ci: add Docker multi-platform build and Release workflows#70
Open
ci: add Docker multi-platform build and Release workflows#70
Conversation
Add production Docker and release infrastructure: - Dockerfile: cargo-chef multi-stage build with debian:bookworm-slim runtime, supports release/maxperf profiles via BUILD_PROFILE arg - .dockerignore: excludes target, .git, tests, local-test - docker.yml: tag-triggered multi-platform (amd64+arm64) build, pushes to ghcr.io/morph-l2/morph-reth with semver tags - release.yml: tag-triggered binary release with version validation, cross-compiled Linux binaries (x86_64+aarch64), SHA256 checksums, auto-generated changelog, and GitHub draft release
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (2)
📝 WalkthroughWalkthroughAdds Docker containerization and automated release pipelines: a multi-stage Dockerfile and Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub as GitHub (push/tag or workflow_dispatch)
participant Actions as GitHub Actions
participant Runner as Runner
participant Buildx as Docker Buildx / cross
participant GHCR as GHCR (Registry)
participant Releases as GitHub Releases
GitHub->>Actions: trigger docker workflow (tag or manual)
Actions->>Runner: checkout repo, setup QEMU & buildx
Runner->>Buildx: build multi-arch image, run docker/metadata-action
Buildx->>GHCR: push images & tags
GitHub->>Actions: trigger release workflow (tag or manual)
Actions->>Runner: extract normalized version, checkout ref
Runner->>Runner: verify crate version matches tag
Runner->>Buildx: cross-compile binaries for targets
Runner->>Actions: upload artifacts
Actions->>Releases: create draft release with changelog and artifacts
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
Dockerfile (1)
7-8: Avoid upgrading the whole distro in the builder layer.
apt-get -y upgrademakes this stage less reproducible and heavier than needed. Install only the required packages with--no-install-recommends, then clear the apt lists.♻️ Suggested cleanup
-RUN apt-get update && apt-get -y upgrade && apt-get install -y libclang-dev pkg-config +RUN apt-get update && \ + apt-get install -y --no-install-recommends libclang-dev pkg-config && \ + rm -rf /var/lib/apt/lists/*🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` around lines 7 - 8, The Dockerfile's RUN line currently performs a full distro upgrade which reduces reproducibility; change the RUN that installs build deps (the line installing libclang-dev and pkg-config) to avoid `apt-get -y upgrade`, use `apt-get install -y --no-install-recommends` to install only required packages, and purge apt caches afterwards (remove apt lists) to keep the layer small and deterministic; locate the RUN that references libclang-dev/pkg-config in the Dockerfile and update it accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/docker.yml:
- Around line 3-6: The workflow currently triggers publishing for both tag
pushes and manual runs because "on: push: tags: ['v*']" coexists with an
unconditional "workflow_dispatch"; update the triggers and publishing guard so
manual dispatches don't publish by default: either restrict the push trigger to
tags only (keep "push: tags: ['v*']") and add a conditional on the publish job
(e.g., check github.event_name == 'push' && starts_with(github.ref,
'refs/tags/') or require a workflow_dispatch input like "publish: true" and gate
the publish steps on that input), or add an explicit if/condition in the publish
job to only run for tag pushes or when a dispatch input opt-in is true;
reference the "on", "push", "tags", and "workflow_dispatch" keys and the publish
job's if-condition to implement this.
In @.github/workflows/release.yml:
- Around line 134-139: The fallback for CHANGELOG uses "HEAD~20..HEAD" which
breaks in repos with fewer than 20 commits; update the logic that sets CHANGELOG
(the block using PREVIOUS_TAG and CHANGELOG) to use a history-length-safe git
command such as using git log --max-count=20 --pretty=format:"- %s" HEAD (or git
rev-list --max-count=20) instead of "HEAD~20..HEAD" so it always works
regardless of commit count and still limits the number of entries when
PREVIOUS_TAG is empty.
- Around line 57-59: The release guard currently uses a prefix glob check ([[
"$TAG_VERSION" != "$CARGO_VERSION"* ]]) which allows suffixed tags (e.g.
0.1.0-rc.1) to match; change the check to require exact equality by comparing
TAG_VERSION and CARGO_VERSION with [[ "$TAG_VERSION" != "$CARGO_VERSION" ]] (or
the inverse ==) so only identical versions pass; if your repo uses a leading "v"
in tags, first normalize TAG_VERSION (strip leading "v") before comparing to
CARGO_VERSION to ensure correct behavior.
In `@Dockerfile`:
- Around line 38-46: The Dockerfile currently runs the runtime image as root
(process started by ENTRYPOINT ["/usr/local/bin/morph-reth"]); add a non-root
runtime user and switch to it before ENTRYPOINT. Create a dedicated user and
group (e.g., "morph" or "appuser"), create its home or data directory, chown
that directory and the copied binary (referencing the COPY --from=builder
/app/morph-reth /usr/local/bin/ and ENTRYPOINT symbols), and add a USER
instruction so the container runs as that non-root user at runtime; ensure
permissions allow executing /usr/local/bin/morph-reth and exposing required
ports.
---
Nitpick comments:
In `@Dockerfile`:
- Around line 7-8: The Dockerfile's RUN line currently performs a full distro
upgrade which reduces reproducibility; change the RUN that installs build deps
(the line installing libclang-dev and pkg-config) to avoid `apt-get -y upgrade`,
use `apt-get install -y --no-install-recommends` to install only required
packages, and purge apt caches afterwards (remove apt lists) to keep the layer
small and deterministic; locate the RUN that references libclang-dev/pkg-config
in the Dockerfile and update it accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f4a551e3-2842-4a9f-86c8-10c1f41422c8
📒 Files selected for processing (4)
.dockerignore.github/workflows/docker.yml.github/workflows/release.ymlDockerfile
- docker.yml: only publish on tag push, not on manual workflow_dispatch - release.yml: thread resolved tag ref through all checkout steps so manual dispatch builds the correct commit - release.yml: use exact version match instead of prefix glob - release.yml: use `git log -n 20` fallback for changelog (safe with <20 commits) - release.yml: add --verify-tag to gh release create - Dockerfile: remove apt-get upgrade for reproducibility, add non-root runtime user
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Around line 45-49: The workflow currently skips the check-version job when
manually dispatched with inputs.dry_run true due to the if expression
(github.event_name == 'workflow_dispatch' && inputs.dry_run), which lets build
continue despite a missing version check; remove that conditional so the
check-version job always runs (delete the if: ${{ !(github.event_name ==
'workflow_dispatch' && inputs.dry_run) }} from the check-version job) and also
remove or tighten any permissive if on the build job that explicitly allows
build to proceed when check-version was skipped (update the build job's
conditional so it requires check-version to have run/succeeded rather than
allowing continuation when skipped).
- Around line 16-17: Move the repository write permission off the global
workflow level and restrict it to the release job: remove or change the
top-level "permissions: contents: write" and instead add "permissions: contents:
write" under the "draft-release" job definition so only that job gets write
access; for the "check-version" and "build" jobs locate their checkout steps
(uses: actions/checkout@...) and add "persist-credentials: false" to those
checkout steps to ensure the GITHUB_TOKEN is not persisted for non-release jobs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 93f5541c-abd2-45cf-a77d-c677e1e96bfb
📒 Files selected for processing (3)
.github/workflows/docker.yml.github/workflows/release.ymlDockerfile
✅ Files skipped from review due to trivial changes (2)
- Dockerfile
- .github/workflows/docker.yml
- Move OCI labels from chef stage to runtime stage so they appear on final image - Change latest tag to always apply on tag push (is_default_branch is false for tags) - Use sha256sum instead of shasum for Linux CI runners
…ion check - Move contents:write to draft-release job only, default to contents:read - Add persist-credentials:false to check-version and build checkouts - Remove dry_run skip on check-version so version is always validated - Require check-version success (not skipped) before build proceeds
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Around line 33-42: When handling workflow_dispatch input, validate and
normalize the provided TAG so REF and VERSION are consistent: check the input
(inputs.tag) for a leading "v" and either strip it for VERSION or ensure REF
uses the same form; set TAG to include the "v" prefix if downstream steps (like
release creation) expect "vX.Y.Z", set VERSION="${TAG#v}" for release name, and
set REF="refs/tags/${TAG}" accordingly; update the workflow logic around the
TAG, REF, and VERSION assignments (the variables TAG, REF, VERSION and the echo
lines to GITHUB_OUTPUT) to normalize the tag format and fail fast with a clear
error if the input is not a valid semver-like tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9a58b424-be9d-46b4-b0d7-c025767eb96e
📒 Files selected for processing (3)
.github/workflows/docker.yml.github/workflows/release.ymlDockerfile
✅ Files skipped from review due to trivial changes (1)
- .github/workflows/docker.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- Dockerfile
Reject non-semver inputs (e.g., `0.1.0` without `v` prefix) early in extract-version instead of failing late during release creation.
- docker.yml: only tag as `latest` when ref has no `-` (excludes prerelease tags like v0.1.0-rc.1, v0.1.0-alpha) - release.yml: use prefix match for version check so tag v0.1.0-rc.1 passes when Cargo.toml version is 0.1.0 (matches scroll-reth pattern)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dockerfilewith cargo-chef multi-stage build pattern (dependency caching + debian:bookworm-slim runtime).github/workflows/docker.yml: tagv*triggered, builds amd64+arm64 via QEMU, pushes toghcr.io/morph-l2/morph-reth.github/workflows/release.yml: tagv*triggered, cross-compiles Linux binaries (x86_64+aarch64), generates SHA256 checksums, auto-generates changelog, creates GitHub draft release.dockerignoreto exclude build artifacts and dev filesReferences: scroll-reth Docker/Release workflows, tempo Dockerfile patterns
Test plan
docker build -t morph-reth:test .builds successfully locallySummary by CodeRabbit