Ubuntu desktop role - #337
Merged
Merged
Conversation
Contributor
|
Warning Review limit reached
More reviews will be available in 15 minutes and 2 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
WalkthroughAdds an ubuntu_desktop Ansible role (snap, Chrome, RustDesk, Sunshine), integrates it into the homelab playbook, refactors apply-* scripts to pass explicit inventory files, moves ChangesUbuntu Desktop Infrastructure
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ansible/apply-localhost.sh`:
- Line 9: The script currently uses --limit "$(hostname)" which can miss the
inventory host alias; replace the runtime hostname usage with the inventory
alias (e.g., --limit "local-debian") or read a variable (e.g.,
INVENTORY_LOCAL_ALIAS) and pass that to --limit so the play targets the
inventory entry mapped in ansible/inventory/inventory.yaml (the current symbol
to change is the --limit "$(hostname)" argument in apply-localhost.sh).
In `@ansible/roles/ubuntu_desktop/tasks/40-sunshine.yaml`:
- Around line 20-23: Add a checksum to the ansible.builtin.get_url task that
downloads the Sunshine .deb to /tmp/sunshine.deb: fetch the SHA256 from the
release checksums file for the release identified by
ubuntu_desktop_sunshine_version and set the checksum: field on the get_url task
(using the "sha256:<hex>" form) so ansible verifies the artifact before the
installation step that uses /tmp/sunshine.deb.
- Around line 22-29: The tasks that download and install Sunshine use a fixed,
predictable path (/tmp/sunshine.deb) which is unsafe under privilege escalation;
replace that with a unique private temp file created by ansible.builtin.tempfile
and reuse that variable for download, the ansible.builtin.apt deb parameter, and
cleanup. Locate the tasks named "Install Sunshine" (and the earlier download
task that sets dest: /tmp/sunshine.deb) and change them to call
ansible.builtin.tempfile to register a temp path (e.g., register: sunshine_deb),
reference sunshine_deb.path for get_url/download and for the ansible.builtin.apt
deb: parameter, and remove the fixed /tmp path and add a final cleanup task to
file: state=absent path={{ sunshine_deb.path }}.
In `@config-example/ansible/inventory/group_vars/debian/secret.yaml`:
- Around line 3-4: Remove the inline KICS suppression comment "# kics-scan
ignore-line" from the template so the scanner can detect accidental plaintext
secrets; replace the hardcoded admin_password placeholder with a non-secret
template value (e.g. empty string or "<REPLACE_WITH_VAULT_SECRET>") and
document/migrate the real secret into Ansible Vault or environment-backed secret
management, and ensure the secret.yaml template remains tracked while actual
secrets are stored encrypted or excluded (admin_password reference).
In `@scripts/labctl.py`:
- Around line 14-18: The current broad ImportError around "import yaml" can hide
errors raised from within the yaml package; change the except to only handle
missing module by catching ModuleNotFoundError (or check e.name == "yaml") for
the "import yaml" statement and print the install message in that case, while
re-raising any other ImportError/Exception so internal package errors aren't
masked; locate the try/except around the "import yaml" line in scripts/labctl.py
and implement the selective handling (e.g., except ModuleNotFoundError:
print...; except Exception: raise).
In `@scripts/requirements.txt`:
- Around line 1-2: The requirements file currently lists unpinned dependencies
`pyyaml` and `requests` in scripts/requirements.txt; update this by pinning them
to exact, audited versions (e.g., match repo standards like pyyaml==6.0.3 or the
vetted version you choose and a specific requests==<version>) or replace the
file with a generated constraints/lock file and reference it from
scripts/requirements.txt; then add/verify a CI step that runs pip-audit against
that pinned/locked requirements to fail on vulnerabilities.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b8e17774-2737-4c88-86af-694eb513c7eb
📒 Files selected for processing (14)
ansible/apply-cloud.shansible/apply-homelab.shansible/apply-localhost.shansible/inventory/group_vars/debian/vars.yamlansible/playbooks/homelab.yamlansible/roles/ubuntu_desktop/defaults/main.yamlansible/roles/ubuntu_desktop/tasks/10-snap.yamlansible/roles/ubuntu_desktop/tasks/20-chrome.yamlansible/roles/ubuntu_desktop/tasks/30-rustdesk.yamlansible/roles/ubuntu_desktop/tasks/40-sunshine.yamlansible/roles/ubuntu_desktop/tasks/main.yamlconfig-example/ansible/inventory/group_vars/debian/secret.yamlscripts/labctl.pyscripts/requirements.txt
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pre-commit.yml:
- Around line 9-27: For both jobs audit-scripts and audit-infra-mcp, restrict
GITHUB_TOKEN to read-only and stop persisting checkout credentials: add a
permissions: block (e.g., permissions: contents: read) at the job level (or
top-level) and update each actions/checkout step to include persist-credentials:
false (on the Checkout steps that use actions/checkout@de0fac2e...). This
ensures the audit jobs only get read access and do not retain credentials in git
config.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4bee8d63-a677-4acc-be83-d4927093f028
⛔ Files ignored due to path filters (1)
scripts/infra-mcp/uv.lockis excluded by!**/*.lock
📒 Files selected for processing (3)
.github/workflows/pre-commit.ymlansible/roles/ubuntu_desktop/tasks/40-sunshine.yamlscripts/requirements.txt
🚧 Files skipped from review as they are similar to previous changes (2)
- scripts/requirements.txt
- ansible/roles/ubuntu_desktop/tasks/40-sunshine.yaml
bubacoder
force-pushed
the
feature/ubuntu-desktop-role
branch
from
June 6, 2026 14:47
3c55f74 to
caa810b
Compare
bubacoder
force-pushed
the
feature/ubuntu-desktop-role
branch
from
June 6, 2026 15:05
caa810b to
876b7f7
Compare
bubacoder
force-pushed
the
feature/ubuntu-desktop-role
branch
from
June 6, 2026 15:21
876b7f7 to
b6e0818
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Chores
Bug Fixes