ci(build): build the admin-ui image on release tags

[andyne13]

What

Add the admin-ui build job to the GA release workflow (build.yml), mirroring the one already in build_rc.yml.

Why

build.yml (runs on v* tags) built only openrag (api) + openrag-ray. The openrag-admin-ui image was produced only by the RC workflow, so a GA tag would publish the backend + ray images but no admin-ui — the UI container would ImagePullBackOff at that version.

Details

Same build recipe as build_rc.yml's admin-ui job: infra/docker/ui.Dockerfile, context ., pushes to ghcr.io/linagora/openrag-admin-ui + linagoraai/openrag-admin-ui, same base_ref == main tag guard and type=ref,event=tag + latest tags. No build-args (matches the RC build exactly).

Summary by CodeRabbit

• New Features
  • Added automated publishing of the admin UI Docker image when new tags are released.
  • The release process now produces tagged images for both GitHub Container Registry and Docker Hub.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a new GitHub Actions job to build and push a Docker image for the admin UI on tag pushes to main, including registry logins, metadata extraction, and cached build/push steps using infra/docker/ui.Dockerfile.

Changes

CI Admin UI Image Build

Layer / File(s)	Summary
Add admin UI image build job .github/workflows/build.yml	New build-and-push-image-admin-ui job runs on tag pushes with base_ref main, logs into GHCR and Docker Hub, generates tags/labels via metadata-action, and builds/pushes the admin UI image from infra/docker/ui.Dockerfile with GitHub Actions caching.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• linagora/openrag#593: Both PRs modify GitHub Actions workflows to build/push the admin UI image from infra/docker/ui.Dockerfile.

Suggested labels: chore

Suggested reviewers: Ahmath-Gadji, hedhoud

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: building and pushing the admin UI image on release tags.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/build-yml-admin-ui

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/build.yml (1)

118-168: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Job structure and configuration look correct.

The new build-and-push-image-admin-ui job correctly mirrors the existing build-and-push-image job: same trigger guard (base_ref == 'refs/heads/main'), same permissions, Docker Hub login (needed since it pushes to linagoraai/openrag-admin-ui), correct Dockerfile (infra/docker/ui.Dockerfile), and matching image names/tags. The downstream Helm chart values (linagoraai/openrag-admin-ui) align with the image name here. The omission of the "Extract tag version" step is fine — it's unused in the existing jobs as well.

One minor security note: the actions/checkout@v4 step doesn't set persist-credentials: false, which means the GITHUB_TOKEN persists in the local git config for the job's duration. This is consistent with the other jobs in this file, so consider addressing it across all jobs in a follow-up rather than just this one.

🔒 Optional: disable credential persistence

     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build.yml around lines 118 - 168, The
`build-and-push-image-admin-ui` job’s `actions/checkout@v4` step should disable
persisted git credentials to avoid leaving `GITHUB_TOKEN` in the local config.
Update the checkout configuration in this job’s setup so it does not persist
credentials, and apply the same change consistently to the other checkout steps
in the workflow if you want a file-wide fix.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/build.yml:
- Around line 118-168: The `build-and-push-image-admin-ui` job’s
`actions/checkout@v4` step should disable persisted git credentials to avoid
leaving `GITHUB_TOKEN` in the local config. Update the checkout configuration in
this job’s setup so it does not persist credentials, and apply the same change
consistently to the other checkout steps in the workflow if you want a file-wide
fix.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6f4e1116-b30b-417c-8512-5b82e96fe6ae

📥 Commits

Reviewing files that changed from the base of the PR and between 3cc6322 and e3f912d.

📒 Files selected for processing (1)

• .github/workflows/build.yml