Merged
Conversation
Reviewer's GuideAdds a production-ready containerization and deployment pipeline for PipeRAG using a multi-stage .NET 10 Docker image, GitHub Actions CI/CD, fly.io app configuration, and updated documentation/env configuration, including a production Docker Compose profile. Sequence diagram for CI/CD workflow on PRs and main branch pushessequenceDiagram
actor Developer
participant GitHub
participant GHA_CI as GitHub_Actions_CI
participant GHCR as GitHub_Container_Registry
participant Fly as fly_io
rect rgb(230,230,250)
Developer->>GitHub: Open_PR_to_main
GitHub-->>GHA_CI: Trigger_build_and_test_workflow
GHA_CI->>GHA_CI: Restore_dependencies
GHA_CI->>GHA_CI: Build_API_Project
GHA_CI->>GHA_CI: Restore_test_dependencies
GHA_CI->>GHA_CI: Run_tests
GHA_CI->>GitHub: Upload_test_results_artifact
Note over GHA_CI,GHCR: For PRs, Docker image is built without push
GHA_CI->>GHA_CI: Optional_Docker_build_no_push
end
rect rgb(220,255,220)
Developer->>GitHub: Push_commit_to_main
GitHub-->>GHA_CI: Trigger_build_and_test_job
GHA_CI->>GHA_CI: Restore_build_test
GitHub-->>GHA_CI: Trigger_docker_build_job
GHA_CI->>GHCR: Login_with_GITHUB_TOKEN
GHA_CI->>GHA_CI: Build_multi_stage_Docker_image
GHA_CI->>GHCR: Push_image_tags_sha_and_latest
GitHub-->>GHA_CI: Trigger_deploy_job
GHA_CI->>Fly: flyctl_deploy_with_FLY_API_TOKEN
Fly->>Fly: Pull_image_from_GHCR
Fly-->>Developer: Deployed_new_version_to_piperag_app
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- The Dockerfile’s HEALTHCHECK uses
curlbut themcr.microsoft.com/dotnet/aspnet:10.0-previewbase image doesn’t include it by default, so the health check will fail unless you installcurl(or switch to a check that uses a built-in tool likewgetordotnetitself). - In the
docker-compose.ymlproduction profile, theDATABASE_URLis hard-coded with development credentials; consider wiring this through environment variables or secrets so production-like runs don’t rely on embedded passwords.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The Dockerfile’s HEALTHCHECK uses `curl` but the `mcr.microsoft.com/dotnet/aspnet:10.0-preview` base image doesn’t include it by default, so the health check will fail unless you install `curl` (or switch to a check that uses a built-in tool like `wget` or `dotnet` itself).
- In the `docker-compose.yml` production profile, the `DATABASE_URL` is hard-coded with development credentials; consider wiring this through environment variables or secrets so production-like runs don’t rely on embedded passwords.
## Individual Comments
### Comment 1
<location> `docker-compose.yml:35` </location>
<code_context>
+ - "8080:8080"
+ environment:
+ ASPNETCORE_ENVIRONMENT: Production
+ DATABASE_URL: "Host=postgres;Database=piperag;Username=piperag;Password=piperag_dev"
+ JWT_SECRET: "${JWT_SECRET}"
+ OPENAI_API_KEY: "${OPENAI_API_KEY}"
</code_context>
<issue_to_address>
**🚨 issue (security):** Avoid hardcoding database credentials in the production docker-compose configuration.
`DATABASE_URL` currently includes the username and password inline, and even uses a `*_dev` password for a `Production` service. These credentials are easy to leak or accidentally reuse. Please switch to env interpolation for sensitive fields (e.g. `Password=${POSTGRES_PASSWORD}`) so secrets are managed via your environment/secret store instead of the compose file.
</issue_to_address>
### Comment 2
<location> `Dockerfile:31-32` </location>
<code_context>
+ENV ASPNETCORE_URLS=http://+:8080
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+ CMD curl -f http://localhost:8080/health || exit 1
+
+ENTRYPOINT ["dotnet", "PipeRAG.Api.dll"]
</code_context>
<issue_to_address>
**issue (bug_risk):** The healthcheck relies on `curl`, which is not present in the base ASP.NET runtime image.
In `mcr.microsoft.com/dotnet/aspnet` images `curl` is not installed, so this healthcheck will always fail with `command not found` even when the app is healthy. Please either install an HTTP client in the runtime image (e.g. via `apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*`) or change the healthcheck to use a built-in mechanism (for example a `dotnet`-based self-check) so it can run without extra packages.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| - "8080:8080" | ||
| environment: | ||
| ASPNETCORE_ENVIRONMENT: Production | ||
| DATABASE_URL: "Host=postgres;Database=piperag;Username=piperag;Password=piperag_dev" |
There was a problem hiding this comment.
🚨 issue (security): Avoid hardcoding database credentials in the production docker-compose configuration.
DATABASE_URL currently includes the username and password inline, and even uses a *_dev password for a Production service. These credentials are easy to leak or accidentally reuse. Please switch to env interpolation for sensitive fields (e.g. Password=${POSTGRES_PASSWORD}) so secrets are managed via your environment/secret store instead of the compose file.
Comment on lines
+31
to
+32
| HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ | ||
| CMD curl -f http://localhost:8080/health || exit 1 |
There was a problem hiding this comment.
issue (bug_risk): The healthcheck relies on curl, which is not present in the base ASP.NET runtime image.
In mcr.microsoft.com/dotnet/aspnet images curl is not installed, so this healthcheck will always fail with command not found even when the app is healthy. Please either install an HTTP client in the runtime image (e.g. via apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*) or change the healthcheck to use a built-in mechanism (for example a dotnet-based self-check) so it can run without extra packages.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Final PR! Adds Dockerfile, GitHub Actions CI/CD, fly.io config, and production configuration. Closes the PipeRAG MVP backlog.
Changes
Summary by Sourcery
Introduce containerized production deployment and automated CI/CD for the application.
New Features:
Enhancements:
CI:
Documentation:
Tests: