Add CI workflow and composite setup action by lupodevelop · Pull Request #2 · lupodevelop/thrifty

lupodevelop · 2025-11-16T09:27:50Z

Introduces a GitHub Actions workflow for CI, including steps for dependency installation, formatting, building, and testing. Adds a reusable composite action to install Erlang, rebar3, and Gleam with caching and fallback installation strategies.

Copilot

Pull Request Overview

This PR introduces a GitHub Actions CI workflow for a Gleam project, along with a reusable composite action for setting up the build environment. The workflow performs standard CI tasks (formatting checks, building, testing) while the composite action handles installation of Erlang, rebar3, and Gleam with multiple fallback strategies.

Adds a comprehensive CI workflow with dependency installation, formatting checks, building, and testing
Creates a composite action for environment setup with intelligent fallback mechanisms for Gleam installation
Implements caching strategies for both Gleam dependencies and build artifacts

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 9 comments.

File	Description
`.github/workflows/ci.yml`	Defines the main CI workflow with steps for checkout, environment setup, dependency installation, formatting checks, build, tests, and artifact upload
`.github/actions/ci-setup/action.yml`	Provides a reusable composite action for installing Erlang/OTP, rebar3, and Gleam with multiple fallback installation strategies including binary download and building from source

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-16T09:32:38Z

.github/workflows/ci.yml

+        run: |
+          set -eux
+          mkdir -p ci_artifacts
+          echo "tests: ok" > ci_artifacts/test-success.txt


The artifact step always creates test-success.txt with "tests: ok" even if the tests actually failed. Since if: always() is used, this file will be created and uploaded regardless of test outcome, which could be misleading. Consider only creating this file when tests succeed, or include the actual test status in the artifact.

Copilot · 2025-11-16T09:32:39Z

.github/workflows/ci.yml

+      - name: Cache Gleam deps and build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/gleam
+            ~/.gleam
+            ./_gleam_deps
+            ./build
+          key: ${{ runner.os }}-gleam-1.13.0-otp28-cache-${{ hashFiles('**/gleam.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-gleam-1.13.0-otp28-cache-
+


The cache paths include both ~/.cache/gleam (line 27 in ci-setup action) and ~/.cache/gleam (line 27 in workflow), creating duplicate caching. Additionally, the cache in the workflow includes more paths and has version/OTP-specific keys, while the action's cache has a simpler key. This could lead to cache conflicts or inefficiency. Consider consolidating the caching strategy to either the workflow or the action, not both.

Suggested change

- name: Cache Gleam deps and build

uses: actions/cache@v4

with:

path: |

~/.cache/gleam

~/.gleam

./_gleam_deps

./build

key: ${{ runner.os }}-gleam-1.13.0-otp28-cache-${{ hashFiles('**/gleam.toml') }}

restore-keys: |

${{ runner.os }}-gleam-1.13.0-otp28-cache-

Copilot · 2025-11-16T09:32:39Z

.github/workflows/ci.yml

+            ~/.gleam
+            ./_gleam_deps
+            ./build
+          key: ${{ runner.os }}-gleam-1.13.0-otp28-cache-${{ hashFiles('**/gleam.toml') }}


The cache key hardcodes gleam-1.13.0-otp28 but the actual versions are specified in the setup step inputs (lines 19-21). If those input values change, the cache key will become stale and won't match. Consider using ${{ inputs.gleam-version }} or deriving the key from the setup inputs to ensure consistency.

Copilot · 2025-11-16T09:32:39Z

.github/actions/ci-setup/action.yml

+
+        if [ -n "${DOWNLOAD_URL}" ]; then
+          echo "Found asset: ${DOWNLOAD_URL}"
+          curl -fsSL -o /tmp/gleam.tar.gz "${DOWNLOAD_URL}"


The Gleam binary is downloaded via curl without verifying checksums or signatures. This could pose a security risk if the download is compromised or redirected. Consider verifying the downloaded artifact against published checksums or signatures from the Gleam releases page.

Suggested change

curl -fsSL -o /tmp/gleam.tar.gz "${DOWNLOAD_URL}"

curl -fsSL -o /tmp/gleam.tar.gz "${DOWNLOAD_URL}"

# Download and verify checksum

CHECKSUM_URL="${DOWNLOAD_URL}.sha256"

echo "Downloading checksum from ${CHECKSUM_URL}"

curl -fsSL -o /tmp/gleam.tar.gz.sha256 "${CHECKSUM_URL}"

EXPECTED_SUM=$(cat /tmp/gleam.tar.gz.sha256 | awk '{print $1}')

ACTUAL_SUM=$(sha256sum /tmp/gleam.tar.gz | awk '{print $1}')

if [ "$EXPECTED_SUM" != "$ACTUAL_SUM" ]; then

echo "Checksum verification failed!"

echo "Expected: $EXPECTED_SUM"

echo "Actual: $ACTUAL_SUM"

exit 1

fi

echo "Checksum verified."

Copilot · 2025-11-16T09:32:39Z

.github/actions/ci-setup/action.yml

+        if [ -n "${DOWNLOAD_URL}" ]; then
+          echo "Found asset: ${DOWNLOAD_URL}"
+          curl -fsSL -o /tmp/gleam.tar.gz "${DOWNLOAD_URL}"
+          tar -xzf /tmp/gleam.tar.gz -C /usr/local/bin --strip-components=1


The tar command attempts to extract to /usr/local/bin which typically requires root permissions. On GitHub Actions runners, this will likely fail with a permission denied error. Consider using sudo tar or extracting to a user-writable location like $HOME/.local/bin or $HOME/.cargo/bin and ensuring it's in the PATH.

Suggested change

tar -xzf /tmp/gleam.tar.gz -C /usr/local/bin --strip-components=1

mkdir -p "$HOME/.local/bin"

tar -xzf /tmp/gleam.tar.gz -C "$HOME/.local/bin" --strip-components=1

export PATH="$HOME/.local/bin:$PATH"

Copilot · 2025-11-16T09:32:40Z

.github/actions/ci-setup/action.yml

+          tmpdir=$(mktemp -d)
+          git clone --depth 1 --branch "${TAG}" https://github.com/gleam-lang/gleam.git "$tmpdir"
+          cd "$tmpdir"
+          cargo build --release


The fallback build copies the binary to $HOME/.cargo/bin/ but doesn't ensure this directory exists first. If rustup was just installed, the directory should exist, but if cargo was already present, this path might not exist. Consider adding mkdir -p "$HOME/.cargo/bin" before the copy operation to ensure it succeeds.

Suggested change

cargo build --release

cargo build --release

mkdir -p "$HOME/.cargo/bin"

Copilot · 2025-11-16T09:32:40Z

.github/actions/ci-setup/action.yml

+          cp target/release/gleam "$HOME/.cargo/bin/"
+        }
+
+        export PATH="$HOME/.cargo/bin:$PATH"


The PATH is exported within the script but these exports only affect the current shell session. In GitHub Actions composite actions, PATH modifications need to be persisted to subsequent steps using echo "$HOME/.cargo/bin" >> $GITHUB_PATH. Without this, the Gleam binary installed via cargo will not be accessible in the parent workflow's subsequent steps.

Suggested change

export PATH="$HOME/.cargo/bin:$PATH"

export PATH="$HOME/.cargo/bin:$PATH"

echo "$HOME/.cargo/bin" >> $GITHUB_PATH

Copilot · 2025-11-16T09:32:40Z

.github/workflows/ci.yml

+            ./build
+          key: ${{ runner.os }}-gleam-1.13.0-otp28-cache-${{ hashFiles('**/gleam.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-gleam-1.13.0-otp28-cache-


The cache restore-keys hardcode gleam-1.13.0-otp28 but the actual versions are specified in the setup step inputs. If those input values change, the restore keys will become stale. Consider using the actual version values from the setup inputs for consistency.

Copilot · 2025-11-16T09:32:40Z

.github/actions/ci-setup/action.yml

+        # Install rustup if necessary
+        if ! command -v cargo >/dev/null 2>&1; then
+          echo "Installing rustup/cargo"
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y


[nitpick] The rustup installation script is piped directly to sh without verification. While this is the official installation method, it poses a security risk if the source is compromised. Consider adding a checksum verification or using a pinned version of the installer script.

Suggested change

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y

# Download rustup installer script

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o /tmp/rustup-init.sh

# Verify SHA256 hash (update this hash if the installer script changes)

EXPECTED_HASH="REPLACE_WITH_KNOWN_GOOD_HASH"

ACTUAL_HASH="$(sha256sum /tmp/rustup-init.sh | awk '{print $1}')"

if [ "$ACTUAL_HASH" != "$EXPECTED_HASH" ]; then

echo "rustup-init.sh hash mismatch! Aborting."

exit 1

fi

sh /tmp/rustup-init.sh -y

Copilot AI review requested due to automatic review settings November 16, 2025 09:27

Copilot started reviewing on behalf of lupodevelop November 16, 2025 09:28 View session

lupodevelop merged commit f31d409 into main Nov 16, 2025
5 checks passed

Copilot finished reviewing on behalf of lupodevelop November 16, 2025 09:31

Copilot AI reviewed Nov 16, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add CI workflow and composite setup action#2

Add CI workflow and composite setup action#2
lupodevelop merged 1 commit intomainfrom
workflow/ci-test

lupodevelop commented Nov 16, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Nov 16, 2025

Uh oh!

Copilot AI Nov 16, 2025

Uh oh!

Copilot AI Nov 16, 2025

Uh oh!

Copilot AI Nov 16, 2025

Uh oh!

Copilot AI Nov 16, 2025

Uh oh!

Copilot AI Nov 16, 2025

Uh oh!

Copilot AI Nov 16, 2025

Uh oh!

Copilot AI Nov 16, 2025

Uh oh!

Copilot AI Nov 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-          curl -fsSL -o /tmp/gleam.tar.gz "${DOWNLOAD_URL}"
+          curl -fsSL -o /tmp/gleam.tar.gz "${DOWNLOAD_URL}"
+          # Download and verify checksum
+          CHECKSUM_URL="${DOWNLOAD_URL}.sha256"
+          echo "Downloading checksum from ${CHECKSUM_URL}"
+          curl -fsSL -o /tmp/gleam.tar.gz.sha256 "${CHECKSUM_URL}"
+          EXPECTED_SUM=$(cat /tmp/gleam.tar.gz.sha256 | awk '{print $1}')
+          ACTUAL_SUM=$(sha256sum /tmp/gleam.tar.gz | awk '{print $1}')
+          if [ "$EXPECTED_SUM" != "$ACTUAL_SUM" ]; then
+            echo "Checksum verification failed!"
+            echo "Expected: $EXPECTED_SUM"
+            echo "Actual:   $ACTUAL_SUM"
+            exit 1
+          fi
+          echo "Checksum verified."

-          tar -xzf /tmp/gleam.tar.gz -C /usr/local/bin --strip-components=1
+          mkdir -p "$HOME/.local/bin"
+          tar -xzf /tmp/gleam.tar.gz -C "$HOME/.local/bin" --strip-components=1
+          export PATH="$HOME/.local/bin:$PATH"

	cargo build --release
	cargo build --release
	mkdir -p "$HOME/.cargo/bin"

	export PATH="$HOME/.cargo/bin:$PATH"
	export PATH="$HOME/.cargo/bin:$PATH"
	echo "$HOME/.cargo/bin" >> $GITHUB_PATH

-          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+          # Download rustup installer script
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o /tmp/rustup-init.sh
+          # Verify SHA256 hash (update this hash if the installer script changes)
+          EXPECTED_HASH="REPLACE_WITH_KNOWN_GOOD_HASH"
+          ACTUAL_HASH="$(sha256sum /tmp/rustup-init.sh | awk '{print $1}')"
+          if [ "$ACTUAL_HASH" != "$EXPECTED_HASH" ]; then
+            echo "rustup-init.sh hash mismatch! Aborting."
+            exit 1
+          fi
+          sh /tmp/rustup-init.sh -y

Conversation

lupodevelop commented Nov 16, 2025

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 16, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants