ci: build evm single app on PRs#2381
Conversation
WalkthroughThe workflow for building Docker images was updated: the main job was renamed, and a new job was added to build and push a Docker image for the EVM single app. The EVM single app's Dockerfile was refactored to streamline and clarify the build process, removing manual instructions. Changes
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
The latest Buf updates on your PR. Results from workflow CI and Release / buf-check (pull_request).
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @chatton, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request focuses on enhancing the continuous integration pipeline for the evm-single application by updating its Dockerfile. My primary goal is to enable the automated building and pushing of the evm-single Docker image to the GitHub Container Registry (GHCR) on pull requests, which will facilitate more robust and integrated testing, particularly with tastora.
Highlights
- Dockerfile Refactor: I've refactored the
apps/evm/single/Dockerfileto implement a multi-stage build process. This change streamlines the image creation by performing the Go binary compilation within the Dockerfile itself, rather than relying on a pre-built binary or external build steps. - Build Process Integration: The
evm-singleapplication's Go binary is now built directly inside thebuild-envstage of the Dockerfile usingCGO_ENABLED=0 GOOS=linux go build -o evm-single .. This ensures a self-contained, statically linked binary suitable for the final Alpine image. - Dependency Addition: I've added
ca-certificatesto the final Alpine image (RUN apk --no-cache add ca-certificates). This is crucial for enabling secure network communication within the container, such as fetching external resources or interacting with APIs. - Binary Copy Path Update: The
COPY --from=build-envinstruction has been updated to reflect the correct path of the compiled binary within the build stage (/src/apps/evm/single/evm-single), ensuring the application executable is correctly placed in the final image.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| WORKDIR /src | ||
|
|
||
| COPY . . |
There was a problem hiding this comment.
Consider copying go.mod and go.sum and running go mod download in a separate step before copying the source code to leverage Docker layer caching. This way, the dependency layer is only rebuilt when go.mod or go.sum change.
COPY go.mod go.sum ./
RUN go mod download
COPY . .
|
|
||
| WORKDIR /src/apps/evm/single | ||
| RUN CGO_ENABLED=0 GOOS=linux go build -o evm-single . | ||
|
|
There was a problem hiding this comment.
Run go mod tidy before go build to prune unused dependencies. Also, use -ldflags="-s -w" to strip debugging information from the binary, reducing its size.
RUN go mod tidy && CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o evm-single .
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #2381 +/- ##
=======================================
Coverage 72.33% 72.33%
=======================================
Files 65 65
Lines 6315 6315
=======================================
Hits 4568 4568
Misses 1345 1345
Partials 402 402
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (3)
.github/workflows/test.yml (2)
65-66: Scope the build context for faster Docker builds
Rather thancontext: ., considercontext: apps/evm/singleto reduce upload size and speed up the build.
41-49: Extract common build steps to DRY up the workflow
Bothbuild-rollkit-imageandbuild-rollkit-evm-single-imageshare identical checkout, buildx, and login steps. Consider moving them into a reusable workflow or composite action to reduce duplication.apps/evm/single/Dockerfile (1)
13-13: Strip debug info to reduce binary size
Add linker flags to minimize the artifact:- RUN go mod tidy && CGO_ENABLED=0 GOOS=linux go build -o evm-single . + RUN go mod tidy && CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o evm-single .
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/test.yml(2 hunks)apps/evm/single/Dockerfile(1 hunks)
🧰 Additional context used
🪛 GitHub Check: CodeQL
.github/workflows/test.yml
[warning] 53-53: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash
[warning] 56-56: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/login-action' with ref 'v3', not a pinned commit hash
[warning] 63-63: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/build-push-action' with ref 'v6', not a pinned commit hash
🪛 Hadolint (2.12.0)
apps/evm/single/Dockerfile
[error] 5-5: Use COPY instead of ADD for files and folders
(DL3020)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Summary
🔇 Additional comments (3)
.github/workflows/test.yml (2)
17-18: Explicit package write permissions added
LimitingGITHUB_TOKENtopackages: writescopes the token appropriately for the Docker push step.
73-73: Updateneedsto reflect renamed job
Thedocker-testsjob correctly depends onbuild-rollkit-imageafter renaming.apps/evm/single/Dockerfile (1)
17-17: Ensureca-certificatesin final image
Installing CA certificates is crucial for HTTPS operations; this is a good inclusion.
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin the setup-buildx-action to a full commit SHA
Using floating tags like @v3 can introduce unexpected updates. Pin to a specific commit or digest for immutability and reproducibility.
🧰 Tools
🪛 GitHub Check: CodeQL
[warning] 53-53: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/setup-buildx-action' with ref 'v3', not a pinned commit hash
🤖 Prompt for AI Agents
In .github/workflows/test.yml at line 53, the action
'docker/setup-buildx-action' is referenced using a floating tag '@v3', which can
lead to unexpected updates. Replace '@v3' with a specific full commit SHA to pin
the action version, ensuring immutability and reproducibility of the workflow.
|
|
||
| - name: Log in to GHCR | ||
| uses: docker/login-action@v3 | ||
| with: |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin the login-action to a full commit SHA
Locking this action to a digest or commit prevents unexpected behavior from upstream changes.
🧰 Tools
🪛 GitHub Check: CodeQL
[warning] 56-56: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/login-action' with ref 'v3', not a pinned commit hash
🤖 Prompt for AI Agents
In .github/workflows/test.yml at line 56, the docker/login-action is currently
referenced by a version tag (v3). To prevent unexpected behavior from upstream
changes, update this reference to use a full commit SHA instead of the version
tag. Find the latest commit SHA for docker/login-action@v3 and replace "v3" with
that full commit SHA in the uses line.
|
|
||
| - name: Build and push rollkit-evm-single Docker image | ||
| uses: docker/build-push-action@v6 | ||
| with: |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin the build-push-action to a full commit SHA
Switch from @v6 to a concrete SHA or digest to ensure consistent builds over time.
🧰 Tools
🪛 GitHub Check: CodeQL
[warning] 63-63: Unpinned tag for a non-immutable Action in workflow
Unpinned 3rd party Action 'Tests / Code Coverage' step Uses Step uses 'docker/build-push-action' with ref 'v6', not a pinned commit hash
🤖 Prompt for AI Agents
In .github/workflows/test.yml at line 63, the usage of docker/build-push-action
is currently pinned to the version tag @v6, which can lead to inconsistent
builds as the tag may point to different commits over time. Replace @v6 with a
specific full commit SHA or digest from the action's repository to ensure the
workflow uses a fixed, immutable version of the action for consistent and
reproducible builds.
| ADD core core | ||
|
|
||
| # Uncomment the following lines to build the binary from source in the dockerfile directly | ||
| # WORKDIR /src/apps/evm/single | ||
| COPY go.mod go.sum ./ | ||
| RUN go mod download | ||
|
|
||
| # RUN go mod tidy -compat=1.19 && \ | ||
| # CGO_ENABLED=0 go build -o /src/evm-single . | ||
| COPY . . |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Optimize Docker layer ordering and replace ADD
- Replace
ADD core corewithCOPY core core(Hadolint DL3020). - Move
COPY go.mod go.sumandRUN go mod downloadbefore copying source files to leverage layer caching when dependencies don’t change.
🧰 Tools
🪛 Hadolint (2.12.0)
[error] 5-5: Use COPY instead of ADD for files and folders
(DL3020)
🤖 Prompt for AI Agents
In apps/evm/single/Dockerfile lines 5 to 10, replace the ADD instruction with
COPY for adding the core directory to follow best practices. Also, reorder the
Dockerfile commands to copy go.mod and go.sum and run go mod download before
copying the rest of the source files. This change optimizes Docker layer caching
by isolating dependency installation from source code changes.
4 participants
Overview
I noticed the evm image isn't being pushed, the Dockerfile existed to be used for local testing (unsure if it's being actively used right now?)
This PR updates it to use a multi stage build, and pushes to the ghcr registry. This will allow for testing w/tastora
Summary by CodeRabbit