ci: replace jetify-com/devbox-install-action with our own action#1303
Open
abueide wants to merge 1 commit into
Open
ci: replace jetify-com/devbox-install-action with our own action#1303abueide wants to merge 1 commit into
abueide wants to merge 1 commit into
Conversation
Org policy blocks it outright - all actions must come from a GitHub-owned or enterprise-owned repository, and this is neither. Consolidates the previous two-step "Install devbox" + "Route Nix/devbox packages through Artifactory" sequence into one composite action (install-devbox) that does the whole bootstrap: installs Nix via the official single-user installer script (a plain run: step, not a third-party uses: - the same distinction that made the earlier codecov/codecov-action fix work), configures the Artifactory substituter, then builds/installs the patched devbox directly, rather than installing a stock binary first and overwriting it afterward. No other workflow in this repo references a non-GitHub-owned action - checked ci.yml, release.yml, e2e-tests.yml, and publish-e2e-cli.yml; everything else is already actions/* and SHA-pinned.
2 tasks
abueide
added a commit
that referenced
this pull request
Jul 22, 2026
* ci: release without devbox/Nix as a stopgap release.yml's Install devbox step still uses jetify-com/devbox-install-action, which is blocked outright by org policy (third-party action) - #1303 fixes that properly, but it and the underlying Nix/Artifactory work (segmentio analytics-react-native #1301/#1302, twilio-internal artifactory-cloud-twilio-config #11/#12) aren't merged yet, and releases are blocked in the meantime. Removes devbox from every job in release.yml and runs the exact same commands devbox.json already ran, directly: - ci:install / release / release-dry-run / update-apps scripts translated 1:1 to their underlying yarn invocations - actions/setup-node (node 22, matching devbox.json's pin) + corepack enable in place of devbox's nix-provided yarn-berry, to get the packageManager-pinned yarn@4.1.0 - Artifactory OIDC Auth step is untouched - that's about npm/yarn package curation, unrelated to the devbox/Nix bootstrap problem This overlaps with #1303: once devbox/Nix + Artifactory is fully working and merged, this stopgap should be reconciled or reverted rather than left alongside it long-term. Not verified end-to-end (no way to safely test corepack/yarn locally without touching this machine's global Node setup) - the intended next step is a real `dry-run` release via workflow_dispatch to confirm before trusting it for beta/production. * ci: port ci.yml to the same devbox-free checks as release.yml ci.yml's Lint + Build + Test / Commitlint jobs both used jetify-com/devbox-install-action, confirmed via run history to fail with startup_failure on every single run going back weeks (the blocked-action policy, not a code problem) - this was blocking every PR check on the repo, not just releases. Ports both jobs to the exact same commands release.yml's own ci job already uses (added in the previous commit): actions/setup-node + corepack enable + plain yarn invocations, no devbox. The two "Lint + Build + Test" jobs are now identical, so release.yml's needs: [ci] gate is the same check PRs already have to pass. Also disables e2e-tests.yml's push/pull_request triggers for now - unlike ci.yml, this one doesn't use devbox at all and never hit startup_failure; its recent runs show stuck queued/cancelled instead, a separate, still-unresolved runner-availability issue. Left as workflow_dispatch-only until that's confirmed healthy, rather than porting it to "fix" a problem it doesn't actually have.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Org policy blocks
jetify-com/devbox-install-actionoutright - all actions must come from a GitHub-owned or enterprise-owned repository, and this is neither.Consolidates the previous two-step "Install devbox" + "Route Nix/devbox packages through Artifactory" sequence (from #1302) into one composite action (
install-devbox) that does the whole bootstrap:run:step, not a third-partyuses:- the same distinction that made the earliercodecov/codecov-actionfix work)Verified
ci.yml,release.yml,e2e-tests.yml,publish-e2e-cli.yml) - no other non-GitHub-owned action references exist; everything else is alreadyactions/*and SHA-pinneddevbox run checkpasses locally (70 suites, 492 tests)Test plan