[ci] Use OCIR for non-release PRs - #1226
Conversation
WalkthroughThe changes update the Docker registry configuration for CI workflows and Makefile scripts. The workflow now authenticates with Oracle Cloud Infrastructure Registry (OCIR) using new secrets, and a registry environment variable is added. In the Makefile, the registry variable assignment is made conditional, allowing for overrides. Changes
Estimated code review effort2 (10–30 minutes) Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Summary of Changes
Hello Timofei Larkin (@lllamnyp), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request primarily focuses on enhancing the CI/CD pipeline's robustness and flexibility by transitioning the default container image registry for non-release builds from GHCR to OCIR. This strategic move aims to alleviate common pain points such as restrictive GitHub token policies for fork-based contributions and to enable more adaptable image retention strategies. Furthermore, the changes introduce a mechanism to dynamically specify the target registry during the build process, improving overall build system configurability.
Highlights
- Container Registry Migration: The default container registry for non-release pull requests has been shifted from GitHub Container Registry (GHCR) to Oracle Cloud Infrastructure Registry (OCIR). This change is intended to provide more flexible image retention policies and remove restrictions related to GitHub tokens when contributors submit PRs from forks.
- Build System Flexibility: The
REGISTRYvariable in thescripts/common-envs.mkMakefile has been updated to use the?=operator. This allows the default registry to be overridden externally, providing greater flexibility for CI/CD processes and local development environments.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | Gemini (@gemini-code-assist) | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request switches the container registry to OCIR for non-release PR builds. The change to scripts/common-envs.mk correctly implements this. However, the PR also includes a change to packages/core/installer/values.yaml which updates the default installer image to one from OCIR. This change should be reverted, as the default configuration should point to a stable release image from GHCR.
| @@ -1,2 +1,2 @@ | |||
| cozystack: | |||
| image: ghcr.io/cozystack/cozystack/installer:v0.34.0-beta.2@sha256:92639050dc388167c0a7047edc3288423963ecb36954e5cd1f472841bf380713 | |||
| image: iad.ocir.io/idyksih5sir9/cozystack/installer:v0.34.0-beta.2@sha256:76f2c535d0222760805163b5e29410e0a17a3ccb5bce0c57a04a42e53af4987c | |||
There was a problem hiding this comment.
The change to values.yaml updates the default installer image to one from OCIR. This should be reverted because the default configuration in the repository should point to a stable, long-lived release image from GHCR, not a potentially temporary image from a PR build on OCIR, which could be subject to garbage collection.
image: ghcr.io/cozystack/cozystack/installer:v0.34.0-beta.2@sha256:92639050dc388167c0a7047edc3288423963ecb36954e5cd1f472841bf380713
Changing the container registry from GHCR to OCIR will help with more flexibe image retention policies and removes the restrictions on the GitHub token when contributors submit PRs from forks. Release PRs remain on GHCR, as before. Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>
e1fb5a6 to
6576624
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/pull-requests.yaml (1)
35-42: Consider updating the step name to reflect OCIR usage.The step name "Login to GitHub Container Registry" is misleading since it now authenticates with Oracle Cloud Infrastructure Registry.
- - name: Login to GitHub Container Registry + - name: Login to Container RegistryOr for more specificity:
- - name: Login to GitHub Container Registry + - name: Login to Oracle Cloud Infrastructure Registry
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/pull-requests.yaml(2 hunks)scripts/common-envs.mk(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
scripts/common-envs.mk (3)
Learnt from: NickVolynkin
PR: #1196
File: packages/apps/http-cache/Makefile:24-27
Timestamp: 2025-07-14T16:23:12.803Z
Learning: In the cozystack repository, the readme-generator tool removes enum contents from values.schema.json files during its operation. Therefore, when using readme-generator in Makefiles, any enum values need to be injected back into the schema using yq commands after readme-generator has run, not before.
Learnt from: NickVolynkin
PR: #1117
File: packages/apps/mysql/Makefile:8-8
Timestamp: 2025-06-26T04:29:24.830Z
Learning: The cozystack project uses yq v4+ on their CI runner, so yq v4 syntax (-o json --indent 4) is compatible and version checks are not needed.
Learnt from: NickVolynkin
PR: #1120
File: packages/apps/ferretdb/README.md:35-37
Timestamp: 2025-07-02T09:58:11.406Z
Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
🔇 Additional comments (3)
scripts/common-envs.mk (1)
1-1: LGTM: Conditional registry assignment enables flexible registry switching.The change from unconditional (
:=) to conditional (?=) assignment correctly allows the GitHub workflow to override the registry value while maintaining GHCR as the default fallback. This implementation aligns perfectly with the PR objective to switch between registries based on the build context..github/workflows/pull-requests.yaml (2)
3-4: LGTM: Environment variable correctly enables registry override.The addition of the
REGISTRYenvironment variable set to${{ secrets.OCIR_REPO }}properly integrates with the conditional assignment inscripts/common-envs.mk. This allows the workflow to override the default GHCR registry with OCIR for non-release PRs.
38-40: Verify OCIR credentials and registry configurationPlease double-check the following after switching from GitHub’s default registry to OCIR:
- Ensure
${{ secrets.OCIR_USER }}and${{ secrets.OCIR_TOKEN }}are defined under Settings → Secrets in this repository.- The
iad.ocir.ioendpoint must match your OCI region (e.g.iad.ocir.iofor US-East,phx.ocir.iofor Phoenix, etc.).- If you intend to push into a specific OCIR namespace (tenancy/compartment), you’ll need an
OCIR_REPOsecret and to inject it as yourREGISTRYor in thewith:block ofbuild-push-action. RemoveOCIR_REPOif it’s not used.- Verify that the
docker/login-actionstep and the subsequentdocker/build-push-actioncan successfully authenticate against OCIR and push your images.Example snippet to wire up a custom namespace:
- name: Log in to OCIR uses: docker/login-action@v2 with: registry: iad.ocir.io username: ${{ secrets.OCIR_USER }} password: ${{ secrets.OCIR_TOKEN }} - name: Build and push uses: docker/build-push-action@v3 env: REGISTRY: ${{ secrets.OCIR_REPO }} # e.g. iad.ocir.io/tenancy/compartment with: context: . push: true tags: ${{ env.REGISTRY }}/my-image:${{ github.sha }}
Changing the container registry from GHCR to OCIR will help with more flexibe image retention policies and removes the restrictions on the GitHub token when contributors submit PRs from forks. Release PRs remain on GHCR, as before.
What this PR does
Release note
Summary by CodeRabbit