Add supervisor build pipeline #1772
Conversation
|
WalkthroughThis pull request updates the project’s configuration and CI/CD workflows. The Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant GH as GitHub Workflow
participant CB as Check-Branch Job
participant BI as Build Job
participant GT as Get-Image-Tag Action
participant DR as Docker Registry
Dev->>GH: Push tag / Trigger workflow
GH->>CB: Run check-branch job
CB-->>GH: Validate branch & tag conditions
GH->>BI: Trigger build job (after check passes)
BI->>GT: Retrieve image tag (if ref matches re2 pattern)
GT-->>BI: Return constructed tag
BI->>DR: Build and push Docker image
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (7)
.github/actions/get-image-tag/action.yml (1)
34-39: Consider refactoring duplicate tag generation logicThe logic for generating tags from
re2-*-*pattern is identical to the one forinfra-*-*. Consider extracting this common logic into a function to avoid duplication and make future maintenance easier.- elif [[ "${{ github.ref_name }}" == re2-*-* ]]; then - env=$(echo ${{ github.ref_name }} | cut -d- -f2) - sha=$(echo ${{ github.sha }} | head -c7) - ts=$(date +%s) - tag=${env}-${sha}-${ts} + elif [[ "${{ github.ref_name }}" == re2-*-* ]] || [[ "${{ github.ref_name }}" == infra-*-* ]]; then + env=$(echo ${{ github.ref_name }} | cut -d- -f2) + sha=$(echo ${{ github.sha }} | head -c7) + ts=$(date +%s) + tag=${env}-${sha}-${ts}.github/workflows/publish-worker-re2.yml (1)
67-70: Use Docker Buildx build command for better cachingYou're setting up Docker Buildx but not using it for the build command. Consider using the
docker buildx buildcommand to take advantage of Buildx's improved caching mechanisms.- - name: 🚢 Build Container Image - run: | - docker build -t infra_image -f ./apps/${{ matrix.package }}/Containerfile . + - name: 🚢 Build Container Image + run: | + docker buildx build --load -t infra_image -f ./apps/${{ matrix.package }}/Containerfile .apps/supervisor/Containerfile (5)
8-9: Consider improving dependency pruningThe Turbo prune followed by a separate find command to remove node_modules seems redundant. Turbo prune should already handle excluding node_modules from the output directory.
RUN npx -q turbo@1.10.9 prune --scope=supervisor --docker -RUN find . -name "node_modules" -type d -prune -exec rm -rf '{}' +
24-26: Consider using --frozen-lockfile for deterministic installationsYou're using
--no-frozen-lockfilewhich allows package versions to be updated during installation. For reproducible builds, consider using--frozen-lockfileinstead.-RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm fetch --no-frozen-lockfile -RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --ignore-scripts --no-frozen-lockfile +RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm fetch +RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --ignore-scripts --frozen-lockfile
31-31: Consider using --frozen-lockfile for production dependenciesSame issue here - for reproducible builds, consider using
--frozen-lockfileinstead of--no-frozen-lockfile.-RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --prod --no-frozen-lockfile +RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --prod --frozen-lockfile
36-36: Consider using a version variable for PrismaThe Prisma version (5.4.1) is hardcoded. Consider defining it as a build argument or environment variable for easier maintenance.
+ARG PRISMA_VERSION=5.4.1 ENV NPM_CONFIG_IGNORE_WORKSPACE_ROOT_CHECK true -RUN pnpx prisma@5.4.1 generate --schema /app/internal-packages/database/prisma/schema.prisma +RUN pnpx prisma@${PRISMA_VERSION} generate --schema /app/internal-packages/database/prisma/schema.prisma
63-63: Add a health check to improve container orchestrationConsider adding a HEALTHCHECK instruction to enable container orchestrators to monitor the application's health.
USER node +# Add health check to the container +HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \ + CMD wget --no-verbose --tries=1 --spider http://localhost:8000/health || exit 1 + CMD [ "/usr/bin/dumb-init", "--", "pnpm", "run", "--filter", "supervisor", "start"]
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.dockerignore(1 hunks).github/actions/get-image-tag/action.yml(1 hunks).github/workflows/publish-worker-re2.yml(1 hunks)apps/supervisor/Containerfile(1 hunks)apps/supervisor/package.json(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: typecheck / typecheck
- GitHub Check: Analyze (javascript-typescript)
🔇 Additional comments (3)
apps/supervisor/package.json (1)
8-8: Added build script looks good!The
"build": "tsc"script addition is straightforward and will enable TypeScript compilation for the Docker build process defined in the new Containerfile..dockerignore (1)
12-12: Good improvement to catch all node_modules directories!Changing from
node_modulesto**/node_modulesensures that Docker ignores all node_modules directories at any level in the project tree, which is ideal for monorepos. This will help optimize Docker builds by reducing context size.apps/supervisor/Containerfile (1)
1-1: Good practice pinning the base image with SHAUsing a SHA digest for the base image ensures build reproducibility and security. This is an excellent practice.
Summary by CodeRabbit
Chores
New Features