Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 56 additions & 0 deletions .github/workflows/containerfile.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
name: Build and Push Container Image

on:
push:
branches:
- main
paths:
- 'Containerfile'
- 'pyproject.toml'
- 'uv.lock'
workflow_dispatch:

env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}

jobs:
build-and-push:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Log in to Container Registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Extract metadata (tags, labels)
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=raw,value=latest,enable={{is_default_branch}}
type=sha,prefix=

- name: Build and push container image
uses: docker/build-push-action@v6
with:
context: .
file: ./Containerfile
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
27 changes: 27 additions & 0 deletions .github/workflows/copilot.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
name: GitHub Copilot Dev Environment

on:
workflow_dispatch:

jobs:
copilot:
runs-on: ubuntu-latest
container:
image: ghcr.io/${{ github.repository }}:latest
credentials:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

Comment on lines +7 to +14
Copy link

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Like on_pr.yml, this job pulls a GHCR image but does not declare permissions: packages: read. In orgs that default GITHUB_TOKEN to read-only or restrict package access, the image pull can fail. Add explicit job/workflow permissions for contents: read and packages: read to make execution more predictable.

Copilot uses AI. Check for mistakes.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot open a new pull request to apply changes based on this feedback

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Sync dependencies
run: uv sync --frozen

- name: Setup Copilot environment
run: |
echo "Development environment ready for GitHub Copilot"
echo "Python version: $(python --version)"
echo "uv version: $(uv --version)"
uv pip list
Comment on lines +19 to +27
Copy link

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this workflow is meant to mirror the devcontainer setup for the “AI agent”, it currently only runs uv sync --frozen and a few echo commands; it doesn’t apply the devcontainer’s post-create steps (e.g., syncing the dev group / tool installs). Consider invoking .devcontainer/post-create.sh (or replicating its uv sync --group dev --no-install-project) so the environment matches what contributors/agents get locally.

Copilot uses AI. Check for mistakes.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot open a new pull request to apply changes based on this feedback

28 changes: 28 additions & 0 deletions .github/workflows/on_pr.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
name: PR Tests

on:
pull_request:
branches: [main]

env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}

jobs:
test:
runs-on: ubuntu-latest
container:
image: ghcr.io/${{ github.repository }}:latest
credentials:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
Comment on lines +14 to +18
Copy link

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow runs tests inside ghcr.io/${{ github.repository }}:latest, which is built only after pushes to main. That means PRs can run against a stale image (or fail if no latest image exists yet), and dependency changes in the PR won’t be represented. Consider running CI directly on the runner with setup-uv/setup-python, or build the image as part of this PR workflow (without pushing) and run tests against that image.

Suggested change
container:
image: ghcr.io/${{ github.repository }}:latest
credentials:
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

Copilot uses AI. Check for mistakes.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you sure this is an okay tradeoff, @gvegayon? Do you have experience in how long it usually takes to build similar images on GHA?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally, it should be fast. But I think, overall, having a production environment makes things more robust. Sure, the CI will fail the first time, but it will only be once. Having an image to run on becomes more important as the project starts increasing in complexity (which I've seen in the past).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great, thanks. I'll resolve this conversation.


Comment on lines +12 to +19
Copy link

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pulling from GHCR in a PR workflow often requires explicit token permissions (packages: read) and can fail for PRs from forks/private packages where the token cannot access the registry. To make this workflow reliable, add explicit permissions for packages: read (and contents: read) and/or avoid GHCR pulls for PR CI.

Copilot uses AI. Check for mistakes.
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot open a new pull request to apply changes based on this feedback

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Install dependencies with uv
run: uv sync --frozen

- name: Run tests with pytest
run: uv run pytest