fix(archon): use absolute paths for ARCHON_UI_DIR in vendor build step by POWERFULMOVES · Pull Request #1592 · POWERFULMOVES/PMOVES.AI

POWERFULMOVES · 2026-05-24T11:11:15Z

Summary

Fixes a relative-path-after-cd bug in pmoves/services/archon/Dockerfile:178-186 that has broken every push-event GHCR build of pmoves-archon since at least 2026-05-19.

The bug

ARG ARCHON_UI_DIR=vendor/archon/packages/web
RUN if [ -d "$ARCHON_UI_DIR" ]; then \
        ...
        cd /app/vendor/archon && bun install --frozen-lockfile && \
        cd "$ARCHON_UI_DIR" && bun run build && \
        ...

The test [ -d "$ARCHON_UI_DIR" ] runs from WORKDIR /app and passes (/app/vendor/archon/packages/web exists).
cd /app/vendor/archon changes CWD.
cd "$ARCHON_UI_DIR" (relative vendor/archon/packages/web) resolves to /app/vendor/archon/vendor/archon/packages/web — doesn't exist.

Build log proof:

→ Building Archon UI from vendor/archon/packages/web
bun install v1.3.14 (0d9b296a)
... 2631 packages installed [5.39s]
/bin/sh: 1: cd: can't cd to vendor/archon/packages/web

The fix

Two-line change — prefix both the [ -d ] test and the cd with /app/ so they resolve unambiguously regardless of current CWD.

History

This bug has been failing repeatedly on Build and publish integration images to GHCR runs since 2026-05-19+ — surfaced on dependabot branches, fix/agent-zero-dockerized-flag, and main pushes. It also reproduces on PR #1589's Validate archon (PR) job after the submodule-aware archive fix from that PR materialized the build context correctly.

Relation to other PRs

PR infra(ci): resolve stale-branch-sweep label gap + agent-zero post-ci checkout gap #1581 — round 1 CI failure sweep (different scope: agent-zero-upstream-check, label gap)
PR infra(ci): fix archon-ui matrix path drift + flip CodeQL to ubuntu-latest #1589 — round 2 (matrix archon-ui entry, CodeQL ubuntu-latest flip, submodule-aware archive)
This PR — narrow Dockerfile fix; companion to infra(ci): fix archon-ui matrix path drift + flip CodeQL to ubuntu-latest #1589.

Once #1581 + #1589 + this PR merge, all 14 GHCR matrix builds should progress past their respective build phases. GHCR push 403 remains a separate auth-order issue tracked under Finding 2 of PR #1589 (operator action: workflow auth chain reorder OR App installation permission).

Test plan

CI Validate archon (PR) flips from fail to pass on this PR
After merge + PR infra(ci): fix archon-ui matrix path drift + flip CodeQL to ubuntu-latest #1589 merge, trigger workflow_dispatch on integrations-ghcr.yml — Build archon should complete the docker build successfully (push step pending Finding 2 resolution)

🤖 Generated with Claude Code

The archon Dockerfile's UI build step had a relative-path-after-cd bug that broke every multi-arch GHCR build of pmoves-archon: ARG ARCHON_UI_DIR=vendor/archon/packages/web RUN if [ -d "$ARCHON_UI_DIR" ]; then \ ... cd /app/vendor/archon && bun install --frozen-lockfile && \ cd "$ARCHON_UI_DIR" && bun run build && \ ... The test `[ -d "$ARCHON_UI_DIR" ]` ran from the /app WORKDIR and passed. `cd /app/vendor/archon` then changed CWD. After that, `cd "$ARCHON_UI_DIR"` was interpreted as relative — the shell tried to cd to `/app/vendor/archon/vendor/archon/packages/web`, which doesn't exist. Build log: → Building Archon UI from vendor/archon/packages/web bun install v1.3.14 (0d9b296a) ... 2631 packages installed [5.39s] /bin/sh: 1: cd: can't cd to vendor/archon/packages/web Fix: prefix both the test and the cd with /app/ so they resolve unambiguously regardless of current CWD. This bug has been failing every push-event GHCR build of pmoves-archon since at least 2026-05-19 (dependabot branches, fix/agent-zero-dockerized-flag, main pushes) and was confirmed reproducing on PR #1589's `Validate archon (PR)` job after that PR's submodule-aware archive fix materialized the build context correctly. Companion fix to PR #1589 (CI failure sweep round 2). Once both merge, all 14 GHCR matrix builds will progress past their respective build phases. GHCR push 403 remains a separate operator/workflow issue tracked under Finding 2 of PR #1589. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-05-24T11:11:21Z

Warning

Review limit reached

@POWERFULMOVES, we couldn't start this review because you've used your available PR reviews for now.

Your plan currently allows 1 review/hour. Refill in 4 minutes and 8 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ce03fe6d-788d-420c-b2fa-409ad9de82f0

📥 Commits

Reviewing files that changed from the base of the PR and between 08ea3f2 and df2d0bf.

📒 Files selected for processing (1)

pmoves/services/archon/Dockerfile

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/archon-dockerfile-relative-cd-2026-05-24

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-05-24T11:11:37Z

Docker Hardening Validation

Hardening Validation Report

Validated: Sun May 24 11:11:36 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

[INFO] Checking: pmoves/docker-compose.hardened.yml

[INFO] Validating: hi-rag-gateway-v2
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: extract-worker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: langextract
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: presign
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: render-webhook
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: retrieval-eval
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pdf-ingest
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: jellyfin-bridge
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: invidious-companion-proxy
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: ffmpeg-whisper
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-video
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: media-audio
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-v2-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: hi-rag-gateway-gpu
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: deepresearch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supaserch
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher-discord
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: mesh-agent
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-req
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: nats-echo-res
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: publisher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: analysis-echo
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: graph-linker
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: comfy-watcher
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: grayjay-plugin-host
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: agent-zero
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: archon
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: channel-monitor
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: pmoves-yt
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: notebook-sync
[PASS] Non-root user: 65532:65532
[PASS] Read-only filesystem
[PASS] All capabilities dropped
[PASS] No-new-privileges enabled
[WARN] No resource limits

[INFO] Validating: supabase_service_role_key
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

[INFO] Validating: supabase_jwt_secret
[WARN] No user directive
[WARN] No read_only directive
[WARN] No cap_drop: ["ALL"]
[WARN] No no-new-privileges
[WARN] No resource limits

======================================
Summary: 120 passed, 40 warnings, 0 errors

…1594 #1595) (#1596) Records the 5-PR sprint: archon Dockerfile absolute-path fix, CI matrix path drift, Shift Crew Phase 6 conflict resolution, PMOVES-Archon upstream sync to v0.3.12, and restore to PMOVES.AI-Edition-Hardened tracking. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* infra(ci): prefer org-scoped PAT over App token for GHCR auth The GitHub App installation referenced by GH_APP_CLIENT_ID/GH_APP_SEC lacks org-level write:packages permission on POWERFULMOVES, so its token cannot push to ghcr.io/powerfulmoves/* packages. But because docker/login-action only validates that the registry accepts the credential (not whether it has push scope), App login was claiming "success" — preempting the PAT fallback. Result: all 14 integration builds fail at the push step with `403 denied: installation not allowed to Write organization package`, even after the GHCR_TOKEN secret is rotated to an org-scoped PAT with write:packages. Fix: swap the auth-chain order so PAT runs first when configured. New precedence: PAT > App > workflow token. The PAT step's existing condition (`env.GHCR_USERNAME != '' && env.GHCR_PAT != ''`) already gates correctly when PAT is unset, falling through to App. The other reference (USE_GHCR at line 474) is an OR across all three outcomes, so order-independent. After this lands, the next workflow_dispatch run should show all build-publish jobs reaching the push step successfully — gated only by the remaining build-time failures (archon Dockerfile bug → PR #1592, archon-ui matrix entry → PR #1589). Verified empirically via run 26352859002: agent-zero/open-notebook/wger all hit `403 Forbidden` at blob PUT despite the rotated GHCR_TOKEN being correctly configured. Companion to: - PR #1581 (round 1 CI sweep) - PR #1589 (round 2: archon-ui matrix + CodeQL + submodule-aware archive) - PR #1592 (archon Dockerfile relative-cd fix) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(ci): correct GH_APP_CLIENT_ID in GHCR auth error message Error message referenced GH_APP_ID but the actual secret is GH_APP_CLIENT_ID. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Shaela Bello <slbello@uncg.edu> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

POWERFULMOVES mentioned this pull request May 24, 2026

infra(ci): prefer org-scoped PAT over App token for GHCR auth #1593

Merged

3 tasks

POWERFULMOVES merged commit 6646687 into main May 24, 2026
53 of 58 checks passed

POWERFULMOVES deleted the fix/archon-dockerfile-relative-cd-2026-05-24 branch May 24, 2026 13:51

POWERFULMOVES mentioned this pull request May 24, 2026

docs(agnote): Archon reconciliation trail entry (#1589-#1595) #1596

Merged

2 tasks

POWERFULMOVES mentioned this pull request May 27, 2026

docs(agnote): Archon reconciliation RELEASE trail #1608

Closed

2 tasks

Navigation Menu

fix(archon): use absolute paths for ARCHON_UI_DIR in vendor build step - #1592

fix(archon): use absolute paths for ARCHON_UI_DIR in vendor build step#1592
POWERFULMOVES merged 1 commit into
mainfrom
fix/archon-dockerfile-relative-cd-2026-05-24

POWERFULMOVES commented May 24, 2026

Uh oh!

coderabbitai Bot commented May 24, 2026

Review limit reached

Uh oh!

github-actions Bot commented May 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

POWERFULMOVES commented May 24, 2026

Summary

The bug

The fix

History

Relation to other PRs

Test plan

Uh oh!

coderabbitai Bot commented May 24, 2026

Review limit reached

Uh oh!

github-actions Bot commented May 24, 2026

Docker Hardening Validation

Hardening Validation Report

Validated: Sun May 24 11:11:36 UTC 2026

Services Checked

PMOVES.AI Docker Hardening Validation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants