feat: expose running image build metadata - #15
Conversation
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
WalkthroughThe change embeds image channel and source revision metadata in Codex images, adds a ChangesEmbedded image metadata and remote-dev reporting
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant BuildWorkflow
participant CodexDockerfile
participant RemoteDevVersion
participant CodexMenu
participant CodexDoctor
BuildWorkflow->>CodexDockerfile: pass PROJECT_VERSION and SOURCE_REVISION
CodexDockerfile->>CodexDockerfile: write OCI label and metadata files
CodexMenu->>RemoteDevVersion: request --menu summary
RemoteDevVersion-->>CodexMenu: return image revision and Codex version
CodexDoctor->>RemoteDevVersion: validate embedded metadata
RemoteDevVersion-->>CodexDoctor: return metadata status
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/codex-doctor.sh`:
- Around line 32-35: Update the remote-dev-version validation block to reject
successful command output that reports unknown, missing, or unreadable metadata,
not just nonzero command exits. Validate both metadata values/files explicitly
or invoke the command’s validation mode so invalid metadata sets status=1, while
preserving the existing unavailable message for command failures.
In `@scripts/codex-menu.sh`:
- Around line 6-10: Update run_interactive_and_harden to capture each wrapped
command’s exit status, print a concise failure message, and preserve that status
instead of using “|| true”; add explicit status checks and user-facing errors
for gh auth login and gh auth setup-git in the authentication/setup flow,
ensuring failures do not proceed silently to persistence or the menu.
In `@scripts/smoke-test.sh`:
- Around line 18-21: Strengthen the smoke-test metadata checks around
/usr/share/remote-dev/image-version and /usr/share/remote-dev/source-revision:
read and validate their exact expected build-input values, rejecting empty or
unknown values, then assert those exact values appear in both remote-dev-version
outputs, including the menu output. Replace bare test commands with production
Bash checks that emit useful failure messages while preserving the existing
default and --menu verification.
In `@scripts/start-codex-web.sh`:
- Around line 63-69: Update the tmux session setup for the codex and shell cases
so the attached existing session’s active window is explicitly renamed to
remote-dev, not only newly created via -n. Add a preflight rename-window step
while preserving the current new-session behavior, and cover both new-session
and existing-session paths in tests.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 85a4cfc9-192b-4e57-976c-177f5cb70e80
📒 Files selected for processing (13)
.github/workflows/publish-amd64.yml.github/workflows/publish-edge-amd64.ymlCHANGELOG.mdREADME.es.mdREADME.mdconfig/tmux.confimages/codex/Dockerfilescripts/build-local.shscripts/codex-doctor.shscripts/codex-menu.shscripts/remote-dev-version.shscripts/smoke-test.shscripts/start-codex-web.sh
📜 Review details
🧰 Additional context used
📓 Path-based instructions (4)
scripts/**/*.sh
⚙️ CodeRabbit configuration file
scripts/**/*.sh: Review as production Bash. Check quoting, set -euo pipefail behavior, cleanup traps,
bounded retries and timeouts, non-interactive execution, idempotency and useful failure messages.
Flag commands that can hang, leak credentials, silently ignore failures or mutate persistent data unexpectedly.
Files:
scripts/start-codex-web.shscripts/build-local.shscripts/smoke-test.shscripts/codex-doctor.shscripts/remote-dev-version.shscripts/codex-menu.sh
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Review GitHub Actions for least-privilege permissions, safe event triggers, untrusted input handling,
accidental publication, tag-channel correctness, secret exposure, reproducible builds, SBOM/provenance
generation and appropriate validation before pushing images.
Files:
.github/workflows/publish-edge-amd64.yml.github/workflows/publish-amd64.yml
**/*.md
⚙️ CodeRabbit configuration file
**/*.md: Check that documentation matches the implemented behavior and clearly distinguishes experimental edge builds
from stable releases. Flag outdated versions, unsafe deployment guidance and claims not proven by CI or testing.
Files:
CHANGELOG.mdREADME.mdREADME.es.md
images/**/Dockerfile
⚙️ CodeRabbit configuration file
images/**/Dockerfile: Review for reproducibility, supply-chain security and minimal image growth.
Require pinned upstream versions and checksum or digest verification for downloaded binaries.
Flag secrets, floating base tags, unsafe remote-script execution, broken multi-architecture logic,
cache misuse, unnecessary packages and changes that weaken the secure-by-default runtime.
Files:
images/codex/Dockerfile
🔇 Additional comments (9)
scripts/build-local.sh (1)
13-14: LGTM!Also applies to: 33-34
.github/workflows/publish-amd64.yml (1)
102-102: LGTM!.github/workflows/publish-edge-amd64.yml (1)
108-112: LGTM!images/codex/Dockerfile (1)
8-13: LGTM!Also applies to: 55-55, 64-72
README.es.md (1)
25-25: LGTM!Also applies to: 49-62
config/tmux.conf (1)
6-9: LGTM!scripts/remote-dev-version.sh (1)
1-41: LGTM!CHANGELOG.md (1)
26-26: LGTM!README.md (1)
49-49: LGTM!Also applies to: 75-87
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 154f9f0b08
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/codex-menu.sh`:
- Around line 63-68: Move the version-summary computation using
remote-dev-version out of the repeatedly executing while loop in
scripts/codex-menu.sh, initializing version_summary once before the loop.
Preserve the existing fallback to “Image metadata unavailable” when the check
fails, and only refresh the cached value if the menu explicitly needs to detect
a runtime Codex CLI upgrade.
In `@scripts/smoke-test.sh`:
- Around line 31-39: Remove the duplicated format_short_revision implementation
from smoke-test.sh and introduce a shared helper, such as
scripts/lib/format-short-revision.sh, containing the canonical function. Source
that helper from both smoke-test.sh and remote-dev-version.sh, preserving the
existing formatting behavior and exact-value assertions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 55430f2b-99c9-4bf5-a852-45255ce54915
📒 Files selected for processing (17)
.github/workflows/build-amd64.yml.github/workflows/publish-amd64.yml.github/workflows/publish-edge-amd64.ymlCHANGELOG.mdREADME.es.mdREADME.mdconfig/tmux.confimages/codex/Dockerfilescripts/attach-remote-dev-tmux.shscripts/build-local.shscripts/codex-doctor.shscripts/codex-menu.shscripts/detect-source-revision.shscripts/remote-dev-version.shscripts/smoke-test.shscripts/start-codex-web.shscripts/test-source-revision.sh
📜 Review details
🧰 Additional context used
📓 Path-based instructions (4)
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Review GitHub Actions for least-privilege permissions, safe event triggers, untrusted input handling,
accidental publication, tag-channel correctness, secret exposure, reproducible builds, SBOM/provenance
generation and appropriate validation before pushing images.
Files:
.github/workflows/build-amd64.yml.github/workflows/publish-amd64.yml.github/workflows/publish-edge-amd64.yml
scripts/**/*.sh
⚙️ CodeRabbit configuration file
scripts/**/*.sh: Review as production Bash. Check quoting, set -euo pipefail behavior, cleanup traps,
bounded retries and timeouts, non-interactive execution, idempotency and useful failure messages.
Flag commands that can hang, leak credentials, silently ignore failures or mutate persistent data unexpectedly.
Files:
scripts/start-codex-web.shscripts/test-source-revision.shscripts/attach-remote-dev-tmux.shscripts/detect-source-revision.shscripts/build-local.shscripts/smoke-test.shscripts/codex-doctor.shscripts/remote-dev-version.shscripts/codex-menu.sh
**/*.md
⚙️ CodeRabbit configuration file
**/*.md: Check that documentation matches the implemented behavior and clearly distinguishes experimental edge builds
from stable releases. Flag outdated versions, unsafe deployment guidance and claims not proven by CI or testing.
Files:
CHANGELOG.mdREADME.mdREADME.es.md
images/**/Dockerfile
⚙️ CodeRabbit configuration file
images/**/Dockerfile: Review for reproducibility, supply-chain security and minimal image growth.
Require pinned upstream versions and checksum or digest verification for downloaded binaries.
Flag secrets, floating base tags, unsafe remote-script execution, broken multi-architecture logic,
cache misuse, unnecessary packages and changes that weaken the secure-by-default runtime.
Files:
images/codex/Dockerfile
🔇 Additional comments (17)
scripts/detect-source-revision.sh (1)
1-41: LGTM!scripts/test-source-revision.sh (1)
1-42: LGTM!scripts/build-local.sh (1)
4-4: LGTM!Also applies to: 13-17, 36-37
.github/workflows/publish-amd64.yml (1)
102-102: LGTM!.github/workflows/publish-edge-amd64.yml (1)
111-112: LGTM!images/codex/Dockerfile (1)
8-13: LGTM!Also applies to: 53-82
scripts/start-codex-web.sh (1)
62-63: LGTM!scripts/attach-remote-dev-tmux.sh (1)
1-56: LGTM!config/tmux.conf (1)
6-9: LGTM!.github/workflows/build-amd64.yml (1)
28-28: LGTM!scripts/remote-dev-version.sh (1)
1-78: LGTM!scripts/codex-doctor.sh (1)
27-38: LGTM! The--checkbranch now relies onremote-dev-version --check's real content validation (unknown/unavailable metadata is rejected), which resolves the previously flagged gap where success could mask missing metadata.scripts/smoke-test.sh (1)
4-8: LGTM! The exact-value metadata assertions (lines 47-76), the semantic-marker edge case (lines 78-86), and the per-run tmux socket isolation (lines 23-29, 104-141) resolve the previously flagged gap where arbitrary/unknownmetadata could pass.Also applies to: 23-29, 41-91, 104-141
CHANGELOG.md (1)
26-26: LGTM! Correctly distinguishes embedded image metadata from the runtime-reported Codex CLI version, resolving the earlier wording concern.README.md (1)
49-49: LGTM! Wording now correctly distinguishes embedded image metadata from the runtime Codex CLI version, and the "Expected edge output" example matchesremote-dev-version's actual output format.Also applies to: 75-88
README.es.md (1)
25-25: LGTM! Consistent with the README.md wording and resolves the same past embedded-vs-runtime distinction concern.Also applies to: 49-62
scripts/codex-menu.sh (1)
6-61: LGTM! The refactored failure handling correctly captures and reports exit status for interactive commands and the GitHub login/setup flow, resolving the previously flagged silent-failure issues.Also applies to: 86-108
|
@coderabbitai full review |
✅ Action performedFull review finished. |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/build-local.sh`:
- Around line 15-17: Update the SOURCE_REVISION guard in the build script to
treat both an unset variable and an explicitly empty value as missing, then run
detect-source-revision.sh before invoking Docker. Preserve any non-empty
caller-provided revision, and apply the same empty-value validation to default
values such as PROJECT_VERSION if they are used in the Docker build inputs.
In `@scripts/test-source-revision.sh`:
- Around line 39-40: Extend the dirty-worktree test around the tracked.txt
modification to restore tracked.txt, create an untracked file in the same
worktree, and assert that invoking the helper still returns
${head_revision}-dirty. Use the existing cleanup and assertion flow so the
untracked-file case specifically exercises status --porcelain
--untracked-files=normal.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b52205d8-40c8-47ea-b01f-40ee25a0355e
📒 Files selected for processing (18)
.github/workflows/build-amd64.yml.github/workflows/publish-amd64.yml.github/workflows/publish-edge-amd64.ymlCHANGELOG.mdREADME.es.mdREADME.mdconfig/tmux.confimages/codex/Dockerfilescripts/attach-remote-dev-tmux.shscripts/build-local.shscripts/codex-doctor.shscripts/codex-menu.shscripts/detect-source-revision.shscripts/lib/format-short-revision.shscripts/remote-dev-version.shscripts/smoke-test.shscripts/start-codex-web.shscripts/test-source-revision.sh
📜 Review details
🧰 Additional context used
📓 Path-based instructions (4)
**/*.md
⚙️ CodeRabbit configuration file
**/*.md: Check that documentation matches the implemented behavior and clearly distinguishes experimental edge builds
from stable releases. Flag outdated versions, unsafe deployment guidance and claims not proven by CI or testing.
Files:
CHANGELOG.mdREADME.es.mdREADME.md
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Review GitHub Actions for least-privilege permissions, safe event triggers, untrusted input handling,
accidental publication, tag-channel correctness, secret exposure, reproducible builds, SBOM/provenance
generation and appropriate validation before pushing images.
Files:
.github/workflows/publish-amd64.yml.github/workflows/build-amd64.yml.github/workflows/publish-edge-amd64.yml
scripts/**/*.sh
⚙️ CodeRabbit configuration file
scripts/**/*.sh: Review as production Bash. Check quoting, set -euo pipefail behavior, cleanup traps,
bounded retries and timeouts, non-interactive execution, idempotency and useful failure messages.
Flag commands that can hang, leak credentials, silently ignore failures or mutate persistent data unexpectedly.
Files:
scripts/test-source-revision.shscripts/start-codex-web.shscripts/lib/format-short-revision.shscripts/attach-remote-dev-tmux.shscripts/build-local.shscripts/remote-dev-version.shscripts/codex-doctor.shscripts/smoke-test.shscripts/detect-source-revision.shscripts/codex-menu.sh
images/**/Dockerfile
⚙️ CodeRabbit configuration file
images/**/Dockerfile: Review for reproducibility, supply-chain security and minimal image growth.
Require pinned upstream versions and checksum or digest verification for downloaded binaries.
Flag secrets, floating base tags, unsafe remote-script execution, broken multi-architecture logic,
cache misuse, unnecessary packages and changes that weaken the secure-by-default runtime.
Files:
images/codex/Dockerfile
🔇 Additional comments (17)
scripts/detect-source-revision.sh (1)
1-41: LGTM!.github/workflows/build-amd64.yml (1)
26-30: LGTM!.github/workflows/publish-amd64.yml (1)
35-37: LGTM!Also applies to: 104-104
.github/workflows/publish-edge-amd64.yml (1)
44-46: LGTM!Also applies to: 113-114
images/codex/Dockerfile (1)
8-13: LGTM!Also applies to: 53-84
scripts/lib/format-short-revision.sh (1)
1-11: LGTM!scripts/remote-dev-version.sh (1)
1-72: LGTM!scripts/codex-doctor.sh (1)
27-38: LGTM!scripts/smoke-test.sh (1)
4-8: LGTM!Also applies to: 23-104, 123-154
scripts/build-local.sh (1)
4-4: LGTM!Also applies to: 13-13, 36-37
CHANGELOG.md (1)
26-26: LGTM!README.md (1)
49-49: LGTM!Also applies to: 75-87
README.es.md (1)
25-25: LGTM!Also applies to: 49-62
scripts/codex-menu.sh (1)
6-67: LGTM!Also applies to: 86-108
scripts/start-codex-web.sh (1)
62-63: LGTM!scripts/attach-remote-dev-tmux.sh (1)
1-56: LGTM!config/tmux.conf (1)
7-9: LGTM!
Independent pre-merge auditA manual audit was completed across all 19 changed files plus adjacent runtime, release and security code. This was not limited to existing CodeRabbit/Codex findings. Additional issues found and fixed independently
Validation completed
Reviewed but not treated as blockers
The remaining manual gate is deployment of the published post-merge edge image on TrueNAS and verification of the visible revision, clean screen transitions, stable tmux label and persisted credentials/workspace. |
Follow-up on the current CodeRabbit pre-merge checks
No new unresolved inline code findings are present at this point. |
1 participant
What changed
remote-dev-versionfor querying the embedded image metadata without Docker socket access.-dirtyand source trees without their own Git worktree aslocal-untracked.remote-devfor new and existing sessions.mainhistory.Why
TrueNAS validation confirmed that the current edge image contains Codex CLI
0.145.0, Bubblewrap0.11.1, working Codex/GitHub authentication and hardened credential permissions. However, the terminal did not expose the exact image revision, making it difficult to prove which movingedge-amd64build was under test.Browser testing also found that the startup menu remained visible above the Codex TUI and tmux automatically changed the status-line name between foreground programs and scrollback mode. This PR presents each interactive screen cleanly and keeps a stable tmux window name without disabling mouse scrollback.
Impact
mainhistory.Safety and release
edgechannel until it is recreated and retested on TrueNAS.Expected menu
A modified local worktree is reported as
<12-character-revision>-dirty. A copied or unpacked source tree without its own Git worktree is reported aslocal-untracked.Expected diagnostic command
Independent audit findings addressed
In addition to external review comments, a manual audit of all changed files and adjacent runtime/release code found and corrected:
remote-dev-version;mainhistory.Validation
Scope and residual follow-up
This PR does not alter container privileges, the TrueNAS Compose security profile or Bubblewrap behavior. The observed
Nested bubblewrap sandbox: UNAVAILABLEresult remains a host namespace/AppArmor limitation; no privileged mode,SYS_ADMINor unconfined profile is added.The following repository-wide hardening items are intentionally deferred to dedicated follow-up work rather than expanding this PR further:
Codex CLI
0.145.0does not provide a first-class safe session-delete command. This PR therefore does not delete rollout JSONL files or edit Codex indexes/SQLite state outside the official CLI.