Use bubblewrap isolation for Linux package validation

[leynos]

Summary

• set POLYTHENE_ISOLATION to bubblewrap when validating Linux packages so the sandbox respects executable bits

Testing

• not run (not applicable)

---

https://chatgpt.com/codex/tasks/task_e_68e661a9f48c8322929bfa35c6eebedf

Summary by Sourcery

CI:

• Set POLYTHENE_ISOLATION bubblewrap in the Linux package validation job to ensure the sandbox respects executable bits

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

The CI workflow for Linux package validation is updated to set the POLYTHENE_ISOLATION environment variable to bubblewrap, ensuring the validation sandbox respects executable bits.

File-Level Changes

Change	Details	Files
Enable bubblewrap isolation for Linux package validation	Added an env block to the validate-linux-packages step Configured POLYTHENE_ISOLATION to bubblewrap	.github/workflows/rust-toy-app.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Summary by CodeRabbit

• Chores
  • Strengthened Linux package validation in continuous integration by introducing sandboxed isolation, improving reliability and security of build checks. No changes to application behaviour or user-facing functionality.

Walkthrough

Add the environment variable POLYTHENE_ISOLATION: bubblewrap to the "Validate Linux packages" step in .github/workflows/rust-toy-app.yml; leave all other workflow steps, inputs, and outputs unchanged. (≤50 words)

Changes

Cohort / File(s)	Summary
CI workflow env var update .github/workflows/rust-toy-app.yml	Add POLYTHENE_ISOLATION: bubblewrap environment variable to the "Validate Linux packages" step; no other edits.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A bubblewrap hug for the build,
Sandboxed step snug and still.
One small var, the checks upheld,
Logs stay calm, the runs fulfilled.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title Check	✅ Passed	The title clearly summarises the primary change of setting bubblewrap isolation for Linux package validation and remains concise and specific to the workflow modification.
Description Check	✅ Passed	The description directly outlines setting POLYTHENE_ISOLATION to bubblewrap in the Linux package validation step and explains its purpose, matching the changeset.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/fix-ci-workflow-to-use-bubblewrap

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 16727c6 and 88f5073.

📒 Files selected for processing (1)

• .github/workflows/rust-toy-app.yml (1 hunks)

🧰 Additional context used

🔍 Remote MCP Ref

Summary of additional relevant facts for PR #183

• Change verified in branch codex/fix-ci-workflow-to-use-bubblewrap: .github/workflows/rust-toy-app.yml adds env POLYTHENE_ISOLATION: bubblewrap to the Validate Linux packages step and no other modifications to that workflow file were made ([Ref::Ref_ref_read_url::https://raw.githubusercontent.com/leynos/shared-actions/codex/fix-ci-workflow-to-use-bubblewrap/.github/workflows/rust-toy-app.yml]).
• PR metadata (author, branch, target, title, PR URL) confirmed: Use bubblewrap isolation for Linux package validation — leynos — codex/fix-ci-workflow-to-use-bubblewrap → main — Use bubblewrap isolation for Linux package validation #183 ([Ref::Ref_ref_read_url::https://github.com/Use bubblewrap isolation for Linux package validation #183]).

Reviewer checklist (concise, actionable)

• Confirm bubblewrap (bwrap) is available on the runner(s) used by this workflow (GitHub-hosted runners generally include it; verify self-hosted runners if any).
• Optionally add a short smoke step that asserts an executable file retains +x inside the sandbox to catch regressions.
• No other files or exported/public APIs are affected by this change.

Sources

• Workflow file (PR branch): https://raw.githubusercontent.com/leynos/shared-actions/codex/fix-ci-workflow-to-use-bubblewrap/.github/workflows/rust-toy-app.yml
• PR page: Use bubblewrap isolation for Linux package validation #183

⏰ Context from checks skipped due to timeout of 120000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)

• GitHub Check: Sourcery review
• GitHub Check: build-release (windows-latest, aarch64-pc-windows-gnullvm)
• GitHub Check: build-release (windows-latest, x86_64-pc-windows-gnullvm)
• GitHub Check: build-release (ubuntu-latest, aarch64-unknown-linux-gnu)
• GitHub Check: python-tests (ubuntu-latest)
• GitHub Check: python-tests (macos-13)
• GitHub Check: python-tests-windows

🔇 Additional comments (1)

.github/workflows/rust-toy-app.yml (1)

93-94: Ensure bubblewrap is present on runners. Set POLYTHENE_ISOLATION to bubblewrap but the job now needs bwrap installed on every Linux runner; if the binary is absent the validation step will fail. Confirm that ubuntu-latest (and any self-hosted machines you rely on) already ship bubblewrap or add an install step before using it.

#!/bin/bash
set -euo pipefail
which bwrap
bwrap --version

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sourcery-ai]

Hey there - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}