refactor: bootstrap the canonical Remote Dev image package - #59
Conversation
|
Warning Review limit reached
Next review available in: 46 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
Summary by CodeRabbit
WalkthroughThe PR standardizes image naming on ChangesRemote Dev image naming and publication
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant BuildWorkflow
participant ImageRegistry
participant Trivy
participant PromotionVerifier
BuildWorkflow->>ImageRegistry: Build and push remote-dev candidate
BuildWorkflow->>Trivy: Scan candidate digest
Trivy-->>BuildWorkflow: Vulnerability report
BuildWorkflow->>ImageRegistry: Promote canonical and legacy tags
BuildWorkflow->>PromotionVerifier: Verify tag digest parity
PromotionVerifier-->>BuildWorkflow: Promotion validation result
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@codex review Please review the current head |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish-amd64.yml:
- Around line 224-235: Validate every runtime tag emitted by promotion: in
.github/workflows/publish-amd64.yml lines 224-235, check versioned, stable,
stable-amd64, and latest tags for both runtime packages; in
.github/workflows/publish-edge-amd64.yml lines 225-236, check edge, edge-amd64,
and sha-${GITHUB_SHA} tags for both packages, comparing each tag_ref digest with
the scanned digest. Update docs/releases.md lines 21-23 to state only the exact
scope proven by these validations.
In `@CHANGELOG.md`:
- Around line 32-33: Update the changelog’s digest-parity statement to apply
only to edge and stable publication, or explicitly document that candidate-pr
releases do not publish a matching codex-remote-dev candidate package. Keep the
documented canonical GHCR package and compatibility relationship aligned with
the implemented workflow behavior.
In `@scripts/test-image-name-compat.sh`:
- Around line 60-62: Replace the bare warning-content grep after the conflicting
canonical-value assertion with an explicit failure check that emits an ERROR
message when the expected override text is absent. Keep the existing
fixed-string pattern and warning_file validation, matching the descriptive
failure behavior used by assert_eq and other checks in the script.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e551ced1-24fc-4014-9013-ade29d20fd10
📒 Files selected for processing (11)
.github/workflows/build-amd64.yml.github/workflows/publish-amd64.yml.github/workflows/publish-edge-amd64.yml.github/workflows/publish-pr-candidate-amd64.ymlCHANGELOG.mdMakefiledocs/releases.mdimages/codex/Dockerfilescripts/build-local.shscripts/lib/remote-dev-image-names.shscripts/test-image-name-compat.sh
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: build
🧰 Additional context used
📓 Path-based instructions (4)
images/**/Dockerfile
⚙️ CodeRabbit configuration file
images/**/Dockerfile: Review for reproducibility, supply-chain security and minimal image growth.
Require pinned upstream versions and checksum or digest verification for downloaded binaries.
Flag secrets, floating base tags, unsafe remote-script execution, broken multi-architecture logic,
cache misuse, unnecessary packages and changes that weaken the secure-by-default runtime.
Files:
images/codex/Dockerfile
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Review GitHub Actions for least-privilege permissions, safe event triggers, untrusted input handling,
accidental publication, tag-channel correctness, secret exposure, reproducible builds, SBOM/provenance
generation and appropriate validation before pushing images.
Files:
.github/workflows/publish-pr-candidate-amd64.yml.github/workflows/build-amd64.yml.github/workflows/publish-edge-amd64.yml.github/workflows/publish-amd64.yml
scripts/**/*.sh
⚙️ CodeRabbit configuration file
scripts/**/*.sh: Review as production Bash. Check quoting, set -euo pipefail behavior, cleanup traps,
bounded retries and timeouts, non-interactive execution, idempotency and useful failure messages.
Flag commands that can hang, leak credentials, silently ignore failures or mutate persistent data unexpectedly.
Files:
scripts/lib/remote-dev-image-names.shscripts/build-local.shscripts/test-image-name-compat.sh
**/*.md
⚙️ CodeRabbit configuration file
**/*.md: Check that documentation matches the implemented behavior and clearly distinguishes experimental edge builds
from stable releases. Flag outdated versions, unsafe deployment guidance and claims not proven by CI or testing.
Files:
CHANGELOG.mddocs/releases.md
🪛 Shellcheck (0.11.0)
scripts/test-image-name-compat.sh
[info] 26-26: Expressions don't expand in single quotes, use double quotes for that.
(SC2016)
🔇 Additional comments (14)
.github/workflows/build-amd64.yml (4)
50-51: LGTM!
64-93: LGTM!
124-128: 🗄️ Data Integrity & IntegrationNo action needed.
No repository consumers request the previous Codex report filenames by exact path.
95-104: 🔒 Security & PrivacyNo change needed for the Trivy gate.
scripts/enforce-trivy-gate.shrejects missing, empty, or malformed JSON reports and fails on fixableCRITICALfindings before the workflow can complete.scripts/lib/remote-dev-image-names.sh (2)
8-32: LGTM!
34-44: LGTM!scripts/test-image-name-compat.sh (2)
1-28: LGTM!
30-53: LGTM!images/codex/Dockerfile (2)
2-2: LGTM!
12-13: LGTM!scripts/build-local.sh (3)
7-12: LGTM!
34-41: LGTM!
72-119: LGTM!Makefile (1)
9-20: LGTM!
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dc1a8dc749
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1 participant
What changed
remote-dev-base:localandremote-dev:local;REMOTE_DEV_BASE_IMAGE/REMOTE_DEV_IMAGEresolution withBASE_IMAGE/CODEX_IMAGEcompatibility throughv0.1.x;codex-remote-dev-base:localandcodex-remote-dev:localcompatibility aliases and verifies identical image IDs;Remote Devwhile retaining the legacy documentation symlink;ghcr.io/experience83/remote-dev;Safe two-step migration
GitHub creates a newly published GHCR package as private. This PR deliberately keeps the checked-in Compose and README defaults on the existing public
codex-remote-devpackage.After merge and the first successful edge publication:
remote-devpackage Public in GitHub package settings;REMOTE_DEV_IMAGEand the canonical package.No anonymous deployment is pointed at a private package.
Compatibility
codex-remote-devis not rebuilt separately; it is another name for the same promoted digest;CODEX_IMAGEand the legacy public package remain supported throughoutv0.1.xand will not be removed beforev0.2.0;remote-dev-base.Deliberately out of scope
No Compose default switch, launcher/gateway, new services, mounts, data-root migration, Antigravity, Claude Code or Context7 changes.
Validation
Part of #25. The follow-up deployment-default PR is intentionally blocked on public visibility of the first canonical GHCR package.