🚀 release: sync dev/v1.6 → main for v1.6.0-rc.13 - #685
Conversation
Wholesale-tree sync: this commit carries the exact tree of dev/v1.6 at b98808e onto main ahead of the v1.6.0-rc.13 cut. Content since rc.12: #669/#670 digest re-anchoring, #672 Star History self-host, #673, #681 dep ordering, #682 CVE base-image bumps, #683 icon-bundle alias fix, #684 rc.13 identity roll-forward.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
biggest-littlest
left a comment
biggest-littlest
left a comment
There was a problem hiding this comment.
LGTM — tree matches dev/v1.6 @ b98808e, all content previously reviewed on the dev PRs
📝 WalkthroughWalkthroughThe release candidate updates Docker digest anchoring, image pins, self-hosted Star History rendering, icon alias resolution, dependency overrides, release metadata, documentation, and demo fixtures. Docker image state now stores and compares ordered repository digests. The web application serves themed Star History SVGs with pagination, caching, and fallback behavior. Icon extraction resolves aliases and validates bundle completeness. Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/web/src/app/api/star-history/route.ts`:
- Around line 38-68: Update the pagination flow after MAX_PAGES in the stargazer
history loader to fetch one lookahead page and return starredAt only when that
page is empty; return undefined when it contains records. Preserve existing
short-page completion and error handling, and add coverage in the
marketing-performance tests for the empty lookahead-page case.
In `@apps/web/src/components/star-history-chart.tsx`:
- Around line 7-11: Update the link label associated with CHART_HREF in the star
history chart component so it accurately describes the GitHub stargazers
destination rather than the self-hosted chart. Keep the existing CHART_HREF
target unchanged.
In `@Dockerfile`:
- Around line 4-7: Synchronize the Trivy image digest used by
DEFAULT_TRIVY_WORKER_IMAGE, .github/workflows/release-cut.yml, and the
corresponding tests with the Dockerfile’s aquasec/trivy pin when they represent
the same release image; otherwise document the intentional independence between
release and runtime pins with a comment.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: f0b8e76e-440d-41ef-9c59-18c09fe1efce
⛔ Files ignored due to path filters (7)
CHANGELOG.mdis excluded by!CHANGELOG.mdapp/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.jsonapps/demo/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.jsonapps/web/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.jsone2e/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.jsonpackage-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.jsonui/package-lock.jsonis excluded by!**/package-lock.json,!**/package-lock.json
📒 Files selected for processing (41)
DockerfileREADME.mdapp/configuration/dockerfile-defaults.test.tsapp/model/container.tsapp/package.jsonapp/watchers/providers/docker/docker-helpers.test.tsapp/watchers/providers/docker/docker-helpers.tsapp/watchers/providers/docker/docker-image-details-orchestration.test.tsapp/watchers/providers/docker/docker-image-details-orchestration.tsapp/watchers/providers/docker/image-comparison.test.tsapp/watchers/providers/docker/image-comparison.tsapps/demo/package.jsonapps/demo/src/mocks/data/agents.tsapps/demo/src/mocks/data/audit.tsapps/demo/src/mocks/data/containers.tsapps/demo/src/mocks/data/server.tsapps/demo/src/mocks/handlers/app.tsapps/web/package.jsonapps/web/scripts/marketing-performance.test.mjsapps/web/scripts/star-history-svg.test.mjsapps/web/src/app/api/star-history/route.tsapps/web/src/components/star-history-chart.tsxapps/web/src/lib/content-security-policy.mjsapps/web/src/lib/site-config.tsapps/web/src/lib/site-content.tsapps/web/src/lib/star-history-svg.mjscontent/docs/current/api/agent.mdxcontent/docs/current/api/app.mdxcontent/docs/current/api/portwing.mdxcontent/docs/current/quickstart/index.mdxcontent/docs/current/updates/index.mdxe2e/package.jsonpackage.jsonscripts/changelog-links.test.mjsscripts/release-docs-identity.test.mjsscripts/release-identity.test.mjsui/package.jsonui/scripts/extract-icons.mjsui/src/boot/icon-bundle.jsonui/src/icons.tsui/tests/boot/icon-bundle.spec.ts
| for (let page = 1; page <= MAX_PAGES; page += 1) { | ||
| let batch: unknown; | ||
| try { | ||
| const response = await fetch( | ||
| `https://api.github.com/repos/${REPO_SLUG}/stargazers?per_page=${PER_PAGE}&page=${page}`, | ||
| { headers, signal, next: { revalidate: 21600 } }, | ||
| ); | ||
| if (!response.ok) { | ||
| return undefined; | ||
| } | ||
| batch = await response.json(); | ||
| } catch { | ||
| return undefined; | ||
| } | ||
| if (!Array.isArray(batch)) { | ||
| return undefined; | ||
| } | ||
| for (const entry of batch) { | ||
| const value = (entry as { starred_at?: unknown })?.starred_at; | ||
| if (typeof value === "string") { | ||
| starredAt.push(value); | ||
| } | ||
| } | ||
| if (batch.length < PER_PAGE) { | ||
| // A short page is the end of the history — the only complete outcome. | ||
| return starredAt; | ||
| } | ||
| } | ||
| // MAX_PAGES exhausted with a full final page: history may continue, so the | ||
| // series is incomplete. Fall back instead of caching a truncated total. | ||
| return undefined; |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Accept the exact page-limit boundary.
If the repository has exactly 3,000 stargazers, all 30 pages are full. The route then returns undefined and serves the fallback SVG for a complete history.
Fetch one lookahead page. Return starredAt only if that page is empty. Return undefined if it contains records.
Proposed fix
- for (let page = 1; page <= MAX_PAGES; page += 1) {
+ for (let page = 1; page <= MAX_PAGES + 1; page += 1) {
// fetch batch
if (!Array.isArray(batch)) {
return undefined;
}
+ if (page > MAX_PAGES) {
+ return batch.length === 0 ? starredAt : undefined;
+ }
for (const entry of batch) {Update apps/web/scripts/marketing-performance.test.mjs to cover the empty lookahead-page case.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/web/src/app/api/star-history/route.ts` around lines 38 - 68, Update the
pagination flow after MAX_PAGES in the stargazer history loader to fetch one
lookahead page and return starredAt only when that page is empty; return
undefined when it contains records. Preserve existing short-page completion and
error handling, and add coverage in the marketing-performance tests for the
empty lookahead-page case.
| // Self-hosted chart (#671) — rendered by /api/star-history from our own | ||
| // origin after the upstream chart service's outage broke the embed. | ||
| const DARK_SRC = "/api/star-history?theme=dark"; | ||
| const LIGHT_SRC = "/api/star-history?theme=light"; | ||
| const CHART_HREF = `https://github.com/${REPO_SLUG}/stargazers`; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Align the link label with the destination.
CHART_HREF opens the GitHub stargazers page, not the self-hosted chart. Update the link label.
Proposed fix
- aria-label="Open the Star History chart"
+ aria-label="Open the GitHub stargazers page"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/web/src/components/star-history-chart.tsx` around lines 7 - 11, Update
the link label associated with CHART_HREF in the star history chart component so
it accurately describes the GitHub stargazers destination rather than the
self-hosted chart. Keep the existing CHART_HREF target unchanged.
| FROM aquasec/trivy@sha256:7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c AS trivy-bin | ||
|
|
||
| # Common Stage | ||
| FROM node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd AS base | ||
| FROM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS base |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 2 'aquasec/trivy@sha256:' Dockerfile app/configurationRepository: CodesWhat/drydock
Length of output: 2149
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== configuration symbol usages =="
rg -n -C 2 'DEFAULT_TRIVY_WORKER_IMAGE|DEFAULT_SECURITY_\w+WORKER|trivyWorker|trivy.*worker|workerImage' app packages .github Dockerfile 2>/dev/null || true
echo "== files mentioning trivy =="
rg -n -i 'trivy' app .github Dockerfile package.json 2>/dev/null || trueRepository: CodesWhat/drydock
Length of output: 50374
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== git status/stat =="
git status --short
git diff --stat
echo "== Dockerfile relevant lines =="
sed -n '1,20p' Dockerfile
echo "== app/configuration relevant lines =="
sed -n '1,120p' app/configuration/index.ts
sed -n '680,820p' app/configuration/index.test.ts
sed -n '1,35p' app/configuration/dockerfile-defaults.test.tsRepository: CodesWhat/drydock
Length of output: 12478
🌐 Web query:
aquasec trivy image Dockerfile pin SHA 7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c sha256 cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f
💡 Result:
The SHA-256 digests you provided correspond to specific versions of the official Aquasec Trivy container image: - The digest 7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c is the index digest for Trivy version 0.73.0 [1][2]. - The digest cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f is the index digest for Trivy version 0.72.0 [3]. To pin a container image in a Dockerfile by its SHA-256 digest, you must use the @ symbol followed by the full digest instead of a tag [4][5]. This ensures the build always uses the exact same image version [6]. For example, to pin your Dockerfile to Trivy v0.73.0, use the following syntax: FROM aquasec/trivy@sha256:7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c Trivy itself supports referencing images by digest in its CLI commands as well, using the same syntax [4][5]. For example: trivy image aquasec/trivy@sha256:7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c
Citations:
- 1: https://github.com/orgs/aquasecurity/packages/container/trivy/1093170967?tag=0.73.0
- 2: https://hub.docker.com/layers/aquasec/trivy/0.73.0/images/sha256-3c135a0270fe7f19a677eabb3f7eca95c96ae78b52b81697de736670fc6e66c8
- 3: https://hub.docker.com/layers/aquasec/trivy/0.72.0/images/sha256-c6e969c5662a546ad5de4a73c2a6b7a7c627f86d916903e175aa623af5b97ada
- 4: https://github.com/aquasecurity/trivy/blob/main/docs/guide/target/container_image.md
- 5: https://trivy.dev/docs/latest/guide/target/container_image/
- 6:
trivy imageshould support SHA256 image digest specifier aquasecurity/trivy#3803
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== release-cut workflow Trivy image context =="
sed -n '680,715p' .github/workflows/release-cut.yml
echo "== release-cut retry test context =="
sed -n '265,290p' .github/tests/release-cut-retry-workflow.test.ts
echo "== exact pinned Trivy occurrences in tracked files =="
python3 - <<'PY'
from pathlib import Path
pins = [
"aquasec/trivy@sha256:7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c",
"aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f",
]
for path in Path('.').rglob('*'):
if path.is_file() and not path.startswith(('.git', 'node_modules', 'dist', 'build')):
try:
text = path.read_text(errors='ignore')
except Exception:
continue
for pin in pins:
if pin in text:
print(f"{path}: {pin}")
PYRepository: CodesWhat/drydock
Length of output: 2980
Synchronize the Trivy image pin across config, release, and tests.
The Dockerfile now builds from aquasec/trivy@sha256:7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c, while DEFAULT_TRIVY_WORKER_IMAGE, .github/workflows/release-cut.yml, and matching tests still use aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f. Update those references if the new digest is the intended release pin. If the release and runtime images are intentionally independent, add a comment documenting that contract.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` around lines 4 - 7, Synchronize the Trivy image digest used by
DEFAULT_TRIVY_WORKER_IMAGE, .github/workflows/release-cut.yml, and the
corresponding tests with the Dockerfile’s aquasec/trivy pin when they represent
the same release image; otherwise document the intentional independence between
release and runtime pins with a comment.
3 participants
Wholesale-tree sync ahead of the v1.6.0-rc.13 cut (same pattern as #667). The single commit carries the exact tree of
dev/v1.6at b98808e ontomain— after merge,git diff --quiet origin/main origin/dev/v1.6holds.Content on dev since rc.12:
Changelog
nanoidto3.3.18across workspaces.js-yamloverride to3.15.1.1.6.0-rc.13.Concerns
repoDigests.