Skip to content
Open
Show file tree
Hide file tree
Changes from 7 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 21 additions & 26 deletions Dockerfiles/Dockerfile.agent-provisioning
Original file line number Diff line number Diff line change
@@ -1,57 +1,52 @@
# Stage 1: Build the application
FROM node:18-alpine as build
FROM oven/bun:1.1-alpine AS build
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
# Install OpenSSL
RUN apk update && apk upgrade
RUN apk add --no-cache openssl
RUN set -eux \
&& apk --no-cache add \
openssh-client \
aws-cli \
docker \
docker-compose \
jq \
&& npm install -g pnpm --ignore-scripts \
&& export PATH=$PATH:/usr/lib/node_modules/pnpm/bin \
&& rm -rf /var/cache/apk/*
RUN apk update && apk upgrade && apk add --no-cache \
openssl \
openssh-client \
aws-cli \
docker \
docker-compose \
jq
Comment on lines 4 to +12

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Remove redundant apk commands.

Lines 4-5 are redundant since lines 6-12 perform another apk update && apk upgrade and also install openssl. This creates unnecessary image layers and duplicates the openssl installation.

🔎 Apply this diff to consolidate:
 # Stage 1: Build the application
 FROM oven/bun:1.1-alpine AS build
-# Install OpenSSL
-RUN apk update && apk upgrade
-RUN apk add --no-cache openssl
+# Install required packages
 RUN apk update && apk upgrade && apk add --no-cache \
     openssl \
     openssh-client \
     aws-cli \
     docker \
     docker-compose \
     jq

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents
In Dockerfiles/Dockerfile.agent-provisioning around lines 4 to 12, the first two
RUN lines are redundant because the subsequent RUN repeats apk update && apk
upgrade and installs openssl again; remove the initial two RUN lines and
consolidate into the single RUN that performs apk update && apk upgrade && apk
add --no-cache with the full package list (openssl, openssh-client, aws-cli,
docker, docker-compose, jq) to eliminate duplicate layers and duplicate openssl
installation.


# Set the working directory
WORKDIR /app

# Copy package.json and package-lock.json
COPY package.json ./
COPY bun.lock ./
COPY pnpm-workspace.yaml ./

ENV PUPPETEER_SKIP_DOWNLOAD=true

# Install dependencies while ignoring scripts (including Puppeteer's installation)
RUN pnpm i --ignore-scripts
RUN bun i --ignore-scripts

# Copy the rest of the application code
COPY . .

# Generate Prisma client
# RUN cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate
RUN cd libs/prisma-service && npx prisma generate
RUN cd libs/prisma-service && bunx prisma generate

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Verify Node.js availability in the Dockerfile build environment.

Prisma works out of the box with Bun, and Node.js must be installed in the environment where you're running bunx prisma commands. While bunx prisma generate is the official approach, Docker builds with Bun have reported compatibility issues. Ensure your build image includes Node.js, or consider pre-generating the Prisma client locally and shipping it with the image. If using a Bun-only base image (e.g., oven/bun), Node.js installation may be necessary for bunx prisma generate to succeed.

🤖 Prompt for AI Agents
In Dockerfiles/Dockerfile.agent-provisioning around line 32, the RUN command
calls "bunx prisma generate" but the build image may not have Node.js available
(Bun-only bases can fail), so either ensure Node.js is installed in the image
before this step (install Node runtime + npm/node binaries or use a base image
that includes Node), or avoid running prisma generation in the container by
pre-generating the Prisma client locally and copying the generated client into
the image (or switch the build stage to a Node-based stage to run prisma
generate). Make the change by adding a step to install Node.js (or changing the
base stage) before RUN cd libs/prisma-service && bunx prisma generate, or remove
that RUN and COPY the pre-generated client into the image.

RUN ls -R /app/apps/agent-provisioning/AFJ/

# Build the user service
RUN pnpm run build agent-provisioning
RUN bun --bun run build agent-provisioning

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check packageManager configuration
echo "=== Package Manager Configuration ==="
head -20 package.json | grep -A2 '"packageManager"'
echo ""

# Check build-related scripts in package.json
echo "=== Build Scripts ==="
grep -A30 '"scripts"' package.json | grep -i build
echo ""

# Look for Dockerfile and related build context
echo "=== Checking Dockerfile structure ==="
head -50 Dockerfiles/Dockerfile.agent-provisioning
echo ""

# Search for agent-provisioning build configuration
echo "=== Looking for agent-provisioning build config ==="
find . -path ./node_modules -prune -o -name "tsconfig.json" -o -name "nx.json" -o -name "project.json" 2>/dev/null | head -20
echo ""

# Check if there are any build or monorepo configuration files
ls -la | grep -E 'nx\.json|turbo\.json|lerna\.json|pnpm-workspace|workspace' 2>/dev/null
echo ""

# Search for Node-specific APIs in agent-provisioning
echo "=== Searching for Node.js-specific patterns ==="
rg 'process\.(binding|_rawDebug|_tickCallback|env|argv|versions\[|_eval)|require\.extensions|module\._compile|Buffer\.|stream\.|crypto\.|fs\.|path\.|url\.' apps/agent-provisioning --type ts --type js -c 2>/dev/null | head -20

Repository: credebl/platform

Length of output: 1948


🏁 Script executed:

#!/bin/bash
# Get more details about the Node-specific API usage
echo "=== Checking actual imports in agent-provisioning ==="
head -20 apps/agent-provisioning/src/agent-provisioning.service.ts
head -20 apps/agent-provisioning/src/main.ts
head -20 apps/agent-provisioning/src/agent-provisioning.module.ts
echo ""

# Check the actual build script definition
echo "=== Complete package.json scripts section ==="
sed -n '/"scripts"/,/^[[:space:]]*}/p' package.json | grep -E '(build|test)' | head -30
echo ""

# Check if there's a nest config or build config for agent-provisioning
echo "=== NestJS configuration files ==="
find apps/agent-provisioning -maxdepth 2 -name "*.json" -o -name "*.config.*" 2>/dev/null | head -20
echo ""

# Check package.json for agent-provisioning workspace
echo "=== Package.json structure ==="
grep -n '"name"' package.json | head -5
echo ""

# Check if there's a workspace for agent-provisioning
cat pnpm-workspace.yaml

Repository: credebl/platform

Length of output: 4147


🏁 Script executed:

#!/bin/bash
# Check if there's a specific build script for agent-provisioning in its own package.json
echo "=== Checking agent-provisioning package.json if exists ==="
if [ -f "apps/agent-provisioning/package.json" ]; then
  cat apps/agent-provisioning/package.json | grep -A50 '"scripts"' | head -60
else
  echo "No separate package.json in agent-provisioning"
fi
echo ""

# Check the complete tsconfig for agent-provisioning
echo "=== agent-provisioning tsconfig ==="
cat apps/agent-provisioning/tsconfig.app.json
echo ""

# Verify what "build agent-provisioning" command refers to in root package.json
echo "=== Root package.json complete content (around build scripts) ==="
sed -n '1,100p' package.json | grep -A2 '"build"'
echo ""

# Check if there are any Bun-specific configurations
echo "=== Checking for bunfig.toml or bun config ==="
ls -la bunfig.toml bun.config.* 2>/dev/null || echo "No bun config files found"
echo ""

# Check if the Dockerfile.agent-provisioning is the only one or if there's a pattern
echo "=== Checking all Dockerfiles ==="
ls -la Dockerfiles/

Repository: credebl/platform

Length of output: 2038


🏁 Script executed:

#!/bin/bash
# Check if "build agent-provisioning" is a NestJS CLI command or if it's supposed to be "nest build agent-provisioning"
echo "=== Checking NestJS nest-cli.json for project config ==="
if [ -f "nest-cli.json" ]; then
  cat nest-cli.json
else
  echo "No nest-cli.json found"
fi
echo ""

# Check all Dockerfiles to see how other services handle build
echo "=== Comparing build commands across Dockerfiles ==="
grep -h "RUN.*run build\|RUN.*run nest build" Dockerfiles/* 2>/dev/null || echo "No matching build commands found in other Dockerfiles"
echo ""

# Check if there's a workspace or projects configuration
echo "=== Checking tsconfig root ==="
cat tsconfig.json | head -50
echo ""

# Verify the exact bun command syntax - does "bun --bun run build agent-provisioning" work?
echo "=== Checking Bun documentation reference in comments ==="
head -100 Dockerfiles/Dockerfile.agent-provisioning | grep -i "bun\|run\|build"

Repository: credebl/platform

Length of output: 11697


Remove --bun flag from build command to ensure Node.js API compatibility.

The --bun flag forces Bun's native runtime, bypassing Node.js compatibility. The agent-provisioning service uses Node.js-specific APIs (fs, child_process, process.env) and should use Bun's compatibility mode instead. Additionally, this is the only service in the repository using --bun—all others use pnpm run build (the primary package manager per the team's configuration). Change to RUN bun run build agent-provisioning to maintain consistency and compatibility.

🤖 Prompt for AI Agents
In Dockerfiles/Dockerfile.agent-provisioning around line 36, the build uses "RUN
bun --bun run build agent-provisioning" which forces Bun's native runtime and
breaks Node.js API compatibility; replace the command with "RUN bun run build
agent-provisioning" (or align with other services using "pnpm run build
agent-provisioning" if preferred) so the build runs in Bun's Node-compatibility
mode and matches repository conventions.


# Stage 2: Create the final image
FROM node:18-alpine as prod
FROM oven/bun:1.1-alpine AS prod
# Install OpenSSL
RUN apk update && apk upgrade
RUN apk add --no-cache openssl
RUN set -eux \
&& apk --no-cache add \
openssh-client \
aws-cli \
docker \
docker-compose \
jq \
&& npm install -g pnpm --ignore-scripts \
&& export PATH=$PATH:/usr/lib/node_modules/pnpm/bin \
&& rm -rf /var/cache/apk/*
RUN apk update && apk upgrade && apk add --no-cache \
openssl \
openssh-client \
aws-cli \
docker \
docker-compose \
jq
Comment on lines 41 to +49

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion | 🟠 Major

Remove redundant apk commands in prod stage.

Same issue as the build stage: lines 41-42 are redundant since lines 43-49 perform another apk update && apk upgrade and also install openssl.

🔎 Apply this diff to consolidate:
 # Stage 2: Create the final image
 FROM oven/bun:1.1-alpine AS prod
-# Install OpenSSL
-RUN apk update && apk upgrade
-RUN apk add --no-cache openssl
+# Install required packages
 RUN apk update && apk upgrade && apk add --no-cache \
     openssl \
     openssh-client \
     aws-cli \
     docker \
     docker-compose \
     jq

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents
In Dockerfiles/Dockerfile.agent-provisioning around lines 41 to 49, the
Dockerfile runs redundant APK commands: lines 41-42 perform "apk update && apk
upgrade" and install openssl, but lines 43-49 repeat "apk update && apk upgrade"
and reinstall openssl along with other packages. Remove the duplicate RUN lines
(41-42) and keep a single consolidated RUN that performs update/upgrade and
installs the full set of packages (openssl, openssh-client, aws-cli, docker,
docker-compose, jq) to avoid extra layers and duplication.


WORKDIR /app

Expand Down Expand Up @@ -80,4 +75,4 @@ RUN chmod 777 /app/agent-provisioning/AFJ/token
COPY libs/ ./libs/

# Set the command to run the microservice
CMD ["sh", "-c", "cd libs/prisma-service && npx prisma migrate deploy && npx prisma generate && cd ../.. && node dist/apps/agent-provisioning/main.js"]
CMD ["sh", "-c", "cd libs/prisma-service && bunx prisma migrate deploy && bunx prisma generate && cd ../.. && bun --bun dist/apps/agent-provisioning/main.js"]

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Consider running migrations separately and verify --bun flag necessity.

Two concerns with the startup command:

  1. Running migrations at container startup risks: Multiple replicas starting simultaneously can cause migration race conditions. Container startup failures occur if migrations fail. Consider running migrations in a separate init container or CI/CD step.

  2. The --bun flag bypasses Node.js compatibility: This may cause runtime issues if the application or its dependencies use Node.js-specific APIs. Test without the flag first unless you've confirmed all dependencies are Bun-compatible.

🔎 Consider this safer approach:
-CMD ["sh", "-c", "cd libs/prisma-service && bunx prisma migrate deploy && bunx prisma generate && cd ../.. && bun --bun dist/apps/agent-provisioning/main.js"]
+# Run migrations separately (e.g., in CI/CD or init container)
+# Generate Prisma client at build time (already done in build stage)
+CMD ["bun", "dist/apps/agent-provisioning/main.js"]

If you must run migrations at startup, add error handling:

-CMD ["sh", "-c", "cd libs/prisma-service && bunx prisma migrate deploy && bunx prisma generate && cd ../.. && bun --bun dist/apps/agent-provisioning/main.js"]
+CMD ["sh", "-c", "set -e && cd libs/prisma-service && bunx prisma migrate deploy && bunx prisma generate && cd ../.. && bun dist/apps/agent-provisioning/main.js"]

Based on learnings, the team wants to support both pnpm and Bun. Verify that the complete removal of pnpm from this Dockerfile aligns with that goal, or if this service specifically requires Bun-only deployment.

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents
In Dockerfiles/Dockerfile.agent-provisioning around line 78, the CMD runs
migrations at container startup and forces Bun via the --bun flag; move DB
migrations out of the main container start sequence (run them in an init
container, pre-deploy job, or CI/CD step) to avoid migration races and startup
failures, and make the runtime command use the appropriate runner based on an
environment variable or build-time ARG (supporting pnpm/node or bun) — remove
hardcoded --bun unless you’ve verified full Bun compatibility, and add a short
fallback path or env check that selects pnpm/node when required.

Loading