ci: add Dockerfile and enable Docker Hub publish#1
Conversation
- Add multi-stage Dockerfile (rust:1.88 -> debian:bookworm-slim) - Add .dockerignore to exclude target/ and dev files - Uncomment publish-docker job in release.yml - Bump MSRV to 1.88 in Cargo.toml - Update Docker tags from seedgen/seedgen to fikridev/seedgen
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughAdds a multi-stage Dockerfile and bumps Rust to 1.88, narrows Docker build context via .dockerignore, updates the release workflow for cross-architecture image publishing to fikridev/seedgen, and refreshes CodeRabbit auto-review and CONTRIBUTING documentation in English. ChangesDocker build and publish infrastructure
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 107: Replace the mutable tag docker/setup-qemu-action@v3 with an
immutable commit SHA: locate the workflow step that references
docker/setup-qemu-action@v3 and change it to
docker/setup-qemu-action@<full-commit-sha> (the full 40-char commit hash from
the action's repository) so the workflow is pinned to a specific commit; update
any related usage comments to reflect the immutable pin and verify the workflow
still runs in CI.
In `@Dockerfile`:
- Around line 20-30: Create a non-root runtime user and ensure seedgen is
owned/executable by that user: in the final stage (the Debian runtime stage with
ENTRYPOINT ["seedgen"]), install the minimal useradd utility (e.g., adduser or
passwd/useradd package), create an unprivileged user/group (e.g., "appuser"),
chown /usr/local/bin/seedgen to that user and ensure it is executable, and
switch to that user with USER appuser before ENTRYPOINT; reference the runtime
stage, /usr/local/bin/seedgen, and ENTRYPOINT ["seedgen"] when locating where to
make these changes.
- Line 18: The Dockerfile's builder stage runs "cargo build --release --bin
seedgen" without locking dependencies; update the build invocation to include
the --locked flag (i.e., run cargo build --release --bin seedgen --locked) so
Cargo uses the copied Cargo.lock and makes the build deterministic.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: dcbaff47-e6b7-4665-b8a7-89ef5b714fe1
📒 Files selected for processing (4)
.dockerignore.github/workflows/release.ymlCargo.tomlDockerfile
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: docker/setup-qemu-action@v3 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant portion around the referenced line
echo "=== release.yml around line 107 ==="
nl -ba .github/workflows/release.yml | sed -n '90,130p'
echo
echo "=== All uses of docker/setup-qemu-action in .github/workflows ==="
rg -n "docker/setup-qemu-action@" .github/workflows || trueRepository: ff4f/seedgen
Length of output: 153
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== release.yml around line 107 ==="
cat -n .github/workflows/release.yml | sed -n '90,130p'
echo
echo "=== All uses of docker/setup-qemu-action in .github/workflows ==="
rg -n "docker/setup-qemu-action@" .github/workflows || trueRepository: ff4f/seedgen
Length of output: 1364
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== release.yml around line 107 ==="
cat -n .github/workflows/release.yml | sed -n '90,130p'
echo
echo "=== All uses of docker/setup-qemu-action in .github/workflows ==="
rg -n "docker/setup-qemu-action@" .github/workflows || trueRepository: ff4f/seedgen
Length of output: 1364
Pin docker/setup-qemu-action to an immutable commit SHA (.github/workflows/release.yml line 107 uses docker/setup-qemu-action@v3, a mutable tag). Supply-chain risk—pin to the full commit SHA instead.
Suggested pattern
- - uses: docker/setup-qemu-action@v3
+ - uses: docker/setup-qemu-action@<full_commit_sha>🧰 Tools
🪛 zizmor (1.25.2)
[error] 107-107: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 107, Replace the mutable tag
docker/setup-qemu-action@v3 with an immutable commit SHA: locate the workflow
step that references docker/setup-qemu-action@v3 and change it to
docker/setup-qemu-action@<full-commit-sha> (the full 40-char commit hash from
the action's repository) so the workflow is pinned to a specific commit; update
any related usage comments to reflect the immutable pin and verify the workflow
still runs in CI.
| COPY tests ./tests | ||
| COPY scenarios ./scenarios | ||
|
|
||
| RUN cargo build --release --bin seedgen |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate and print Dockerfile with line numbers around the referenced line(s)
if [ -f Dockerfile ]; then
echo "== Dockerfile =="
nl -ba Dockerfile | sed -n '1,120p'
else
echo "Dockerfile not found at repo root."
fi
echo
echo "== Searching for Cargo.lock and cargo build flags in Dockerfile =="
rg -n "Cargo\.lock|cargo build|--locked|--frozen|--offline" -S Dockerfile || trueRepository: ff4f/seedgen
Length of output: 134
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Find Dockerfile(s)
echo "== Dockerfiles found =="
fd -a -t f 'Dockerfile' . || true
echo
# Prefer repo-root Dockerfile if it exists; otherwise print first found
if [ -f Dockerfile ]; then
DOCKERFILE="Dockerfile"
else
DOCKERFILE="$(fd -a -t f 'Dockerfile' . | head -n 1 || true)"
fi
if [ -z "${DOCKERFILE:-}" ]; then
echo "No Dockerfile found."
exit 0
fi
echo "== Using: $DOCKERFILE =="
# Print first 120 lines with line numbers via awk (no nl dependency)
awk 'NR<=120 { printf "%d:%s\n", NR, $0 }' "$DOCKERFILE"
echo
echo "== Search: Cargo.lock / cargo build / --locked / --frozen / --offline =="
rg -n "Cargo\.lock|cargo build|--locked|--frozen|--offline" -S "$DOCKERFILE" || trueRepository: ff4f/seedgen
Length of output: 1020
Make the Docker build deterministic by enforcing Cargo.lock (--locked).
Dockerfile copies Cargo.lock into the builder stage, but the build command at line 18 runs cargo build --release --bin seedgen without --locked, so Cargo can update lock resolution (and thus the resulting binary) if Cargo.lock would change—breaking reproducibility.
Suggested patch
-RUN cargo build --release --bin seedgen
+RUN cargo build --release --locked --bin seedgen📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN cargo build --release --bin seedgen | |
| RUN cargo build --release --locked --bin seedgen |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 18, The Dockerfile's builder stage runs "cargo build
--release --bin seedgen" without locking dependencies; update the build
invocation to include the --locked flag (i.e., run cargo build --release --bin
seedgen --locked) so Cargo uses the copied Cargo.lock and makes the build
deterministic.
| FROM debian:bookworm-slim | ||
|
|
||
| RUN apt-get update && apt-get install -y --no-install-recommends \ | ||
| ca-certificates \ | ||
| libssl3 \ | ||
| && rm -rf /var/lib/apt/lists/* | ||
|
|
||
| COPY --from=builder /app/target/release/seedgen /usr/local/bin/seedgen | ||
|
|
||
| ENTRYPOINT ["seedgen"] | ||
| CMD ["--help"] |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate Dockerfile(s)
ls -la
fd -H -g 'Dockerfile*' . || true
# Print the Dockerfile content with line numbers (best guess path: ./Dockerfile)
if [ -f Dockerfile ]; then
echo "---- Dockerfile (head 120) ----"
nl -ba Dockerfile | head -n 160
fi
# Search for USER directives anywhere
if [ -f Dockerfile ]; then
echo "---- USER directives ----"
rg -n --hidden --no-ignore-vcs '^\s*USER\s+' Dockerfile || true
fiRepository: ff4f/seedgen
Length of output: 1575
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if [ -f Dockerfile ]; then
echo "---- Dockerfile (numbered) ----"
cat -n Dockerfile
else
echo "Dockerfile not found at repo root"
fi
echo "---- USER directives ----"
rg -n --hidden --no-ignore-vcs '^\s*USER\s+' Dockerfile || true
echo "---- builder stage hints (FROM lines) ----"
rg -n --hidden --no-ignore-vcs '^\s*FROM\s+' Dockerfile || true
echo "---- chown/chmod hints ----"
rg -n --hidden --no-ignore-vcs '(chown|chmod)\b' Dockerfile || trueRepository: ff4f/seedgen
Length of output: 1120
Run the runtime image as a non-root user.
The final stage (FROM debian:bookworm-slim) has no USER, so ENTRYPOINT ["seedgen"] runs as root. Create an unprivileged user in the runtime stage, chown/ensure permissions for /usr/local/bin/seedgen, and switch to that user before ENTRYPOINT (and install the required package for useradd/groupadd).
🧰 Tools
🪛 Checkov (3.2.529)
[low] 1-30: Ensure that HEALTHCHECK instructions have been added to container images
(CKV_DOCKER_2)
[low] 1-30: Ensure that a user for the container has been created
(CKV_DOCKER_3)
🪛 Hadolint (2.14.0)
[warning] 22-22: Pin versions in apt get install. Instead of apt-get install <package> use apt-get install <package>=<version>
(DL3008)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` around lines 20 - 30, Create a non-root runtime user and ensure
seedgen is owned/executable by that user: in the final stage (the Debian runtime
stage with ENTRYPOINT ["seedgen"]), install the minimal useradd utility (e.g.,
adduser or passwd/useradd package), create an unprivileged user/group (e.g.,
"appuser"), chown /usr/local/bin/seedgen to that user and ensure it is
executable, and switch to that user with USER appuser before ENTRYPOINT;
reference the runtime stage, /usr/local/bin/seedgen, and ENTRYPOINT ["seedgen"]
when locating where to make these changes.
Convert Indonesian copy to English in .coderabbit.yaml and CONTRIBUTING.md to improve clarity for international contributors. Updated phrasing for review rules and CodeRabbit guidance, and replaced example clone URL with https://github.com/ff4f/seedgen.git. No behavioral changes to CI commands or workflows.
1 participant
What
Why
How
Testing
Checklist
cargo fmt && cargo clippy -- -D warningspasses locallycargo insta review.unwrap()or.expect()in library code (src/outsidecli/andmain.rs)rand::thread_rng()orSystemTime::now()for randomness — only seededChaCha8RngSummary by CodeRabbit
Chores
Documentation