Reworked CI Build #322
Reworked CI Build #322
Conversation
[build image]
[build image]
[build image]
[build image]
[build image]
human-friendly tag will be applied in separate workflow [build image]
[build image]
# Conflicts: # backend/pom.xml
|
Caution Review failedThe pull request is closed. WalkthroughThe changes modify the build and deployment configurations across multiple areas. The GitHub Actions workflow in Possibly related PRs
Suggested reviewers
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (2)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (4)
backend/src/main/docker/Dockerfile.jvm (2)
2-2: Consider pinning specific base image versions.The base images use major version tags which could lead to unexpected changes. Consider using more specific version tags for better reproducibility.
-FROM quay.io/quarkus/ubi-quarkus-mandrel-builder-image:jdk-21 AS builder +FROM quay.io/quarkus/ubi-quarkus-mandrel-builder-image:jdk-21.0.2 AS builder -FROM eclipse-temurin:21-jre-alpine +FROM eclipse-temurin:21.0.2_13-jre-alpineAlso applies to: 13-13
8-10: Consider caching Maven dependencies more effectively.The current setup downloads dependencies twice. Consider copying the source files before running
go-offlineto cache all dependencies.+COPY src /code/src RUN ./mvnw -B quarkus:go-offline --no-transfer-progress -COPY src /code/src RUN ./mvnw -B package -DskipTests --no-transfer-progress --strict-checksumsbackend/src/main/docker/Dockerfile.native (2)
2-2: Consider pinning specific base image versions.The base images use major version tags which could lead to unexpected changes. Consider using more specific version tags for better reproducibility.
-FROM quay.io/quarkus/ubi-quarkus-mandrel-builder-image:jdk-21 AS builder +FROM quay.io/quarkus/ubi-quarkus-mandrel-builder-image:jdk-21.0.2 AS builder -FROM quay.io/quarkus/quarkus-micro-image:2.0 +FROM quay.io/quarkus/quarkus-micro-image:2.0.3Also applies to: 13-13
8-10: Consider caching Maven dependencies more effectively.The current setup downloads dependencies twice. Consider copying the source files before running
go-offlineto cache all dependencies.+COPY src /code/src RUN ./mvnw -B quarkus:go-offline --no-transfer-progress -COPY src /code/src RUN ./mvnw -B package -Dnative -DskipTests --no-transfer-progress --strict-checksums
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (9)
.github/workflows/build.yml(2 hunks)backend/.mvn/wrapper/.gitignore(1 hunks)backend/.mvn/wrapper/maven-wrapper.properties(1 hunks)backend/README.md(2 hunks)backend/mvnw(1 hunks)backend/mvnw.cmd(1 hunks)backend/pom.xml(1 hunks)backend/src/main/docker/Dockerfile.jvm(1 hunks)backend/src/main/docker/Dockerfile.native(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- backend/.mvn/wrapper/maven-wrapper.properties
- backend/.mvn/wrapper/.gitignore
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/build.yml
87-87: label "ubuntu-24.04-arm" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2022", "windows-2019", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-22.04", "ubuntu-20.04", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "macos-12-xl", "macos-12-xlarge", "macos-12-large", "macos-12", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
🔇 Additional comments (11)
backend/mvnw.cmd (1)
1-150: LGTM! Well-structured Maven wrapper script for Windows.The script follows best practices with proper error handling, secure credential management, and checksum validation.
backend/mvnw (1)
1-260: LGTM! Well-structured Maven wrapper script for Unix-like systems.The script implements robust security practices with proper error handling, secure credential management, and platform-specific adaptations.
backend/src/main/docker/Dockerfile.native (1)
17-21: LGTM! Proper permission setup for non-root user.The permission setup follows security best practices by:
- Setting appropriate directory permissions
- Running as non-root user
- Maintaining group access for container orchestration
backend/README.md (3)
11-11: Use of Maven Wrapper for Dev Mode
The command now uses./mvnw clean quarkus:devto start dev mode. This ensures that the build environment is consistent across systems.
51-52: JVM Docker Image Build Command Update
The Docker build command now referencesDockerfile.jvmwith the correct image tag. This change aligns with the Docker-centric approach. Confirm that the image metadata and context are correct.
58-59: Native Docker Image Build Command Update
The command to build native images now correctly points toDockerfile.native. The accompanying note on build-time and memory requirements is informative..github/workflows/build.yml (4)
18-21: Renaming of Test Job to "Run Tests"
Renaming the job to "Run Tests" improves clarity. The updated steps (checkout, Node setup, frontend build/test, and backend Maven build) appear correctly sequenced.
66-71: Backend Maven Build Command Update
The backend build command now uses the Maven Wrapper (./mvnw -B clean verify ... --no-transfer-progress). This should provide more stable builds and cleaner logs.
76-147: New Job: Build and Push Native Images
The newly addedbuild-native-imagejob is well structured with a matrix strategy for multi-architecture builds. Each step—from setting up Node and installing dependencies to configuring Docker metadata and pushing the container—seems properly orchestrated.🧰 Tools
🪛 actionlint (1.7.4)
87-87: label "ubuntu-24.04-arm" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2022", "windows-2019", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-22.04", "ubuntu-20.04", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "macos-12-xl", "macos-12-xlarge", "macos-12-large", "macos-12", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
148-187: New Job: Multi-Arch Image Manifest and Provenance
Themulti-arch-imagejob correctly depends on the native image build, creates a multi-architecture manifest, and generates an artifact attestation. The step to extract a short commit SHA and use it for tagging is a neat touch.backend/pom.xml (1)
271-274: Update to Uber-Jar Packaging Property
The change from<quarkus.package.type>to<quarkus.package.jar.type>uber-jar</quarkus.package.jar.type>in the "uber-jar" profile aligns with updated Quarkus conventions for packaging. Verify that downstream processes and documentation are updated to reflect this change.
-amd64suffix when deploying native images.See Build
See Resulting Image for commit 625d3cd
See Attestation for this build.
Verify as per this instruction: