From 09b1ea33e3d89ca3ffa5c8bbdc470bc348828709 Mon Sep 17 00:00:00 2001 From: Jean Date: Mon, 15 Jun 2026 21:37:33 -0500 Subject: [PATCH 1/3] Document docker and helm tags --- .github/workflows/docker.yml | 56 ++++++++++++++++++++++++++++++++++++ .github/workflows/helm.yml | 51 ++++++++++++++++++++++++++++++++ README.md | 22 ++++++++++++++ 3 files changed, 129 insertions(+) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 2384d11..4f12365 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -12,6 +12,10 @@ concurrency: group: docker-${{ github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} +permissions: + contents: read + pull-requests: write + jobs: build: runs-on: ubuntu-latest @@ -146,3 +150,55 @@ jobs: push: ${{ steps.registry.outputs.publish == 'true' }} cache-from: ${{ steps.registry.outputs.publish == 'true' && join(fromJson(steps.cache.outputs.from-json), '\n') || '' }} cache-to: ${{ steps.registry.outputs.publish == 'true' && join(fromJson(steps.cache.outputs.to-json), '\n') || '' }} + + comment: + needs: build + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v6 + with: + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 0 + + - name: Compute workflow metadata + id: workflow-metadata + uses: ./.github/actions/workflow-metadata + + - name: Build comment + id: comment + shell: bash + env: + APP_JSON: ${{ steps.workflow-metadata.outputs.app-version-json }} + run: | + STABLE_TAG=$(echo "${APP_JSON}" | jq --raw-output '."stable-tag"') + TAG_LIST=$(echo "${APP_JSON}" | jq --raw-output \ + --arg pr "pr.${{ github.event.number }}" \ + '(.tags + [$pr]) | map("`" + . + "`") | join(", ")') + + BACKEND=quay.io/nebari/nebari-chat-backend + FRONTEND=quay.io/nebari/nebari-chat-frontend + + { + echo "## Docker images" + echo + echo "Built from ${{ github.event.pull_request.head.sha }}." + echo + echo "| Image | Tags |" + echo "| --- | --- |" + echo "| \`${BACKEND}\` | ${TAG_LIST} |" + echo "| \`${FRONTEND}\` | ${TAG_LIST} |" + echo + echo '```sh' + echo "docker pull ${BACKEND}:${STABLE_TAG}" + echo "docker pull ${FRONTEND}:${STABLE_TAG}" + echo '```' + } > comment.md + + - name: Post comment + uses: marocchino/sticky-pull-request-comment@v2 + with: + header: docker-tags + path: comment.md diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml index d91de39..78d96c9 100644 --- a/.github/workflows/helm.yml +++ b/.github/workflows/helm.yml @@ -12,6 +12,10 @@ concurrency: group: helm-${{ github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} +permissions: + contents: read + pull-requests: write + jobs: metadata: runs-on: ubuntu-latest @@ -98,3 +102,50 @@ jobs: - name: Push helm chart if: steps.registry.outputs.publish == 'true' run: helm push nebari-chat-*.tgz oci://quay.io/nebari/charts + + comment: + needs: helm + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v6 + with: + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 0 + + - name: Compute workflow metadata + id: workflow-metadata + uses: ./.github/actions/workflow-metadata + + - name: Build comment + id: comment + shell: bash + env: + CHART_JSON: ${{ steps.workflow-metadata.outputs.chart-version-json }} + run: | + STABLE_TAG=$(echo "${CHART_JSON}" | jq --raw-output '."stable-tag"') + TAG_LIST=$(echo "${CHART_JSON}" | jq --raw-output '.tags | map("`" + . + "`") | join(", ")') + + CHART=oci://quay.io/nebari/charts/nebari-chat + + { + echo "## Helm chart" + echo + echo "Built from ${{ github.event.pull_request.head.sha }}." + echo + echo "| Chart | Versions |" + echo "| --- | --- |" + echo "| \`${CHART}\` | ${TAG_LIST} |" + echo + echo '```sh' + echo "helm install chat ${CHART} --version ${STABLE_TAG}" + echo '```' + } > comment.md + + - name: Post comment + uses: marocchino/sticky-pull-request-comment@v2 + with: + header: helm-tags + path: comment.md diff --git a/README.md b/README.md index d85595d..37ff689 100644 --- a/README.md +++ b/README.md @@ -54,6 +54,28 @@ Docker images for the frontend and backend are published by pushing a `v$SEMVER` > [!IMPORTANT] > Do not push the app and chart tags at the same time. Each tag triggers the release workflow independently, and if the chart tag arrives first, the chart may reference the previous app version instead of the newly tagged one. +## Available tags + +Every build publishes a set of tags that depends on what triggered it. `` is the next version computed from the most recent tag (e.g. `1.2.4`); `` is the version of the release tag (e.g. `1.2.3`); `` is the PR number; `` is the short commit SHA. + +Docker images (`quay.io/nebari/nebari-chat-backend` and `quay.io/nebari/nebari-chat-frontend`): + +| Trigger | Tags | +| --- | --- | +| Release (`v$SEMVER`) | ``, `latest` | +| Push to `main` | `-main`, `main` | +| Pull request | `-pr..`, `-pr.`, `pr.` | + +Helm chart (`oci://quay.io/nebari/charts/nebari-chat`): + +| Trigger | Tags | +| --- | --- | +| Release (`chart/v$SEMVER`) | `` | +| Push to `main` | `-main` | +| Pull request | `-pr..`, `-pr.` | + +The exact docker and helm tags for the latest commit on a pull request are also posted as comments on that PR. + ## License Apache 2.0 — see [LICENSE](LICENSE). From 92a76f995ce002a3f24d6debfc8b4feaa5ae9ff9 Mon Sep 17 00:00:00 2001 From: Jean Date: Mon, 15 Jun 2026 21:42:03 -0500 Subject: [PATCH 2/3] Skip tag comments on fork PRs --- .github/workflows/docker.yml | 3 ++- .github/workflows/helm.yml | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 4f12365..fe5936d 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -153,7 +153,8 @@ jobs: comment: needs: build - if: github.event_name == 'pull_request' + # Comments require a write token, which fork PRs don't get, so skip them there. + if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml index 78d96c9..9a1a042 100644 --- a/.github/workflows/helm.yml +++ b/.github/workflows/helm.yml @@ -105,7 +105,8 @@ jobs: comment: needs: helm - if: github.event_name == 'pull_request' + # Comments require a write token, which fork PRs don't get, so skip them there. + if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: From 87bdae39186de11983f0a86427f246f322be92f2 Mon Sep 17 00:00:00 2001 From: Jean Paul R <71387616+killua156@users.noreply.github.com> Date: Fri, 19 Jun 2026 00:17:20 -0500 Subject: [PATCH 3/3] Use v-prefixed tag examples and placeholder in README Address review: tags use the v$SEMVER string, rename to , and drop the note about tags being posted as PR comments. --- README.md | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 37ff689..6c3a227 100644 --- a/README.md +++ b/README.md @@ -56,7 +56,7 @@ Docker images for the frontend and backend are published by pushing a `v$SEMVER` ## Available tags -Every build publishes a set of tags that depends on what triggered it. `` is the next version computed from the most recent tag (e.g. `1.2.4`); `` is the version of the release tag (e.g. `1.2.3`); `` is the PR number; `` is the short commit SHA. +Every build publishes a set of tags that depends on what triggered it. `` is the next version computed from the most recent tag (e.g. `v1.2.4`); `` is the version of the release tag (e.g. `v1.2.3`); `` is the PR number; `` is the short commit SHA. Docker images (`quay.io/nebari/nebari-chat-backend` and `quay.io/nebari/nebari-chat-frontend`): @@ -64,7 +64,7 @@ Docker images (`quay.io/nebari/nebari-chat-backend` and `quay.io/nebari/nebari-c | --- | --- | | Release (`v$SEMVER`) | ``, `latest` | | Push to `main` | `-main`, `main` | -| Pull request | `-pr..`, `-pr.`, `pr.` | +| Pull request | `-pr..`, `-pr.`, `pr.` | Helm chart (`oci://quay.io/nebari/charts/nebari-chat`): @@ -72,9 +72,7 @@ Helm chart (`oci://quay.io/nebari/charts/nebari-chat`): | --- | --- | | Release (`chart/v$SEMVER`) | `` | | Push to `main` | `-main` | -| Pull request | `-pr..`, `-pr.` | - -The exact docker and helm tags for the latest commit on a pull request are also posted as comments on that PR. +| Pull request | `-pr..`, `-pr.` | ## License