[chores] Cache CI bot dependencies #628#629
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (8)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (12)
🧰 Additional context used🧠 Learnings (4)📚 Learning: 2026-03-05T20:55:29.968ZApplied to files:
📚 Learning: 2026-03-05T09:38:10.320ZApplied to files:
📚 Learning: 2026-03-05T14:23:55.528ZApplied to files:
📚 Learning: 2026-03-05T09:59:22.581ZApplied to files:
🔇 Additional comments (11)
📝 WalkthroughWalkthroughAdds pip dependency caching to CI workflows and the bot-changelog-generator action. Introduces a new action input Sequence Diagram(s)sequenceDiagram
participant Runner as Runner
participant Workflow as Workflow Job
participant Action as bot-changelog-generator Action
participant SetupPy as actions/setup-python
participant Cache as Cache Store
Runner->>Workflow: start job
Workflow->>Action: call bot-changelog-generator (input: cache-dependency-path)
alt cache-dependency-path != ""
Workflow->>SetupPy: setup-python (cache: "pip", cache-dependency-path)
SetupPy->>Cache: lookup cache(key from cache-dependency-path)
alt cache hit
Cache-->>SetupPy: restore cache
else cache miss
SetupPy-->>Cache: populate cache after install
end
else cache-dependency-path == ""
Workflow->>SetupPy: setup-python (no pip cache)
end
SetupPy-->>Action: python env ready
Action-->>Workflow: run remaining steps
Workflow-->>Runner: finish job
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip CodeRabbit can generate a title for your PR based on the changes with custom instructions.Set the |
coderabbitai
bot
added
enhancement
github_actions
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/actions/bot-changelog-generator/action.yml:
- Around line 26-38: Update the composite action steps that currently reference
"uses: actions/setup-python@v5" to use "@v6" for consistency with the rest of
the repo; specifically modify both occurrences of the "uses:
actions/setup-python@v5" lines in the steps that handle the cache (with
cache-dependency-path) and the non-cache branch so they read "uses:
actions/setup-python@v6", leaving the existing with: keys (python-version,
cache, cache-dependency-path) unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: d2e1d5b0-85b6-4a72-b22b-62277fea74a7
📒 Files selected for processing (8)
.github/actions/bot-changelog-generator/action.yml.github/workflows/bot-autoassign-issue.yml.github/workflows/bot-autoassign-pr-issue-link.yml.github/workflows/bot-autoassign-pr-reopen.yml.github/workflows/bot-autoassign-stale-pr.yml.github/workflows/reusable-bot-autoassign.yml.github/workflows/reusable-bot-changelog.yml.github/workflows/reusable-bot-ci-failure.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: Python==3.10 | django~=5.1.0
- GitHub Check: Python==3.10 | django~=5.0.0
- GitHub Check: Python==3.12 | django~=4.2.0
- GitHub Check: Python==3.12 | django~=5.0.0
- GitHub Check: Python==3.11 | django~=5.2.0
- GitHub Check: Python==3.11 | django~=5.1.0
- GitHub Check: Python==3.11 | django~=5.0.0
- GitHub Check: Python==3.11 | django~=4.2.0
🧰 Additional context used
🧠 Learnings (4)
📚 Learning: 2026-03-05T09:38:10.320Z
Learnt from: pushpitkamboj
Repo: openwisp/openwisp-utils PR: 584
File: .github/workflows/reusable-bot-changelog.yml:49-49
Timestamp: 2026-03-05T09:38:10.320Z
Learning: In openwisp-utils, PR title prefixes are strictly limited to `[feature]`, `[fix]`, and `[change]` (exact bracketed tags, no scoping/sub-types). The regex `^\[(feature|fix|change)\]` in `.github/workflows/reusable-bot-changelog.yml` is intentional and correct — scoped variants like `[feature/bots]` are not valid and should not be matched.
Applied to files:
.github/workflows/reusable-bot-changelog.yml
📚 Learning: 2026-02-06T20:46:32.980Z
Learnt from: nemesifier
Repo: openwisp/openwisp-utils PR: 560
File: openwisp_utils/commitizen/openwisp.py:9-25
Timestamp: 2026-02-06T20:46:32.980Z
Learning: In openwisp-utils, the commit message prefix "chores" (plural) is intentionally used instead of "chore" (singular) in the Commitizen ALLOWED_PREFIXES configuration.
Applied to files:
.github/workflows/reusable-bot-changelog.yml
📚 Learning: 2026-03-05T09:59:22.581Z
Learnt from: pushpitkamboj
Repo: openwisp/openwisp-utils PR: 584
File: .github/actions/bot-changelog-generator/generate_changelog.py:356-364
Timestamp: 2026-03-05T09:59:22.581Z
Learning: In `.github/actions/bot-changelog-generator/generate_changelog.py`, the `validate_changelog_output` function's purpose is to act as an output safety filter — ensuring no sensitive information or arbitrary LLM-generated text gets posted as a PR comment. It checks that the output starts with a valid tag ([feature]/[fix]/[change]) and contains a correctly structured PR reference pattern. It is NOT intended to strictly validate that the referenced PR number/URL matches the current PR.
Applied to files:
.github/workflows/reusable-bot-changelog.yml
📚 Learning: 2026-03-05T20:55:29.968Z
Learnt from: nemesifier
Repo: openwisp/openwisp-utils PR: 0
File: :0-0
Timestamp: 2026-03-05T20:55:29.968Z
Learning: For the openwisp/openwisp-utils repository (and the broader openwisp org), the maintainers have explicitly decided to use mutable version tags (e.g. `v2`, `v6`) for GitHub Actions and to use `ref: master` for internal script checkouts. Do NOT flag unpinned action versions or `master`/version-tag usage as security issues in any openwisp-utils workflow file. The maintainers are aware of the trade-offs and are intentionally fine with this approach.
Applied to files:
.github/workflows/reusable-bot-changelog.yml
🔇 Additional comments (10)
.github/workflows/reusable-bot-autoassign.yml (1)
38-39: LGTM!The pip caching configuration is correctly aligned with the checkout path. The
openwisp-utils/setup.pypath matches the checkout destination at line 32, ensuring the cache key will properly invalidate when dependencies change..github/workflows/bot-autoassign-stale-pr.yml (1)
35-36: LGTM!Caching is correctly configured for the repository's root
setup.py, matching the checkout and install paths..github/workflows/reusable-bot-ci-failure.yml (1)
71-72: LGTM!The pip caching configuration correctly references
trusted_scripts/setup.py, consistent with the checkout path at line 56 and the install command at line 76..github/workflows/reusable-bot-changelog.yml (2)
64-67: LGTM!Good change to include
setup.pyin the sparse checkout. This ensures the file is available for the cache key computation when invoking the composite action.
73-73: LGTM!The
cache-dependency-pathcorrectly references the sparse-checked-outsetup.pyrelative to the workspace root..github/workflows/bot-autoassign-issue.yml (1)
34-35: LGTM!Pip caching is correctly configured for the repository root
setup.py..github/workflows/bot-autoassign-pr-reopen.yml (2)
37-38: LGTM!Pip caching correctly configured for the
reassign-on-reopenjob.
70-71: LGTM!Pip caching correctly configured for the
handle-pr-activityjob, consistent with the other job in this workflow..github/workflows/bot-autoassign-pr-issue-link.yml (1)
35-36: LGTM!Pip caching correctly configured for the repository root
setup.py..github/actions/bot-changelog-generator/action.yml (1)
18-21: LGTM!Good design choice making the cache-dependency-path optional with an empty default. This maintains backward compatibility for callers that don't provide the input.
| - name: Set up Python with cache | ||
| if: ${{ inputs.cache-dependency-path != '' }} | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.13" | ||
| cache: "pip" | ||
| cache-dependency-path: ${{ inputs.cache-dependency-path }} | ||
|
|
||
| - name: Set up Python | ||
| if: ${{ inputs.cache-dependency-path == '' }} | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.13" |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
🧩 Analysis chain
🌐 Web query:
What is the latest version of actions/setup-python GitHub Action?
💡 Result:
The latest release of actions/setup-python is v6.2.0 (tagged “Latest” on the Releases page). You can reference it as actions/setup-python@v6.2.0 (pinned) or actions/setup-python@v6 (floating major). (github.com)
Citations:
🏁 Script executed:
find .github/workflows -type f -name "*.yml" -o -name "*.yaml" | xargs grep -n "actions/setup-python"Repository: openwisp/openwisp-utils
Length of output: 900
Version inconsistency: actions/setup-python@v5 vs @v6 used elsewhere.
This composite action uses actions/setup-python@v5 (lines 28, 36), while the workflow files in this PR use actions/setup-python@v6. Consider updating to @v6 for consistency across the codebase.
♻️ Suggested fix for version consistency
- name: Set up Python with cache
if: ${{ inputs.cache-dependency-path != '' }}
- uses: actions/setup-python@v5
+ uses: actions/setup-python@v6
with:
python-version: "3.13"
cache: "pip"
cache-dependency-path: ${{ inputs.cache-dependency-path }}
- name: Set up Python
if: ${{ inputs.cache-dependency-path == '' }}
- uses: actions/setup-python@v5
+ uses: actions/setup-python@v6
with:
python-version: "3.13"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Set up Python with cache | |
| if: ${{ inputs.cache-dependency-path != '' }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.13" | |
| cache: "pip" | |
| cache-dependency-path: ${{ inputs.cache-dependency-path }} | |
| - name: Set up Python | |
| if: ${{ inputs.cache-dependency-path == '' }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.13" | |
| - name: Set up Python with cache | |
| if: ${{ inputs.cache-dependency-path != '' }} | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.13" | |
| cache: "pip" | |
| cache-dependency-path: ${{ inputs.cache-dependency-path }} | |
| - name: Set up Python | |
| if: ${{ inputs.cache-dependency-path == '' }} | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.13" |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/actions/bot-changelog-generator/action.yml around lines 26 - 38,
Update the composite action steps that currently reference "uses:
actions/setup-python@v5" to use "@v6" for consistency with the rest of the repo;
specifically modify both occurrences of the "uses: actions/setup-python@v5"
lines in the steps that handle the cache (with cache-dependency-path) and the
non-cache branch so they read "uses: actions/setup-python@v6", leaving the
existing with: keys (python-version, cache, cache-dependency-path) unchanged.
czarflix
force-pushed
the
codex/issue-628-cache-bot-deps
branch
from
742972a to
92914fd
Compare
|
@nemesifier could you take a look, this addresses the caching issue |
nemesifier
left a comment
nemesifier
left a comment
There was a problem hiding this comment.
The goal is to cache the installation of openwisp-utils itself, so we shouldn't need to add a new input parameter as the result is always the same in all repos. Are you sure this is the correct approach?
The problem is that now we're installing openwisp-utils directly and using master, we may need to do something different to make cache invalidation easier.
Thanks, I reworked this locally in the direction you suggested. I removed the extra input and changed the changelog bot to install from the checked-out I tested that locally with a fresh sparse-checkout-style install, a smoke import, |
3 participants
Checklist
Reference to Existing Issue
Closes #628.
Description of Changes
openwisp-utils[github_actions], usingsetup.pyas the cache invalidation keysetup.pyso the cache key is available there as wellLocal validation:
git diff --checkactionlint .github/workflows/*.ymlactvalidation covering the repo-root, nested checkout,trusted_scripts, sparse checkout, and composite-action caller-path shapesScreenshot
N/A, workflow-only change.