ci: build docker image on PRs / tags#2353
Conversation
WalkthroughThe CI workflows were updated by adding a dynamic Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub Actions
participant build-docker-image
participant GHCR
participant upgrade-tests
GitHub Actions->>build-docker-image: Start job with image-tag input
build-docker-image->>GHCR: Login and push Docker image (tagged with image-tag)
build-docker-image-->>upgrade-tests: On success, trigger upgrade-tests
upgrade-tests->>upgrade-tests: Run placeholder step (TODO: add upgrade tests)
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
The latest Buf updates on your PR. Results from workflow CI and Release / buf-check (pull_request).
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Log in to GHCR | ||
| uses: docker/login-action@v3 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and push Docker image with PR tag | ||
| uses: docker/build-push-action@v5 |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #2353 +/- ##
=======================================
Coverage 65.91% 65.91%
=======================================
Files 66 66
Lines 6140 6140
=======================================
Hits 4047 4047
Misses 1724 1724
Partials 369 369 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
chatton
changed the title
| name: Build Docker Image | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Log in to GHCR | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and push Docker image with PR tag | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . | ||
| push: true | ||
| tags: ghcr.io/${{ github.repository_owner }}/rollkit:${{ inputs.image-tag }} | ||
|
|
||
| upgrade-tests: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the issue, we need to add a permissions block to the workflow. This block should specify the least privileges required for the workflow to function correctly. Based on the steps in the workflow:
- The
docker/login-actionstep requirescontents: readto authenticate using theGITHUB_TOKEN. - Other steps in the workflow do not appear to require additional permissions.
The permissions block should be added at the root level of the workflow to apply to all jobs, as none of the jobs require write permissions.
| @@ -3,2 +3,4 @@ | ||
| name: Tests / Code Coverage | ||
| permissions: | ||
| contents: read | ||
| on: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/test.yml (2)
19-31: Pin GitHub Action versions for immutability
To ensure reproducible and secure runs, pin third-party actions to specific commit SHAs instead of floating version tags (@v3,@v5).🧰 Tools
🪛 GitHub Check: CodeQL
[warning] 20-20: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash
[warning] 23-23: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/login-action' with ref 'v3', not a pinned commit hash
[warning] 30-30: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/build-push-action' with ref 'v5', not a pinned commit hash
37-41: Implement the upgrade-tests placeholder
Theupgrade-testsjob currently exits immediately. Add real upgrade-test steps or remove the placeholder if not needed, and consider opening an issue to track this enhancement.🧰 Tools
🪛 GitHub Check: CodeQL
[warning] 37-42: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{}}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/workflows/ci_release.yml(1 hunks).github/workflows/docker-build-publish.yml(0 hunks).github/workflows/test.yml(1 hunks)
💤 Files with no reviewable changes (1)
- .github/workflows/docker-build-publish.yml
🧰 Additional context used
🪛 GitHub Check: CodeQL
.github/workflows/test.yml
[warning] 13-36: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}
[warning] 20-20: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash
[warning] 23-23: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/login-action' with ref 'v3', not a pinned commit hash
[warning] 30-30: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/build-push-action' with ref 'v5', not a pinned commit hash
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Summary
🔇 Additional comments (2)
.github/workflows/ci_release.yml (1)
32-35: Approve dynamic image-tag derivation
The expression correctly falls back topr-<number>for pull requests and uses the branch or tag name otherwise..github/workflows/test.yml (1)
6-10: Well-definedimage-taginput parameter
The required string inputimage-tagforworkflow_callis clearly specified and correctly typed.
| name: Build Docker Image | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Log in to GHCR | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and push Docker image with PR tag | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . | ||
| push: true | ||
| tags: ghcr.io/${{ github.repository_owner }}/rollkit:${{ inputs.image-tag }} | ||
|
|
||
| upgrade-tests: |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add explicit permissions block for least-privilege
This workflow currently inherits default token permissions, which may be overly permissive. Define a top-level permissions: block (e.g., contents: read, packages: write) to restrict GITHUB_TOKEN to only the scopes needed for build and push operations.
🧰 Tools
🪛 GitHub Check: CodeQL
[warning] 13-36: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}
[warning] 20-20: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash
[warning] 23-23: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/login-action' with ref 'v3', not a pinned commit hash
[warning] 30-30: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/build-push-action' with ref 'v5', not a pinned commit hash
🤖 Prompt for AI Agents
In .github/workflows/test.yml around lines 13 to 36, the workflow lacks an
explicit permissions block, causing the GITHUB_TOKEN to have default,
potentially excessive permissions. Add a top-level permissions section
specifying only the necessary scopes, such as 'contents: read' and 'packages:
write', to enforce least-privilege access for the build and push steps.
<!-- Please read and fill out this form before submitting your PR. Please make sure you have reviewed our contributors guide before submitting your first PR. NOTE: PR titles should follow semantic commits: https://www.conventionalcommits.org/en/v1.0.0/ --> ## Overview This PR adds a workflow which will build the rollkit image on each PR, in a follow up we can use this image to perform upgrade tests. If it's on a PR, it will be tagged like `pr-1234`, if it's a tag or main it will be tagged with the format `v1.0.0` or `main`. <!-- Please provide an explanation of the PR, including the appropriate context, background, goal, and rationale. If there is an issue with this information, please provide a tl;dr and link the issue. Ex: Closes #<issue number> --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Chores** - Updated continuous integration workflows to support dynamic Docker image tagging for test jobs. - Added automated building and publishing of Docker images during testing. - Introduced a placeholder for future upgrade tests. - Removed the separate Docker build and publish workflow to streamline processes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Please read and fill out this form before submitting your PR. Please make sure you have reviewed our contributors guide before submitting your first PR. NOTE: PR titles should follow semantic commits: https://www.conventionalcommits.org/en/v1.0.0/ --> ## Overview This PR adds a workflow which will build the rollkit image on each PR, in a follow up we can use this image to perform upgrade tests. If it's on a PR, it will be tagged like `pr-1234`, if it's a tag or main it will be tagged with the format `v1.0.0` or `main`. <!-- Please provide an explanation of the PR, including the appropriate context, background, goal, and rationale. If there is an issue with this information, please provide a tl;dr and link the issue. Ex: Closes #<issue number> --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Chores** - Updated continuous integration workflows to support dynamic Docker image tagging for test jobs. - Added automated building and publishing of Docker images during testing. - Introduced a placeholder for future upgrade tests. - Removed the separate Docker build and publish workflow to streamline processes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
3 participants
Overview
This PR adds a workflow which will build the rollkit image on each PR, in a follow up we can use this image to perform upgrade tests.
If it's on a PR, it will be tagged like
pr-1234, if it's a tag or main it will be tagged with the formatv1.0.0ormain.Summary by CodeRabbit