[delete-cloud]

Summary

• mount the SRE-provided Woodpecker runner cache PVC in lint-and-smoke-tests
• set pip to use /cache/pip/coding-agent-loop for reusable dependency downloads
• leave build-image and build-deploy-tools unchanged

Verification

• git diff --check -- .
• woodpecker-cli lint .woodpecker/ci.yml
• woodpecker-cli lint --strict .woodpecker/ci.yml
• subagent review: no P1/P2 findings

Rollout notes

• Woodpecker repo state currently has trusted.volumes=false for kina/Coding-Agent-Loop.
• Before expecting this workflow to run on Forgejo/Woodpecker, enable trusted volumes deliberately for this repo or the volume mount will be rejected.
• trusted volumes are repo/workflow-author scoped, not limited to this single PVC; keep fork PR approval in place and treat the cache as disposable.

Summary by CodeRabbit

• Chores
  • Improved CI pipeline efficiency by adding a persistent download cache for package installs during lint and smoke tests.

[coderabbitai]

📝 Walkthrough

Walkthrough

The lint-and-smoke-tests CI pipeline step in .woodpecker/ci.yml is updated to set a PIP_CACHE_DIR environment variable and mount a persistent woodpecker-runner-cache volume at /cache, enabling pip download caching across runs.

Changes

CI Pip Cache Update

Layer / File(s)	Summary
Pip cache environment and volume mount .woodpecker/ci.yml	Adds PIP_CACHE_DIR environment variable pointing to a cache path under /cache, and mounts the woodpecker-runner-cache volume at /cache for the lint-and-smoke-tests step.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• delete-cloud/Coding-Agent-Loop#642: Also modifies the same lint-and-smoke-tests/lint and smoke-tests step environment in .woodpecker/ci.yml, adding pip-related environment variables.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: configuring Woodpecker CI to use the runner pip cache.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/woodpecker-runner-cache

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.woodpecker/ci.yml (1)

13-15: 🔒 Security & Privacy | 🔵 Trivial

Shared, persistent pip cache is a soft cache-poisoning vector.

PIP_CACHE_DIR now points into a persistent PVC shared across all runs of this step. Since trusted volumes are repo/workflow-author scoped rather than PVC-scoped (per the PR's own rollout notes), any trusted-but-compromised commit or dependency resolved once could leave poisoned wheels/sdists in the shared cache for reuse by later runs, including main-branch builds. The PR notes treat the cache as "disposable," but there's no periodic invalidation or integrity check tied to that assumption in this config.

Consider documenting/automating a cache-clearing cadence (or hash-pinning pip install inputs) so a stale/poisoned cache entry can't silently persist indefinitely.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.woodpecker/ci.yml around lines 13 - 15, The shared PIP_CACHE_DIR in the
Woodpecker CI step can persist poisoned pip artifacts across runs, so update the
CI configuration to avoid relying on an indefinitely shared cache. In the
.woodpecker/ci.yml step that sets PIP_CACHE_DIR and mounts the volume, add a
cache-clearing or rotation mechanism tied to the pip install workflow, or
enforce hash-pinned dependency inputs so cached wheels/sdists cannot be reused
silently. Keep the guidance close to the existing pip cache setup and the runner
cache volume definition.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.woodpecker/ci.yml:
- Around line 13-15: The shared PIP_CACHE_DIR in the Woodpecker CI step can
persist poisoned pip artifacts across runs, so update the CI configuration to
avoid relying on an indefinitely shared cache. In the .woodpecker/ci.yml step
that sets PIP_CACHE_DIR and mounts the volume, add a cache-clearing or rotation
mechanism tied to the pip install workflow, or enforce hash-pinned dependency
inputs so cached wheels/sdists cannot be reused silently. Keep the guidance
close to the existing pip cache setup and the runner cache volume definition.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4f5ddd8e-f583-4bb9-b85a-5401ed193ac8

📥 Commits

Reviewing files that changed from the base of the PR and between 2244e01 and a5e5f4e.

📒 Files selected for processing (1)

• .woodpecker/ci.yml