Merged
Conversation
...to push latest mongo:noble version (v8.2.3) and fix cve-2025-14847
Contributor
Reviewer's guide (collapsed on small PRs)Reviewer's GuideHelm chart version is bumped, MongoDB deployment is configured to always pull its image (ensuring the latest patched image is used), and the Celery worker image reference is updated to a specific tagged image. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- Switching
imagePullPolicytoAlwayswill force pulls on every restart and can cause unnecessary load or failures in air‑gapped/limited environments; consider making this configurable via values.yaml instead of hard‑coding it. - The
celeryWorker.imagevalue now points to a personal/alternate repository (lvarin/cwl-wes:20220325); if this is intentional, consider making the registry/repository configurable and avoid hard‑coding a user‑specific image. - The PR description mentions updating to
mongo:nobleand fixing CVE-2025-14847, but the diff only changes the pull policy, not the MongoDB image itself; consider aligning the description and changes or explicitly updating the image tag in values.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Switching `imagePullPolicy` to `Always` will force pulls on every restart and can cause unnecessary load or failures in air‑gapped/limited environments; consider making this configurable via values.yaml instead of hard‑coding it.
- The `celeryWorker.image` value now points to a personal/alternate repository (`lvarin/cwl-wes:20220325`); if this is intentional, consider making the registry/repository configurable and avoid hard‑coding a user‑specific image.
- The PR description mentions updating to `mongo:noble` and fixing CVE-2025-14847, but the diff only changes the pull policy, not the MongoDB image itself; consider aligning the description and changes or explicitly updating the image tag in values.
## Individual Comments
### Comment 1
<location> `deployment/values.yaml:167` </location>
<code_context>
celeryWorker:
appName: celery-worker
- image: elixircloud/cwl-wes:latest
+ image: lvarin/cwl-wes:20220325
initResources:
limits:
</code_context>
<issue_to_address>
**suggestion:** Using a personal Docker Hub namespace and dated tag for `celeryWorker` image may complicate maintenance and provenance.
While pinning avoids `latest`, relying on a user-specific repo and a date-based tag may hurt maintainability. If the tag is meant to track the chart/app version, consider aligning it with `appVersion`, or make the repo and tag configurable (e.g. `celeryWorker.image.repository` / `celeryWorker.image.tag`) to ease future updates and avoid drift.
Suggested implementation:
```
celeryWorker:
appName: celery-worker
image:
# Default to the official repository; can be overridden per environment
repository: elixircloud/cwl-wes
# Leave empty to allow templates to default to .Chart.AppVersion if desired
tag: ""
initResources:
limits:
memory: 16Mi
```
1. Update the corresponding Deployment/Job template(s) for the celery worker to use the new structure, e.g.:
- `image: "{{ .Values.celeryWorker.image.repository }}:{{ default .Chart.AppVersion .Values.celeryWorker.image.tag }}"`.
2. If you had previously referenced `.Values.celeryWorker.image` as a single string in any other templates (e.g. in CronJobs or tests), update those references to use `.Values.celeryWorker.image.repository` and `.Values.celeryWorker.image.tag` with the same defaulting behavior.
3. Optionally document the new `celeryWorker.image.repository` and `celeryWorker.image.tag` values in the chart README so users know how to override them.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| celeryWorker: | ||
| appName: celery-worker | ||
| image: elixircloud/cwl-wes:latest | ||
| image: lvarin/cwl-wes:20220325 |
Contributor
There was a problem hiding this comment.
suggestion: Using a personal Docker Hub namespace and dated tag for celeryWorker image may complicate maintenance and provenance.
While pinning avoids latest, relying on a user-specific repo and a date-based tag may hurt maintainability. If the tag is meant to track the chart/app version, consider aligning it with appVersion, or make the repo and tag configurable (e.g. celeryWorker.image.repository / celeryWorker.image.tag) to ease future updates and avoid drift.
Suggested implementation:
celeryWorker:
appName: celery-worker
image:
# Default to the official repository; can be overridden per environment
repository: elixircloud/cwl-wes
# Leave empty to allow templates to default to .Chart.AppVersion if desired
tag: ""
initResources:
limits:
memory: 16Mi
- Update the corresponding Deployment/Job template(s) for the celery worker to use the new structure, e.g.:
image: "{{ .Values.celeryWorker.image.repository }}:{{ default .Chart.AppVersion .Values.celeryWorker.image.tag }}".
- If you had previously referenced
.Values.celeryWorker.imageas a single string in any other templates (e.g. in CronJobs or tests), update those references to use.Values.celeryWorker.image.repositoryand.Values.celeryWorker.image.tagwith the same defaulting behavior. - Optionally document the new
celeryWorker.image.repositoryandceleryWorker.image.tagvalues in the chart README so users know how to override them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
...to pull latest mongo:noble version (v8.2.3) and fix cve-2025-14847
IMPORTANT: Please create an issue before filing a pull request! Changes need to be discussed before proceeding. Please read the contribution guidelines.
Details
Please provide enough information so that others can review your pull request. Give a brief summary of the motivation. Refer to the corresponding issue/s with
#XXXXfor more information.Testing
Write the appropriate unit and integration tests, if applicable. Make sure these and all other tests pass.
Documentation
Please document your changes and test cases in the appropriate places, if applicable.
Style
Make sure your changes adhere to the coding/documentation style used throughout the project.
Closing issues
If your changes fix any issue/s, put
closes #XXXXin your comment to auto-close it/them.Credit
Add your credentials to the list of contributors once your pull request was merged.
Summary by Sourcery
Bump the Helm chart and application versions and adjust deployment settings for MongoDB and the Celery worker image.
Enhancements: