ci(docker): publish GHCR image built with all cargo features#2657
ci(docker): publish GHCR image built with all cargo features#2657theonlyhennygod merged 1 commit intomainfrom
Conversation
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (2)
Note
|
| Cohort / File(s) | Summary |
|---|---|
GitHub Actions Workflow .github/workflows/pub-docker-img.yml |
Added build-args to pass ZEROCLAW_CARGO_ALL_FEATURES=true to the Docker build step, enabling compilation with all features for the published image. |
Docker Build Configuration Dockerfile |
Introduced ZEROCLAW_CARGO_ALL_FEATURES build argument with conditional logic to select between all-features, specific features, or default cargo build configurations. Applied consistently across three build steps. Added libudev-dev to build dependencies. |
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~20 minutes
Possibly related PRs
- PR
#2073: Modifies Dockerfile cargo build invocations for feature-enabled builds, handling how feature flags are passed to cargo. - PR
#2523: Modifies the same CI Docker workflow and Dockerfile with related build infrastructure changes. - PR
#175: Modifies Dockerfile build logic by restructuring multi-stage builds and feature flag handling.
Suggested labels
size: S, type: ci, type: dependencies, risk: high
Suggested reviewers
- chumyin
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check | The description is largely incomplete; it lacks required sections like label snapshot, change metadata, security impact, compatibility, human verification, side effects, and rollback plan that are specified in the repository template. | Complete the PR description by adding all required sections from the template, including label snapshot, change metadata, validation evidence, security/privacy assessments, and rollback plan. |
✅ Passed checks (4 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly and specifically describes the main change: publishing a GHCR image built with all cargo features, which aligns with the PR's primary objective. |
| Linked Issues check | ✅ Passed | The PR successfully implements the core requirement from issue #2628: adding Docker build infrastructure to publish a container image with zeroclaw compiled with all cargo features enabled. |
| Out of Scope Changes check | ✅ Passed | All changes are directly scoped to the build pipeline as specified in issue #2628: Dockerfile modifications for feature flag support and workflow configuration to enable all-features builds for GHCR publication. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. |
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches
🧪 Generate unit tests (beta)
- Create PR with unit tests
- Post copyable unit tests in a comment
- Commit unit tests in branch
issue-2628-ghcr-all-features
Comment @coderabbitai help to get the list of available commands and usage tips.
PR intake checks found warnings (non-blocking)Fast safe checks found advisory issues. CI lint/test/build gates still enforce merge quality.
Action items:
Detected Linear keys: none Run logs: https://github.com/zeroclaw-labs/zeroclaw/actions/runs/22645937948 Detected blocking line issues (sample):
Detected advisory line issues (sample):
Workflow files changed in this PR:
|
|
Thanks for contributing to ZeroClaw. For faster review, please ensure:
See |
github-actions
bot
added
ci
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/pub-docker-img.yml (1)
182-183: Smoke-test the same all-features path in PRs.
publishnow builds withZEROCLAW_CARGO_ALL_FEATURES=true, but PR smoke still exercises default features only. Mirroring this in the smoke build catches all-features breakage before tag publish.Suggested diff
- name: Build smoke image uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 with: context: . push: false load: true provenance: false sbom: false + build-args: | + ZEROCLAW_CARGO_ALL_FEATURES=true tags: zeroclaw-pr-smoke:latest labels: ${{ steps.meta.outputs.labels || '' }} platforms: linux/amd64 cache-from: type=gha cache-to: type=gha,mode=max🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/pub-docker-img.yml around lines 182 - 183, The PR smoke workflow does not set the same Docker build-arg used by publish; update the smoke build step to pass the same build-arg so PRs exercise the all-features path by adding the build-args entry with ZEROCLAW_CARGO_ALL_FEATURES=true to the smoke job’s docker build action (match the publish job’s build-args stanza). Locate the publish build-args block and replicate the build-args: | ZEROCLAW_CARGO_ALL_FEATURES=true into the corresponding smoke/pr job step so both paths run with the same all-features configuration.Dockerfile (1)
34-37: Consider de-duplicating the cargo feature-selection branch.The same
if/elif/elsecargo-flag logic appears in two build layers. Extracting shared logic (e.g., a reusable shell snippet or computed flag variable pattern) reduces drift risk.Also applies to: 70-73
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` around lines 34 - 37, The Dockerfile duplicates cargo feature-selection logic in two build layers; consolidate by computing a single build command or feature-arg variable (e.g., derive FEATURES_ARG or CARGO_BUILD_CMD based on ZEROCLAW_CARGO_ALL_FEATURES and ZEROCLAW_CARGO_FEATURES) and reuse it in both places instead of repeating the if/elif/else blocks. Update the two locations that currently branch on ZEROCLAW_CARGO_ALL_FEATURES and ZEROCLAW_CARGO_FEATURES to call the shared shell snippet or use the precomputed variable so both build layers run the same cargo build invocation.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/pub-docker-img.yml:
- Around line 182-183: The workflow uses docker/build-push-action with
build-args (ZEROCLAW_CARGO_ALL_FEATURES) and also github/codeql-action which is
not covered by the current allowlist; update the PR notes to either confirm no
new Actions were introduced or explicitly document that github/codeql-action is
permitted by the allowlist policy, and if the policy is missing that entry add
github/codeql-action to the allowlist (or update the security policy) so the
workflow’s use of github/codeql-action is authorized.
---
Nitpick comments:
In @.github/workflows/pub-docker-img.yml:
- Around line 182-183: The PR smoke workflow does not set the same Docker
build-arg used by publish; update the smoke build step to pass the same
build-arg so PRs exercise the all-features path by adding the build-args entry
with ZEROCLAW_CARGO_ALL_FEATURES=true to the smoke job’s docker build action
(match the publish job’s build-args stanza). Locate the publish build-args block
and replicate the build-args: | ZEROCLAW_CARGO_ALL_FEATURES=true into the
corresponding smoke/pr job step so both paths run with the same all-features
configuration.
In `@Dockerfile`:
- Around line 34-37: The Dockerfile duplicates cargo feature-selection logic in
two build layers; consolidate by computing a single build command or feature-arg
variable (e.g., derive FEATURES_ARG or CARGO_BUILD_CMD based on
ZEROCLAW_CARGO_ALL_FEATURES and ZEROCLAW_CARGO_FEATURES) and reuse it in both
places instead of repeating the if/elif/else blocks. Update the two locations
that currently branch on ZEROCLAW_CARGO_ALL_FEATURES and ZEROCLAW_CARGO_FEATURES
to call the shared shell snippet or use the precomputed variable so both build
layers run the same cargo build invocation.
| build-args: | | ||
| ZEROCLAW_CARGO_ALL_FEATURES=true |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check if workflow file exists
if [ ! -f .github/workflows/pub-docker-img.yml ]; then
echo "Workflow file not found"
exit 1
fi
echo "=== Workflow file check ==="
wc -l .github/workflows/pub-docker-img.yml
echo
echo "=== YAML syntax validation ==="
python3 <<EOF
import yaml
try:
with open('.github/workflows/pub-docker-img.yml', 'r') as f:
yaml.safe_load(f)
print("✓ YAML syntax is valid")
except yaml.YAMLError as e:
print(f"✗ YAML syntax error: {e}")
EOF
echo
echo "=== Action source inventory in workflow ==="
rg -nP '^\s*uses:\s*' .github/workflows/pub-docker-img.yml || echo "No 'uses' directives found"
echo
echo "=== Policy doc status ==="
if [ -f docs/actions-source-policy.md ]; then
echo "✓ docs/actions-source-policy.md exists"
echo "File size:"
wc -l docs/actions-source-policy.md
else
echo "✗ docs/actions-source-policy.md not found"
fiRepository: zeroclaw-labs/zeroclaw
Length of output: 1479
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Context around lines 182-183 (175-190) ==="
sed -n '175,190p' .github/workflows/pub-docker-img.yml
echo
echo "=== Actions sources covered in policy doc ==="
cat docs/actions-source-policy.mdRepository: zeroclaw-labs/zeroclaw
Length of output: 4324
Confirm Actions allowlist status in PR notes; workflow uses github/codeql-action which is not explicitly listed in policy.
YAML syntax is valid. Actionlint cannot run in sandbox, but verification confirms: (1) lines 182-183 contain only build-args configuration for docker/build-push-action (no new Actions sources); (2) all Actions used—actions/*, docker/*, and github/codeql-action—must align with allowlist. The policy doc covers actions/* and docker/*, but github/codeql-action (line 404) is not explicitly in the allowlist patterns, despite being actively used. Include PR notes either confirming no new Actions sources were introduced or documenting the codeql-action allowlist status.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/pub-docker-img.yml around lines 182 - 183, The workflow
uses docker/build-push-action with build-args (ZEROCLAW_CARGO_ALL_FEATURES) and
also github/codeql-action which is not covered by the current allowlist; update
the PR notes to either confirm no new Actions were introduced or explicitly
document that github/codeql-action is permitted by the allowlist policy, and if
the policy is missing that entry add github/codeql-action to the allowlist (or
update the security policy) so the workflow’s use of github/codeql-action is
authorized.
theonlyhennygod
force-pushed
the
issue-2628-ghcr-all-features
branch
from
751d039 to
a0025eb
Compare
github-actions
bot
removed
the
dependencies
1 participant
Summary
ZEROCLAW_CARGO_ALL_FEATURESand use--all-featureswhen enabled--lockedis consistently appliedlibudev-devin builder stage for all-features compile requirementsZEROCLAW_CARGO_ALL_FEATURES=trueTesting
Closes #2628
Summary by CodeRabbit