feat: service deployments by gaspergrom · Pull Request #1668 · linuxfoundation/insights

gaspergrom · 2026-02-10T13:41:05Z

No description provided.

Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

Copilot

Pull request overview

Adds deploy-time service selection so staging/production workflows can build/push and roll out different service images (frontend and Temporal workers) using a parameterized Docker build action.

Changes:

Add service input to staging/production deploy workflows and map it to dockerfile/image/deployment/container settings.
Generalize the build-docker-image composite action to accept dockerfile, image-name, and optional build-args.
Add a Dockerfile for the package_downloads_worker service (and a minor .dockerignore tweak).

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`workers/temporal/package_downloads_worker/Dockerfile`	Introduces a worker image build (multi-stage Node/pnpm install).
`workers/temporal/package_downloads_worker/.dockerignore`	Minor ignore list formatting change (note: build context currently makes this ineffective).
`.github/workflows/staging-deploy.yaml`	Adds service selector and deploys selected Kubernetes deployment/container.
`.github/workflows/production-deploy.yaml`	Same as staging; also gates Redis flush to frontend only.
`.github/actions/build-docker-image/action.yaml`	Makes Docker build/push reusable across services by parameterizing dockerfile/image name and build args.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-10T13:47:15Z

.github/workflows/staging-deploy.yaml

-          NUXT_REDIS_URL: ${{ env.NUXT_REDIS_URL }}
+          dockerfile: ${{ steps.config.outputs.dockerfile }}
+          image-name: ${{ steps.config.outputs.image_name }}
+          build-args: ${{ inputs.service == 'frontend' && format('NUXT_REDIS_URL={0}', env.NUXT_REDIS_URL) || '' }}


NUXT_REDIS_URL is being passed into the Docker build as a build-arg. Since frontend/Dockerfile exports it as an ENV during the build, this value (often including credentials) can be baked into image layers/build output and be recoverable from the image. Prefer injecting Redis configuration at runtime (Kubernetes env/config) rather than at build time, or ensure the build does not persist secrets into the resulting image.

Suggested change

build-args: ${{ inputs.service == 'frontend' && format('NUXT_REDIS_URL={0}', env.NUXT_REDIS_URL) || '' }}

build-args: ''

Copilot · 2026-02-10T13:47:15Z

.github/workflows/production-deploy.yaml

-          NUXT_REDIS_URL: ${{ env.NUXT_REDIS_URL }}
+          dockerfile: ${{ steps.config.outputs.dockerfile }}
+          image-name: ${{ steps.config.outputs.image_name }}
+          build-args: ${{ inputs.service == 'frontend' && format('NUXT_REDIS_URL={0}', env.NUXT_REDIS_URL) || '' }}


NUXT_REDIS_URL is being passed into the Docker build as a build-arg. Since frontend/Dockerfile exports it as an ENV during the build, this value (often including credentials) can be baked into image layers/build output and be recoverable from the image. Prefer injecting Redis configuration at runtime (Kubernetes env/config) rather than at build time, or ensure the build does not persist secrets into the resulting image.

Suggested change

build-args: ${{ inputs.service == 'frontend' && format('NUXT_REDIS_URL={0}', env.NUXT_REDIS_URL) || '' }}

build-args: ''

This one might be a security issue

Copilot · 2026-02-10T13:47:15Z

.github/workflows/staging-deploy.yaml

+          case "${{ inputs.service }}" in
+            frontend)
+              echo "dockerfile=frontend/Dockerfile" >> $GITHUB_OUTPUT
+              echo "image_name=insights-app" >> $GITHUB_OUTPUT
+              echo "k8s_deployment=insights-app-dpl" >> $GITHUB_OUTPUT


The case over ${{ inputs.service }} has no default (*) branch. If this workflow is triggered with an unexpected value (e.g., via API), it will continue with empty outputs and fail later in a less obvious way. Consider adding a default branch that prints an error and exits non-zero.

Copilot · 2026-02-10T13:47:16Z

.github/workflows/production-deploy.yaml

+          case "${{ inputs.service }}" in
+            frontend)
+              echo "dockerfile=frontend/Dockerfile" >> $GITHUB_OUTPUT
+              echo "image_name=insights-app" >> $GITHUB_OUTPUT
+              echo "k8s_deployment=insights-app-dpl" >> $GITHUB_OUTPUT


The case over ${{ inputs.service }} has no default (*) branch. If this workflow is triggered with an unexpected value (e.g., via API), it will continue with empty outputs and fail later in a less obvious way. Consider adding a default branch that prints an error and exits non-zero.

Copilot · 2026-02-10T13:47:16Z

.github/actions/build-docker-image/action.yaml

      uses: docker/build-push-action@v6
      with:
        context: .
-        file: frontend/Dockerfile
+        file: ${{ inputs.dockerfile }}
        push: true


docker/build-push-action is invoked with context: ., which uses the repo-root .dockerignore. That .dockerignore currently excludes workers and submodules, but the worker Dockerfiles copy those paths, so builds for the worker services will fail with missing files. Consider updating the root .dockerignore to include these directories (or make the build context/dockerignore configurable per service) so worker builds have access to required sources.

Not sure if this is a valid comment, but might be worth checking out

Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

emlimlf

There are copilot comments that might pose a security risk please check them out

emlimlf · 2026-02-11T05:39:13Z

.github/actions/build-docker-image/action.yaml

      uses: docker/build-push-action@v6
      with:
        context: .
-        file: frontend/Dockerfile
+        file: ${{ inputs.dockerfile }}
        push: true


Not sure if this is a valid comment, but might be worth checking out

emlimlf · 2026-02-11T05:40:45Z

.github/workflows/production-deploy.yaml

-          NUXT_REDIS_URL: ${{ env.NUXT_REDIS_URL }}
+          dockerfile: ${{ steps.config.outputs.dockerfile }}
+          image-name: ${{ steps.config.outputs.image_name }}
+          build-args: ${{ inputs.service == 'frontend' && format('NUXT_REDIS_URL={0}', env.NUXT_REDIS_URL) || '' }}


This one might be a security issue

emlimlf · 2026-02-11T05:41:04Z

.github/workflows/staging-deploy.yaml

-          NUXT_REDIS_URL: ${{ env.NUXT_REDIS_URL }}
+          dockerfile: ${{ steps.config.outputs.dockerfile }}
+          image-name: ${{ steps.config.outputs.image_name }}
+          build-args: ${{ inputs.service == 'frontend' && format('NUXT_REDIS_URL={0}', env.NUXT_REDIS_URL) || '' }}


Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

workers/temporal/package_downloads_worker/Dockerfile:1

The builder stage is Node 24 but the runtime stage is Node 20. This can lead to runtime failures (e.g., dependency engines/ABI mismatches) since node_modules are installed under Node 24 and then copied into a Node 20 image. Align the Node major version between builder and runner (ideally parameterize via an ARG like the search-volume-worker Dockerfile).
workers/temporal/package_downloads_worker/Dockerfile:18
The runtime stage uses node:20-bookworm-slim while the builder uses node:24-alpine. Copying node_modules built under a different Node major into this image is likely to break at runtime. Update this stage to use the same Node major as the builder (or revert builder to Node 20 if that’s the intended runtime).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

feat: service deployments

df0c530

Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

gaspergrom self-assigned this Feb 10, 2026

Copilot AI review requested due to automatic review settings February 10, 2026 13:41

Copilot started reviewing on behalf of gaspergrom February 10, 2026 13:41 View session

Copilot AI reviewed Feb 10, 2026

View reviewed changes

gaspergrom added 2 commits February 10, 2026 14:48

fix: deployment issue

0141d2a

Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

fix: build issues

654715e

Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

emlimlf requested changes Feb 11, 2026

View reviewed changes

gaspergrom added 2 commits February 12, 2026 08:24

Merge branch 'main' into feat/service-deployments

1baa765

feat: pr comments

a8c2a06

Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

gaspergrom requested review from Copilot and emlimlf February 12, 2026 07:35

Copilot started reviewing on behalf of gaspergrom February 12, 2026 07:36 View session

Copilot AI reviewed Feb 12, 2026

View reviewed changes

emlimlf approved these changes Feb 12, 2026

View reviewed changes

gaspergrom merged commit a9ca835 into main Feb 12, 2026
16 checks passed

gaspergrom deleted the feat/service-deployments branch February 12, 2026 07:41

	build-args: ${{ inputs.service == 'frontend' && format('NUXT_REDIS_URL={0}', env.NUXT_REDIS_URL) \|\| '' }}
	build-args: ''

Conversation

gaspergrom commented Feb 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

emlimlf Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

emlimlf Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

emlimlf Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

emlimlf left a comment

Choose a reason for hiding this comment

Uh oh!

emlimlf Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

emlimlf Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

emlimlf Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants