Harden agent workflow bootstrap and tool setup

Merged
HA
2mo ago
+237-84

The lane installers die when GitHub's release CDN 503s, and replay proved the outage sticks around (#392, #393). This makes the review lane's copilot install survive it.

Both engine blocks pin copilot 1.0.79, so the installer asks for one fixed artifact. A cache block keeps the toolcache copy of that version across runs, a post-install step seeds the toolcache from wherever the installer put the binary, and the detection job restores the same cache before its own installer runs. The installer's toolcache lookup finds the seeded copy and skips the download, and since the agent job's cache save lands before detection starts, even the first run's detection leg is covered.

The awf bundle still comes off the release CDN every run, since its installer has no toolcache lookup to feed. That half needs an upstream change. The mention and triage lanes keep downloading too; the same pattern extends to them once this proves out.

On the tool bench, scripts/tools.sh is gone. Every consumer queries cargo metadata with jq directly, the shared tool cache keys off hashFiles on the manifest, and taiki-e installs carry fallback none so a bad pin fails loudly instead of quietly building from source. The contract tests check the cargo form in the composite, the platform lane, and both ratchet hooks, and refuse the shim coming back.

Summary by cubic

Hardens the agent review lane against GitHub Releases CDN 503s and makes tool setup deterministic. The review lane now pins Copilot CLI 1.0.79, restores it from the runner toolcache, warms the build cache, and extends the timeout from 20 to 30 minutes.

  • Details

    • Pins the engine and installers to 1.0.79; exports COPILOT_CLI_VERSION and GH_AW_ENGINE_VERSION to keep one version across the lane and lock.
    • Restores Copilot CLI from ${{ runner.tool_cache }} via actions/cache/restore, seeds ${{ runner.tool_cache }}/copilot-cli/1.0.79/<arch>/bin/copilot, and saves with actions/cache/save before the agent runs; detection restores the same cache and skips downloads.
    • Adds shared-key: gates to Swatinem/rust-cache to warm the lane build cache from the gates job (applied to review, mention, triage, and CI).
    • Replaces the scripts/tools.sh shim with direct cargo metadata --locked --format-version 1 --no-deps --offline queries; the tools composite keys its cache with hashFiles('Cargo.toml') + runner.arch and sets fallback: none in taiki-e/install-action.
    • CI reads the cargo-nextest pin from cargo metadata and installs with fallback: none; pre-commit hooks read the similarity-rs pin from the source table.
    • Contract tests assert cargo metadata usage, cache keying, absence of the shim, and one Copilot version across the lane and lock. AWF binary downloads remain unchanged.

  • Migration

    • Replace any scripts/tools.sh usage with cargo metadata --locked --format-version 1 --no-deps --offline | jq ... as shown in the tools composite and hooks.

Summary by CodeRabbit

  • Improvements

    • Tool versions are now sourced consistently from the project’s Cargo metadata.
    • CI and development checks use locked tool definitions with stricter installation behavior.
    • Caching for review tooling and command-line utilities has been improved.
    • Review engines and related tooling are pinned to a consistent version for more predictable results.

  • Documentation

    • Updated development guidance to reflect the streamlined tool-version configuration and update process.