cd: publish stable images to azure container registry #145
Conversation
WalkthroughThe workflow configuration for publishing containers was updated to support both GitHub Container Registry (GHCR) and Azure Container Registry (ACR). This includes adding a login step for ACR and modifying the metadata extraction to handle both registries. No changes were made to exported or public code entities. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
Note 🔌 MCP (Model Context Protocol) integration is now available in Early Access!Pro users can now connect to remote MCP servers under the Integrations page to get reviews and chat conversations that understand additional development context. 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/publish.yml (1)
158-164: Prefer GITHUB_TOKEN over PAT for GHCR and update the action versionUse GitHub’s OIDC-scoped GITHUB_TOKEN instead of a PAT and modernize the login action. This reduces secret sprawl and aligns with least-privilege.
- - name: Log in to GHCR - uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9 - with: - registry: ghcr.io - username: ${{ secrets.GHCR_USER }} - password: ${{ secrets.PACKAGE_SCOPE }} + - name: Log in to GHCR + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }}Note: If you prefer pinning by commit for supply-chain hardening, replace
@v3with the corresponding commit SHA.
| - name: Log in to ACR | ||
| uses: azure/docker-login@v1 | ||
| with: | ||
| login-server: ${{ secrets.ACR_AZUREHOUND_REGISTRY_URL }} | ||
| username: ${{ secrets.ACR_CLIENT_ID }} | ||
| password: ${{ secrets.ACR_SECRET }} | ||
|
|
There was a problem hiding this comment.
💡 Verification agent
❓ Verification inconclusive
Pin azure/docker-login and validate login-server format
- Pin the action to a commit SHA to mitigate supply-chain risk.
- Ensure
${{ secrets.ACR_AZUREHOUND_REGISTRY_URL }}is host-only without scheme (e.g., myregistry.azurecr.io), as required by the action.
- - name: Log in to ACR
- uses: azure/docker-login@v1
+ - name: Log in to ACR
+ uses: azure/docker-login@<commit-sha>
with:
login-server: ${{ secrets.ACR_AZUREHOUND_REGISTRY_URL }}
username: ${{ secrets.ACR_CLIENT_ID }}
password: ${{ secrets.ACR_SECRET }}Optional: Consider migrating to federated credentials (OIDC) with azure/login@v2 + az acr login to drop the client secret entirely. Want a sample? I can provide one.
Pin azure/docker-login and validate ACR registry URL
- In
.github/workflows/publish.yml(lines 165–171):- Pin
azure/docker-loginto a specific commit SHA instead of a floating version. - Ensure
${{ secrets.ACR_AZUREHOUND_REGISTRY_URL }}contains only the hostname (e.g.myregistry.azurecr.io) with no URL scheme.
- Pin
Suggested diff:
- - name: Log in to ACR
- uses: azure/docker-login@v1
+ - name: Log in to ACR
+ uses: azure/docker-login@<commit-sha>
with:
login-server: ${{ secrets.ACR_AZUREHOUND_REGISTRY_URL }}
username: ${{ secrets.ACR_CLIENT_ID }}
password: ${{ secrets.ACR_SECRET }}Optional: To eliminate the client secret altogether, consider swapping to OIDC-based login using azure/login@v2 + az acr login. Let me know if you’d like a config example!
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Log in to ACR | |
| uses: azure/docker-login@v1 | |
| with: | |
| login-server: ${{ secrets.ACR_AZUREHOUND_REGISTRY_URL }} | |
| username: ${{ secrets.ACR_CLIENT_ID }} | |
| password: ${{ secrets.ACR_SECRET }} | |
| - name: Log in to ACR | |
| uses: azure/docker-login@<commit-sha> | |
| with: | |
| login-server: ${{ secrets.ACR_AZUREHOUND_REGISTRY_URL }} | |
| username: ${{ secrets.ACR_CLIENT_ID }} | |
| password: ${{ secrets.ACR_SECRET }} |
🤖 Prompt for AI Agents
In .github/workflows/publish.yml around lines 165 to 171, update the
azure/docker-login action to use a specific commit SHA instead of the floating
v1 version to ensure stability. Also, verify that the secret
ACR_AZUREHOUND_REGISTRY_URL contains only the registry hostname without any URL
scheme like https://. Optionally, consider replacing this login step with an
OIDC-based login using azure/login@v2 and az acr login to avoid using client
secrets.
ddlees
changed the title
2 participants
Summary by CodeRabbit