[svonava]

Policy can exhaust its 15-minute budget while installing tools it never uses. In PR656 attempt 2, setup spent about 12 minutes downloading mise, then installed the full toolset and was cancelled while compiling cargo-deny; none of the three Policy checks ran.

Install only the repository-pinned Python, uv, and actionlint for Policy, and explicitly select those tools for every mise exec so later commands cannot lazily install the remaining toolchains. All three checks remain mandatory. The full fresh-bootstrap and Rust audit lanes, tool/action versions, permissions, caching, and job limits are unchanged. This removes unnecessary setup work; it does not guarantee completion during an arbitrarily slow mise download.

Validation:

• 133 focused CI contract/public-tree tests passed; seven additional mutation controls include six expected refusals for full installs, implicit tool activation, missing checks, and changed tool selection.
• With the exact CI mise 2026.5.5 binary in an isolated macOS arm64 directory, the cold three-tool install and all three Policy checks passed. Only Python 3.12.12, uv 0.5.31, and actionlint 1.7.7 were installed afterward; Rust, cargo tools, and Node remained absent.
• Scoped Ruff/format checks passed. Linux runner validation will come from this PR’s ordinary CI; no workflow was blindly retried.

Summary by CodeRabbit

• Chores
  • Updated the policy CI job to select Python, uv, and actionlint explicitly when running checks.
  • Added checks to verify the policy workflow’s tool setup and commands.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Team
• Run ID: 2560f40c-fc76-4edc-b627-dea3aade5c11

📥 Commits

Reviewing files that changed from the base of the PR and between 947c1d6 and 64a7f3d.

📒 Files selected for processing: 2

• .github/workflows/ci.yml
• tools/ci/tests/test_required_ci.py

Included review availability: This review used your included allowance. 8 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

📝 Walkthrough

The policy job installs Python, uv, and actionlint, then selects them with mise exec --no-deps for its checks. CI tests verify the tool installation and command arguments.

Changes: Policy CI tool selection

Layer / File(s)	Summary
Policy job tool setup and checks .github/workflows/ci.yml, tools/ci/tests/test_required_ci.py	The policy job installs Python, uv, and actionlint, then explicitly selects them for pytest, the public-tree check, and actionlint. Tests verify the install arguments and all three commands.

Suggested reviewers: huronat

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 64a7f

The policy job now limits setup to and explicitly selects its pinned Python, uv, and actionlint tools. The supplied validation reports the checks passed, with no concrete merge-blocking risk identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: limiting Policy setup to its pinned tools.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}