Skip to content

fix(ghcr): close 4 missing image gaps + targeted local build targets #822

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
POWERFULMOVES merged 2 commits into from
Mar 7, 2026
Merged

fix(ghcr): close 4 missing image gaps + targeted local build targets #822

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
acb5859
docs(audit): Mar 7 session refresh — 8 PRs merged, GHCR matrix gap an…
hunnibear Mar 7, 2026
f55a88b
fix(ghcr): close 4 missing image gaps + targeted local build targets
hunnibear Mar 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions .github/workflows/integrations-ghcr.matrix.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,5 +118,53 @@
"platforms": "linux/amd64,linux/arm64",
"generate_sbom": true,
"trivy_ignorefile": ""
},
{
"name": "a2ui-nats-bridge",
"git_url": "https://github.com/POWERFULMOVES/PMOVES.AI.git",
"ref": "main",
"context": "pmoves/services/a2ui-nats-bridge",
"dockerfile": "pmoves/services/a2ui-nats-bridge/Dockerfile",
"image_name": "pmoves-a2ui-nats-bridge",
"build_args": "",
"platforms": "linux/amd64,linux/arm64",
"generate_sbom": false,
"trivy_ignorefile": ""
},
{
"name": "session-context-worker",
"git_url": "https://github.com/POWERFULMOVES/PMOVES.AI.git",
"ref": "main",
"context": "pmoves",
"dockerfile": "pmoves/services/session-context-worker/Dockerfile",
"image_name": "pmoves-session-context-worker",
"build_args": "",
"platforms": "linux/amd64,linux/arm64",
"generate_sbom": false,
"trivy_ignorefile": ""
},
{
"name": "llama-throughput-lab",
"git_url": "https://github.com/POWERFULMOVES/PMOVES-llama-throughput-lab.git",
"ref": "main",
"context": ".",
"dockerfile": "Dockerfile",
"image_name": "pmoves-llama-throughput-lab",
"build_args": "",
"platforms": "linux/amd64",
"generate_sbom": false,
"trivy_ignorefile": ""
},
{
"name": "tokenism-ui",
"git_url": "https://github.com/POWERFULMOVES/PMOVES.AI.git",
"ref": "main",
"context": "PMOVES-ToKenism-Multi/pmoves-nextjs",
"dockerfile": "PMOVES-ToKenism-Multi/pmoves-nextjs/Dockerfile",
"image_name": "pmoves-tokenism-ui",
"build_args": "",
"platforms": "linux/amd64,linux/arm64",
"generate_sbom": false,
"trivy_ignorefile": ""
}
Comment on lines +158 to 169

@coderabbitai coderabbitai Bot Mar 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the submodule exists and check its remote URL
cd "$(git rev-parse --show-toplevel)" 2>/dev/null || exit 0

# Check if PMOVES-ToKenism-Multi is a submodule
if git submodule status PMOVES-ToKenism-Multi 2>/dev/null; then
  echo "✔ PMOVES-ToKenism-Multi is a registered submodule"
  # Get the submodule's URL
  git config --file .gitmodules --get submodule.PMOVES-ToKenism-Multi.url || echo "URL not found in .gitmodules"
else
  echo "✖ PMOVES-ToKenism-Multi is NOT a submodule - context path may be valid"
fi

# Check if the Dockerfile exists within the submodule path
if [ -f "PMOVES-ToKenism-Multi/pmoves-nextjs/Dockerfile" ]; then
  echo "✔ Dockerfile exists at expected path"
else
  echo "✖ Dockerfile not found at PMOVES-ToKenism-Multi/pmoves-nextjs/Dockerfile"
fi

Repository: POWERFULMOVES/PMOVES.AI

Length of output: 312

Submodule context path will fail in CI — git archive does not include submodule contents.

The tokenism-ui entry references context path PMOVES-ToKenism-Multi/pmoves-nextjs, which is a git submodule. The workflow at lines 228-235 in integrations-ghcr.yml uses git archive --format=tar HEAD | tar -x -C integration-src for the PMOVES.AI repo. This command does not export submodule contents — the PMOVES-ToKenism-Multi/ directory will be empty, and the Dockerfile won't be available during the Docker build, causing the build to fail.

Options to fix:

  1. Change git_url to https://github.com/POWERFULMOVES/PMOVES-ToKenism-Multi.git and adjust context to pmoves-nextjs (similar to llama-throughput-lab)
  2. Add git submodule update --init --recursive to the workflow before archive
  3. Use git clone --recurse-submodules instead of archive for this entry
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/integrations-ghcr.matrix.json around lines 158 - 169, The
tokenism-ui entry references a submodule path
(PMOVES-ToKenism-Multi/pmoves-nextjs) which won't be exported by the workflow's
git archive command; update the JSON entry for "tokenism-ui" so git_url points
to the submodule repo
(https://github.com/POWERFULMOVES/PMOVES-ToKenism-Multi.git) and change
"context" to "pmoves-nextjs" (keep "dockerfile" as "pmoves-nextjs/Dockerfile" or
adjust to match), ensuring the Docker build context includes the actual files
instead of an empty submodule; alternatively, if you prefer keeping the current
git_url, modify the workflow (integrations-ghcr.yml) to init submodules (git
submodule update --init --recursive) before running git archive or switch to git
clone --recurse-submodules for that entry.

]
2 changes: 1 addition & 1 deletion PMOVES-ToKenism-Multi
Open in desktop
Submodule PMOVES-ToKenism-Multi updated 1 files
+0 −55 .github/workflows/codeql.yml
36 changes: 35 additions & 1 deletion pmoves/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2181,7 +2181,7 @@ GHCR_PREPUBLISH_SCRIPT ?= tools/ghcr_local_prepublish.py
GHCR_MATRIX_FILE ?= ../.github/workflows/integrations-ghcr.matrix.json
GHCR_PREPUBLISH_TAG_SUFFIX ?= local-smoke
GHCR_PREPUBLISH_PLATFORM ?= linux/amd64
GHCR_LOCAL_INTEGRATIONS ?= agent-zero archon firefly-iii jellyfin pmoves-yt deepresearch supaserch
GHCR_LOCAL_INTEGRATIONS ?= agent-zero archon firefly-iii jellyfin pmoves-yt deepresearch supaserch a2ui-nats-bridge session-context-worker tokenism-ui

.PHONY: buildx-setup docker-login
buildx-setup: ## Ensure docker buildx builder exists and is bootstrapped
Expand Down Expand Up @@ -2275,6 +2275,40 @@ ghcr-dispatch-supaserch: ci-runners-check-strict ## Dispatch GHCR workflow for S
gh workflow run "$(GHCR_WORKFLOW)" --repo "$(GH_REPO)" --ref "$(GHCR_DISPATCH_REF)" $$args
@echo "✔ Dispatched $(GHCR_WORKFLOW) for supaserch on ref $(GHCR_DISPATCH_REF)"

.PHONY: ghcr-build-one
ghcr-build-one: buildx-setup ## Build a single GHCR image locally: make ghcr-build-one IMAGE=agent-zero
@if [ -z "$(IMAGE)" ]; then echo "Usage: make ghcr-build-one IMAGE=<name>"; exit 1; fi
@$(PYTHON) $(GHCR_PREPUBLISH_SCRIPT) \
--matrix-file "$(GHCR_MATRIX_FILE)" \
--repo-root .. \
--integration "$(IMAGE)" \
--skip-trivy \
--platform "$(GHCR_PREPUBLISH_PLATFORM)" \
--builder "$(BUILDX_BUILDER)" \
--tag-suffix "$(GHCR_PREPUBLISH_TAG_SUFFIX)"

.PHONY: ghcr-prepublish-one
ghcr-prepublish-one: buildx-setup ## Build + Trivy gate a single image: make ghcr-prepublish-one IMAGE=agent-zero
@if [ -z "$(IMAGE)" ]; then echo "Usage: make ghcr-prepublish-one IMAGE=<name>"; exit 1; fi
@$(PYTHON) $(GHCR_PREPUBLISH_SCRIPT) \
--matrix-file "$(GHCR_MATRIX_FILE)" \
--repo-root .. \
--integration "$(IMAGE)" \
--platform "$(GHCR_PREPUBLISH_PLATFORM)" \
--builder "$(BUILDX_BUILDER)" \
--tag-suffix "$(GHCR_PREPUBLISH_TAG_SUFFIX)"

.PHONY: ghcr-dispatch-one
ghcr-dispatch-one: ci-runners-check-strict ## Dispatch GHCR workflow for a single image: make ghcr-dispatch-one IMAGE=agent-zero
@if [ -z "$(IMAGE)" ]; then echo "Usage: make ghcr-dispatch-one IMAGE=<name>"; exit 1; fi
@args="-f integration=$(IMAGE) -f push_to_dockerhub=false"; \
if [ -n "$(GHCR_NAMESPACE)" ]; then args="$$args -f ghcr_namespace=$(GHCR_NAMESPACE)"; fi; \
gh workflow run "$(GHCR_WORKFLOW)" --repo "$(GH_REPO)" --ref "$(GHCR_DISPATCH_REF)" $$args

.PHONY: ghcr-list
ghcr-list: ## List all images in the integrations-ghcr matrix
@$(PYTHON) -c "import json,pathlib;[print(e['name']) for e in json.loads(pathlib.Path('$(GHCR_MATRIX_FILE)').read_text())]"

.PHONY: deepresearch-smoke
deepresearch-smoke: ## Publish a sample DeepResearch request and wait for a result (requires worker running)
@ENV_FILE="$(CURDIR)/env.shared" bash -lc '. ./scripts/with-env.sh "$$ENV_FILE" && PYTHONPATH="$(CURDIR)/.." python3 tools/deepresearch_smoke.py --nats nats://localhost:4222 --timeout $${DEEPRESEARCH_SMOKE_TIMEOUT:-60}'
Expand Down
29 changes: 28 additions & 1 deletion pmoves/docs/NEXT_STEPS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,34 @@

# PMOVES v5 • NEXT_STEPS
Note: Consolidated plan index at pmoves/docs/PMOVES.AI PLANS/README_DOCS_INDEX.md.
_Last updated: 2026-03-06_
_Last updated: 2026-03-07_

### Latest changes (Mar 7, 2026)
- Merge wave completed on `main`: 8 PRs merged in 3 batches
- Batch 1: `#814` (UI build fix), `#815` (smoke Supabase discovery), `#816` (healthcheck stability), `#817` (CI runner alignment), `#819` (DoX submodule bump)
- Batch 2: `#818` (model fabric + coding-plan wiring — rebased after 8 CodeRabbit comments)
- Batch 3: `#820` (distributed topology docs/examples), `#821` (chrome extension + 9 security fixes)

@coderabbitai coderabbitai Bot Mar 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Capitalize "Chrome" as a proper noun.

Static analysis correctly flags that "chrome" should be "Chrome" when referring to Google Chrome software.

Proposed fix 
-  - Batch 3: `#820` (distributed topology docs/examples), `#821` (chrome extension + 9 security fixes)
+  - Batch 3: `#820` (distributed topology docs/examples), `#821` (Chrome extension + 9 security fixes)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- Batch 3: `#820` (distributed topology docs/examples), `#821` (chrome extension + 9 security fixes)
- Batch 3: `#820` (distributed topology docs/examples), `#821` (Chrome extension + 9 security fixes)
🧰 Tools
🪛 LanguageTool

[uncategorized] ~10-~10: The proper noun “Chrome” (= software from Google) needs to be capitalized.
Context: ...ibuted topology docs/examples), #821 (chrome extension + 9 security fixes) - Chrome ...

(GOOGLE_PRODUCTS)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pmoves/docs/NEXT_STEPS.md` at line 10, The string in the release note line
containing "chrome extension" should use the proper noun "Chrome" — update the
phrase in the Batch 3 entry (the line that reads "`#821` (chrome extension + 9
security fixes)") to "`#821` (Chrome extension + 9 security fixes)`" so the
product name is capitalized correctly.

- Chrome extension security hardening (`#821`):
- auth credentials moved from `chrome.storage.sync` to `session` (memory-only)
- XSS eliminated in options page (innerHTML → createElement)
- mock server hardened (method allowlist, pathname parsing)
- `synthesizeAudio` timeout added (AbortController)
- processing status auto-cleanup (5min TTL)
- config race condition fixed (configReady promise)
- storage write serialization (promise queue)
- CSP added to manifest.json
- Distributed deployment documentation landed (`#820`):
- topology visualization with ASCII architecture diagrams
- example configs for local-network, Tailscale, and VPS deployments
- env.shared.example expanded with distributed config vars
- GHCR matrix gap analysis completed:
- 4 compose-referenced images lack CI build definitions: `a2ui-nats-bridge`, `llama-throughput-lab`, `session-context-worker`, `tokenism-ui`
- `ultimate-tts-studio` is in GHCR (manually pushed) but has no automated CI build
- `integrations-ghcr.matrix.json` covers 10 of 24 `images.yaml` entries
Comment on lines +24 to +27

@coderabbitai coderabbitai Bot Mar 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Verify gap analysis accuracy after this PR lands.

The GHCR gap analysis section states that 4 images "lack CI build definitions" and the matrix "covers 10 of 24" entries. However, this PR adds these 4 images to integrations-ghcr.matrix.json, which would change the count to 14.

Consider updating the narrative to reflect the post-merge state, or clarify this describes the pre-fix baseline. As per coding guidelines, keep status claims aligned with evidence.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pmoves/docs/NEXT_STEPS.md` around lines 24 - 27, Update the GHCR gap analysis
narrative in NEXT_STEPS.md to match the post-merge state introduced by this PR:
either adjust the counts to show that integrations-ghcr.matrix.json now includes
the four previously-missing images (update "4 compose-referenced images lack CI
build definitions" and "covers 10 of 24" to the new totals, e.g., 14 covered),
or add an explicit note that the listed numbers reflect the pre-fix baseline and
will change after applying the entries added to integrations-ghcr.matrix.json;
reference the file integrations-ghcr.matrix.json and the four image names
(`a2ui-nats-bridge`, `llama-throughput-lab`, `session-context-worker`,
`tokenism-ui`) in the updated text so the claim is aligned with the evidence.

- Live backlog snapshot:
- Open PRs: `0`
- Dependabot alerts: `1` (`1 medium`)
- Code scanning alerts: `0`

### Latest changes (Mar 6, 2026)
- Merge queue closeout completed on `main`:
Expand Down
8 changes: 6 additions & 2 deletions pmoves/docs/PMOVES.AI PLANS/ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,15 @@
# PMOVES v5 • ROADMAP
Last updated: 2026-03-06
Last updated: 2026-03-07

## Vision
A production-ready, self-hostable orchestration mesh for creative + agent workloads across GPU boxes and Jetsons: **hybrid Hi‑RAG**, **Supabase Studio**, **n8n orchestration**, **Jellyfin publishing**, and **graph-aware retrieval**.

## Audit Snapshot (2026-03-06)
## Audit Snapshot (2026-03-07)

- March 7 merge wave completed on `main`: `#814`, `#815`, `#816`, `#817`, `#818`, `#819`, `#820`, `#821` (8 PRs, 3 batches).
- Chrome extension security hardening landed in `#821`: 9 CodeRabbit review items addressed (auth storage isolation, XSS remediation, mock server hardening, timeout guards, state management fixes, CSP).
- Distributed topology documentation + examples landed in `#820`.
- GHCR matrix gap analysis: 4 compose-referenced images (`a2ui-nats-bridge`, `llama-throughput-lab`, `session-context-worker`, `tokenism-ui`) have no CI build definition — tracked as ops follow-up.

@coderabbitai coderabbitai Bot Mar 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Update this audit bullet so it doesn’t describe a closed gap as still open.

This PR is the one adding those missing GHCR entries, so keeping the note as “have no CI build definition” will make the Mar 7 snapshot stale as soon as #822 merges. Reword it as the gap analysis finding that this PR closes.

Suggested wording 
-- GHCR matrix gap analysis: 4 compose-referenced images (`a2ui-nats-bridge`, `llama-throughput-lab`, `session-context-worker`, `tokenism-ui`) have no CI build definition — tracked as ops follow-up.
+- GHCR matrix gap analysis identified 4 compose-referenced images (`a2ui-nats-bridge`, `llama-throughput-lab`, `session-context-worker`, `tokenism-ui`) without CI build definitions; PR `#822` adds the missing matrix coverage and local validation targets.

As per coding guidelines, "Keep status claims aligned with evidence in runbooks and smokes."

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- GHCR matrix gap analysis: 4 compose-referenced images (`a2ui-nats-bridge`, `llama-throughput-lab`, `session-context-worker`, `tokenism-ui`) have no CI build definition — tracked as ops follow-up.
- GHCR matrix gap analysis identified 4 compose-referenced images (`a2ui-nats-bridge`, `llama-throughput-lab`, `session-context-worker`, `tokenism-ui`) without CI build definitions; PR `#822` adds the missing matrix coverage and local validation targets.
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pmoves/docs/PMOVES.AI` PLANS/ROADMAP.md at line 12, Update the GHCR matrix
audit bullet to reflect that the missing CI build entries for images
a2ui-nats-bridge, llama-throughput-lab, session-context-worker, and tokenism-ui
are being added by this PR (`#822`) rather than stating the gap as still open;
edit the sentence in ROADMAP.md so it reads that the gap analysis identified
those images without GHCR CI definitions and that this PR (`#822`) closes that gap
(or similar wording indicating the resolution).

- March 6 merge wave completed on `main`: `#797`, `#798`, `#799`, `#800`, `#802`, plus Dependabot workflow updates `#803`-`#807`.
- Superseded lane cleanup completed: `#801` closed (scope incorporated into `#802`).
- Production runtime re-validation passed after merge wave:
Expand Down
56 changes: 52 additions & 4 deletions pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
> **Single source of truth** for PMOVES.AI production readiness.
> Supersedes all individual audit documents accumulated Feb 7 -- Feb 18, 2026.

**Last Updated:** 2026-03-06 (merge queue closeout + production re-validation)
**Last Updated:** 2026-03-07 (8-PR merge wave + GHCR matrix gap analysis)
**Branch:** `PMOVES.AI-Edition-Hardened` (production release lane)
**Commit:** `96adc266`
**Consolidated From:** 27 audit documents
Expand All @@ -28,6 +28,54 @@

---

## Latest Changes (Mar 7, 2026)

- Merge wave completed on `main`: 8 PRs merged in 3 batches (#814-#821)
- Batch 1 (06:00 UTC): #814 UI build fix, #815 smoke Supabase discovery, #816 healthcheck stability, #817 CI runner alignment, #819 DoX submodule bump
- Batch 2 (07:01 UTC): #818 model fabric + coding-plan wiring (rebased after 8 CodeRabbit comments)
- Batch 3 (17:11 UTC): #820 distributed topology docs, #821 chrome extension (9 security fixes)

@coderabbitai coderabbitai Bot Mar 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Capitalize "Chrome" as a proper noun.

Same issue as in NEXT_STEPS.md - "chrome" should be "Chrome".

Proposed fix 
-  - Batch 3 (17:11 UTC): `#820` distributed topology docs, `#821` chrome extension (9 security fixes)
+  - Batch 3 (17:11 UTC): `#820` distributed topology docs, `#821` Chrome extension (9 security fixes)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- Batch 3 (17:11 UTC): #820 distributed topology docs, #821 chrome extension (9 security fixes)
- Batch 3 (17:11 UTC): `#820` distributed topology docs, `#821` Chrome extension (9 security fixes)
🧰 Tools
🪛 LanguageTool

[uncategorized] ~36-~36: The proper noun “Chrome” (= software from Google) needs to be capitalized.
Context: ...): #820 distributed topology docs, #821 chrome extension (9 security fixes) - Chrome e...

(GOOGLE_PRODUCTS)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pmoves/docs/PRODUCTION_AUDIT_DASHBOARD.md` at line 36, The "Batch 3" release
line contains a lowercase "chrome" which should be capitalized as the proper
noun "Chrome"; update the text in the PRODUCTION_AUDIT_DASHBOARD.md entry (the
line referencing "Batch 3 (17:11 UTC): `#820` distributed topology docs, `#821`
chrome extension (9 security fixes)") to read "#821 Chrome extension (9 security
fixes)". Ensure you also scan for the same lowercase "chrome" occurrence
referenced in NEXT_STEPS.md and replace it with "Chrome" for consistency.

- Chrome extension security review completed (9/11 actionable CodeRabbit items addressed):
- `chrome.storage.sync` → `session` for auth credentials
- innerHTML XSS eliminated in options shapes display
- Mock server method allowlist + pathname routing
- `synthesizeAudio` timeout (AbortController)
- Processing status TTL cleanup
- Config load race condition (configReady promise)
- Storage read-modify-write serialization
- Content Security Policy added to manifest.json
- GHCR matrix gap analysis completed (see section below)
- Live metrics: Open PRs `0`, Dependabot `1` (medium), Code Scanning `0`

---

### GHCR Matrix Gap Analysis (Mar 7, 2026)

**Build pipelines:**
- `integrations-ghcr.yml` — 10 images (matrix-driven, multi-arch, Trivy + Cosign)
- `self-hosted-builds.yml` — 11 CPU + 2 GPU images (push-triggered, amd64)
- `build-images.yml` — 24 images from `images.yaml` (manual dispatch)

**GHCR registry:** 23 packages published.

**Compose → GHCR coverage gaps (4 truly missing):**

| Service | Compose Image Reference | In GHCR? | In CI? |
|---------|------------------------|----------|--------|
| `a2ui-nats-bridge` | `ghcr.io/.../pmoves-a2ui-nats-bridge:pmoves-latest` | ❌ | ❌ |
| `llama-throughput-lab` | `ghcr.io/.../pmoves-llama-throughput-lab:latest` | ❌ | ❌ |
| `session-context-worker` | `ghcr.io/.../pmoves-session-context-worker:latest` | ❌ | ❌ |
| `tokenism-ui` | `ghcr.io/.../pmoves-tokenism-ui:pmoves-latest` | ❌ | ❌ |
| `ultimate-tts-studio` | `ghcr.io/.../pmoves-ultimate-tts-studio:pmoves-latest` | ✅ (manual) | ❌ |

**Cross-reference gaps:**
- `integrations-ghcr.matrix.json` covers 10/24 `images.yaml` entries
- `self-hosted-builds.yml` builds 13 services not in `integrations-ghcr.matrix.json`
- 2 submodules in `images.yaml` still track `main` instead of `PMOVES.AI-Edition-Hardened` (`pmoves-botz`, `pmoves-tailscale`)

**Recommendation:** Add build definitions for the 4 missing images, or convert their compose references to local `build:` directives if they're dev-only.

---

## Latest Changes (Mar 6, 2026)

- Merge queue closeout completed on `main`:
Expand Down Expand Up @@ -85,16 +133,16 @@

| Metric | Value |
|--------|-------|
| Quantitative snapshot timestamp | 2026-03-04 (live GitHub + local smoke/model-readiness snapshot) |
| Quantitative snapshot timestamp | 2026-03-07 (live GitHub + local smoke/model-readiness snapshot) |
| Total tracked items | 24 |
| Resolved | 23 (+1 since last update) |
| Active blockers | 1 (self-hosted queue starvation) |
| Critical | 0 |
| High | 1 |
| Medium | 0 |
| Low | 0 |
| CodeQL alerts (open) | **0 open** (live GitHub API on 2026-03-04) |
| Dependabot alerts | **1 open** (`1 medium`; live GitHub API on 2026-03-04) |
| CodeQL alerts (open) | **0 open** (live GitHub API on 2026-03-07) |
| Dependabot alerts | **1 open** (`1 medium`; live GitHub API on 2026-03-07) |
| Open PRs | **0** |
| CI queue | Hosted gates healthy; self-hosted queue starvation persists on CodeQL/GHCR lanes |

Expand Down
34 changes: 32 additions & 2 deletions pmoves/images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ images:

- name: pmoves-botz
repo: PMOVES-BoTZ
ref: heads/main
ref: heads/PMOVES.AI-Edition-Hardened
Comment on lines 81 to +83

@coderabbitai coderabbitai Bot Mar 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Keep the image refs aligned with integrations-ghcr.matrix.json.

build-images.yml publishes from pmoves/images.yaml, but make ghcr-build-one goes through pmoves/tools/ghcr_local_prepublish.py and reads .github/workflows/integrations-ghcr.matrix.json instead. The provided cross-file context already shows pmoves-tokenism-ui is split today (main in the matrix vs heads/PMOVES.AI-Edition-Hardened here), so local prepublish and CI are validating different code. These pmoves-botz / pmoves-tailscale ref flips need to stay in lockstep for the same reason.

Use this read-only check to compare overlapping refs in both sources. Expected result: no mismatches.

#!/bin/bash
set -euo pipefail

python - <<'PY'
import json
import pathlib
import re

images_refs = {}
current = None

for line in pathlib.Path("pmoves/images.yaml").read_text().splitlines():
    m = re.match(r'^\s*-\s+name:\s*(\S+)\s*$', line)
    if m:
        current = m.group(1)
        images_refs[current] = None
        continue
    m = re.match(r'^\s*ref:\s*(\S+)\s*$', line)
    if m and current:
        images_refs[current] = m.group(1)

matrix_raw = json.loads(pathlib.Path(".github/workflows/integrations-ghcr.matrix.json").read_text())
if isinstance(matrix_raw, dict):
    entries = matrix_raw.get("include") or matrix_raw.get("matrix") or matrix_raw.get("images") or []
else:
    entries = matrix_raw

mismatches = []
for entry in entries:
    name = entry.get("name")
    if name in images_refs:
        matrix_ref = entry.get("ref")
        images_ref = images_refs[name]
        if images_ref != matrix_ref:
            mismatches.append((name, images_ref, matrix_ref))

if not mismatches:
    print("No ref mismatches found between pmoves/images.yaml and integrations-ghcr.matrix.json")
else:
    for name, images_ref, matrix_ref in mismatches:
        print(f"{name}: images.yaml={images_ref!r} matrix.json={matrix_ref!r}")
    raise SystemExit(1)
PY

Also applies to: 102-104, 169-174

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@pmoves/images.yaml` around lines 81 - 83, Update the image refs in
pmoves/images.yaml to match the refs used by the local-prepublish/CI matrix so
builds validate the same code: open pmoves/images.yaml and change the ref values
for the entries named pmoves-botz and pmoves-tailscale (and any others flagged
like pmoves-tokenism-ui) to the exact ref strings used in
.github/workflows/integrations-ghcr.matrix.json (the entries there are read by
pmoves/tools/ghcr_local_prepublish.py and make ghcr-build-one), then run the
provided verification script to ensure no mismatches remain.

context: .
dockerfile: Dockerfile
image: ghcr.io/powerfulmoves/pmoves-botz
Expand All @@ -101,7 +101,7 @@ images:

- name: pmoves-tailscale
repo: PMOVES-Tailscale
ref: heads/main
ref: heads/PMOVES.AI-Edition-Hardened
context: .
dockerfile: Dockerfile
image: ghcr.io/powerfulmoves/pmoves-tailscale
Expand Down Expand Up @@ -156,10 +156,40 @@ images:
dockerfile: services/gpu-orchestrator/Dockerfile
image: ghcr.io/powerfulmoves/pmoves-gpu-orchestrator

- name: pmoves-a2ui-nats-bridge
context: pmoves
dockerfile: services/a2ui-nats-bridge/Dockerfile
image: ghcr.io/powerfulmoves/pmoves-a2ui-nats-bridge

- name: pmoves-session-context-worker
context: pmoves
dockerfile: services/session-context-worker/Dockerfile
image: ghcr.io/powerfulmoves/pmoves-session-context-worker

- name: pmoves-tokenism-ui
repo: PMOVES-ToKenism-Multi
ref: heads/PMOVES.AI-Edition-Hardened
context: pmoves-nextjs
dockerfile: pmoves-nextjs/Dockerfile
image: ghcr.io/powerfulmoves/pmoves-tokenism-ui

# GPU-heavy services (manual dispatch only — not in integrations-ghcr matrix)
- name: pmoves-ultimate-tts-studio
context: pmoves
dockerfile: docker/ultimate-tts-studio/Dockerfile
image: ghcr.io/powerfulmoves/pmoves-ultimate-tts-studio

# Submodule-backed services
- name: pmoves-transcribe-backend
repo: PMOVES-transcribe-and-fetch
ref: heads/PMOVES.AI-Edition-Hardened
context: .
dockerfile: backend/Dockerfile
image: ghcr.io/powerfulmoves/pmoves-transcribe-backend

- name: pmoves-llama-throughput-lab
repo: PMOVES-llama-throughput-lab
ref: heads/main
context: .
dockerfile: Dockerfile
image: ghcr.io/powerfulmoves/pmoves-llama-throughput-lab
Loading