[talos] Unpin talos version used for extensions #1360
Conversation
Some version strings were accidentally hardcoded instead of retrieving them dynamically in the profile generator for the Talos build. This follows up #1351 and fixes these issues. ```release-note [talos] Add LLDP support and improve profile generation logic. ``` Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
WalkthroughUpdated gen-profiles.sh to use a dynamic TALOS_VERSION tag for the crane export image reference and refined digest extraction by anchoring grep matches to the "/name:" pattern using fixed-string matching. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Summary of Changes
Hello @lllamnyp, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request addresses an issue in the Talos profile generator script where specific Talos extension versions were hardcoded. The changes update the script to dynamically retrieve these versions, ensuring consistency with the main Talos version. Additionally, the image digest lookup logic has been improved for greater precision and reliability.
Highlights
- Dynamic Versioning: The script now dynamically retrieves the Talos extension version using the
TALOS_VERSIONenvironment variable, replacing a previously hardcoded version. - Improved Image Digest Lookup: The
grepcommands used to find image digests have been refined with fixed string matching and more specific patterns, improving the accuracy and robustness of image lookups.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request correctly replaces a hardcoded Talos version with a dynamic variable in the profile generation script. It also improves the logic for finding firmware and extension images by making the grep pattern more specific. I've suggested a refactoring to combine two duplicated loops into one, which also addresses a potential bug where multiple matching images could lead to invalid YAML output. Overall, good changes that improve the script's correctness and maintainability.
| for firmware in $FIRMWARES; do | ||
| printf "fetching %s version: " "$firmware" | ||
| firmware_var=$(echo "$firmware" | tr '[:lower:]' '[:upper:]' | tr - _)_IMAGE | ||
| image=$(grep $firmware $TMPDIR/image-digests) | ||
| image=$(grep -F "/$firmware:" $TMPDIR/image-digests) | ||
| echo "$image" | ||
| export "$firmware_var=$image" | ||
| done | ||
|
|
||
| for extension in $EXTENSIONS; do | ||
| printf "fetching %s version: " "$extension" | ||
| extension_var=$(echo "$extension" | tr '[:lower:]' '[:upper:]' | tr - _)_IMAGE | ||
| image=$(grep $extension $TMPDIR/image-digests) | ||
| image=$(grep -F "/$extension:" $TMPDIR/image-digests) | ||
| echo "$image" | ||
| export "$extension_var=$image" | ||
| done |
There was a problem hiding this comment.
These two loops for FIRMWARES and EXTENSIONS are identical. You can combine them into a single loop to reduce code duplication and improve maintainability.
Additionally, there's a potential issue if grep finds multiple matching images. The $image variable would contain multiple lines, which would generate invalid YAML. The suggested code below includes a fix by taking only the first line using head -n 1. For more robustness, you might consider adding a check to ensure exactly one image is found and erroring out otherwise.
| for firmware in $FIRMWARES; do | |
| printf "fetching %s version: " "$firmware" | |
| firmware_var=$(echo "$firmware" | tr '[:lower:]' '[:upper:]' | tr - _)_IMAGE | |
| image=$(grep $firmware $TMPDIR/image-digests) | |
| image=$(grep -F "/$firmware:" $TMPDIR/image-digests) | |
| echo "$image" | |
| export "$firmware_var=$image" | |
| done | |
| for extension in $EXTENSIONS; do | |
| printf "fetching %s version: " "$extension" | |
| extension_var=$(echo "$extension" | tr '[:lower:]' '[:upper:]' | tr - _)_IMAGE | |
| image=$(grep $extension $TMPDIR/image-digests) | |
| image=$(grep -F "/$extension:" $TMPDIR/image-digests) | |
| echo "$image" | |
| export "$extension_var=$image" | |
| done | |
| for component in $FIRMWARES $EXTENSIONS; do | |
| printf "fetching %s version: " "$component" | |
| component_var=$(echo "$component" | tr '[:lower:]' '[:upper:]' | tr - _)_IMAGE | |
| image=$(grep -F "/$component:" "$TMPDIR/image-digests" | head -n 1) | |
| echo "$image" | |
| export "$component_var=$image" | |
| done |
There was a problem hiding this comment.
Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
packages/core/installer/hack/gen-profiles.sh(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
| @@ -15,20 +15,20 @@ echo "$talos_version" | |||
|
|
|||
| export "TALOS_VERSION=$talos_version" | |||
|
|
|||
| crane export ghcr.io/siderolabs/extensions:v1.10.6 | tar x -O image-digests > $TMPDIR/image-digests | |||
| crane export ghcr.io/siderolabs/extensions:${TALOS_VERSION} | tar x -O image-digests > $TMPDIR/image-digests | |||
There was a problem hiding this comment.
🛠️ Refactor suggestion
Fix tar invocation and harden the pipeline (current form likely breaks on many systems).
tar x -O image-digests without -f - assumes a default tape device rather than stdin; with a pipe, GNU/dash tar won’t reliably read from stdin and will fail. Also, because /bin/sh lacks set -o pipefail, a failure in crane export may not abort the script. Replace the pipeline with a two-step, fail-safe sequence and quote paths.
Apply this diff:
-crane export ghcr.io/siderolabs/extensions:${TALOS_VERSION} | tar x -O image-digests > $TMPDIR/image-digests
+crane export "ghcr.io/siderolabs/extensions:${TALOS_VERSION}" > "$TMPDIR/extensions.tar"
+tar -xO -f "$TMPDIR/extensions.tar" image-digests > "$TMPDIR/image-digests"Optional (outside this line range, but recommended): add a tempdir cleanup trap near the mktemp line:
trap 'rm -rf "$TMPDIR"' EXIT| image=$(grep -F "/$firmware:" $TMPDIR/image-digests) | ||
| echo "$image" | ||
| export "$firmware_var=$image" | ||
| done |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Make digest selection deterministic and fail-fast; quote paths.
- If multiple matches exist,
grepcan yield multiple lines, leaking newlines into env vars and breaking YAML. - If there are no matches,
grepexits 1, but inside command substitution with/bin/sh -ethe script won’t stop; you’ll silently export an empty value.
Harden with -m1, proper quoting, and an explicit error on miss.
- image=$(grep -F "/$firmware:" $TMPDIR/image-digests)
+ image=$(grep -F -m1 "/$firmware:" "$TMPDIR/image-digests") || {
+ echo "ERROR: digest for firmware '$firmware' not found in $TMPDIR/image-digests" >&2
+ exit 1
+ }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| image=$(grep -F "/$firmware:" $TMPDIR/image-digests) | |
| echo "$image" | |
| export "$firmware_var=$image" | |
| done | |
| image=$(grep -F -m1 "/$firmware:" "$TMPDIR/image-digests") || { | |
| echo "ERROR: digest for firmware '$firmware' not found in $TMPDIR/image-digests" >&2 | |
| exit 1 | |
| } | |
| echo "$image" | |
| export "$firmware_var=$image" | |
| done |
🤖 Prompt for AI Agents
In packages/core/installer/hack/gen-profiles.sh around lines 23-26, make the
grep deterministic, quote the file path, and fail-fast on no-match: use grep -F
-m1 -- "/$firmware:" "$TMPDIR/image-digests" (so at most one line and the path
is quoted), assign that to image, check if image is empty and if so print an
error to stderr and exit non‑zero, then echo the image and export the dynamic
variable name safely (e.g. using eval to export the variable name with the
quoted value) so you don't leak newlines or silently export empty values.
| image=$(grep -F "/$extension:" $TMPDIR/image-digests) | ||
| echo "$image" | ||
| export "$extension_var=$image" | ||
| done |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Apply the same deterministic, fail-fast pattern for extensions; quote paths.
Mirror the firmware fix to avoid multi-line matches and silent empties.
- image=$(grep -F "/$extension:" $TMPDIR/image-digests)
+ image=$(grep -F -m1 "/$extension:" "$TMPDIR/image-digests") || {
+ echo "ERROR: digest for extension '$extension' not found in $TMPDIR/image-digests" >&2
+ exit 1
+ }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| image=$(grep -F "/$extension:" $TMPDIR/image-digests) | |
| echo "$image" | |
| export "$extension_var=$image" | |
| done | |
| image=$(grep -F -m1 "/$extension:" "$TMPDIR/image-digests") || { | |
| echo "ERROR: digest for extension '$extension' not found in $TMPDIR/image-digests" >&2 | |
| exit 1 | |
| } | |
| echo "$image" | |
| export "$extension_var=$image" | |
| done |
🤖 Prompt for AI Agents
In packages/core/installer/hack/gen-profiles.sh around lines 31–34, the grep and
export for extensions can produce multi-line matches and silently export empty
values; change the grep to be deterministic (e.g. use fixed-string match, limit
to the first match, and quote the path/filename), assign the single-line result
to image, check if image is empty and fail-fast with a clear error and non-zero
exit if so, and set the dynamic environment variable using a safe method that
quotes both name and value (e.g. declare -x or printf -v + declare) instead of
the current unquoted export pattern.
What this PR does
Some version strings were accidentally hardcoded instead of retrieving them dynamically in the profile generator for the Talos build. This follows up #1351 and fixes these issues.
Release note
Summary by CodeRabbit
Bug Fixes
Chores