Skip to content

feat(deployment): Tier-based environment structure and container registry updates #501

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
POWERFULMOVES wants to merge 5 commits into from
Closed

feat(deployment): Tier-based environment structure and container registry updates #501

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
edee2b6
fix(hardened): Restore RLS policies and remove hardcoded credentials …
POWERFULMOVES Jan 7, 2026
d1a5073
fix(ci): Disable VPS runner, use ubuntu-latest for CHIT check
Jan 7, 2026
1f58e6a
feat(deployment): Update container registry and tier-based env structure
Jan 19, 2026
abc6701
fix(coderabbit): Remove invalid language field and enable v3-clean re…
Jan 19, 2026
7ddfea9
fix(deployment): Address PR #501 review findings
Jan 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 18 additions & 2 deletions .coderabbit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ reviews:
# Branches to review
branches:
- "PMOVES.AI-Edition-Hardened"
- "PMOVES.AI-Edition-Hardened-v3-clean"
- "feat/hardened-*"
- "fix/hardened-*"

Expand All @@ -16,5 +17,20 @@ reviews:
- "main"
- "origin/main"

# Language setting (locale for reviews)
language: "en"
# Documentation comment requirements
documentation:
# Require docstrings for Python functions/classes
coverage:
minimum: 80
patch: 80

# Review depth settings
review:
# Number of commits to review in a PR
num_commits: 10

# Include summary of PR
summary: true

# Enable line-by-line reviews
Comment on lines +20 to +35

@coderabbitai coderabbitai Bot Jan 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# Find and read the .coderabbit.yaml file
find . -name ".coderabbit.yaml" -o -name "coderabbit.yaml" | head -20

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 85

🏁 Script executed:

# Also search for schema-related files
find . -type f \( -name "*schema*" -o -name "*config*" \) | grep -E "\.(json|yaml|yml)$" | head -20

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 244

🏁 Script executed:

# Look for documentation files that might describe the schema
find . -type f \( -name "*.md" -o -name "*.rst" \) | xargs grep -l "coderabbit\|CodeRabbit\|schema" 2>/dev/null | head -10

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 445

🏁 Script executed:

# Read the .coderabbit.yaml file with line numbers
cat -n ./.coderabbit.yaml

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 1106

🌐 Web query:

CodeRabbit .coderabbit.yaml schema configuration documentation

💡 Result:

Here are the official CodeRabbit docs for the .coderabbit.yaml schema and configuration:

  • Configuration reference (full schema-driven field list & descriptions). [1]
  • Guide: configuring CodeRabbit via a .coderabbit.yaml file with examples and template. [2]
  • Notes on configuration inheritance and hierarchy (how repository/central/UI settings merge). [3]

Key points: place .coderabbit.yaml in the repository root; the docs include example files and the machine-readable JSON schema (referenced in examples as yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json). [2][1]

Sources:

  1. CodeRabbit — Configuration reference. [1]
  2. CodeRabbit — Configure using a YAML file (examples & template). [2]
  3. CodeRabbit — Configuration inheritance (hierarchy & merging). [3]

🌐 Web query:

CodeRabbit schema json https://coderabbit.ai/integrations/schema.v2.json documentation review top-level keys

💡 Result:

Top-level keys in the CodeRabbit schema (schema.v2.json) and brief descriptions:

  • language — locale for reviews (ISO codes, default "en-US"). [1]
  • tone_instructions — custom tone for reviews/chat (string). [1]
  • early_access — enable early-access features (boolean). [1]
  • enable_free_tier — enable free-tier features (boolean). [1]
  • inheritance — whether to inherit parent settings (boolean). [1]
  • reviews — object with many review-related settings (profile, summaries, labeling, auto-review, path filters, commit/review status, etc.). [1]
  • finishing_touches — options for generated docstrings and unit tests. [1]
  • pre_merge_checks — pre-merge check configuration (docstring coverage, title/description checks, linked-issue assessment, custom checks). [1]

Source: CodeRabbit schema JSON. [1] https://coderabbit.ai/integrations/schema.v2.json

🌐 Web query:

CodeRabbit configuration pre_merge_checks docstrings threshold

💡 Result:

Short answer: CodeRabbit’s pre_merge_checks include a Docstring Coverage check with a configurable "threshold" (percentage). The default threshold is 80% and you can set it in .coderabbit.yaml under reviews.pre_merge_checks.docstrings.threshold (example: threshold: 85). You can also set the check’s mode (off | warning | error). [1][2]

Sources:

  • CodeRabbit Pre‑Merge Checks (Docstring Coverage, default 80% and YAML example). [1]
  • Configuration reference / .coderabbit.yaml schema (pre_merge_checks.docstrings). [2]

documentation and review are invalid top-level keys in CodeRabbit schema.

Per the official CodeRabbit schema (schema.v2.json), valid top-level keys are reviews, pre_merge_checks, language, tone_instructions, early_access, enable_free_tier, inheritance, and finishing_touches. The documentation and review blocks at lines 20–36 will be ignored.

Move documentation coverage to pre_merge_checks.docstrings.threshold and keep review settings nested within the reviews block:

🔧 Schema-aligned adjustment 
 reviews:
   review_status: true
   branches:
     - "PMOVES.AI-Edition-Hardened"
     - "PMOVES.AI-Edition-Hardened-v3-clean"
     - "feat/hardened-*"
     - "fix/hardened-*"
   excluded_branches:
     - "main"
     - "origin/main"
+  num_commits: 10
+  summary: true
+  line_comments: true
 
-# Documentation comment requirements
-documentation:
-  # Require docstrings for Python functions/classes
-  coverage:
-    minimum: 80
-    patch: 80
-
-# Review depth settings
-review:
-  # Number of commits to review in a PR
-  num_commits: 10
-
-  # Include summary of PR
-  summary: true
-
-  # Enable line-by-line reviews
-  line_comments: true
+
+pre_merge_checks:
+  docstrings:
+    threshold: 80
🤖 Prompt for AI Agents 
In @.coderabbit.yaml around lines 20 - 35, The config uses invalid top-level
keys "documentation" and "review"; move the docstring coverage settings into
pre_merge_checks.docstrings.threshold (set to 80 from coverage.minimum/patch)
and relocate the review settings under a top-level "reviews" block, e.g., copy
review.num_commits -> reviews.num_commits, review.summary -> reviews.summary,
and enable the line-by-line flag as reviews.line_by_line (true) so the schema
matches schema.v2.json and those settings are honored.

line_comments: true
2 changes: 1 addition & 1 deletion .github/workflows/chit-contract.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ permissions:

jobs:
verify:
runs-on: [self-hosted, vps]
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@v2
Expand Down
2 changes: 1 addition & 1 deletion pmoves/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1427,7 +1427,7 @@ up-jellyfin-single: ## Single Jellyfin using your forked image (8096)
@$(MAKE) --no-print-directory down-jellyfin-ai
@docker network create cataclysm-net >/dev/null 2>&1 || true
@bash -lc '$(LOAD_ENV_SHARED) files="-f docker-compose.external.yml"; if [ -f docker-compose.jellyfin.hosts.yml ]; then files="$$files -f docker-compose.jellyfin.hosts.yml"; fi; exec docker compose -p $(PROJECT) $$files up -d --pull $(PULL) jellyfin-ext'
@echo "✔ Jellyfin (single) up at http://localhost:8096 using $${JELLYFIN_IMAGE:-ghcr.io/cataclysm-studios-inc/pmoves-jellyfin:pmoves-latest}"
@echo "✔ Jellyfin (single) up at http://localhost:8096 using $${JELLYFIN_IMAGE:-ghcr.io/powerfulmoves/pmoves-jellyfin:pmoves-latest}"

.PHONY: jellyfin-enhanced-smoke
jellyfin-enhanced-smoke: ## Validate Jellyfin core (/System/Info, /Plugins) and web assets on single instance
Expand Down
27 changes: 22 additions & 5 deletions pmoves/docker-compose.external.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,26 @@
# YAML anchors for tier-based env file loading
# These reference the tier env files from parent docker-compose.yml
x-env-tier-data: &env-tier-data
env_file:
- env.shared
- env.tier-data

x-env-tier-worker: &env-tier-worker
env_file:
- env.shared
- env.tier-worker

x-env-tier-media: &env-tier-media
env_file:
- env.shared
- env.tier-media

services:
wger:
image: ${WGER_IMAGE:-ghcr.io/powerfulmoves/pmoves-health-wger:pmoves-latest}
container_name: cataclysm-wger
restart: unless-stopped
env_file: [env.shared.generated, env.shared, .env.generated, .env.local]
<<: *env-tier-worker
networks:
cataclysm:
aliases:
Expand Down Expand Up @@ -42,7 +59,7 @@ services:
image: ${FIREFLY_IMAGE:-ghcr.io/powerfulmoves/pmoves-wealth:pmoves-latest}
container_name: cataclysm-firefly
restart: unless-stopped
env_file: [env.shared.generated, env.shared, .env.generated, .env.local]
<<: *env-tier-worker
networks:
cataclysm:
aliases:
Expand All @@ -65,7 +82,7 @@ services:
open-notebook-surrealdb-ext:
image: ${OPEN_NOTEBOOK_SURREAL_IMAGE:-surrealdb/surrealdb:v2}
container_name: cataclysm-open-notebook-surrealdb
env_file: [env.shared.generated, env.shared, .env.generated, .env.local]
<<: *env-tier-data
command: start --log info --user ${SURREAL_USER} --pass ${SURREAL_PASS} rocksdb:/mydata/mydatabase.db
restart: unless-stopped
user: "0:0"
Expand All @@ -82,7 +99,7 @@ services:
# Default to the Open Notebook fork; override OPEN_NOTEBOOK_IMAGE to pin your own tag.
container_name: cataclysm-open-notebook
restart: unless-stopped
env_file: [env.shared.generated, env.shared, .env.generated, .env.local]
<<: *env-tier-worker
depends_on:
- open-notebook-surrealdb-ext
networks:
Expand All @@ -105,7 +122,7 @@ services:
image: ${JELLYFIN_IMAGE:-ghcr.io/powerfulmoves/pmoves-jellyfin:pmoves-latest}
container_name: cataclysm-jellyfin
restart: unless-stopped
env_file: [env.shared.generated, env.shared, .env.generated, .env.local]
<<: *env-tier-media
networks:
cataclysm:
aliases:
Expand Down
2 changes: 1 addition & 1 deletion pmoves/docker-compose.gpu-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
services:
hi-rag-gateway-v2-gpu:
image: ${HIRAG_V2_GPU_IMAGE:-ghcr.io/cataclysm-studios-inc/hi-rag-gateway-v2-gpu:cu128-py310-stable}
image: ${HIRAG_V2_GPU_IMAGE:-ghcr.io/powerfulmoves/hi-rag-gateway-v2-gpu:cu128-py310-stable}
runtime: nvidia
Comment on lines 2 to 4

@coderabbitai coderabbitai Bot Jan 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# Search for references to this image in the codebase
rg "hi-rag-gateway-v2-gpu" --type yml --type yaml -A 2 -B 2

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 94

🏁 Script executed:

# Look for any CI/CD, build, or deployment files that might reference image publishing
fd -e "yml" -e "yaml" -e "json" -e "dockerfile" -e "Dockerfile" | head -20

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 929

🏁 Script executed:

# Check the docker-compose file structure and any environment variable documentation
cat pmoves/docker-compose.gpu-image.yml

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 2208

🏁 Script executed:

# Search for any documentation or scripts related to GPU image building/publishing
fd -e "md" -e "sh" -e "py" | xargs rg -l "HIRAG.*GPU|cu128|py310" 2>/dev/null | head -10

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 348

🏁 Script executed:

# Check the hi-rag-gateway-v2 documentation
cat pmoves/docs/services/hi-rag-gateway-v2/README.md | head -100

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 6272

🏁 Script executed:

# Search for GitHub Actions or CI/CD workflows
fd -e "yml" -e "yaml" | xargs rg -l "ghcr.io|gpu|image" | grep -i "workflow\|action\|ci\|\.github"

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 49

🏁 Script executed:

# Look for any GitHub Actions workflows
fd ".github" -type d

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 237

🏁 Script executed:

# Search for Dockerfile related to hi-rag-gateway-v2-gpu
fd -i "dockerfile*" | xargs grep -l "hi-rag-gateway\|cu128\|py310" 2>/dev/null

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 295

🏁 Script executed:

# Search for any image build or publish scripts
rg "ghcr.io/powerfulmoves/hi-rag-gateway-v2-gpu" --type-list all -l

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 456

🏁 Script executed:

# Check the Dockerfile.gpu to see what organization it references
cat pmoves/services/hi-rag-gateway-v2/Dockerfile.gpu

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 2244

🏁 Script executed:

# Search for references to both organizations in the codebase
rg "cataclysm-studios-inc|powerfulmoves" --type yaml -B 2 -A 2

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 6580

🏁 Script executed:

# Look for any CI/CD workflows or build scripts that push images
fd -type f -name "*.yml" -o -name "*.yaml" | xargs grep -l "push\|build\|registry\|ghcr" 2>/dev/null | head -10

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 237

🏁 Script executed:

# Check if there are any recent commits or documentation about the image registry
rg "HIRAG_V2_GPU_IMAGE" -B 2 -A 2

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 1412

Clarify the correct GHCR organization for the GPU image.

The docker-compose file specifies ghcr.io/powerfulmoves/hi-rag-gateway-v2-gpu:cu128-py310-stable, but the service documentation recommends ghcr.io/cataclysm-studios-inc/hi-rag-gateway-v2-gpu:cu128-py310-stable. Verify which organization hosts the actual image and update either the compose file or documentation to ensure the tag is correct, or the container will fail to pull at startup.

🤖 Prompt for AI Agents 
In `@pmoves/docker-compose.gpu-image.yml` around lines 2 - 4, The docker-compose
entry for service hi-rag-gateway-v2-gpu references an incorrect GHCR
organization in the image value (image:
${HIRAG_V2_GPU_IMAGE:-ghcr.io/powerfulmoves/hi-rag-gateway-v2-gpu:cu128-py310-stable});
verify which org actually hosts the image (powerfulmoves vs
cataclysm-studios-inc) and update the default image tag or the docs to the
correct registry string so pulls succeed; change the fallback value in the
HIRAG_V2_GPU_IMAGE default to
ghcr.io/cataclysm-studios-inc/hi-rag-gateway-v2-gpu:cu128-py310-stable if that
is the correct host (or update docs to match the powerfulmoves org) and add a
brief comment clarifying the authoritative source.

restart: unless-stopped
env_file: [env.shared.generated, env.shared, .env.generated, .env.local]
Expand Down
Loading