feat: add Docker image build/push to the release workflow - #138
Conversation
Adds a Dockerfile and .dockerignore, and extends the tag-triggered release workflow with a job that builds and pushes the image to GitHub Container Registry (ghcr.io) alongside the existing wheel/sdist GitHub release. Tags the image with the release version and, for non-prerelease tags, also tags it "latest".
|
Warning Review limit reached
Next review available in: 25 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughThe pull request adds a Python 3.11 container, excludes unnecessary Docker build-context files, and updates the release workflow to publish tagged images to GHCR. ChangesDocker image release
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Dockerfile
participant GHCR
GitHubActions->>GHCR: Authenticate with GITHUB_TOKEN
GitHubActions->>Dockerfile: Build image with release tags
GitHubActions->>GHCR: Push tagged image
Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 10: Update the workflow permissions so the global configuration retains
only contents: write, remove global packages: write, and add a permissions block
to the docker job with contents: read and packages: write. Leave
build-and-release with its existing release behavior and without package write
access.
- Line 48: Update the Docker job’s actions/checkout, docker/login-action, and
docker/build-push-action uses entries to reference immutable full commit SHAs,
while retaining each action’s version in an inline comment.
- Line 48: Update the actions/checkout@v4 step in the Docker job to set
persist-credentials to false, while leaving the existing checkout behavior
unchanged.
- Around line 62-64: Update the version checks near the release tag handling and
the latest-image assignment to use one version-aware prerelease condition that
recognizes hyphenated prerelease forms such as 0.1.0-beta and 1.2.3-rc.1. Reuse
that condition in both locations so latest is assigned only for stable versions,
including the declared version 0.1.0-beta as prerelease.
In `@Dockerfile`:
- Around line 11-14: Add a Docker HEALTHCHECK instruction near the existing
EXPOSE and ENTRYPOINT directives, probing the local service on the configured
RPC host and port 9000. Use a command that fails when the listener or health
endpoint is unavailable, with suitable check interval, timeout, and retry
settings, while preserving the existing ENTRYPOINT and CMD behavior.
- Line 11: Remove 8545 from the Dockerfile EXPOSE declaration unless the image
is intended to provide external RPC access; keep only the port consistently
exposed by the container’s actual service bindings.
- Line 1: Update the Dockerfile around the python:3.11-slim base image to create
a non-root application user with tools available in that slim variant, grant
that user ownership or write access to /app, and set USER before ENTRYPOINT. Use
a stable UID for the application user so mounted state directories can be
created with the same UID.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 89c5bfde-f2f6-4b1a-9c5d-238c7d19ccbc
📒 Files selected for processing (3)
.dockerignore.github/workflows/release.ymlDockerfile
| EXPOSE 9000 8545 | ||
|
|
||
| ENTRYPOINT ["python", "main.py"] | ||
| CMD ["--host", "0.0.0.0", "--port", "9000"] |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔵 Trivial
Add a container health check when the deployment uses Docker health status.
No HEALTHCHECK instruction exists. A hung node can remain running without a container-level failure signal. Check the local listener or add a dedicated health endpoint. Keep the check aligned with the RPC bind and port contract.
🧰 Tools
🪛 Checkov (3.3.9)
[low] 1-14: Ensure that HEALTHCHECK instructions have been added to container images
(CKV_DOCKER_2)
[low] 1-14: Ensure that a user for the container has been created
(CKV_DOCKER_3)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` around lines 11 - 14, Add a Docker HEALTHCHECK instruction near
the existing EXPOSE and ENTRYPOINT directives, probing the local service on the
configured RPC host and port 9000. Use a command that fails when the listener or
health endpoint is unavailable, with suitable check interval, timeout, and retry
settings, while preserving the existing ENTRYPOINT and CMD behavior.
Source: Linters/SAST tools
- Scope packages:write permission to the docker job only, not globally - Pin docker job's actions/checkout, docker/login-action, and docker/build-push-action to commit SHAs (with version comments) - Set persist-credentials: false on the docker job's checkout - Fix prerelease detection regex to recognize hyphenated forms like 0.1.0-beta and 1.2.3-rc.1 (previous regex required a trailing digit and silently missed our own version scheme) - Add HEALTHCHECK probing the internal RPC port - Drop 8545 from EXPOSE since RPC only binds 127.0.0.1 internally - Run the container as a non-root user with a stable UID, and add libgmp-dev/build deps needed to compile fastecdsa
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Around line 5-7: Pin explicit compatible versions for gcc, python3-dev,
libffi-dev, and libgmp-dev in the apt-get install command, using Debian package
version syntax. Keep the existing no-recommends option and package-list cleanup,
and update the pinned versions deliberately when dependencies change.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 3401dc6c-6160-4d9f-a4fb-75b2801b659c
📒 Files selected for processing (2)
.github/workflows/release.ymlDockerfile
Pins gcc, python3-dev, libffi-dev, and libgmp-dev to the exact candidate versions available in the python:3.11-slim (Debian 13 trixie) base image, so builds don't silently pick up new package versions over time. Verified with a clean docker build.
3 participants
Adds a Dockerfile and .dockerignore, and extends the tag-triggered release workflow with a job that builds and pushes the image to GitHub Container Registry (ghcr.io) alongside the existing wheel/sdist GitHub release. Tags the image with the release version and, for non-prerelease tags, also tags it "latest".
Addressed Issues:
Fixes #(TODO:issue number)
Screenshots/Recordings:
TODO: If applicable, add screenshots or recordings that demonstrate the interface before and after the changes.
Additional Notes:
AI Usage Disclosure:
We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact. AI slop is strongly discouraged and may lead to banning and blocking. Do not spam our repos with AI slop.
Check one of the checkboxes below:
I have used the following AI models and tools: TODO
Checklist
Summary by CodeRabbit
New Features
Release & Deployment
latest.