Prod - #4383
Closed
0xheliuni wants to merge 10 commits into
Closed
Conversation
自动同步上游
chore: 初始化 CI/CD 流水线与自动同步配置
Contributor
WalkthroughThis PR adds two GitHub Actions workflows to automate Docker image building and container registry operations. One workflow handles production releases triggered by version tags, while the other manages test environment images on commits to the prod branch. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (1)
.github/workflows/test-ci.yml (1)
34-40: Consider lowercasingIMAGE_NAMEand adding commit-SHA tag / concurrency control.Two concerns:
${{ github.repository }}preserves repo casing (e.g.QuantumNous/new-apiis fine, but forks likeMyOrg/Repowould fail since GHCR requires lowercase). Pipe throughtr '[:upper:]' '[:lower:]'or usegithub.repository_ownerlowercased.- Every push to
prodoverwrites:testwith no immutable reference. Add a short-SHA tag for traceability, and aconcurrency:group to cancel overlapping runs:♻️ Proposed refactor
on: push: branches: - prod +concurrency: + group: build-test-${{ github.ref }} + cancel-in-progress: true + env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} @@ context: . push: true - tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test + tags: | + ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test + ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test-${{ github.sha }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/test-ci.yml around lines 34 - 40, Lowercase the image name and add an immutable short-SHA tag plus concurrency control: update the docker/build-push-action invocation that currently sets tags using ${{ env.IMAGE_NAME }} so the image name is transformed to lowercase (e.g., pipe through tr or use a lowercased owner/repo) and add an additional tag that includes the short commit SHA (e.g., ${GITHUB_SHA::7}) alongside the fixed :test tag; also add a workflow-level concurrency: group (e.g., based on github.ref or image name) to cancel overlapping runs so pushes to prod don't clobber each other. Target the docker/build-push-action@v5 step and the tags input when applying these changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/prod-cd.yml:
- Around line 1-47: Move this workflow into the active workflows directory and
remove the duplicate workflow so there is only one "Build and Release
Production" job (look for the job id build-prod-image and step id meta to locate
it), then add a short step immediately after the actions/checkout step that
writes a VERSION file containing the release semver (derived from the pushed tag
/ GITHUB_REF) so the Dockerfile can consume it before docker/metadata-action and
docker/build-push-action run; ensure only this workflow triggers on the v*.*.*
tag pattern to avoid racing releases.
In @.github/test-ci.yml:
- Around line 1-37: This file is in the wrong location and will never be
executed by GitHub Actions; delete the stray .github/test-ci.yml file (the one
with name "Build for Test Environment" and job "build-test-image") to avoid
confusion and keep only the correct workflow at .github/workflows/test-ci.yml;
ensure no references or duplicates remain in the repo and commit the removal.
In @.github/workflows/prod-cd.yml:
- Around line 4-7: The push tag trigger is too permissive: replace the tag glob
'v*' in the workflow on.push.tags block with a stricter semver pattern such as
'v*.*.*' so only semantic version tags trigger this prod deploy; ensure
downstream steps (e.g., docker/metadata-action expecting type=semver or
type=raw,value=latest) will no longer process non-semver tags.
- Around line 1-47: The workflow fails/mis-tags because VERSION is never written
before docker/build-push-action reads it; add a step after "Checkout repository"
(before "Extract metadata for Docker" / before the build step) that extracts the
tag from GITHUB_REF (or steps.meta.outputs.version if using
docker/metadata-action) and writes it into a VERSION file (e.g., echo "$TAG" >
VERSION) so the Dockerfile's $(cat VERSION) reads the correct value; ensure this
new step runs before the "Extract metadata for Docker" (id: meta) and before the
"Build and push Production Docker image" step so tags and embedded version are
consistent.
- Around line 41-47: The production Docker build step "Build and push Production
Docker image" currently uses docker/build-push-action@v5 but emits a single-arch
image; add a setup-buildx step (docker/setup-buildx-action@v2) and a QEMU setup
step (docker/setup-qemu-action@v2) before it, and modify the build-push step
(docker/build-push-action@v5) to include with: platforms:
"linux/amd64,linux/arm64" so the action produces multi-platform images matching
the existing workflows; ensure the new steps are placed immediately before the
build-push step and reference the same tags/labels outputs.
In @.github/workflows/test-ci.yml:
- Around line 1-40: The workflow's build step 'Build and push Test Docker image'
uses docker/build-push-action@v5 but never creates the VERSION file (same issue
as prod-cd.yml); add a preceding step (e.g., "Create VERSION file" before the
'Build and push Test Docker image' step) that writes a VERSION value derived
from GITHUB_REF/GITHUB_SHA fallback logic (use tag if present, else branch name
or short commit SHA) so the image build gets a deterministic VERSION; ensure the
created file is in the build context and available to the
docker/build-push-action step.
---
Nitpick comments:
In @.github/workflows/test-ci.yml:
- Around line 34-40: Lowercase the image name and add an immutable short-SHA tag
plus concurrency control: update the docker/build-push-action invocation that
currently sets tags using ${{ env.IMAGE_NAME }} so the image name is transformed
to lowercase (e.g., pipe through tr or use a lowercased owner/repo) and add an
additional tag that includes the short commit SHA (e.g., ${GITHUB_SHA::7})
alongside the fixed :test tag; also add a workflow-level concurrency: group
(e.g., based on github.ref or image name) to cancel overlapping runs so pushes
to prod don't clobber each other. Target the docker/build-push-action@v5 step
and the tags input when applying these changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7e613934-c86e-423b-b6e2-fe43491deda7
📒 Files selected for processing (4)
.github/prod-cd.yml.github/test-ci.yml.github/workflows/prod-cd.yml.github/workflows/test-ci.yml
Comment on lines
+1
to
+47
| name: Build and Release Production | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| - 'v*.*.*' | ||
|
|
||
| env: | ||
| REGISTRY: ghcr.io | ||
| IMAGE_NAME: ${{ github.repository }} | ||
|
|
||
| jobs: | ||
| build-prod-image: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| permissions: | ||
| contents: read | ||
| packages: write | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: docker/login-action@v3 | ||
| with: | ||
| registry: ${{ env.REGISTRY }} | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - id: meta | ||
| uses: docker/metadata-action@v5 | ||
| with: | ||
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | ||
| tags: | | ||
| type=semver,pattern={{version}} | ||
| type=raw,value=latest | ||
|
|
||
| - uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . | ||
| push: true | ||
| platforms: linux/amd64,linux/arm64 | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
| cache-from: type=gha | ||
| cache-to: type=gha,mode=max |
Contributor
There was a problem hiding this comment.
Wrong path — this workflow will never run, and it duplicates .github/workflows/prod-cd.yml.
Same issue as .github/test-ci.yml: GitHub Actions only loads workflows from .github/workflows/. This file at .github/prod-cd.yml is inert. However, its content is actually better than the sibling .github/workflows/prod-cd.yml (stricter v*.*.* trigger, setup-buildx-action, multi-platform, gha cache).
Recommended resolution: delete .github/workflows/prod-cd.yml and move this file to .github/workflows/prod-cd.yml, then also add a step to write the VERSION file before the build (see comment on the other prod-cd.yml — the Dockerfile requires it):
🛠️ Proposed addition after checkout
- uses: actions/checkout@v4
+ - name: Resolve tag & write VERSION
+ run: |
+ TAG=${GITHUB_REF#refs/tags/}
+ echo "$TAG" > VERSION
+
- uses: docker/login-action@v3Without consolidation, once this file is moved into workflows/, two workflows will both trigger on the same tag push and race to publish :latest — a recipe for nondeterministic production releases.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/prod-cd.yml around lines 1 - 47, Move this workflow into the active
workflows directory and remove the duplicate workflow so there is only one
"Build and Release Production" job (look for the job id build-prod-image and
step id meta to locate it), then add a short step immediately after the
actions/checkout step that writes a VERSION file containing the release semver
(derived from the pushed tag / GITHUB_REF) so the Dockerfile can consume it
before docker/metadata-action and docker/build-push-action run; ensure only this
workflow triggers on the v*.*.* tag pattern to avoid racing releases.
Comment on lines
+1
to
+37
| # .github/workflows/test-ci.yml | ||
| name: Build for Test Environment | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - prod # 只监听 prod 分支的变更 | ||
|
|
||
| env: | ||
| REGISTRY: ghcr.io | ||
| IMAGE_NAME: ${{ github.repository }} | ||
|
|
||
| jobs: | ||
| build-test-image: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Log in to the Container registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ${{ env.REGISTRY }} | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and push Test Docker image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . | ||
| push: true | ||
| # 固定打上 test 标签，供测试服务器拉取 | ||
| tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test |
Contributor
There was a problem hiding this comment.
Wrong path — this file will never run.
GitHub Actions only discovers workflow YAML files under .github/workflows/. A file at .github/test-ci.yml (repo root of .github/) is ignored by the Actions runner. The first line's comment # .github/workflows/test-ci.yml appears to acknowledge the intended path, and indeed a near-identical file already exists at .github/workflows/test-ci.yml in this PR.
Delete this file to avoid confusion — keep only .github/workflows/test-ci.yml.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/test-ci.yml around lines 1 - 37, This file is in the wrong location
and will never be executed by GitHub Actions; delete the stray
.github/test-ci.yml file (the one with name "Build for Test Environment" and job
"build-test-image") to avoid confusion and keep only the correct workflow at
.github/workflows/test-ci.yml; ensure no references or duplicates remain in the
repo and commit the removal.
Comment on lines
+1
to
+47
| name: Build Production Release | ||
|
|
||
| # 触发条件：当推送以 'v' 开头的 tag 时触发 | ||
| on: | ||
| push: | ||
| tags: | ||
| - 'v*' | ||
|
|
||
| env: | ||
| REGISTRY: ghcr.io | ||
| IMAGE_NAME: ${{ github.repository }} | ||
|
|
||
| jobs: | ||
| build-and-push-prod: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Log in to the Container registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ${{ env.REGISTRY }} | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Extract metadata for Docker | ||
| id: meta | ||
| uses: docker/metadata-action@v5 | ||
| with: | ||
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | ||
| # 自动提取你打的 Tag 版本号，并附加一个 latest 标签 | ||
| tags: | | ||
| type=semver,pattern={{version}} | ||
| type=raw,value=latest | ||
|
|
||
| - name: Build and push Production Docker image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . | ||
| push: true | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| labels: ${{ steps.meta.outputs.labels }} |
Contributor
There was a problem hiding this comment.
Build will fail (or mis-tag) because the VERSION file is never written.
The Dockerfile reads $(cat VERSION) in both build stages (frontend: VITE_REACT_APP_VERSION=$(cat VERSION), backend: -X '...common.Version=$(cat VERSION)'). This workflow checks out the repo and immediately runs docker/build-push-action without populating VERSION from the git tag. If VERSION is not committed, the build fails; if it is committed but stale, the published image will embed a wrong version string. The existing .github/workflows/docker-image-arm64.yml already demonstrates the correct pattern (resolve tag from GITHUB_REF and echo "$TAG" > VERSION).
🛠️ Proposed fix
- name: Checkout repository
uses: actions/checkout@v4
+ - name: Resolve tag & write VERSION
+ run: |
+ TAG=${GITHUB_REF#refs/tags/}
+ echo "$TAG" > VERSION
+ echo "Building tag: $TAG"
+
- name: Log in to the Container registry
uses: docker/login-action@v3📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| name: Build Production Release | |
| # 触发条件：当推送以 'v' 开头的 tag 时触发 | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build-and-push-prod: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| # 自动提取你打的 Tag 版本号，并附加一个 latest 标签 | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=raw,value=latest | |
| - name: Build and push Production Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| name: Build Production Release | |
| # 触发条件：当推送以 'v' 开头的 tag 时触发 | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build-and-push-prod: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Resolve tag & write VERSION | |
| run: | | |
| TAG=${GITHUB_REF#refs/tags/} | |
| echo "$TAG" > VERSION | |
| echo "Building tag: $TAG" | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| # 自动提取你打的 Tag 版本号，并附加一个 latest 标签 | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=raw,value=latest | |
| - name: Build and push Production Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/prod-cd.yml around lines 1 - 47, The workflow
fails/mis-tags because VERSION is never written before docker/build-push-action
reads it; add a step after "Checkout repository" (before "Extract metadata for
Docker" / before the build step) that extracts the tag from GITHUB_REF (or
steps.meta.outputs.version if using docker/metadata-action) and writes it into a
VERSION file (e.g., echo "$TAG" > VERSION) so the Dockerfile's $(cat VERSION)
reads the correct value; ensure this new step runs before the "Extract metadata
for Docker" (id: meta) and before the "Build and push Production Docker image"
step so tags and embedded version are consistent.
Comment on lines
+4
to
+7
| on: | ||
| push: | ||
| tags: | ||
| - 'v*' |
Contributor
There was a problem hiding this comment.
Tag trigger v* is too permissive.
v* matches tags like vtest, vfoo, v1-rc, etc., and docker/metadata-action's type=semver will silently drop non-semver tags while type=raw,value=latest will still retag latest — potentially shipping an arbitrary non-release tag as production latest. Use 'v*.*.*' (as .github/prod-cd.yml does) to restrict to semver releases.
tags:
- - 'v*'
+ - 'v*.*.*'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| on: | |
| push: | |
| tags: | |
| - 'v*.*.*' |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/prod-cd.yml around lines 4 - 7, The push tag trigger is
too permissive: replace the tag glob 'v*' in the workflow on.push.tags block
with a stricter semver pattern such as 'v*.*.*' so only semantic version tags
trigger this prod deploy; ensure downstream steps (e.g., docker/metadata-action
expecting type=semver or type=raw,value=latest) will no longer process
non-semver tags.
Comment on lines
+41
to
+47
| - name: Build and push Production Docker image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . | ||
| push: true | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| labels: ${{ steps.meta.outputs.labels }} |
Contributor
There was a problem hiding this comment.
Missing docker/setup-buildx-action and multi-platform build — regression vs. existing workflows.
The sibling .github/prod-cd.yml and existing arm64 workflow both build for linux/amd64,linux/arm64 via Buildx. This workflow produces only a single-arch (amd64) image for the production latest tag, which will break ARM deployments currently supported. Either drop this workflow in favor of .github/prod-cd.yml (once moved to workflows/), or align it:
🛠️ Proposed fix
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
- name: Build and push Production Docker image
uses: docker/build-push-action@v5
with:
context: .
push: true
+ platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
+ cache-from: type=gha
+ cache-to: type=gha,mode=max📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - name: Build and push Production Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build and push Production Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/prod-cd.yml around lines 41 - 47, The production Docker
build step "Build and push Production Docker image" currently uses
docker/build-push-action@v5 but emits a single-arch image; add a setup-buildx
step (docker/setup-buildx-action@v2) and a QEMU setup step
(docker/setup-qemu-action@v2) before it, and modify the build-push step
(docker/build-push-action@v5) to include with: platforms:
"linux/amd64,linux/arm64" so the action produces multi-platform images matching
the existing workflows; ensure the new steps are placed immediately before the
build-push step and reference the same tags/labels outputs.
Comment on lines
+1
to
+40
| name: Build Test Image | ||
|
|
||
| # 触发条件：当代码 push 或 merge 到 prod 分支时触发 | ||
| on: | ||
| push: | ||
| branches: | ||
| - prod | ||
|
|
||
| env: | ||
| REGISTRY: ghcr.io | ||
| # IMAGE_NAME 会自动获取你的 "用户名/仓库名"，例如 "0xheliuni/new-api" | ||
| IMAGE_NAME: ${{ github.repository }} | ||
|
|
||
| jobs: | ||
| build-and-push-test: | ||
| runs-on: ubuntu-latest | ||
| # 必须的权限：允许 Action 读取代码并向 GHCR 写入镜像包 | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Log in to the Container registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ${{ env.REGISTRY }} | ||
| username: ${{ github.actor }} | ||
| # 这里的 GITHUB_TOKEN 是内置的，你不需要手动去设置 Secret | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Build and push Test Docker image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . # 假设你的 Dockerfile 在项目根目录 | ||
| push: true | ||
| # 固定将其打上 test 标签 | ||
| tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test |
Contributor
There was a problem hiding this comment.
Same missing VERSION file issue as prod-cd.yml.
docker/build-push-action runs with no step writing VERSION, so the :test image will either fail to build or embed whatever stale value is committed. For a branch-triggered build (no tag available), fall back to the commit SHA or branch name:
🛠️ Proposed fix
- name: Checkout repository
uses: actions/checkout@v4
+ - name: Write VERSION
+ run: echo "test-${GITHUB_SHA::7}" > VERSION
+
- name: Log in to the Container registry📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| name: Build Test Image | |
| # 触发条件：当代码 push 或 merge 到 prod 分支时触发 | |
| on: | |
| push: | |
| branches: | |
| - prod | |
| env: | |
| REGISTRY: ghcr.io | |
| # IMAGE_NAME 会自动获取你的 "用户名/仓库名"，例如 "0xheliuni/new-api" | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build-and-push-test: | |
| runs-on: ubuntu-latest | |
| # 必须的权限：允许 Action 读取代码并向 GHCR 写入镜像包 | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| # 这里的 GITHUB_TOKEN 是内置的，你不需要手动去设置 Secret | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push Test Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . # 假设你的 Dockerfile 在项目根目录 | |
| push: true | |
| # 固定将其打上 test 标签 | |
| tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test | |
| name: Build Test Image | |
| # 触发条件：当代码 push 或 merge 到 prod 分支时触发 | |
| on: | |
| push: | |
| branches: | |
| - prod | |
| env: | |
| REGISTRY: ghcr.io | |
| # IMAGE_NAME 会自动获取你的 "用户名/仓库名"，例如 "0xheliuni/new-api" | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build-and-push-test: | |
| runs-on: ubuntu-latest | |
| # 必须的权限：允许 Action 读取代码并向 GHCR 写入镜像包 | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Write VERSION | |
| run: echo "test-${GITHUB_SHA::7}" > VERSION | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| # 这里的 GITHUB_TOKEN 是内置的，你不需要手动去设置 Secret | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push Test Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . # 假设你的 Dockerfile 在项目根目录 | |
| push: true | |
| # 固定将其打上 test 标签 | |
| tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/test-ci.yml around lines 1 - 40, The workflow's build step
'Build and push Test Docker image' uses docker/build-push-action@v5 but never
creates the VERSION file (same issue as prod-cd.yml); add a preceding step
(e.g., "Create VERSION file" before the 'Build and push Test Docker image' step)
that writes a VERSION value derived from GITHUB_REF/GITHUB_SHA fallback logic
(use tag if present, else branch name or short commit SHA) so the image build
gets a deterministic VERSION; ensure the created file is in the build context
and available to the docker/build-push-action step.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
📝 变更描述 / Description
(简述：做了什么？为什么这样改能生效？请基于你对代码逻辑的理解来写，避免粘贴未经整理的内容)
🚀 变更类型 / Type of change
🔗 关联任务 / Related Issue
✅ 提交前检查项 / Checklist
Bug fix，我已提交或关联对应 Issue，且不会将设计取舍、预期不一致或理解偏差直接归类为 bug。📸 运行证明 / Proof of Work
(请在此粘贴截图、关键日志或测试报告，以证明变更生效)
Summary by CodeRabbit