ci: build release Docker images natively per-arch, merge with a manifest#235
Merged
Conversation
The v0.6.0 release run's multi-arch Docker build wedged for 3+ hours emulating the arm64 Rust release build under QEMU, and — because the workflow concurrency group is cancel-in-progress:false — every queued release run sat blocked behind it. - docker is now a matrix: amd64 on ubuntu-latest, arm64 on ubuntu-24.04-arm — both native, mirroring release-binaries. Each leg smoke-tests the image (--version must report the released version) and pushes by digest only. - docker-manifest stitches the digests into the :X.Y.Z, :X.Y and :latest tags with buildx imagetools, so a half-finished matrix can never publish a partially-tagged image. - workflow_dispatch grows docker_backfill_tag (and npm_backfill_tag becomes optional): each channel backfills independently for an already-cut release — needed to publish the missing v0.6.0 image.
Contributor
|
Thanks for the contribution. A couple of things will help us review this faster:
See CONTRIBUTING.md. Update the PR and these notes will clear automatically. |
Contributor
|
Important Review skippedNo new commits to review since the last review. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe release workflow now supports independent npm and Docker backfill tags. Docker images build natively for amd64 and arm64, undergo smoke tests, publish by digest, and are combined into multi-architecture manifests. ChangesDocker release backfill
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ManualDispatch
participant NativeDockerRunners
participant DigestArtifacts
participant ContainerRegistry
ManualDispatch->>NativeDockerRunners: resolve release or Docker backfill tag
NativeDockerRunners->>NativeDockerRunners: build and smoke-test amd64 and arm64 images
NativeDockerRunners->>ContainerRegistry: push architecture-specific images by digest
NativeDockerRunners->>DigestArtifacts: upload architecture digests
DigestArtifacts->>ContainerRegistry: provide digests to docker-manifest
ContainerRegistry->>ContainerRegistry: publish multi-architecture release tags
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
81-101: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicated tag-resolution/validation script across
dockeranddocker-manifest. Both jobs independently parse and validatedocker_backfill_tag/tag_namewith the exact same bash. This duplication likely exists because matrix-job outputs are unreliable in GitHub Actions (needs.docker.outputs.*from a matrix job is nondeterministic), but the logic itself doesn't need to live in a matrix leg — hoisting it to a small upstream job removes the duplication risk entirely.
.github/workflows/release.yml#L81-L101: replace this inline resolution with aneeds: resolve-tagdependency and consumeneeds.resolve-tag.outputs.tagfor the checkoutref..github/workflows/release.yml#L174-L188: replace this inline resolution with the sameneeds.resolve-tag.outputs.tag/.versionconsumption instead of re-running the parsing script.Introduce a single upstream job, e.g.:
resolve-tag: name: Resolve release tag needs: release-please if: ${{ !cancelled() && (needs.release-please.outputs.release_created == 'true' || (github.event_name == 'workflow_dispatch' && (inputs.docker_backfill_tag != '' ))) }} runs-on: ubuntu-latest outputs: tag: ${{ steps.rel.outputs.tag }} version: ${{ steps.rel.outputs.version }} steps: - name: Resolve release tag id: rel env: DISPATCH_TAG: ${{ inputs.docker_backfill_tag }} RELEASE_TAG: ${{ needs.release-please.outputs.tag_name }} run: | set -euo pipefail TAG="${DISPATCH_TAG:-$RELEASE_TAG}" case "$TAG" in v[0-9]*) ;; *) echo "::error::'$TAG' does not look like a release tag (vX.Y.Z)"; exit 1 ;; esac echo "tag=$TAG" >> "$GITHUB_OUTPUT" echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 81 - 101, Hoist the shared tag resolution and validation into a single upstream resolve-tag job dependent on release-please, exposing tag and version outputs while preserving the existing execution condition. In .github/workflows/release.yml lines 81-101, add the resolve-tag dependency and consume needs.resolve-tag.outputs.tag for checkout; apply the same dependency and consume needs.resolve-tag.outputs.tag/version in lines 174-188, removing both duplicated inline scripts.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 139-148: The image output configured in the “Build and push by
digest” step uses a mixed-case repository path. Update its GHCR image reference
to use the lowercased repository value via ${GITHUB_REPOSITORY,,} (or the
existing lowercase prep-step output), matching the manifest job’s target while
preserving the current digest and push options.
---
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 81-101: Hoist the shared tag resolution and validation into a
single upstream resolve-tag job dependent on release-please, exposing tag and
version outputs while preserving the existing execution condition. In
.github/workflows/release.yml lines 81-101, add the resolve-tag dependency and
consume needs.resolve-tag.outputs.tag for checkout; apply the same dependency
and consume needs.resolve-tag.outputs.tag/version in lines 174-188, removing
both duplicated inline scripts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e66652a9-7fce-4c5c-a39f-d12bd88a50bf
📒 Files selected for processing (1)
.github/workflows/release.yml
buildx's --output name= does no lowercasing (unlike metadata-action), so ghcr.io/Gitlawb/node is an invalid reference and the per-arch digest push would fail outright. Compute the lowercase image once in the resolve step and reuse it, matching the manifest job.
Contributor
Author
|
hey @coderabbitai please review and approve if its all good! |
Contributor
|
✅ Action performedReview finished.
|
This was referenced Jul 22, 2026
ci(release): unanchored tag validation glob lets a multiline dispatch input inject step outputs
#239
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v0.6.0 release run's multi-arch Docker build wedged for 3+ hours emulating the arm64 Rust release build under QEMU, and — because the workflow concurrency group is cancel-in-progress:false — every queued release run sat blocked behind it.
Summary by CodeRabbit