Allow manual image build - #879
Conversation
WalkthroughThe CI workflow now supports manual runs via workflow_dispatch with a required string input version. The “Set Gateway Version” step reads GATEWAY_VERSION from this input instead of git describe, propagating it to downstream steps (e.g., Docker build/push). The git-based fallback is effectively bypassed when input is provided. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as GitHub Actions (build.yml)
participant Step1 as Set Gateway Version
participant Build as Docker Build/Push
Dev->>GH: workflow_dispatch(version)
GH->>Step1: Run step with inputs.version
Note over Step1: Set env.GATEWAY_VERSION = inputs.version<br/>(git describe path skipped)
Step1-->>Build: Expose GATEWAY_VERSION
Build->>Build: Tag and push using GATEWAY_VERSION
Build-->>GH: Complete job
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Pre-merge checks (3 passed)✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
7-11: Manual trigger input looks good; consider adding light validation.LGTM for enabling workflow_dispatch. Optional: add
description:for UX and a short pre-step to validate version format (e.g., require a tag-likev1.2.3) to fail fast if someone passes garbage.Example validation step (add before “Set Gateway Version”):
+ - name: Validate input version (manual runs) + if: ${{ github.event_name == 'workflow_dispatch' }} + run: | + case "${{ inputs.version }}" in + v*[0-9]) : ;; + *) echo "Invalid version: ${{ inputs.version }} (expected tag like v1.2.3)"; exit 1 ;; + esac
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build.yml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Test
| - name: Set Gateway Version | ||
| id: set_version | ||
| run: echo "GATEWAY_VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo 'unknown')" >> $GITHUB_OUTPUT | ||
| run: echo "GATEWAY_VERSION=$(echo '${{ inputs.version }}' || git describe --tags --abbrev=0 2>/dev/null || echo 'unknown')" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
Broken fallback: echo always succeeds; tag builds will set an empty GATEWAY_VERSION.
echo '${{ inputs.version }}' || git describe ... never reaches the fallback because echo returns 0 even when empty. On tag pushes (no input) this yields an empty tag and will break Docker build/push.
Use an explicit emptiness check and prefer the event’s tag name when available:
- run: echo "GATEWAY_VERSION=$(echo '${{ inputs.version }}' || git describe --tags --abbrev=0 2>/dev/null || echo 'unknown')" >> $GITHUB_OUTPUT
+ run: |
+ set -euo pipefail
+ ver="${{ inputs.version || '' }}"
+ # On tag pushes, GitHub exposes the tag as GITHUB_REF_NAME
+ if [ -z "$ver" ]; then
+ ver="${GITHUB_REF_NAME:-}"
+ fi
+ # Fallback to git describe if still empty (e.g., manual run without input)
+ if [ -z "$ver" ]; then
+ ver="$(git describe --tags --abbrev=0 2>/dev/null || true)"
+ fi
+ if [ -z "$ver" ]; then
+ echo "error: GATEWAY_VERSION could not be determined" >&2
+ exit 1
+ fi
+ echo "GATEWAY_VERSION=$ver" >> "$GITHUB_OUTPUT"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| run: echo "GATEWAY_VERSION=$(echo '${{ inputs.version }}' || git describe --tags --abbrev=0 2>/dev/null || echo 'unknown')" >> $GITHUB_OUTPUT | |
| run: | | |
| set -euo pipefail | |
| ver="${{ inputs.version || '' }}" | |
| # On tag pushes, GitHub exposes the tag as GITHUB_REF_NAME | |
| if [ -z "$ver" ]; then | |
| ver="${GITHUB_REF_NAME:-}" | |
| fi | |
| # Fallback to git describe if still empty (e.g., manual run without input) | |
| if [ -z "$ver" ]; then | |
| ver="$(git describe --tags --abbrev=0 2>/dev/null || true)" | |
| fi | |
| if [ -z "$ver" ]; then | |
| echo "error: GATEWAY_VERSION could not be determined" >&2 | |
| exit 1 | |
| fi | |
| echo "GATEWAY_VERSION=$ver" >> "$GITHUB_OUTPUT" |
🤖 Prompt for AI Agents
In .github/workflows/build.yml around line 30, the current command uses "echo
'${{ inputs.version }}' || git describe ..." which always succeeds (even when
empty) and results in an empty GATEWAY_VERSION on tag builds; replace this with
a real emptiness check and an ordered fallback: use the workflow input if
non-empty, otherwise prefer the event/tag name (e.g. github.ref or the release
tag name when present), then fallback to git describe --tags --abbrev=0, and
finally 'unknown'; update the run step to compute the value with those explicit
conditionals and then append "GATEWAY_VERSION=..." to $GITHUB_OUTPUT so the
Docker build receives a non-empty version.
There was a problem hiding this comment.
@turbolent Is the AI here right? Have you tried this workflow? Or it needs merge first?
There was a problem hiding this comment.
Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!
There was a problem hiding this comment.
Update: It seems the AI is right indeed.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/build.yml (2)
24-27: Don’t publish “unknown”; make version resolution robust and explicit.Current fallback can yield “unknown”, which would produce/push a bogus tag. Prefer input → tag ref → latest reachable tag → short SHA, and hard-fail if still empty.
- - name: Set Gateway Version - id: set_version - run: echo "GATEWAY_VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo 'unknown')" >> $GITHUB_OUTPUT + - name: Set Gateway Version + id: set_version + shell: bash + run: | + set -euo pipefail + ver="${{ github.event_name == 'workflow_dispatch' && inputs.version || '' }}" + # If this is a tag push, prefer the tag from the ref + if [ -z "$ver" ] && [[ "${GITHUB_REF:-}" == refs/tags/* ]]; then + ver="${GITHUB_REF##refs/tags/}" + fi + # Fallback to latest reachable tag + if [ -z "$ver" ]; then + ver="$(git describe --tags --abbrev=0 2>/dev/null || true)" + fi + # Last resort: short SHA (avoid 'unknown') + if [ -z "$ver" ]; then + ver="$(git rev-parse --short HEAD)" + fi + if [ -z "$ver" ]; then + echo "error: GATEWAY_VERSION could not be determined" >&2 + exit 1 + fi + echo "GATEWAY_VERSION=$ver" >> "$GITHUB_OUTPUT"
41-45: Guard against empty/invalid tags before build/push.Add a strict check so we never publish an image with an empty or “unknown” tag.
- - name: Docker Auth - run: |- - gcloud auth configure-docker ${{ vars.GAR_LOCATION }}-docker.pkg.dev - docker build --build-arg VERSION="${{ steps.set_version.outputs.GATEWAY_VERSION }}" --build-arg ARCH=amd64 -t ${{ env.DOCKER_IMAGE_URL }}:${{ steps.set_version.outputs.GATEWAY_VERSION }} --file Dockerfile . - docker push ${{ env.DOCKER_IMAGE_URL }}:${{ steps.set_version.outputs.GATEWAY_VERSION }} + - name: Docker Auth, Build & Push + shell: bash + run: | + set -euo pipefail + gcloud auth configure-docker ${{ vars.GAR_LOCATION }}-docker.pkg.dev + ver='${{ steps.set_version.outputs.GATEWAY_VERSION }}' + if [ -z "$ver" ] || [ "$ver" = "unknown" ]; then + echo "error: refusing to publish image with invalid tag: '$ver'" >&2 + exit 1 + fi + docker build --build-arg VERSION="$ver" --build-arg ARCH=amd64 -t "${{ env.DOCKER_IMAGE_URL }}:$ver" --file Dockerfile . + docker push "${{ env.DOCKER_IMAGE_URL }}:$ver"
🧹 Nitpick comments (2)
.github/workflows/build.yml (2)
37-37: Upgradesetup-gcloudto v2 (v1 is legacy).Use the maintained major for better performance and fixes.
- - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v1 + - name: Set up Cloud SDK + uses: google-github-actions/setup-gcloud@v2
19-19: Pin Actions by commit SHA for supply-chain hardening.actions/checkout@v4 (and other actions) should be pinned to a specific SHA to prevent supply-chain drift. Optional but recommended.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Test
4 participants
Description
Add support for triggering the workflow to build & publish an image manually.
For example, this is useful when the automatic build failed.
For contributor use:
masterbranchFiles changedin the Github PR explorerSummary by CodeRabbit