bal 2027 fix build image ee include sentry #2385
Conversation
…-fix-build-image-ee-include-sentry
…age-ee-include-sentry
|
|
Important Auto Review SkippedReview was skipped as selected files did not have any reviewable changes. Files selected but had no reviewable changes (1)
You can disable this status message by setting the WalkthroughThis update brings significant improvements to the CI/CD workflow and Docker image management for the workflows service. It includes enhancements like Docker image scanning, conditional HelmChart updates, and checks for data migration based on branch existence. The Dockerfile now incorporates a Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Review Details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (6)
- .github/workflows/publish-workflows-service.yml (7 hunks)
- services/workflows-service/Dockerfile (2 hunks)
- services/workflows-service/prisma/data-migrations (1 hunks)
- services/workflows-service/src/common/utils/request-response/request.ts (1 hunks)
- services/workflows-service/src/errors.ts (1 hunks)
- services/workflows-service/src/sentry/sentry.module.ts (3 hunks)
Files skipped from review due to trivial changes (1)
- services/workflows-service/prisma/data-migrations
Additional comments not posted (10)
services/workflows-service/Dockerfile (1)
10-11: The addition of theSHORT_SHAargument and environment variable looks good and is correctly implemented in both the development and production stages.Also applies to: 28-29
services/workflows-service/src/common/utils/request-response/request.ts (1)
30-30: Addingreq.bodyto the metadata object is a useful enhancement for logging and debugging purposes. Ensure thatreq.bodydoes not contain sensitive information before logging.services/workflows-service/src/sentry/sentry.module.ts (1)
24-24: The addition of the_distproperty and its inclusion in the Sentry configuration is correctly implemented and enhances the Sentry setup.Also applies to: 34-34, 45-45
services/workflows-service/src/errors.ts (1)
63-63: The modification to thegetErrorsmethod ensures that it returns the correct errors from the response object, which is a necessary improvement..github/workflows/publish-workflows-service.yml (6)
146-147: The addition of theSHORT_SHAbuild argument in the Docker build step is correctly implemented.
148-159: The new step for scanning Docker images usingaquasecurity/trivy-actionis a good addition for security. Ensure that thetrivyignoresfile is properly configured.
180-182: The modification to thesparse-checkoutpaths to includekubernetes/helm/wf-serviceand settingsparse-checkout-cone-modetotrueis correctly implemented.
Line range hint
195-205: The step for updating the workflow-service image version in the HelmChart is correctly implemented with a conditional check.
281-308: The new job for checking if a data migration branch exists is correctly implemented and adds a useful conditional check for the build process.
Line range hint
311-382: The new job for building and pushing the EE Docker image is correctly implemented with the necessary steps and conditional checks.
There was a problem hiding this comment.
Actionable comments posted: 2
Review Details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (1)
- .github/workflows/publish-workflows-service.yml (7 hunks)
Additional comments not posted (2)
.github/workflows/publish-workflows-service.yml (2)
146-146: Including theSHORT_SHAbuild argument is a good addition for tracking the commit in the Docker image.
148-159: Adding a Docker image scan withaquasecurity/trivy-actionis a great practice for enhancing security.
| id: update_helm_check | ||
| shell: bash | ||
| run: | | ||
| if [ -f "kubernetes/helm/wf-service/${{ github.ref_name }}-custom-values.yaml" ]; then | ||
| echo "file_name=${{ github.ref_name }}-custom-values.yaml" >> "$GITHUB_OUTPUT" | ||
| elif [ "${{ github.event.inputs.deploy_to_dev }}" == "true" ]; then | ||
| echo "file_name=dev-custom-values.yaml" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "skip_helm=true" >> "$GITHUB_OUTPUT" | ||
| fi | ||
|
|
There was a problem hiding this comment.
Avoid using ${{ github.ref_name }} and ${{ github.event.inputs.deploy_to_dev }} directly in the run: step to prevent potential code injection. Use environment variables instead.
- run: |
- if [ -f "kubernetes/helm/wf-service/${{ github.ref_name }}-custom-values.yaml" ]; then
- echo "file_name=${{ github.ref_name }}-custom-values.yaml" >> "$GITHUB_OUTPUT"
- elif [ "${{ github.event.inputs.deploy_to_dev }}" == "true" ]; then
- echo "file_name=dev-custom-values.yaml" >> "$GITHUB_OUTPUT"
- else
- echo "skip_helm=true" >> "$GITHUB_OUTPUT"
+ env:
+ GITHUB_REF_NAME: ${{ github.ref_name }}
+ DEPLOY_TO_DEV: ${{ github.event.inputs.deploy_to_dev }}
+ run: |
+ if [ -f "kubernetes/helm/wf-service/$GITHUB_REF_NAME-custom-values.yaml" ]; then
+ echo "file_name=$GITHUB_REF_NAME-custom-values.yaml" >> "$GITHUB_OUTPUT"
+ elif [ "$DEPLOY_TO_DEV" == "true" ]; then
+ echo "file_name=dev-custom-values.yaml" >> "$GITHUB_OUTPUT"
+ else
+ echo "skip_helm=true" >> "$GITHUB_OUTPUT"Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| id: update_helm_check | |
| shell: bash | |
| run: | | |
| if [ -f "kubernetes/helm/wf-service/${{ github.ref_name }}-custom-values.yaml" ]; then | |
| echo "file_name=${{ github.ref_name }}-custom-values.yaml" >> "$GITHUB_OUTPUT" | |
| elif [ "${{ github.event.inputs.deploy_to_dev }}" == "true" ]; then | |
| echo "file_name=dev-custom-values.yaml" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "skip_helm=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| id: update_helm_check | |
| shell: bash | |
| env: | |
| GITHUB_REF_NAME: ${{ github.ref_name }} | |
| DEPLOY_TO_DEV: ${{ github.event.inputs.deploy_to_dev }} | |
| run: | | |
| if [ -f "kubernetes/helm/wf-service/$GITHUB_REF_NAME-custom-values.yaml" ]; then | |
| echo "file_name=$GITHUB_REF_NAME-custom-values.yaml" >> "$GITHUB_OUTPUT" | |
| elif [ "$DEPLOY_TO_DEV" == "true" ]; then | |
| echo "file_name=dev-custom-values.yaml" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "skip_helm=true" >> "$GITHUB_OUTPUT" | |
| fi |
| run: | | ||
| if [ "${{ github.event.inputs.deploy_to_dev }}" == "true" ]; then | ||
| suffix="-dev-${{ needs.build-and-push-image.outputs.sha_short }}" | ||
| else | ||
| suffix="" | ||
| fi | ||
| gh release create ${{ needs.build-and-push-image.outputs.version }}${suffix} --notes-start-tag ${{ needs.build-and-push-image.outputs.bumped_tag }} | ||
|
|
There was a problem hiding this comment.
Avoid using ${{ github.event.inputs.deploy_to_dev }} directly in the run: step to prevent potential code injection. Use environment variables instead.
- run: |
- if [ "${{ github.event.inputs.deploy_to_dev }}" == "true" ]; then
- suffix="-dev-${{ needs.build-and-push-image.outputs.sha_short }}"
- else
- suffix=""
- fi
- gh release create ${{ needs.build-and-push-image.outputs.version }}${suffix} --notes-start-tag ${{ needs.build-and-push-image.outputs.bumped_tag }}
+ env:
+ DEPLOY_TO_DEV: ${{ github.event.inputs.deploy_to_dev }}
+ SHA_SHORT: ${{ needs.build-and-push-image.outputs.sha_short }}
+ VERSION: ${{ needs.build-and-push-image.outputs.version }}
+ BUMPED_TAG: ${{ needs.build-and-push-image.outputs.bumped_tag }}
+ run: |
+ if [ "$DEPLOY_TO_DEV" == "true" ]; then
+ suffix="-dev-$SHA_SHORT"
+ else
+ suffix=""
+ fi
+ gh release create "$VERSION$suffix" --notes-start-tag "$BUMPED_TAG"Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| run: | | |
| if [ "${{ github.event.inputs.deploy_to_dev }}" == "true" ]; then | |
| suffix="-dev-${{ needs.build-and-push-image.outputs.sha_short }}" | |
| else | |
| suffix="" | |
| fi | |
| gh release create ${{ needs.build-and-push-image.outputs.version }}${suffix} --notes-start-tag ${{ needs.build-and-push-image.outputs.bumped_tag }} | |
| env: | |
| DEPLOY_TO_DEV: ${{ github.event.inputs.deploy_to_dev }} | |
| SHA_SHORT: ${{ needs.build-and-push-image.outputs.sha_short }} | |
| VERSION: ${{ needs.build-and-push-image.outputs.version }} | |
| BUMPED_TAG: ${{ needs.build-and-push-image.outputs.bumped_tag }} | |
| run: | | |
| if [ "$DEPLOY_TO_DEV" == "true" ]; then | |
| suffix="-dev-$SHA_SHORT" | |
| else | |
| suffix="" | |
| fi | |
| gh release create "$VERSION$suffix" --notes-start-tag "$BUMPED_TAG" |
Description
Elaborate on the subject, motivation, and context.
Related issues
Breaking changes
How these changes were tested
Examples and references
Checklist
Summary by CodeRabbit
New Features
Improvements
ValidationErrorclass.SentryModulefor better version tracking.Bug Fixes