ci: publish container image to ghcr - #1
Conversation
|
Important Review skippedNo new commits to review since the last review. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe CI workflow publishes Docker images to GHCR on version tags. Standard Compose uses the published image and a named volume. Development Compose builds locally. The README documents both deployment modes. ChangesContainer delivery
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions as GitHub Actions
participant TestJob as test job
participant DockerJob as Docker job
participant GHCR as GHCR
GitHubActions->>TestJob: run tests
GitHubActions->>DockerJob: build Docker image
TestJob-->>GitHubActions: successful
DockerJob-->>GitHubActions: successful
GitHubActions->>GHCR: authenticate and push tagged image
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
docker-compose.dev.yml (1)
6-7: 🩺 Stability & Availability | 🔵 TrivialVerify write access to the bind-mounted data directory.
The Dockerfile chowns
/data, but this bind mount replaces that directory with the host directory. Docker can create a missing directory for-v, and host permissions then control access. The container may fail when SQLite creates/data/crosspoint.db. (docs.docker.com)Create
./datawith ownership writable bynode, use a named volume, or document the required setup. Verify this path on a clean Linux host.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docker-compose.dev.yml` around lines 6 - 7, Ensure the ./data bind-mounted directory is writable by the container’s node user, either by documenting and enforcing the required host ownership/permissions, replacing it with a correctly configured named volume, or adding equivalent setup. Verify SQLite can create /data/crosspoint.db on a clean Linux host..github/workflows/ci.yml (1)
46-46: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSecurity And Privacy (CWE-522): Insufficiently Protected Credentials
Reachability: Internal · Exploitability: Moderate
Disable
actions/checkoutcredential persistence before use.The publish job checks out the repository under
GITHUB_TOKENdefault permissions with nopersist-credentials: false. This leaves the token in local Git configuration before the Docker build; keep it unavailable unless a later step needs Git operations.Proposed checkout configuration
- uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 46, Update the publish job’s actions/checkout@v4 step to disable credential persistence by configuring persist-credentials as false, ensuring the GITHUB_TOKEN is not retained in local Git configuration before the Docker build.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 9-11: Update the workflow-level permissions block to retain only
contents: read, then add packages: write under the publish job’s permissions
block. Ensure the test and docker jobs inherit no package write access while
publish retains the permissions required for publishing.
- Around line 6-7: Align the workflow trigger and published image tag behavior:
either add a push trigger for the main branch so the existing main-tag
publication path runs, or, if releases should remain versioned, update the image
references in docker-compose.yml and README.md to use the semver tag produced by
the tag-triggered workflow.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Line 46: Update the publish job’s actions/checkout@v4 step to disable
credential persistence by configuring persist-credentials as false, ensuring the
GITHUB_TOKEN is not retained in local Git configuration before the Docker build.
In `@docker-compose.dev.yml`:
- Around line 6-7: Ensure the ./data bind-mounted directory is writable by the
container’s node user, either by documenting and enforcing the required host
ownership/permissions, replacing it with a correctly configured named volume, or
adding equivalent setup. Verify SQLite can create /data/crosspoint.db on a clean
Linux host.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e28ecd2e-a1fb-4b45-a85f-fd7cc444f56c
📒 Files selected for processing (4)
.github/workflows/ci.ymlREADME.mddocker-compose.dev.ymldocker-compose.yml
📜 Review details
🧰 Additional context used
🪛 zizmor (1.29.0)
.github/workflows/ci.yml
[error] 11-11: overly broad permissions (excessive-permissions): packages: write is overly broad at the workflow level
(excessive-permissions)
[warning] 46-46: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🔇 Additional comments (3)
.github/workflows/ci.yml (1)
41-45: LGTM!Also applies to: 47-58, 63-68
docker-compose.dev.yml (1)
1-5: LGTM!Also applies to: 8-11
README.md (1)
34-38: LGTM!
|
Are these coderabbit suggestions valid? |
54c43df to
7dec38c
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
Some yes, I'll work through those. edit: |
|
|
|
|
2 participants
This actually builds and publishes the container to GHCR.
Also updated the README to point to that image, and separated a development-docker-compose-setup for local development.
I also wanted to add a renovate-setup for the action and Dockerfile, but not sure if that is wanted or not - it would require installing renovate as an app for the repo first I think.
Probably would also be useful for the node-dependencies.