Pin Kotlin for workflow script execution on CI#2373
Merged
leonard84 merged 1 commit intoJun 13, 2026
Merged
Conversation
📝 WalkthroughWalkthroughAdds a composite action to install pinned Kotlin 2.3.10 (verified by SHA-256) and integrates that step into multiple workflow YAML-regeneration jobs while consolidating consistency-check job configuration into a shared commonConsistencyCheckJobConfig. ChangesKT-86352 Kotlin Compiler Pinning and Workflow Configuration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 zizmor (1.25.2).github/workflows/codeql-analysis.yamlINFO zizmor: 🌈 zizmor v1.25.2 Caused by: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2373 +/- ##
=========================================
Coverage 82.18% 82.18%
Complexity 4832 4832
=========================================
Files 473 473
Lines 15051 15051
Branches 1912 1912
=========================================
Hits 12369 12369
Misses 1991 1991
Partials 691 691 🚀 New features to boost your workflow:
|
The Kotlin versions preinstalled on the GitHub runner images (2.3.20 and newer) cannot execute the workflow scripts with the `kotlin` CLI, because resolving extension functions from imported scripts is broken there, see https://youtrack.jetbrains.com/issue/KT-86352. Install an unaffected Kotlin version via a new local composite action and put it on the PATH before any workflow script is executed on a runner, both in the generated consistency check jobs (via shared `consistencyCheckJobConfig` additional steps) and in the regenerate-all-workflows job. Generation via Gradle is unaffected, as it uses the legacy scripting host. Revert this commit once KT-86352 is resolved and the runner images ship a fixed Kotlin version.
leonard84
force-pushed
the
workflow-check_KT-86352_workaround
branch
from
8be10cd to
0ef6432
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/actions/install-pinned-kotlin/action.yml (1)
15-15: ⚡ Quick winHarden download step against transient network failures.
Line 15 currently performs a single
curlattempt without retries/time bounds, so temporary GitHub/network hiccups can fail the whole consistency-check pipeline even though checksum validation is correct.Proposed diff
- curl --fail --silent --show-error --location --output "$RUNNER_TEMP/kotlin-compiler.zip" "https://github.com/JetBrains/kotlin/releases/download/v2.3.10/kotlin-compiler-2.3.10.zip" + curl --fail --silent --show-error --location \ + --retry 5 --retry-all-errors --retry-delay 2 \ + --connect-timeout 20 --max-time 300 \ + --output "$RUNNER_TEMP/kotlin-compiler.zip" \ + "https://github.com/JetBrains/kotlin/releases/download/v2.3.10/kotlin-compiler-2.3.10.zip"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/actions/install-pinned-kotlin/action.yml at line 15, Replace the single, non-retriable curl invocation that writes to "$RUNNER_TEMP/kotlin-compiler.zip" and fetches the kotlin-compiler URL with a hardened download that retries transient failures and enforces timeouts: add curl retry flags (e.g. --retry, --retry-delay, --retry-connrefused), a per-request timeout (--max-time or --connect-timeout), and keep --fail/--silent/--show-error/--location, or wrap curl in a small retry loop that re-attempts the same command up to N times with exponential backoff and exits non-zero if all attempts fail; target the existing curl invocation string to implement this change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/actions/install-pinned-kotlin/action.yml:
- Line 15: Replace the single, non-retriable curl invocation that writes to
"$RUNNER_TEMP/kotlin-compiler.zip" and fetches the kotlin-compiler URL with a
hardened download that retries transient failures and enforces timeouts: add
curl retry flags (e.g. --retry, --retry-delay, --retry-connrefused), a
per-request timeout (--max-time or --connect-timeout), and keep
--fail/--silent/--show-error/--location, or wrap curl in a small retry loop that
re-attempts the same command up to N times with exponential backoff and exits
non-zero if all attempts fail; target the existing curl invocation string to
implement this change.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 876b3388-31ba-4729-9c24-63ba47eb32b8
📒 Files selected for processing (10)
.github/actions/install-pinned-kotlin/action.yml.github/workflows/branches-and-prs.main.kts.github/workflows/branches-and-prs.yaml.github/workflows/codeql-analysis.main.kts.github/workflows/codeql-analysis.yaml.github/workflows/common.main.kts.github/workflows/docs-pr.main.kts.github/workflows/docs-pr.yaml.github/workflows/release.main.kts.github/workflows/release.yaml
🚧 Files skipped from review as they are similar to previous changes (6)
- .github/workflows/codeql-analysis.yaml
- .github/workflows/common.main.kts
- .github/workflows/branches-and-prs.main.kts
- .github/workflows/docs-pr.yaml
- .github/workflows/release.main.kts
- .github/workflows/docs-pr.main.kts
🔎 No tests executed 🔎🏷️ Commit: 0ef6432 Learn more about TestLens at testlens.app. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Kotlin versions preinstalled on the GitHub runner images (2.3.20 and newer) cannot execute our workflow scripts with the
kotlinCLI: resolving extension functions from@file:Imported scripts is broken, see KT-86352. This breaks thecheck_yaml_consistencyjobs and the regenerate-all-workflows job, which execute the*.main.ktsscripts on the runner. Generation via Gradle is unaffected, as it uses the legacy scripting host.Work-around
.github/actions/install-pinned-kotlinthat downloads Kotlin 2.3.10 (last unaffected version), validates its sha256 against the official release checksum, and prepends it to thePATH.commonConsistencyCheckJobConfig(which also centralizes the previously duplicatedDEFAULT_CONSISTENCY_CHECK_JOB_CONFIG.copy(...)blocks), and in thecheck_all_workflow_yaml_consistencyjob.Verified locally by executing the scripts with the pinned 2.3.10 CLI: no KT-86352 failure, and the output is byte-identical to the Gradle-generated YAML.
Revert plan
Revert this commit once KT-86352 is resolved and the runner images ship a fixed Kotlin version.