cloud: add Docker release deployment workflow - #167
Conversation
|
Warning Review limit reached
Next review available in: 47 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (10)
📝 WalkthroughWalkthroughAdds a provider-neutral Dockerized-service release/deployment skill, GitHub Actions workflow templates, immutable digest manifests, deployment and health-check seams, catalog/export wiring, compatibility documentation, and repository-wide version updates. ChangesCloud deployment workflow
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubTag
participant ReleaseWorkflow
participant OCIRegistry
participant GitHubRelease
participant DeploymentWorkflow
participant ProviderAdapter
GitHubTag->>ReleaseWorkflow: trigger tagged release build
ReleaseWorkflow->>OCIRegistry: build and push container
OCIRegistry-->>ReleaseWorkflow: return immutable digest
ReleaseWorkflow->>GitHubRelease: publish manifest and release
GitHubRelease->>DeploymentWorkflow: emit published release event
DeploymentWorkflow->>ProviderAdapter: deploy validated exact digest
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 93eafcc7d7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@plugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/deploy-production.yml.tmpl`:
- Around line 19-66: Bind deployment adapters to the immutable commit recorded
in the release manifest: in
plugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/deploy-production.yml.tmpl
lines 19-66 and
skills/dockerized-service-release-deployment-workflow/assets/deploy-production.yml.tmpl
lines 19-66, extract the manifest commit in the Validate the release manifest
and extract the exact image digest step, compare it with git rev-parse HEAD, and
fail on mismatch before OIDC authentication or adapter execution. Preserve
main-anchored tags and exact-digest deployment.
- Around line 62-64: Update the image validators to require a fully qualified
name/repository component before the `@sha256` digest, rejecting short references
such as service@sha256:.... Apply the same complete-reference pattern
consistently in
plugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/deploy-production.yml.tmpl
lines 62-64, deploy-production-image.sh.tmpl lines 7-10, and
verify-production-health.sh.tmpl lines 7-10, then mirror it in
skills/dockerized-service-release-deployment-workflow/assets/deploy-production.yml.tmpl
lines 62-64, deploy-production-image.sh.tmpl lines 7-10, and
verify-production-health.sh.tmpl lines 7-10.
In
`@plugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/release-container.yml.tmpl`:
- Around line 8-10: Remove the contents: write permission from the permissions
block in
plugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/release-container.yml.tmpl:8-10
and
skills/dockerized-service-release-deployment-workflow/assets/release-container.yml.tmpl:8-10,
retaining packages: write and the existing checkout read access so release
publication continues using RELEASE_PUBLISH_TOKEN.
- Around line 50-55: Update the “Log in to the OCI registry” step in both
release-container.yml.tmpl copies to use registry-appropriate credential
placeholders instead of hard-coded github.actor and GITHUB_TOKEN, or explicitly
constrain OCI_REGISTRY to GHCR/ghcr.io. Apply the same authentication contract
consistently in
plugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/release-container.yml.tmpl
(lines 50-55) and
skills/dockerized-service-release-deployment-workflow/assets/release-container.yml.tmpl
(lines 50-55).
In
`@plugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/SKILL.md`:
- Around line 1-10: Document the Hermes compatibility decision in both
plugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/SKILL.md
lines 1-10 and skills/dockerized-service-release-deployment-workflow/SKILL.md
lines 1-10 by either declaring Hermes support and adding the required
export/index artifacts, or explicitly marking the skill Codex-only; keep both
SKILL.md copies consistent.
- Line 62: Document RELEASE_PUBLISH_TOKEN as fine-grained PAT-only in both
SKILL.md copies at the listed line 62 sites, and update the release workflow
guidance at both line 90-92 sites to use a minted GitHub App installation token
when applicable. In both release-container.yml.tmpl copies at lines 108-120,
create the installation token during the job and pass the corresponding
create-token step output to gh instead of using RELEASE_PUBLISH_TOKEN directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 8c68ecfa-eac1-42da-83c9-3046f9736c74
⛔ Files ignored due to path filters (8)
plugins/agent-portability-skills/uv.lockis excluded by!**/*.lockplugins/apple-dev-skills/uv.lockis excluded by!**/*.lockplugins/cardhop-app/mcp/uv.lockis excluded by!**/*.lockplugins/productivity-skills/uv.lockis excluded by!**/*.lockplugins/python-skills/uv.lockis excluded by!**/*.lockplugins/things-app/mcp/uv.lockis excluded by!**/*.lockplugins/things-app/uv.lockis excluded by!**/*.lockuv.lockis excluded by!**/*.lock
📒 Files selected for processing (52)
README.mdROADMAP.mddocs/maintainers/hermes-compatibility.mdplugins/agent-portability-skills/.codex-plugin/plugin.jsonplugins/agent-portability-skills/pyproject.tomlplugins/agentdeck/.codex-plugin/plugin.jsonplugins/android-dev-skills/.codex-plugin/plugin.jsonplugins/apple-creator-studio-skills/.codex-plugin/plugin.jsonplugins/apple-dev-skills/.codex-plugin/plugin.jsonplugins/apple-dev-skills/pyproject.tomlplugins/cardhop-app/.codex-plugin/plugin.jsonplugins/cardhop-app/mcp/pyproject.tomlplugins/cloud-deployment-skills/.codex-plugin/plugin.jsonplugins/cloud-deployment-skills/AGENTS.mdplugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/SKILL.mdplugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/deploy-production-image.sh.tmplplugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/deploy-production.yml.tmplplugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/release-container.yml.tmplplugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/release-manifest.json.tmplplugins/cloud-deployment-skills/skills/dockerized-service-release-deployment-workflow/assets/verify-production-health.sh.tmplplugins/cloud-inference-skills/.codex-plugin/plugin.jsonplugins/cybersecurity-skills/.codex-plugin/plugin.jsonplugins/dotnet-skills/.codex-plugin/plugin.jsonplugins/game-dev-skills/.codex-plugin/plugin.jsonplugins/messaging-collaboration-skills/.codex-plugin/plugin.jsonplugins/model-lab-skills/.codex-plugin/plugin.jsonplugins/network-protocol-skills/.codex-plugin/plugin.jsonplugins/productivity-skills/.codex-plugin/plugin.jsonplugins/productivity-skills/pyproject.tomlplugins/python-skills/.codex-plugin/plugin.jsonplugins/python-skills/pyproject.tomlplugins/reverse-engineering-skills/.codex-plugin/plugin.jsonplugins/rust-skills/.codex-plugin/plugin.jsonplugins/server-side-jvm/.codex-plugin/plugin.jsonplugins/server-side-swift/.codex-plugin/plugin.jsonplugins/server-side-swift/skills/docker-workflow/SKILL.mdplugins/spotify/.codex-plugin/plugin.jsonplugins/swift-lang/.codex-plugin/plugin.jsonplugins/swiftasb-skills/.codex-plugin/plugin.jsonplugins/things-app/.codex-plugin/plugin.jsonplugins/things-app/mcp/pyproject.tomlplugins/things-app/pyproject.tomlplugins/web-dev-skills/.codex-plugin/plugin.jsonpyproject.tomlscripts/export_hermes_skills.pyskills.sh.jsonskills/dockerized-service-release-deployment-workflow/SKILL.mdskills/dockerized-service-release-deployment-workflow/assets/deploy-production-image.sh.tmplskills/dockerized-service-release-deployment-workflow/assets/deploy-production.yml.tmplskills/dockerized-service-release-deployment-workflow/assets/release-container.yml.tmplskills/dockerized-service-release-deployment-workflow/assets/release-manifest.json.tmplskills/dockerized-service-release-deployment-workflow/assets/verify-production-health.sh.tmpl
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 066296173d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| echo "Release manifest commit '$commit' is not reachable from origin/main; refusing to grant deployment credentials to an unreviewed tag." >&2 | ||
| exit 1 | ||
| fi | ||
| if [[ ! "$image" =~ ^([^/@[:space:]]+\.[^/@[:space:]]+|localhost|[^/@[:space:]]+:[0-9]+)/[^@[:space:]]+@sha256:[0-9a-f]{64}$ ]]; then |
There was a problem hiding this comment.
When someone with release-writing access but no protected-main or registry access publishes a stable release for an existing main tag, they can attach a manifest with the matching tag, kind, and commit but any syntactically valid attacker-controlled image; this check accepts it and the job proceeds to production OIDC after approval. Fresh evidence in the current version is that the new tag, commit, and ancestry validations are present, but none binds the image to the configured registry/repository or a trusted build attestation. Verify the expected image repository and trusted build provenance before granting deployment credentials.
AGENTS.md reference: plugins/cloud-deployment-skills/AGENTS.md:L11-L11
Useful? React with 👍 / 👎.
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| git fetch --no-tags origin main |
There was a problem hiding this comment.
In adopting repositories whose protected integration branch is not named main, this fetch fails before validation or publication even though the skill's required-decisions section explicitly allows selecting that branch and only describes main as the normal choice. Introduce a branch placeholder and use it consistently in both the release and deployment ancestry checks so the templates honor the documented contract.
AGENTS.md reference: AGENTS.md:L60-L61
Useful? React with 👍 / 👎.
1 participant
Summary
Validation
Summary by CodeRabbit
New Features
Documentation
Chores