feat: Add goreleaser docker publish channel#14
Conversation
|
Warning Review limit reached
More reviews will be available in 41 minutes and 2 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThis PR adds Docker multi-architecture image build and publishing infrastructure. It extends the release workflow with Docker Buildx and Hub authentication, configures GoReleaser to build and push images for two variants across linux/amd64 and linux/arm64 platforms, and provides corresponding Dockerfile implementations. ChangesDocker multi-architecture build pipeline
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.goreleaser.yaml:
- Around line 42-43: Update the dockerfile paths in .goreleaser.yaml to match
the repository: replace references to build/buildx.Dockerfile and
build/buildx-alpine.Dockerfile with publish/buildx.Dockerfile and
publish/buildx-alpine.Dockerfile (i.e., update the dockerfile key and any
platforms/docker build entries that refer to those filenames so GoReleaser can
locate the Dockerfiles during image builds).
In `@publish/buildx-alpine.Dockerfile`:
- Around line 10-15: The runtime Dockerfile currently installs compilers and VCS
tools (gcc, musl-dev, git, mercurial) and runs as root; instead, remove those
packages from the final image and ensure the prebuilt binary is copied from a
builder stage (leave COPY $TARGETPLATFORM/commitlint-scope /usr/bin/ and CMD
["commitlint-scope"] intact), then create a non-root user (e.g., user/group
creation and chown of /usr/bin/commitlint-scope) and add a USER instruction so
the container runs as that unprivileged account at runtime.
In `@publish/buildx.Dockerfile`:
- Around line 10-13: Remove the global wildcard git trust and stop running as
root: delete the RUN git config --global --add safe.directory '*' line, add a
non-root user (e.g., create a user/group with addgroup/adduser or useradd), copy
the commitlint-scope binary into /usr/bin/ then chown it to that non-root user
(reference COPY $TARGETPLATFORM/commitlint-scope /usr/bin/ and the
commitlint-scope binary), and switch execution to that user with USER <username>
before the CMD ["commitlint-scope"]; if git access is required at runtime, set a
single explicit safe.directory value instead of '*' or configure trust outside
the runtime image.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 543063ae-7edc-4fd6-bb97-226f9e410742
📒 Files selected for processing (4)
.github/workflows/release.yml.goreleaser.yamlpublish/buildx-alpine.Dockerfilepublish/buildx.Dockerfile
| RUN apk --no-cache add gcc musl-dev git mercurial | ||
|
|
||
| RUN git config --global --add safe.directory '*' | ||
|
|
||
| COPY $TARGETPLATFORM/commitlint-scope /usr/bin/ | ||
| CMD ["commitlint-scope"] |
There was a problem hiding this comment.
Trim unnecessary packages and run as non-root in runtime image.
This image executes a prebuilt binary; keeping compilers/VCS tools plus root runtime user is avoidable exposure.
Suggested patch
-RUN apk --no-cache add gcc musl-dev git mercurial
-
-RUN git config --global --add safe.directory '*'
+RUN adduser -D appuser
@@
COPY $TARGETPLATFORM/commitlint-scope /usr/bin/
+USER appuser
CMD ["commitlint-scope"]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN apk --no-cache add gcc musl-dev git mercurial | |
| RUN git config --global --add safe.directory '*' | |
| COPY $TARGETPLATFORM/commitlint-scope /usr/bin/ | |
| CMD ["commitlint-scope"] | |
| RUN adduser -D appuser | |
| COPY $TARGETPLATFORM/commitlint-scope /usr/bin/ | |
| USER appuser | |
| CMD ["commitlint-scope"] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@publish/buildx-alpine.Dockerfile` around lines 10 - 15, The runtime
Dockerfile currently installs compilers and VCS tools (gcc, musl-dev, git,
mercurial) and runs as root; instead, remove those packages from the final image
and ensure the prebuilt binary is copied from a builder stage (leave COPY
$TARGETPLATFORM/commitlint-scope /usr/bin/ and CMD ["commitlint-scope"] intact),
then create a non-root user (e.g., user/group creation and chown of
/usr/bin/commitlint-scope) and add a USER instruction so the container runs as
that unprivileged account at runtime.
| RUN git config --global --add safe.directory '*' | ||
|
|
||
| COPY $TARGETPLATFORM/commitlint-scope /usr/bin/ | ||
| CMD ["commitlint-scope"] |
There was a problem hiding this comment.
Harden runtime image: drop root and remove wildcard git trust.
Running as root and trusting all git directories broadens blast radius unnecessarily for a runtime image.
Suggested patch
-FROM golang:1.26
+FROM golang:1.26
@@
-RUN git config --global --add safe.directory '*'
-
-COPY $TARGETPLATFORM/commitlint-scope /usr/bin/
+RUN adduser --disabled-password --gecos "" appuser
+COPY $TARGETPLATFORM/commitlint-scope /usr/bin/
+USER appuser
CMD ["commitlint-scope"]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@publish/buildx.Dockerfile` around lines 10 - 13, Remove the global wildcard
git trust and stop running as root: delete the RUN git config --global --add
safe.directory '*' line, add a non-root user (e.g., create a user/group with
addgroup/adduser or useradd), copy the commitlint-scope binary into /usr/bin/
then chown it to that non-root user (reference COPY
$TARGETPLATFORM/commitlint-scope /usr/bin/ and the commitlint-scope binary), and
switch execution to that user with USER <username> before the CMD
["commitlint-scope"]; if git access is required at runtime, set a single
explicit safe.directory value instead of '*' or configure trust outside the
runtime image.
|
@coderabbitai what you think about potentially ambiguous .git owner problem? |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
cat publish/buildx.Dockerfile
echo "---"
cat publish/buildx-alpine.DockerfileLength of output: 676
RUN git config --global --add safe.directory '*'This is the wildcard bypass for CVE-2022-24765 (Git ≥ 2.35.2 refuses to operate on repos owned by a different UID). The wildcard disables that ownership check for every directory, globally, and it's written into the image layer at build time — so every container based on this image inherits it permanently. Why it's potentially problematic
Better alternativesOption 1 — Entrypoint that scopes to the actual working directory (most flexible): COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
CMD ["commitlint-scope"]#!/bin/sh
# entrypoint.sh
git config --global --add safe.directory "$PWD"
exec "$@"Option 2 — Target a fixed, well-known mount point: # For GitHub Actions
RUN git config --global --add safe.directory /github/workspace
# For generic CI
RUN git config --global --add safe.directory /workspaceOption 3 — Leave it to the user / document it: -e GIT_CONFIG_GLOBAL=/dev/null # or add their own safe.directoryFor a tool like |
|
🎉 This PR is included in version 2.1.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
1 participant
Summary by CodeRabbit
Release Notes