mosaicstack/stack
21
0
Fork 1
Code Issues 338 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

ci: bake jq into the prebuilt test image #821

Merged
jason.woltje merged 1 commits from fix/795-ci-base-jq into main 2026-07-17 19:12:44 +00:00
Conversation 1 Commits 1 Files Changed 1
+4 -4
jason.woltje commented 2026-07-17 18:39:50 +00:00
Owner
Copy Link
Copy Source

Dependency audit

The shipped Codex review wrappers require bash, git, jq, codex, and a provider CLI (tea for Gitea or gh for GitHub). Gitea review posting also uses python3 through shared login helpers. BusyBox/coreutils commands used are awk, sed, grep, head, cat, cp, rm, mktemp, and wc.

The hermetic regression test requires bash, git, and jq through the real wrapper preflight; tea and codex are stubbed. Node, pnpm, and Turbo provide the CI runner invocation.

Decision

Path A. jq is a genuine shipped runtime dependency, not test-only parsing convenience: both review wrappers call check_jq, validate Codex JSON with jq empty, and common.sh uses jq to format findings and select review actions.

Change

  • add only jq to the Dockerfile.ci Alpine package set
  • update the adjacent toolset comment

Runtime parity: the host-side shipped wrapper README already declares jq, the operational Mosaic host has jq, and the dedicated codex-review Woodpecker template installs jq and git. Gateway/appservice runtime images do not ship or execute these host-side framework review tools.

Evidence

Pipeline 1893 is the red-first reproducer: git fixture setup passes, then both wrapper paths stop at check_jq because ci-base lacks jq.

After merge, ci-image.yml must publish a successful descendant ci-base:latest before PR #815 is rebased again.

Related to #795; does not close it.

## Dependency audit The shipped Codex review wrappers require bash, git, jq, codex, and a provider CLI (tea for Gitea or gh for GitHub). Gitea review posting also uses python3 through shared login helpers. BusyBox/coreutils commands used are awk, sed, grep, head, cat, cp, rm, mktemp, and wc. The hermetic regression test requires bash, git, and jq through the real wrapper preflight; tea and codex are stubbed. Node, pnpm, and Turbo provide the CI runner invocation. ## Decision Path A. jq is a genuine shipped runtime dependency, not test-only parsing convenience: both review wrappers call check_jq, validate Codex JSON with jq empty, and common.sh uses jq to format findings and select review actions. ## Change - add only jq to the Dockerfile.ci Alpine package set - update the adjacent toolset comment Runtime parity: the host-side shipped wrapper README already declares jq, the operational Mosaic host has jq, and the dedicated codex-review Woodpecker template installs jq and git. Gateway/appservice runtime images do not ship or execute these host-side framework review tools. ## Evidence Pipeline 1893 is the red-first reproducer: git fixture setup passes, then both wrapper paths stop at check_jq because ci-base lacks jq. After merge, ci-image.yml must publish a successful descendant ci-base:latest before PR #815 is rebased again. Related to #795; does not close it.
jason.woltje added 1 commit 2026-07-17 18:39:51 +00:00
feat(#795): bake jq into CI base image
ci/woodpecker/pr/ci Pipeline was successful
Details
d8dc096083
jason.woltje commented 2026-07-17 19:11:02 +00:00
Author
Owner
Copy Link
Copy Source

Independent Review-of-Record — PR #821

Exact head SHA reviewed: d8dc09608345d6c69f817c48a81853b7ea969c85 (branch fix/795-ci-base-jq)
Merge-base / sole parent: cabf02e7b9310f7ae57ad67c1db66959ffaf1bc9 (current main)

Head's sole parent is the current main tip, so this is a trivial fast-forward — the true prospective merge tree is identical to the head tree. I reviewed that tree directly (no synthetic merge required).

Verdict: APPROVE

Independent verification performed

  1. Diff re-fetched and confirmed exact. Dockerfile.ci is the only file changed (+4/-4). The change adds jq to the existing apk add --no-cache layer:

    • before: apk add --no-cache python3 make g++ postgresql-client bash git
    • after: apk add --no-cache python3 make g++ postgresql-client bash git jq
      git is preserved, not dropped. The accompanying comment update accurately describes that bash/git/jq are baked in for framework shell tests and the shipped Codex review wrappers, avoiding per-run installation in ci.yml. No other lines, files, secrets, or tokens are touched.

  2. Merge-base confirmed. GET /repos/mosaicstack/stack/git/commits/d8dc0960... returns a single parent: cabf02e7b9310f7ae57ad67c1db66959ffaf1bc9, matching current main. Fast-forward confirmed independently.

  3. Exact-head CI confirmed green. Woodpecker pipeline 1894 (commit d8dc0960..., ref refs/pull/821/head): overall status: success. All workflow steps green: clone, ci-postgres (service), install, sanitization, upgrade-guard, typecheck, lint, format, test — each state: success, exit_code: 0. changed_files: ["Dockerfile.ci"] only.

  4. Substance review:

    • Scope: CI base image only (Dockerfile.ci), low blast radius.
    • No secrets/tokens/credentials introduced.
    • No regression: python3 make g++ postgresql-client bash git all remain in the apk line; only jq is additive.
    • Comment accurately reflects the change and its purpose.
    • Acknowledged out-of-scope note: runtime/agent-image jq parity (needed for the shipped Codex review wrappers to work outside the CI image) is a known, separately-documented pre-existing gap. It is deliberately out of scope for this CI-image-only PR and is not a basis for REQUEST CHANGES here.

Lane attestation

Author lane = homelab (coordinator). Reviewer lane = independent reviewer-of-record, operating under a single Gitea account (jason.woltje) — author≠reviewer is process/lane-attested per the delegated independent-review protocol, not enforced via separate Gitea identities.

Do not merge

This comment is a review record only; no merge action was taken as part of this review.

—
Independent reviewer-of-record (MS-LEAD-delegated)

## Independent Review-of-Record — PR #821 **Exact head SHA reviewed:** `d8dc09608345d6c69f817c48a81853b7ea969c85` (branch `fix/795-ci-base-jq`) **Merge-base / sole parent:** `cabf02e7b9310f7ae57ad67c1db66959ffaf1bc9` (current `main`) Head's sole parent is the current main tip, so this is a trivial fast-forward — the true prospective merge tree is identical to the head tree. I reviewed that tree directly (no synthetic merge required). ### Verdict: **APPROVE** ### Independent verification performed 1. **Diff re-fetched and confirmed exact.** `Dockerfile.ci` is the only file changed (+4/-4). The change adds `jq` to the existing `apk add --no-cache` layer: - before: `apk add --no-cache python3 make g++ postgresql-client bash git` - after: `apk add --no-cache python3 make g++ postgresql-client bash git jq` `git` is **preserved**, not dropped. The accompanying comment update accurately describes that bash/git/jq are baked in for framework shell tests and the shipped Codex review wrappers, avoiding per-run installation in `ci.yml`. No other lines, files, secrets, or tokens are touched. 2. **Merge-base confirmed.** `GET /repos/mosaicstack/stack/git/commits/d8dc0960...` returns a single parent: `cabf02e7b9310f7ae57ad67c1db66959ffaf1bc9`, matching current main. Fast-forward confirmed independently. 3. **Exact-head CI confirmed green.** Woodpecker pipeline 1894 (commit `d8dc0960...`, ref `refs/pull/821/head`): overall `status: success`. All workflow steps green: clone, ci-postgres (service), install, sanitization, upgrade-guard, typecheck, lint, format, test — each `state: success`, `exit_code: 0`. `changed_files: ["Dockerfile.ci"]` only. 4. **Substance review:** - Scope: CI base image only (`Dockerfile.ci`), low blast radius. - No secrets/tokens/credentials introduced. - No regression: `python3 make g++ postgresql-client bash git` all remain in the apk line; only `jq` is additive. - Comment accurately reflects the change and its purpose. - **Acknowledged out-of-scope note:** runtime/agent-image `jq` parity (needed for the shipped Codex review wrappers to work outside the CI image) is a known, separately-documented pre-existing gap. It is deliberately out of scope for this CI-image-only PR and is not a basis for REQUEST CHANGES here. ### Lane attestation Author lane = homelab (coordinator). Reviewer lane = independent reviewer-of-record, operating under a single Gitea account (`jason.woltje`) — author≠reviewer is process/lane-attested per the delegated independent-review protocol, not enforced via separate Gitea identities. ### Do not merge This comment is a review record only; no merge action was taken as part of this review. — Independent reviewer-of-record (MS-LEAD-delegated)
jason.woltje merged commit fe7a468c9d into main 2026-07-17 19:12:44 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#821