Copilot commented on code in PR #1031:
URL: https://github.com/apache/dubbo-go-pixiu/pull/1031#discussion_r3940669733
##########
.github/workflows/github-actions.yml:
##########
@@ -38,14 +38,12 @@ jobs:
uses: actions/cache@v4
with:
path: ~/go/bin
- key: ${{ runner.os }}-go-imports-formatter-${{
hashFiles('**/go.sum') }}
- restore-keys: |
- ${{ runner.os }}-go-imports-formatter-
+ key: ${{ runner.os }}-go-imports-formatter-v1.0.10
Review Comment:
The cache key doesn’t include runner architecture, so a cache created on one
arch could be restored on another (leading to an `exec format error` when
running `imports-formatter`). Include `runner.arch` in the key to avoid
cross-arch reuse.
##########
.github/workflows/github-actions.yml:
##########
@@ -115,10 +113,10 @@ jobs:
run: |
echo "Cache miss. Downloading Zookeeper JAR..."
zkJarName="zookeeper-3.4.9-fatjar.jar"
-
remoteJarUrl="https://github.com/dubbogo/resources/raw/master/zookeeper-4unitest/contrib/fatjar/${zkJarName}";
+
remoteJarUrl="https://raw.githubusercontent.com/dubbogo/resources/master/zookeeper-4unitest/contrib/fatjar/${zkJarName}";
Review Comment:
`remoteJarUrl` references the moving `master` branch of `dubbogo/resources`,
so the downloaded JAR can change over time. For supply-chain safety and
repeatable CI, consider pinning to an immutable ref (tag or commit SHA) and/or
verifying the downloaded file via a known SHA256 before using it.
##########
.github/workflows/github-actions.yml:
##########
@@ -38,14 +38,12 @@ jobs:
uses: actions/cache@v4
with:
path: ~/go/bin
- key: ${{ runner.os }}-go-imports-formatter-${{
hashFiles('**/go.sum') }}
- restore-keys: |
- ${{ runner.os }}-go-imports-formatter-
+ key: ${{ runner.os }}-go-imports-formatter-v1.0.10
Review Comment:
This job runs `go install` but doesn’t set up a Go toolchain explicitly,
unlike the other jobs in this workflow. Adding `actions/setup-go` with
`go-version-file: go.mod` makes the formatter install deterministic and avoids
breakage if the runner image’s preinstalled Go version changes.
##########
.github/workflows/github-actions.yml:
##########
@@ -38,14 +38,12 @@ jobs:
uses: actions/cache@v4
with:
path: ~/go/bin
Review Comment:
Caching the entire `~/go/bin` directory is broader than needed for this job
(it only needs `imports-formatter`) and can accidentally persist/restore
unrelated binaries. Cache just the specific tool binary to minimize cache scope.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
