ci: add docker build and push workflow for api and worker images#22
Merged
mikolajsobolewski merged 1 commit intomainfrom May 6, 2026
Merged
ci: add docker build and push workflow for api and worker images#22mikolajsobolewski merged 1 commit intomainfrom
mikolajsobolewski merged 1 commit intomainfrom
Conversation
📝 WalkthroughWalkthroughA new GitHub Actions workflow is added that automatically builds and pushes Docker images for API and Worker services to ghcr.io, triggered on pushes to main, version tags, and manual dispatch events. ChangesDocker Image Build & Push Workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
.github/workflows/docker-build-and-push.yml (3)
54-72: ⚡ Quick winAdd layer caching to avoid rebuilding from scratch on every run.
Neither build-push step configures
cache-from/cache-to, so every workflow run performs a full cold build of both targets. Since bothapiandworkershare the same./Dockerfileand likely share a large base/dependency layer, this is compounded — the second build cannot reuse the first's layers without a cache backend.The standard fix for GitHub-hosted runners is the GHA cache backend:
⚡ Proposed cache configuration for both build steps
- name: Build and push API image uses: docker/build-push-action@v6 with: context: . file: ./Dockerfile target: api push: true tags: ${{ steps.meta-api.outputs.tags }} labels: ${{ steps.meta-api.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max - name: Build and push Worker image uses: docker/build-push-action@v6 with: context: . file: ./Dockerfile target: worker push: true tags: ${{ steps.meta-worker.outputs.tags }} labels: ${{ steps.meta-worker.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docker-build-and-push.yml around lines 54 - 72, The two docker/build-push-action steps ("Build and push API image" and "Build and push Worker image") currently do cold builds; update both steps that use docker/build-push-action@v6 (targets 'api' and 'worker') to enable layer caching by adding cache-from and cache-to with the GitHub Actions cache backend (type=gha) and mode=max so layers can be reused across runs and between the two targets; ensure the cache keys/refs are stable (e.g., include build target and runner info) and keep push: true and tags/labels as-is so the builds use the cache backend instead of rebuilding from scratch.
23-24: 💤 Low valueRemove QEMU setup if multi-platform builds are not intended.
QEMU is only required for cross-platform emulation (e.g., building
linux/arm64on anamd64runner). Since neither build-push step specifies aplatforms:field, QEMU is set up but never used, adding unnecessary overhead to each run.If multi-platform support is planned, add
platforms: linux/amd64,linux/arm64to both build steps. Otherwise, remove the QEMU step.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docker-build-and-push.yml around lines 23 - 24, The workflow currently runs the docker/setup-qemu-action@v3 step ("Set up QEMU") even though the build-push steps do not specify any platforms, so QEMU is unused; either remove the "Set up QEMU" step (docker/setup-qemu-action@v3) to eliminate the unnecessary overhead, or if you intend multi-platform builds, add a platforms: linux/amd64,linux/arm64 setting to both build-push steps so QEMU is actually required and used.
21-21: 💤 Low value
actions/checkout@v5is not the latest major version.The current README for
actions/checkoutrecommendsactions/checkout@v6. v5.0.0 updated the action to use Node 24, and v6 has since been released as the new major. Consider upgrading.- uses: actions/checkout@v5 + uses: actions/checkout@v6🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docker-build-and-push.yml at line 21, Update the GitHub Actions checkout action to the latest major release by changing the uses reference from "actions/checkout@v5" to "actions/checkout@v6"; locate the workflow step that contains the uses: actions/checkout@v5 entry and replace the version to actions/checkout@v6 so the job uses the current recommended major release.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/docker-build-and-push.yml:
- Line 10: The workflow uses workflow_dispatch with an unconditional push: true
which will publish images from any branch to ghcr.io; change the job/step that
sets push: true to be conditional (e.g., compute a boolean like should_push
based on github.ref or a workflow_dispatch input) and only set push: true when
the ref matches the protected branch (e.g., github.ref == 'refs/heads/main') or
when a specific manual input is provided; update the occurrences of push: true
(referenced in this file as workflow_dispatch and the push: true flags mentioned
at lines ~60 and ~70) to use that conditional variable so ad-hoc runs from
feature branches won’t publish unless explicitly allowed.
---
Nitpick comments:
In @.github/workflows/docker-build-and-push.yml:
- Around line 54-72: The two docker/build-push-action steps ("Build and push API
image" and "Build and push Worker image") currently do cold builds; update both
steps that use docker/build-push-action@v6 (targets 'api' and 'worker') to
enable layer caching by adding cache-from and cache-to with the GitHub Actions
cache backend (type=gha) and mode=max so layers can be reused across runs and
between the two targets; ensure the cache keys/refs are stable (e.g., include
build target and runner info) and keep push: true and tags/labels as-is so the
builds use the cache backend instead of rebuilding from scratch.
- Around line 23-24: The workflow currently runs the docker/setup-qemu-action@v3
step ("Set up QEMU") even though the build-push steps do not specify any
platforms, so QEMU is unused; either remove the "Set up QEMU" step
(docker/setup-qemu-action@v3) to eliminate the unnecessary overhead, or if you
intend multi-platform builds, add a platforms: linux/amd64,linux/arm64 setting
to both build-push steps so QEMU is actually required and used.
- Line 21: Update the GitHub Actions checkout action to the latest major release
by changing the uses reference from "actions/checkout@v5" to
"actions/checkout@v6"; locate the workflow step that contains the uses:
actions/checkout@v5 entry and replace the version to actions/checkout@v6 so the
job uses the current recommended major release.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b41cf8b9-b847-4f6a-a375-35a969d54c6c
📒 Files selected for processing (1)
.github/workflows/docker-build-and-push.yml
| - main | ||
| tags: | ||
| - 'v*' | ||
| workflow_dispatch: {} |
There was a problem hiding this comment.
workflow_dispatch with hardcoded push: true will publish images from any branch.
workflow_dispatch can be triggered from any branch (including feature branches), and since push: true is unconditional, images will be pushed to ghcr.io from unreviewed branches. If this is intentional for ad-hoc testing, it's fine; otherwise, guard the push.
🔒 Proposed conditional push
- name: Build and push API image
uses: docker/build-push-action@v6
with:
context: .
file: ./Dockerfile
target: api
- push: true
+ push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
tags: ${{ steps.meta-api.outputs.tags }}
labels: ${{ steps.meta-api.outputs.labels }}
- name: Build and push Worker image
uses: docker/build-push-action@v6
with:
context: .
file: ./Dockerfile
target: worker
- push: true
+ push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
tags: ${{ steps.meta-worker.outputs.tags }}
labels: ${{ steps.meta-worker.outputs.labels }}Also applies to: 60-60, 70-70
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/docker-build-and-push.yml at line 10, The workflow uses
workflow_dispatch with an unconditional push: true which will publish images
from any branch to ghcr.io; change the job/step that sets push: true to be
conditional (e.g., compute a boolean like should_push based on github.ref or a
workflow_dispatch input) and only set push: true when the ref matches the
protected branch (e.g., github.ref == 'refs/heads/main') or when a specific
manual input is provided; update the occurrences of push: true (referenced in
this file as workflow_dispatch and the push: true flags mentioned at lines ~60
and ~70) to use that conditional variable so ad-hoc runs from feature branches
won’t publish unless explicitly allowed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit