enh: refactor offline scripts and support github-actions#153
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a comprehensive overhaul of the offline package building infrastructure, moving towards a more automated, robust, and flexible system. By refactoring existing scripts, integrating with GitHub Actions, and enhancing dependency management with Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a significant refactoring of the offline package build scripts and a new GitHub Action, aiming to improve the robustness, maintainability, and performance of the build system. However, critical security vulnerabilities related to command injection have been identified. Untrusted inputs from GitHub Action inputs and script arguments are directly used in shell commands without proper sanitization or quoting, specifically in action.yml and bash scripts using eval, bash -c, and unquoted variables. Addressing these command injection issues is paramount. Additionally, a few minor issues were noted in one of the example shell scripts.
There was a problem hiding this comment.
Pull request overview
This PR refactors the offline packaging scripts to support running builds in a standardized way (native or Docker) and adds GitHub Actions integration (workflow + composite action) to build offline deployment artifacts for different target OS/arch combinations.
Changes:
- Added a GitHub Actions workflow and a composite action to drive offline package builds via workflow_dispatch / workflow_call.
- Introduced a new
build_offline_pkg.shorchestrator to runprepare_offline_pkg.shnatively or inside a container (with container pooling, caching, and optional Nexus repo injection). - Refactored offline env scripts to support TDgpt/IDMP variants, caching
uv, architecture checks, and improved install behaviors.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/build-offline-pkg.yml |
New workflow to build and upload offline package artifacts via GitHub Actions. |
.github/actions/build-offline-pkg/action.yml |
New composite action wrapping build_offline_pkg.sh with inputs for CI usage. |
.github/scripts/offline_env/build_offline_pkg.sh |
New orchestrator script for native/Docker builds, container pooling, locking, defaults, and Nexus injection. |
.github/scripts/offline_env/prepare_offline_pkg.sh |
Extended build logic for TDgpt/IDMP, uv caching, mirrors, and more robust downloads. |
.github/scripts/offline_env/install.sh |
Adds arch verification for packaged components and SELinux handling; improves binary tools installation. |
.github/scripts/offline_env/set-offline.sh |
Improved offline firewall handling (firewalld/ufw interaction, conntrack, persistence). |
.github/scripts/offline_env/set-online.sh |
New helper to remove iptables restrictions and persist “online” rules. |
.github/scripts/offline_env/build_shells/delivery_tools.sh |
Adds/updates example commands for new orchestrator flows (TSDB/TDgpt/IDMP). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated 9 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.
Comments suppressed due to low confidence (1)
.github/scripts/offline_env/install.sh:632
disable_selinuxis executed unconditionally on any host that has/etc/selinux/config, which permanently disables SELinux for the entire system. This is a high-impact operational/security change for an install script and may be unacceptable in hardened environments. Consider gating this behind an explicit flag, limiting it to known-problem scenarios (e.g., only when installing TDgpt/IDMP), or switching to a targeted SELinux policy/module approach instead of globally disabling SELinux.
# Disable SELinux permanently on RPM-based distros (CentOS/RHEL/openEuler/Kylin).
# Required for TDgpt/IDMP services: SELinux blocks uwsgi/Python dynamic library loading
# (status=203/EXEC from systemd) even when the binary path is correct.
# Also disables it for the current session via setenforce so no reboot is needed.
function disable_selinux() {
local selinux_config="/etc/selinux/config"
# Only applies to RPM-based systems that have SELinux
if [ ! -f "$selinux_config" ]; then
return 0
fi
# Check if SELinux is enabled
local current_mode
current_mode=$(getenforce 2>/dev/null || echo "Disabled")
if [ "$current_mode" = "Disabled" ]; then
return 0
fi
yellow_echo "Disabling SELinux (current mode: $current_mode)..."
# Disable for current session immediately (no reboot needed)
setenforce 0 2>/dev/null || true
# Persist: set SELINUX=disabled in /etc/selinux/config
if grep -q '^SELINUX=' "$selinux_config"; then
sed -i 's/^SELINUX=.*/SELINUX=disabled/' "$selinux_config"
else
echo "SELINUX=disabled" >> "$selinux_config"
fi
green_echo "SELinux disabled (current session + permanent after reboot)"
}
function main() {
if [ -f /etc/os-release ]; then
disable_selinux
install_venv
install_binary_tools
install_docker
install_docker_compose
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated 6 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Description
Issue(s)
Checklist
Please check the items in the checklist if applicable.