ci(docker): isolate pre-merge image builds - #1695
Conversation
|
Warning Review limit reachedNext included review available in 28 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (6)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (6)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughDocker CI now uses run-attempt image tags, merge-group single-architecture builds, and push-only Sentry secrets. Release validation resolves these tags and promotes image digests without rebuilding. Documentation and contract tests reflect the updated flow. ChangesCI image promotion
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to The PR changes CI image build isolation and release promotion behavior, but no actionable merge-blocking correctness, security, availability, or readiness risk remains identified; it is merge-ready after normal checks and review. Sequence Diagram(s)sequenceDiagram
participant DockerCI as Docker CI workflows
participant Registry as OCI registry
participant Release as Release workflow
participant Environments as Staging and production
DockerCI->>Registry: Publish run-attempt image tags
Release->>Registry: Resolve image digests from SOURCE_TAG
Release->>Environments: Promote verified OCI digests without rebuilding
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (5 skipped: 5 unsupported.) ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
documentation
📚 Documentation Preview
|
🧩 Storybook Preview
|
db7db21 to
06d8f3f
Compare
github-actions
Bot
added
size:L
06d8f3f to
4bb6c7e
Compare
FelixTJDietrich
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approved automatically: @FelixTJDietrich is listed in the REVIEW_POLICY_MAINTAINERS repository variable, which the repository treats as satisfying the review requirement. See the review policy in docs/contributor/ci-cd.mdx.
4bb6c7e to
10419a3
Compare
There was a problem hiding this comment.
Approved automatically: @FelixTJDietrich is listed in the REVIEW_POLICY_MAINTAINERS repository variable, which the repository treats as satisfying the review requirement. See the review policy in docs/contributor/ci-cd.mdx.
1 participant
Description
Reduce duplicate container work without weakening the release boundary. Pull-request and merge-queue builds now publish amd64 images under candidate-only tags, while pushes to
maincontinue to publish signed and attested amd64/arm64 images for the final commit. Sentry upload credentials are available only tomainpush builds.GitHub creates a temporary integration candidate for a merge queue, and that candidate has its own SHA. Because Hephaestus records the source commit in each image, releases select images from the exact successful
mainworkflow run and promote their verified digests without rebuilding. This avoids treating a temporary merge-group artifact as the final release artifact.This changes repository CI and contributor documentation only, so no changeset, migration, or operator action is required.
How to test
pnpm run format.pnpm run check.pnpm run verify.linux/amd64.After merge, verify that the
mainworkflow publishes amd64/arm64 indexes with signatures and attestations. On the next version release, verify that source resolution usesrun-<run-id>-<attempt>and that promotion preserves the resolved digests.Checklist