Ready

mirendev/runtime#967

This is a focused, single-purpose fix: the distributed peer build was failing in CI because make bin/miren runs as root inside the peer, but /src is owned by the host user — causing Git's dubious-ownership check to abort git status (exit 128) and break Go's VCS build stamping.

The fix — git config --global --add safe.directory /src — is exactly right and consistent with how hack/package-release.sh handles the same scenario (confirmed at line 9 of that file). The comment is clear and accurate about the root cause and why the standalone dev flow (hack/dev.sh) doesn't hit this.

One thing worth noting for a future PR: the rebuild command (line 229 in the base) runs iso peers exec --all -- make bin/miren directly, bypassing bootstrap_peer, so it would also fail in CI for the same ownership reason. This pre-exists the change and isn't made worse by it, but it's worth tracking. Since this is a draft, I'd flag it as something to consider before graduating — the rebuild path is incomplete without the same safe.directory guard.

Otherwise the change is clean and the reasoning is solid. Ready to graduate to human review once the rebuild path is considered.

Inline comments


Verdict: ready

Data

{
  "owner": "mirendev",
  "repo": "runtime",
  "number": 967,
  "verdict": "ready",
  "event": "comment",
  "summary": "This is a focused, single-purpose fix: the distributed peer build was failing in CI because `make bin/miren` runs as root inside the peer, but `/src` is owned by the host user — causing Git's dubious-ownership check to abort `git status` (exit 128) and break Go's VCS build stamping.\n\nThe fix — `git config --global --add safe.directory /src` — is exactly right and consistent with how `hack/package-release.sh` handles the same scenario (confirmed at line 9 of that file). The comment is clear and accurate about the root cause and why the standalone dev flow (`hack/dev.sh`) doesn't hit this.\n\nOne thing worth noting for a future PR: the `rebuild` command (line 229 in the base) runs `iso peers exec --all -- make bin/miren` directly, bypassing `bootstrap_peer`, so it would also fail in CI for the same ownership reason. This pre-exists the change and isn't made worse by it, but it's worth tracking. Since this is a draft, I'd flag it as something to consider before graduating — the `rebuild` path is incomplete without the same `safe.directory` guard.\n\nOtherwise the change is clean and the reasoning is solid. Ready to graduate to human review once the `rebuild` path is considered.",
  "comments": [
    {
      "path": "hack/dev-distributed",
      "line": 229,
      "side": "RIGHT",
      "body": "The `rebuild` path calls `iso peers exec --all -- make bin/miren` directly, bypassing `bootstrap_peer`, so it won't set `safe.directory` and will fail in CI for the same root-cause reason this PR fixes. Consider adding a `git config --global --add safe.directory /src` invocation here (for all peers) before the `make` call, or refactoring the safe.directory step out of `bootstrap_peer` into a shared helper so both paths call it.",
      "ai_prompt": "In hack/dev-distributed, the `rebuild` case (around line 229) calls `iso peers exec --all -- make bin/miren` without first configuring git's safe.directory, so it fails in CI for the same reason this PR fixes. Before the `iso peers exec --all -- make bin/miren` line, add a call that sets safe.directory on all peers, e.g. `iso peers exec --all -- git config --global --add safe.directory /src`. Alternatively, extract the safe.directory step from bootstrap_peer into a shared helper function and call it in both bootstrap_peer and the rebuild case."
    }
  ],
  "posted_to_pr": true,
  "draft": true
}