an unavailable comparison as an unchanged pin.
- Re-run the candidate validation so installation, `--mount-socket`, VM boot, and packed-ownership checks execute against `1.13.1` before merging.
## Suggested approach
- Configure checkout with sufficient history or explicitly fetch `$BASE_SHA`, then make a `git diff` error fail the step instead of falling through to `changed=false`.
|
No new commits exist since the prior Pullfrog review, so no additional review was warranted. Targeted SmolVM-adjacent tests passed: Task list (3/4 completed)
|
There was a problem hiding this comment.
Important
The required real-VM gate silently skipped the candidate checks for this SmolVM upgrade, so the dependency pin merged without its intended compatibility validation.
Reviewed changes: Reviewed the Renovate update to the SmolVM golden-image runtime pin.
- Golden runtime selection: Updates
smolvm_golden_versionfrom1.8.2to1.13.1, which controls the runtime archives installed while building release golden images.
⚠️ Golden runtime gate can silently skip this upgrade
actions/checkout fetches only one commit by default, but the detector diffs against the PR base SHA without fetching it. If that object is absent, both git diff calls fail inside the if condition and leave changed=false, skipping every install and VM check instead of failing the job. This PR's verification job completed in six seconds, which confirms the candidate checks did not run: workflow run.
Technical details
# Fetch the base commit and fail closed when golden-pin detection cannot run
## Affected sites
- [`.github/workflows/smolvm-release-verify.yml:28-45`](https://github.com/preloopdev/preloop/blob/8bce54ed7aa871493a91fbb3a562b17181f60971/.github/workflows/smolvm-release-verify.yml#L28-L45) - the default shallow checkout does not guarantee `${{ github.event.pull_request.base.sha }}` is locally available, while diff failures are swallowed by an `if` condition.
- [`versions.toml:16`](https://github.com/preloopdev/preloop/blob/8bce54ed7aa871493a91fbb3a562b17181f60971/versions.toml#L16) - this candidate golden release therefore advanced untested.
## Required outcome
- Every pull request that changes `smolvm_golden_version` must either execute the release installation and real-VM checks or fail visibly before merge.
## Suggested approach
- Fetch `BASE_SHA` explicitly (or use `fetch-depth: 0`) before detecting the pin change, and make either `git diff` failure terminate the detector step.@v0 or keep the SHA fresh with Dependabot ｜ Fix it ➔ ｜ View workflow run ｜ Using GPT Terra ｜ 𝕏
1 participant
This PR contains the following updates:
1.8.2→1.13.1Release Notes
smol-machines/smolvm (smol-machines/smolvm)
v1.13.1: smolvm v1.13.1Compare Source
What's Changed
New Contributors
Full Changelog: smol-machines/smolvm@v1.13.0...v1.13.1
v1.13.0: smolvm v1.13.0Compare Source
What's Changed
Full Changelog: smol-machines/smolvm@v1.12.0...v1.13.0
v1.12.0: smolvm v1.12.0Compare Source
What's Changed
Full Changelog: smol-machines/smolvm@v1.11.1...v1.12.0
v1.11.1: smolvm v1.11.1Compare Source
What's Changed
Full Changelog: smol-machines/smolvm@v1.11.0...v1.11.1
v1.11.0: smolvm v1.11.0Compare Source
What's Changed
Full Changelog: smol-machines/smolvm@v1.10.1...v1.11.0
v1.10.1: smolvm v1.10.1Compare Source
What's Changed
New Contributors
Full Changelog: smol-machines/smolvm@v1.9.2...v1.10.1
v1.10.0: smolvm v1.10.0Compare Source
What's Changed
Full Changelog: smol-machines/smolvm@v1.9.2...v1.10.0
v1.9.3: smolvm v1.9.3Compare Source
What's Changed
Full Changelog: smol-machines/smolvm@v1.9.2...v1.9.3
v1.9.2: smolvm v1.9.2Compare Source
What's Changed
--instead of silently ignoring them by @Bnjoroge1 in #958Full Changelog: smol-machines/smolvm@v1.9.1...v1.9.2
v1.9.1: smolvm v1.9.1Compare Source
What's Changed
Full Changelog: smol-machines/smolvm@v1.9.0...v1.9.1
v1.9.0: smolvm v1.9.0Compare Source
What's Changed
Full Changelog: smol-machines/smolvm@v1.8.3...v1.9.0
v1.8.3: smolvm v1.8.3Compare Source
What's Changed
New Contributors
Full Changelog: smol-machines/smolvm@v1.8.2...v1.8.3
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.