LCORE-569: Move rag-content images to quay.io#36
LCORE-569: Move rag-content images to quay.io#36matysek merged 1 commit intolightspeed-core:mainfrom
Conversation
WalkthroughRenamed CPU/GPU workflows, switched image registry/namespace to quay.io/lightspeed-core, and updated push credentials to use Quay-specific secrets in both build_and_push_dev.yaml and build_and_push_dev_gpu.yaml. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Developer
participant GH as GitHub Actions
participant Build as Docker Build
participant Quay as Quay.io Registry
Dev->>GH: Push to main
GH->>Build: Build image (CPU or GPU)
note over GH,Build: IMAGE_REGISTRY=quay.io<br/>IMAGE_NAMESPACE=lightspeed-core
GH->>Quay: Login using secrets (username/password)
Build-->>GH: Image artifact
GH->>Quay: Push image
Quay-->>GH: Push result (success/failure)
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (9)
.github/workflows/build_and_push_dev.yaml (5)
1-1: Workflow name clarity: good; consider aligning job id for consistency.The rename reflects CPU scope well. Optional: also rename the job id
build-and-push-devtobuild-and-push-dev-cputo make logs/artifacts unambiguous next to the GPU workflow.- build-and-push-dev: + build-and-push-dev-cpu:
12-13: Hardcoded Quay namespace; prefer repo/org variables for portability.Pinning
IMAGE_NAMESPACEtolightspeed-coreworks for this repo but breaks on forks and complicates org-wide changes. Recommend pulling the namespace from a repository/organization variable so forks can override and we avoid edits in code.- IMAGE_NAMESPACE: lightspeed-core + # Define QUAY_NAMESPACE at org/repo level (Settings → Variables → Actions) + IMAGE_NAMESPACE: ${{ vars.QUAY_NAMESPACE }}Follow-up: ensure a
vars.QUAY_NAMESPACEis defined; otherwise the workflow will fail to compose the registry path.
72-73: Switch to Quay robot credentials; also trim GitHub permissions to least privilege.Using Quay-specific secrets is correct. Two improvements:
- Use a Quay robot account (format: org+robot) for scoped, revocable access.
- Since we are no longer pushing to GHCR,
packages: writecan be dropped to minimize permissions.- # Required for image pushing to a registry - packages: write + # No GHCR push required; minimize permissions + # packages: writeAlso ensure
QUAY_REGISTRY_USERNAMEcontains the robot username (e.g.,lightspeed-core+github) andQUAY_REGISTRY_PASSWORDis the robot token with write perms toquay.io/lightspeed-core/*.
65-73: Guard push on default branch explicitly and add concurrency to avoid tag races.You already skip pushes on PRs. To avoid multiple concurrent runs overwriting
latestand to ensure onlymainpushes publish, consider adding a concurrency group and an extra branch guard.jobs: build-and-push-dev: runs-on: ubuntu-latest + concurrency: + group: rag-content-cpu-${{ github.ref_name }} + cancel-in-progress: true @@ - - name: Push image to Quay.io + - name: Push image to Quay.io uses: redhat-actions/push-to-registry@v2 - if: ${{ github.event_name != 'pull_request' }} + if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }} with: image: ${{ steps.build_image.outputs.image }} tags: ${{ steps.build_image.outputs.tags }} registry: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAMESPACE }} username: ${{ secrets.QUAY_REGISTRY_USERNAME }} password: ${{ secrets.QUAY_REGISTRY_PASSWORD }}
73-73: Fix YAML lint: add a trailing newline at EOF.YAMLlint flagged “no new line character at the end of file”. Add a newline after the last line to satisfy linters and avoid diffs on some editors.
- password: ${{ secrets.QUAY_REGISTRY_PASSWORD }} + password: ${{ secrets.QUAY_REGISTRY_PASSWORD }} +.github/workflows/build_and_push_dev_gpu.yaml (4)
1-1: Workflow name clarity: good; consider adding PR builds for early breakage detection.Unlike the CPU workflow, this one doesn’t run on
pull_request. Building (but not pushing) on PRs helps catch Containerfile regressions earlier.-on: - push: - branches: [ main ] +on: + push: + branches: [ main ] + pull_request: + branches: [ "main" ]The existing push step already has an
ifgate; it will not publish on PRs.
9-10: Hardcoded Quay namespace; make it configurable via repo/org variable.Same recommendation as the CPU workflow for portability and easier org-wide changes.
- IMAGE_NAMESPACE: lightspeed-core + IMAGE_NAMESPACE: ${{ vars.QUAY_NAMESPACE }}Ensure
vars.QUAY_NAMESPACEis set at repo or org level.
69-70: Use Quay robot credentials and consider dropping unnecessary GitHub permissions.Quay secrets usage is correct. Prefer a robot account token and remove
packages: writepermission since GHCR is no longer used here.permissions: contents: read - # Required for image pushing to a registry - packages: write + # No GHCR push; keep minimal permissions + # packages: writeAlso verify the robot account has write access to
quay.io/lightspeed-core/rag-content-gpu.
44-51: Multi-arch GPU images: verify base image availability for arm64.You’re building
amd64andarm64for the GPU image. Many CUDA/NVIDIA bases are amd64-only; if the base lacks arm64, the build for that arch will fail. If arm64 is required (e.g., Jetson), confirm the base tag supports it; otherwise restrict to amd64.- archs: amd64, arm64 + # If the GPU base supports only amd64, build a single-arch image to avoid failures. + archs: amd64If you want me to verify the Containerfile-gpu base tags across the repo, I can run a script to parse and report them.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/build_and_push_dev.yaml(3 hunks).github/workflows/build_and_push_dev_gpu.yaml(2 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/workflows/build_and_push_dev.yaml
[error] 73-73: no new line character at the end of file
(new-line-at-end-of-file)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: mypy
- GitHub Check: build-and-push-dev
- GitHub Check: Pylinter
2 participants
Description
LCORE-569: Move rag-content images to quay.io
Type of change
Related Tickets & Documents
Checklist before requesting a review
Testing
Summary by CodeRabbit