feat: CSS centering + Docker Hub CI/CD and release automation - #2
Conversation
Switch body to column flex with align-items center and use margin auto on #app so the game is vertically centered on large screens while gracefully falling back to top-aligned when content overflows. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- docker.yml: builds and pushes versioned image to Docker Hub on pushes to main (latest) and on semver tags (v*.*.*) using docker/metadata-action for automatic tag generation and GHA layer caching - release.yml: runs release-please on every merge to main, opens a Release PR with bumped version and CHANGELOG.md; merging it creates the git tag that triggers the Docker build - Add release-please-config.json and .release-please-manifest.json - Seed package.json with version 0.1.0 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 37 minutes and 53 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR establishes release infrastructure and deployment automation for version 0.1.0, along with UI layout improvements. It configures release-please for semantic versioning, adds Docker and release workflows to GitHub Actions, and centers the game layout across all screen sizes. ChangesRelease Infrastructure and UI Layout
🎯 2 (Simple) | ⏱️ ~12 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/docker.yml:
- Around line 15-38: Workflow actions in .github/workflows/docker.yml and
.github/workflows/release.yml are using mutable tags (e.g., actions/checkout@v4,
docker/setup-buildx-action@v3, docker/login-action@v3,
docker/metadata-action@v5, docker/build-push-action@v6 and
googleapis/release-please-action@v4) which should be pinned to immutable commit
SHAs; update each `uses:` entry to reference the corresponding action's full
commit SHA (replace the `@v`* ref for actions/checkout,
docker/setup-buildx-action, docker/login-action, docker/metadata-action,
docker/build-push-action in docker.yml and googleapis/release-please-action in
release.yml) so the workflows use exact commits and do not float to new
releases.
- Line 15: The checkout step using actions/checkout@v4 is leaving repository
credentials persisted; update the checkout step in the Docker workflow to
disable persisted credentials by adding the with: persist-credentials: false
option for actions/checkout@v4 so the repo token is not written into the local
git config for later steps.
In @.github/workflows/release.yml:
- Around line 15-19: The release workflow uses
googleapis/release-please-action@v4 with token: ${{ secrets.GITHUB_TOKEN }},
which prevents tags it creates from triggering other push/tag workflows (like
your Docker workflow) and also uses an unpinned action; update the release
workflow to use a dedicated PAT or GitHub App token (with contents: write)
instead of GITHUB_TOKEN for the action's token input so generated tags will
trigger push/tag workflows, and pin googleapis/release-please-action to a
specific commit SHA rather than `@v4` to satisfy security scanning.
In `@README.md`:
- Line 86: The checklist entry that currently reads "[x] Deployment workflow
(GitHub Actions — build, push image, deploy)" overstates scope; change it to
accurately reflect only build-and-push (e.g., "Deployment workflow (GitHub
Actions — build & push image)" or "CI workflow (GitHub Actions — build and push
image)") and remove the checked mark so it no longer signals completion until a
true deploy step exists; update the line containing that exact checklist text
accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6e3f732c-d6b5-4d19-a3ce-f4cac2dd1657
📒 Files selected for processing (7)
.github/workflows/docker.yml.github/workflows/release.yml.release-please-manifest.jsonREADME.mdpackage.jsonpublic/css/style.cssrelease-please-config.json
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Log in to Docker Hub | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| username: ${{ secrets.DOCKERHUB_USERNAME }} | ||
| password: ${{ secrets.DOCKERHUB_TOKEN }} | ||
|
|
||
| - name: Extract metadata | ||
| id: meta | ||
| uses: docker/metadata-action@v5 | ||
| with: | ||
| images: ${{ secrets.DOCKERHUB_USERNAME }}/blip | ||
| tags: | | ||
| type=semver,pattern={{version}} | ||
| type=semver,pattern={{major}}.{{minor}} | ||
| type=semver,pattern={{major}} | ||
| type=raw,value=latest,enable={{is_default_branch}} | ||
|
|
||
| - name: Build and push | ||
| uses: docker/build-push-action@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# List workflows
echo "== Workflows =="
find .github/workflows -maxdepth 1 -type f -print
echo
echo "== docker.yml =="
nl -ba .github/workflows/docker.yml | sed -n '1,200p'
echo
echo "== release.yml (or similarly named) =="
for f in .github/workflows/release.yml .github/workflows/releases.yml .github/workflows/release*.yml; do
if [ -f "$f" ]; then
echo "--- $f ---"
nl -ba "$f" | sed -n '1,220p'
fi
done
echo
echo "== All uses: lines in workflow files =="
rg -n --no-heading "^\s*uses:\s*" .github/workflows -S || true
echo
echo "== Which uses: are not pinned to SHA (heuristic) =="
# Heuristic: detect uses@v* or uses@* without @<40-hex> or full SHA pin
rg -n --no-heading "^\s*uses:\s*[^@]+@([^\s]+)" .github/workflows -S | while read -r line; do
file=$(echo "$line" | cut -d: -f1)
lno=$(echo "$line" | cut -d: -f2)
ref=$(echo "$line" | sed -E 's/.*@([^ ]+).*/\1/')
# If ref looks like 40-hex SHA, skip
if echo "$ref" | grep -Eq '^[0-9a-fA-F]{40}$'; then
continue
fi
echo "$file:$lno uses@$ref"
doneRepository: clovisphere/blip
Length of output: 242
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== docker.yml =="
awk '{printf "%4d\t%s\n", NR, $0}' .github/workflows/docker.yml | sed -n '1,220p'
echo
echo "== release.yml =="
awk '{printf "%4d\t%s\n", NR, $0}' .github/workflows/release.yml | sed -n '1,260p'
echo
echo "== test.yml (not requested, but quick scan for other uses) =="
awk '{printf "%4d\t%s\n", NR, $0}' .github/workflows/test.yml | sed -n '1,220p'
echo
echo "== All uses: lines in workflow files =="
rg -n --no-heading "^\s*uses:\s*" .github/workflows -S || true
echo
echo "== Which uses: are not pinned to SHA (heuristic) =="
rg -n --no-heading "^\s*uses:\s*[^@]+@([^\s]+)" .github/workflows -S | while read -r line; do
file=$(echo "$line" | cut -d: -f1)
lno=$(echo "$line" | cut -d: -f2)
ref=$(echo "$line" | sed -E 's/.*@([^ ]+).*/\1/')
if echo "$ref" | grep -Eq '^[0-9a-fA-F]{40}$'; then
continue
fi
echo "$file:$lno uses@$ref"
doneRepository: clovisphere/blip
Length of output: 2866
Pin GitHub Actions uses: entries to commit SHAs in .github/workflows/docker.yml and .github/workflows/release.yml. Both workflows use mutable @v* tags rather than immutable commit SHAs, including:
docker.yml:actions/checkout@v4,docker/setup-buildx-action@v3,docker/login-action@v3,docker/metadata-action@v5,docker/build-push-action@v6release.yml:googleapis/release-please-action@v4
Given these workflows build/release and may use tokens/credentials, SHA-pin everyuses:reference.
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 28-28: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 38-38: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/docker.yml around lines 15 - 38, Workflow actions in
.github/workflows/docker.yml and .github/workflows/release.yml are using mutable
tags (e.g., actions/checkout@v4, docker/setup-buildx-action@v3,
docker/login-action@v3, docker/metadata-action@v5, docker/build-push-action@v6
and googleapis/release-please-action@v4) which should be pinned to immutable
commit SHAs; update each `uses:` entry to reference the corresponding action's
full commit SHA (replace the `@v`* ref for actions/checkout,
docker/setup-buildx-action, docker/login-action, docker/metadata-action,
docker/build-push-action in docker.yml and googleapis/release-please-action in
release.yml) so the workflows use exact commits and do not float to new
releases.
Source: Linters/SAST tools
- Pin all action refs to immutable commit SHAs - Add persist-credentials: false to checkout step in docker.yml - Switch release.yml to use RELEASE_TOKEN (PAT) instead of GITHUB_TOKEN so release-please-created tags trigger the Docker workflow - Correct README TODO wording (build & push, not deploy) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 participant
Summary
margin: autoon#appdocker.ymlworkflow: builds and pushes versioned image to Docker Hub on merges tomain(taggedlatest) and on semver tags (taggedv1.2.3,1.2,1)release.ymlworkflow: runs release-please on every merge tomain, opens a Release PR with auto-bumped version andCHANGELOG.md; merging it creates the git tag that triggers the Docker buildpackage.jsonwithversion: 0.1.0and add release-please config filesRelease flow (after merge)
Secrets required
Set these in GitHub repo → Settings → Secrets → Actions:
DOCKERHUB_USERNAMEDOCKERHUB_TOKENTest plan
docker.ymltriggers on av*.*.*tag push and image appears on Docker Hubrelease.ymlopens a Release PR after merge tomain🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Style