Skip to content
Closed

Prod #4383

Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions .github/prod-cd.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
name: Build and Release Production

on:
push:
tags:
- 'v*.*.*'

env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}

jobs:
build-prod-image:
runs-on: ubuntu-latest

permissions:
contents: read
packages: write

steps:
- uses: actions/checkout@v4

- uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=semver,pattern={{version}}
type=raw,value=latest

- uses: docker/setup-buildx-action@v3

- uses: docker/build-push-action@v5
with:
context: .
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
Comment on lines +1 to +47

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Wrong path — this workflow will never run, and it duplicates .github/workflows/prod-cd.yml.

Same issue as .github/test-ci.yml: GitHub Actions only loads workflows from .github/workflows/. This file at .github/prod-cd.yml is inert. However, its content is actually better than the sibling .github/workflows/prod-cd.yml (stricter v*.*.* trigger, setup-buildx-action, multi-platform, gha cache).

Recommended resolution: delete .github/workflows/prod-cd.yml and move this file to .github/workflows/prod-cd.yml, then also add a step to write the VERSION file before the build (see comment on the other prod-cd.yml — the Dockerfile requires it):

🛠️ Proposed addition after checkout
       - uses: actions/checkout@v4

+      - name: Resolve tag & write VERSION
+        run: |
+          TAG=${GITHUB_REF#refs/tags/}
+          echo "$TAG" > VERSION
+
       - uses: docker/login-action@v3

Without consolidation, once this file is moved into workflows/, two workflows will both trigger on the same tag push and race to publish :latest — a recipe for nondeterministic production releases.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/prod-cd.yml around lines 1 - 47, Move this workflow into the active
workflows directory and remove the duplicate workflow so there is only one
"Build and Release Production" job (look for the job id build-prod-image and
step id meta to locate it), then add a short step immediately after the
actions/checkout step that writes a VERSION file containing the release semver
(derived from the pushed tag / GITHUB_REF) so the Dockerfile can consume it
before docker/metadata-action and docker/build-push-action run; ensure only this
workflow triggers on the v*.*.* tag pattern to avoid racing releases.

37 changes: 37 additions & 0 deletions .github/test-ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
# .github/workflows/test-ci.yml
name: Build for Test Environment

on:
push:
branches:
- prod # 只监听 prod 分支的变更

env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}

jobs:
build-test-image:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Log in to the Container registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and push Test Docker image
uses: docker/build-push-action@v5
with:
context: .
push: true
# 固定打上 test 标签,供测试服务器拉取
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test
Comment on lines +1 to +37

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Wrong path — this file will never run.

GitHub Actions only discovers workflow YAML files under .github/workflows/. A file at .github/test-ci.yml (repo root of .github/) is ignored by the Actions runner. The first line's comment # .github/workflows/test-ci.yml appears to acknowledge the intended path, and indeed a near-identical file already exists at .github/workflows/test-ci.yml in this PR.

Delete this file to avoid confusion — keep only .github/workflows/test-ci.yml.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/test-ci.yml around lines 1 - 37, This file is in the wrong location
and will never be executed by GitHub Actions; delete the stray
.github/test-ci.yml file (the one with name "Build for Test Environment" and job
"build-test-image") to avoid confusion and keep only the correct workflow at
.github/workflows/test-ci.yml; ensure no references or duplicates remain in the
repo and commit the removal.

47 changes: 47 additions & 0 deletions .github/workflows/prod-cd.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
name: Build Production Release

# 触发条件:当推送以 'v' 开头的 tag 时触发
on:
push:
tags:
- 'v*'
Comment on lines +4 to +7

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Tag trigger v* is too permissive.

v* matches tags like vtest, vfoo, v1-rc, etc., and docker/metadata-action's type=semver will silently drop non-semver tags while type=raw,value=latest will still retag latest — potentially shipping an arbitrary non-release tag as production latest. Use 'v*.*.*' (as .github/prod-cd.yml does) to restrict to semver releases.

     tags:
-      - 'v*'
+      - 'v*.*.*'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
on:
push:
tags:
- 'v*'
on:
push:
tags:
- 'v*.*.*'
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/prod-cd.yml around lines 4 - 7, The push tag trigger is
too permissive: replace the tag glob 'v*' in the workflow on.push.tags block
with a stricter semver pattern such as 'v*.*.*' so only semantic version tags
trigger this prod deploy; ensure downstream steps (e.g., docker/metadata-action
expecting type=semver or type=raw,value=latest) will no longer process
non-semver tags.


env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}

jobs:
build-and-push-prod:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Log in to the Container registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Extract metadata for Docker
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
# 自动提取你打的 Tag 版本号,并附加一个 latest 标签
tags: |
type=semver,pattern={{version}}
type=raw,value=latest

- name: Build and push Production Docker image
uses: docker/build-push-action@v5
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
Comment on lines +1 to +47

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Build will fail (or mis-tag) because the VERSION file is never written.

The Dockerfile reads $(cat VERSION) in both build stages (frontend: VITE_REACT_APP_VERSION=$(cat VERSION), backend: -X '...common.Version=$(cat VERSION)'). This workflow checks out the repo and immediately runs docker/build-push-action without populating VERSION from the git tag. If VERSION is not committed, the build fails; if it is committed but stale, the published image will embed a wrong version string. The existing .github/workflows/docker-image-arm64.yml already demonstrates the correct pattern (resolve tag from GITHUB_REF and echo "$TAG" > VERSION).

🛠️ Proposed fix
       - name: Checkout repository
         uses: actions/checkout@v4

+      - name: Resolve tag & write VERSION
+        run: |
+          TAG=${GITHUB_REF#refs/tags/}
+          echo "$TAG" > VERSION
+          echo "Building tag: $TAG"
+
       - name: Log in to the Container registry
         uses: docker/login-action@v3
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
name: Build Production Release
# 触发条件:当推送以 'v' 开头的 tag 时触发
on:
push:
tags:
- 'v*'
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build-and-push-prod:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Log in to the Container registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract metadata for Docker
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
# 自动提取你打的 Tag 版本号,并附加一个 latest 标签
tags: |
type=semver,pattern={{version}}
type=raw,value=latest
- name: Build and push Production Docker image
uses: docker/build-push-action@v5
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
name: Build Production Release
# 触发条件:当推送以 'v' 开头的 tag 时触发
on:
push:
tags:
- 'v*'
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build-and-push-prod:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Resolve tag & write VERSION
run: |
TAG=${GITHUB_REF#refs/tags/}
echo "$TAG" > VERSION
echo "Building tag: $TAG"
- name: Log in to the Container registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract metadata for Docker
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
# 自动提取你打的 Tag 版本号,并附加一个 latest 标签
tags: |
type=semver,pattern={{version}}
type=raw,value=latest
- name: Build and push Production Docker image
uses: docker/build-push-action@v5
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/prod-cd.yml around lines 1 - 47, The workflow
fails/mis-tags because VERSION is never written before docker/build-push-action
reads it; add a step after "Checkout repository" (before "Extract metadata for
Docker" / before the build step) that extracts the tag from GITHUB_REF (or
steps.meta.outputs.version if using docker/metadata-action) and writes it into a
VERSION file (e.g., echo "$TAG" > VERSION) so the Dockerfile's $(cat VERSION)
reads the correct value; ensure this new step runs before the "Extract metadata
for Docker" (id: meta) and before the "Build and push Production Docker image"
step so tags and embedded version are consistent.

Comment on lines +41 to +47

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Missing docker/setup-buildx-action and multi-platform build — regression vs. existing workflows.

The sibling .github/prod-cd.yml and existing arm64 workflow both build for linux/amd64,linux/arm64 via Buildx. This workflow produces only a single-arch (amd64) image for the production latest tag, which will break ARM deployments currently supported. Either drop this workflow in favor of .github/prod-cd.yml (once moved to workflows/), or align it:

🛠️ Proposed fix
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Build and push Production Docker image
         uses: docker/build-push-action@v5
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Build and push Production Docker image
uses: docker/build-push-action@v5
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build and push Production Docker image
uses: docker/build-push-action@v5
with:
context: .
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/prod-cd.yml around lines 41 - 47, The production Docker
build step "Build and push Production Docker image" currently uses
docker/build-push-action@v5 but emits a single-arch image; add a setup-buildx
step (docker/setup-buildx-action@v2) and a QEMU setup step
(docker/setup-qemu-action@v2) before it, and modify the build-push step
(docker/build-push-action@v5) to include with: platforms:
"linux/amd64,linux/arm64" so the action produces multi-platform images matching
the existing workflows; ensure the new steps are placed immediately before the
build-push step and reference the same tags/labels outputs.

40 changes: 40 additions & 0 deletions .github/workflows/test-ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
name: Build Test Image

# 触发条件:当代码 push 或 merge 到 prod 分支时触发
on:
push:
branches:
- prod

env:
REGISTRY: ghcr.io
# IMAGE_NAME 会自动获取你的 "用户名/仓库名",例如 "0xheliuni/new-api"
IMAGE_NAME: ${{ github.repository }}

jobs:
build-and-push-test:
runs-on: ubuntu-latest
# 必须的权限:允许 Action 读取代码并向 GHCR 写入镜像包
permissions:
contents: read
packages: write

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Log in to the Container registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
# 这里的 GITHUB_TOKEN 是内置的,你不需要手动去设置 Secret
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and push Test Docker image
uses: docker/build-push-action@v5
with:
context: . # 假设你的 Dockerfile 在项目根目录
push: true
# 固定将其打上 test 标签
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test
Comment on lines +1 to +40

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Same missing VERSION file issue as prod-cd.yml.

docker/build-push-action runs with no step writing VERSION, so the :test image will either fail to build or embed whatever stale value is committed. For a branch-triggered build (no tag available), fall back to the commit SHA or branch name:

🛠️ Proposed fix
       - name: Checkout repository
         uses: actions/checkout@v4

+      - name: Write VERSION
+        run: echo "test-${GITHUB_SHA::7}" > VERSION
+
       - name: Log in to the Container registry
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
name: Build Test Image
# 触发条件:当代码 push 或 merge 到 prod 分支时触发
on:
push:
branches:
- prod
env:
REGISTRY: ghcr.io
# IMAGE_NAME 会自动获取你的 "用户名/仓库名",例如 "0xheliuni/new-api"
IMAGE_NAME: ${{ github.repository }}
jobs:
build-and-push-test:
runs-on: ubuntu-latest
# 必须的权限:允许 Action 读取代码并向 GHCR 写入镜像包
permissions:
contents: read
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Log in to the Container registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
# 这里的 GITHUB_TOKEN 是内置的,你不需要手动去设置 Secret
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push Test Docker image
uses: docker/build-push-action@v5
with:
context: . # 假设你的 Dockerfile 在项目根目录
push: true
# 固定将其打上 test 标签
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test
name: Build Test Image
# 触发条件:当代码 push 或 merge 到 prod 分支时触发
on:
push:
branches:
- prod
env:
REGISTRY: ghcr.io
# IMAGE_NAME 会自动获取你的 "用户名/仓库名",例如 "0xheliuni/new-api"
IMAGE_NAME: ${{ github.repository }}
jobs:
build-and-push-test:
runs-on: ubuntu-latest
# 必须的权限:允许 Action 读取代码并向 GHCR 写入镜像包
permissions:
contents: read
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Write VERSION
run: echo "test-${GITHUB_SHA::7}" > VERSION
- name: Log in to the Container registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
# 这里的 GITHUB_TOKEN 是内置的,你不需要手动去设置 Secret
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push Test Docker image
uses: docker/build-push-action@v5
with:
context: . # 假设你的 Dockerfile 在项目根目录
push: true
# 固定将其打上 test 标签
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:test
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/test-ci.yml around lines 1 - 40, The workflow's build step
'Build and push Test Docker image' uses docker/build-push-action@v5 but never
creates the VERSION file (same issue as prod-cd.yml); add a preceding step
(e.g., "Create VERSION file" before the 'Build and push Test Docker image' step)
that writes a VERSION value derived from GITHUB_REF/GITHUB_SHA fallback logic
(use tag if present, else branch name or short commit SHA) so the image build
gets a deterministic VERSION; ensure the created file is in the build context
and available to the docker/build-push-action step.