Repository navigation
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dd9b1be771
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - run: go vet ./... | ||
| - run: go test ./... | ||
|
|
||
| image: |
There was a problem hiding this comment.
On a main or tag push where go vet or go test fails but the Dockerfile still builds, this independent job continues and pushes the main, version, and potentially latest tags. GitHub documents that jobs without dependencies run in parallel, so the failed test job does not gate this publication; add needs: test to prevent rejected code from reaching GHCR. GitHub Actions documentation
Useful? React with 👍 / 👎.
| type=ref,event=branch | ||
| type=sha,prefix=sha- | ||
| type=semver,pattern=v{{version}} | ||
| type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }} |
There was a problem hiding this comment.
When a prerelease such as v2.0.0-rc.1 is pushed, this raw rule unconditionally publishes it as latest; even malformed tags beginning with v do the same while the semver rule rejects them. This bypasses metadata-action's semver-aware latest handling, which deliberately avoids treating prereleases as public stable versions, so consumers of latest can unexpectedly receive an RC or invalid release. Use the semver flavor's automatic latest behavior or explicitly restrict this rule to stable semver tags. docker/metadata-action documentation
Useful? React with 👍 / 👎.
| platforms: linux/amd64 | ||
| push: ${{ github.event_name != 'pull_request' }} | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| labels: ${{ steps.meta.outputs.labels }} |
There was a problem hiding this comment.
On a main push, the metadata action selects the higher-priority branch tag and generates org.opencontainers.image.version=main; passing those labels to Buildx replaces the Dockerfile's VERSION=<short SHA> label. Thus the published image does not contain the short-SHA version computed above. The action documents that its highest-priority tag becomes the generated OCI version label, so override that label with steps.ver.outputs.version or stop supplying the conflicting generated label. docker/metadata-action priority documentation
Useful? React with 👍 / 👎.
| with: | ||
| context: . | ||
| platforms: linux/amd64 | ||
| push: ${{ github.event_name != 'pull_request' }} |
There was a problem hiding this comment.
When two main pushes run concurrently, both builds write the same main tag, and the older build can finish last and move that tag back to an older commit; concurrent version-tag runs can similarly race on latest. Because the workflow has no concurrency or publication-order guard, consumers of these mutable tags can receive stale images after a newer run has succeeded. Serialize or cancel superseded publication runs before allowing them to push.
Useful? React with 👍 / 👎.
1 participant
Step 1 of the hq GitOps migration: images get built by GitHub Actions instead of on cube.
testjob:go vet+go test ./...imagejob: builds the existing Dockerfile and pushes toghcr.io/saveweb/hqwith tagsmain,sha-<short>, andvX.Y.Z(+latest) on version tags.VERSIONis the tag or short sha,COMMITthe full sha, so the OCI labels match whatscripts/deploy.shchecks today.Nothing about the running deployment changes. The compose/Komodo switch comes in the next PRs.