ci: publish research and trading images to ACR - #14
Conversation
|
Warning Review limit reached
Next review available in: 47 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughAdds a manually triggered GitHub Actions workflow that builds and pushes ChangesACR image publishing
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 |
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 |
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Log in to ACR | ||
| uses: docker/login-action@v3 |
|
|
||
| - name: Build and push | ||
| id: build | ||
| uses: docker/build-push-action@v6 |
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/acr-publish.yml (2)
26-27: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueDisable credential persistence in the checkout action.
As flagged by static analysis, the
actions/checkoutaction persists theGITHUB_TOKENin the local git configuration by default. Since this workflow only needs to read the repository contents to build the Docker image, it is a security best practice to disable credential persistence. This minimizes the token's exposure to subsequent steps or the Docker build environment.🛡️ Proposed fix to disable credential persistence
- name: Checkout uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/acr-publish.yml around lines 26 - 27, Update the actions/checkout@v4 step in the workflow to disable credential persistence by configuring its persist-credentials input to false, while leaving the existing checkout behavior unchanged.Source: Linters/SAST tools
51-53: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valuePass variables to the run script via environment variables.
As flagged by static analysis, interpolating GitHub Actions expressions (
${{ ... }}) directly into arunscript can expose the workflow to shell injection risks if any variable unexpectedly contains quotes. Although the specific variables used here are trusted and unlikely to contain malicious characters, passing them via environment variables is a strong security best practice that prevents quoting issues entirely.🛡️ Proposed fix to securely pass variables
- name: Record immutable image + env: + REGISTRY: ${{ vars.ACR_REGISTRY }} + REPOSITORY: ${{ matrix.repository }} + DIGEST: ${{ steps.build.outputs.digest }} run: | - echo '${{ matrix.repository }}=${{ vars.ACR_REGISTRY }}/monday/${{ matrix.repository }}@${{ steps.build.outputs.digest }}' >> "$GITHUB_STEP_SUMMARY" + echo "${REPOSITORY}=${REGISTRY}/monday/${REPOSITORY}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/acr-publish.yml around lines 51 - 53, Update the “Record immutable image” step to pass matrix.repository, vars.ACR_REGISTRY, and steps.build.outputs.digest through the step’s environment, then reference those environment variables in the shell command instead of interpolating GitHub Actions expressions directly in run. Preserve the existing summary format and image digest value.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/acr-publish.yml:
- Around line 26-27: Update the actions/checkout@v4 step in the workflow to
disable credential persistence by configuring its persist-credentials input to
false, while leaving the existing checkout behavior unchanged.
- Around line 51-53: Update the “Record immutable image” step to pass
matrix.repository, vars.ACR_REGISTRY, and steps.build.outputs.digest through the
step’s environment, then reference those environment variables in the shell
command instead of interpolating GitHub Actions expressions directly in run.
Preserve the existing summary format and image digest value.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 74c4f32d-0461-4ea6-a215-05fe2e8ca0d0
📒 Files selected for processing (1)
.github/workflows/acr-publish.yml
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e5fca20162
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| context: rust_hft | ||
| file: ${{ matrix.file }} | ||
| platforms: linux/amd64 | ||
| push: true |
There was a problem hiding this comment.
When this manually dispatched workflow is run from a non-main ref (the Actions UI/gh workflow run --ref allow selecting a branch), this unconditional push: true builds whatever Dockerfiles and source are on that branch and publishes them to the shared ACR under a commit-SHA tag. That lets unreviewed branch code produce monday/research-runner and monday/hft-trading images with production registry credentials; add a main-ref guard or pin checkout/push provenance before pushing.
Useful? React with 👍 / 👎.
Summary
linux/amd64research and trading images from the existing DockerfilesConfiguration
ACR_REGISTRY,ACR_USERNAMEACR_PASSWORDmondayresearch-runner,hft-tradingReview
git diff --check: passSummary by CodeRabbit