feat: update images, their release, and optimized the builds for effi… - #119
Merged
Conversation
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
Owner
Author
|
✍️ All contributors have signed the CLA |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Contributor
📝 WalkthroughWalkthroughThe PR replaces a Bun/TypeScript-based release orchestration system (including Estimated code review effort🎯 5 (Critical) | ⏱️ ~120 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 27
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
docs/IMAGE_VARIANTS.md (2)
89-97: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winUpdate ESLint references to oxlint/oxfmt to match README.md.
This file still mentions "ESLint pre-installed" and "ESLint (global)" but README.md (in this same PR) updated to
oxlint/oxfmt. The PR objective is to "match the new image/tool naming and formatting" across all docs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/IMAGE_VARIANTS.md` around lines 89 - 97, Update the runtime/tools wording in IMAGE_VARIANTS documentation to match the new oxlint/oxfmt naming used elsewhere. Replace the outdated ESLint references in the image summary and Included Tools section with the corresponding oxlint/oxfmt terms, keeping the rest of the runtime/tool list unchanged.
239-240: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winUpdate "No ESLint" to "No oxlint/oxfmt" to match README.md.
ubuntu-tools description says "No Bun, Node.js, npm, or ESLint preinstalled" but README.md (updated in this PR) says "No Bun, Node.js, npm, or oxlint/oxfmt". Align with the new tool naming.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/IMAGE_VARIANTS.md` around lines 239 - 240, Update the ubuntu-tools description in IMAGE_VARIANTS to match the new wording used in README.md by replacing the “No ESLint” reference with “No oxlint/oxfmt”. Keep the rest of the capability list unchanged and verify the updated text stays consistent wherever this environment description is referenced.AGENTS.md (1)
14-20: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winUpdate tooling references to match new stack.
The Tooling section still describes the old TypeScript/Prettier/ESLint stack (
bun run check,bun run f, ESLint). Per the PR changes, this should referenceoxlint/oxfmtand updated package scripts. Thebun.lockreference is also stale since the PR removes Bun-based release tooling.Cross-reference:
package.jsonin the "Remove TypeScript tooling and hooks" layer was updated to useoxfmtandoxlint.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@AGENTS.md` around lines 14 - 20, The Tooling section in AGENTS.md still refers to the old Bun/TypeScript workflow, so update it to match the new stack used by package.json. Replace the references to bun install, bun run check, and bun run f with the current install and verification/format commands backed by oxlint and oxfmt, and remove or revise the bun.lock mention since Bun-based tooling is being removed. Use the updated script names from the package.json changes to keep the instructions accurate.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/notes/action.yml:
- Around line 21-24: The Docker Hub links generated by the notes action are
using github.repository_owner, which can differ from the namespace actually used
to publish images. Update the notes action inputs/env handling in the action.yml
workflow so it receives the registry namespace from the releases workflow (the
same value used for GL_USERNAME) and use that value in the release notes link
construction instead of github.repository_owner, including the link-building
logic around the affected step and the Docker Hub URL template.
- Line 13: The composite action still uses tag-based third-party action
references, so update the affected steps in the action definition to use full
commit SHAs instead of version tags. Specifically, replace the usages for
actions/download-artifact, stefanzweifel/git-auto-commit-action, and
softprops/action-gh-release with their pinned commit hashes in the
workflow/action YAML so the release path is immutable.
In @.github/workflows/releases.yml:
- Around line 159-169: The metadata extraction in the release workflow is
reading from the mutable latest tag, which can produce artifacts for the wrong
image if another run updates it first. Update the skopeo inspect calls in the
“Extract Size & Tool Versions via Skopeo” step to use the immutable release tag
from needs.prepare.outputs.new_tag instead of latest, and make the same change
in the corresponding release-notes metadata step so the size and versions files
always match the published release.
- Around line 283-301: The dockerhub-sync job is uploading a stale README
because it checks out the workflow commit instead of using the README updated by
finalize. Update the dockerhub-sync steps so it consumes the README produced by
finalize, either by checking out the committed branch head after finalize or by
passing the rendered README forward as an artifact and pointing
peter-evans/dockerhub-description at that file. Use the job names finalize and
dockerhub-sync plus the dockerhub-description step to locate the change.
- Around line 48-55: The Set Final Tag step is interpolating
github.event.inputs.tag_override directly into the shell script, which exposes
the workflow to shell injection. Update the releases workflow step so the tag
override is passed via env in the tag job/step, then reference that environment
variable inside the script and validate it against the expected tag format
before writing to $GITHUB_OUTPUT. Keep the existing step behavior for
steps.auto_tag.outputs.new_tag as the fallback, but ensure the logic in Set
Final Tag no longer expands the manual-dispatch input inline.
- Around line 38-43: The release workflow uses third-party actions with mutable
version tags, so update the uses entries for actions/checkout and
mathieudutour/github-tag-action to immutable commit SHAs instead of release
tags. Keep the existing workflow steps and logic in releases.yml intact, but
replace the tag-based references in the checkout and Auto-bump Tag steps with
pinned SHAs so the release job always runs trusted, fixed action code.
In @.github/workflows/sync.yml:
- Line 12: The cron string in the workflow YAML uses single quotes instead of
the required double-quote style. Update the schedule entry in the workflow so
the cron expression is double-quoted, matching the repository’s YAML formatting
rule for .github/workflows/sync.yml and related YAML files.
In @.husky/pre-commit:
- Around line 4-5: The pre-commit hook is only documenting the identity guard
instead of actually enforcing it, so update the .husky/pre-commit script to
execute ./.husky/_/identity-guard.sh rather than leaving it as a comment. Make
sure the hook continues through the intended pre-commit flow and that the
identity-guard step is invoked by name from the script so it cannot be bypassed.
In @.oxfmtrc.json:
- Around line 9-19: Add per-file width overrides in .oxfmtrc.json so the global
printWidth stays 80 while Markdown and JSON/YAML use the repo-specific widths.
Update the config by adding an overrides section for the markdown pattern and
the json/yml/yaml pattern, and keep the existing formatter settings like
singleQuote and trailingComma unchanged.
In @.vscode/tasks.json:
- Around line 5-7: The Build DevContainer task uses docker buildx build in a way
that may not leave a locally available workspace:latest image, so update the
tasks.json entry for the Build DevContainer command to include an explicit
Buildx output option. Adjust the command so the build result is exported to the
local Docker image store while keeping the existing image name and Dockerfile
path, ensuring the task reliably makes workspace:latest available after
completion.
In `@CHANGELOG.md`:
- Line 516: Correct the typo in the changelog entry for commit 10bc7cd by
changing “Uprade” to “Upgrade” in the commit message text; update the relevant
changelog line in CHANGELOG.md so it matches the existing spelling used
elsewhere.
- Line 260: Fix the typo in the copied commit message text by changing “Uprade”
to “Upgrade” in the CHANGELOG entry for the 10bc7cd version section, and also
correct the same misspelling in the other CHANGELOG occurrence referenced by the
review; use the surrounding version-entry text to locate the duplicated commit
message.
In `@images/bun-node/Dockerfile`:
- Around line 21-28: The Dockerfile now switches to USER ${USERNAME} without
ensuring that the non-root account exists or retains passwordless sudo handling.
Update the image setup around USERNAME and USER root so the requested user is
created before the final USER switch, and preserve the existing sudo-related
behavior for non-root builds. Use the USERNAME variable and the root setup block
in this Dockerfile as the place to restore the missing user-creation/bootstrap
steps.
- Around line 18-26: The Dockerfile currently installs Node via apk add nodejs
npm, which can diverge from the NODE_VERSION used by devcontainer.tool.node and
the version written to /usr/local/share/tool-versions.txt. Update the Node
install step in the Dockerfile to use the same version source as NODE_VERSION,
either by pinning the package/source to that version or switching to a versioned
Node distribution, and keep the devcontainer metadata and installed binary
aligned.
In `@images/bun/devcontainer.json`:
- Around line 27-33: The devcontainer extensions list still installs the retired
ESLint and Prettier editor stack, so remove the entries for
dbaeumer.vscode-eslint and esbenp.prettier-vscode from the extensions array in
the devcontainer configuration, leaving the remaining editor tooling intact and
aligned with oxlint/oxfmt.
In `@images/bun/Dockerfile`:
- Around line 20-25: The Dockerfile for the Bun image is missing the required
in-image version manifest, so restore writing /usr/local/share/tool-versions.txt
during the build. Update the install step around the apk add and bun install -g
block to create that file with the image/tool versions, keeping it consistent
with the existing pinned tool setup and any labels already emitted.
In `@images/ubuntu-bun-node/Dockerfile`:
- Around line 33-48: The Dockerfile’s tool installation block updates the
shipped tools but never restores the required /usr/local/share/tool-versions.txt
manifest. Update the existing Node.js/formatters install section in the
ubuntu-bun-node Dockerfile so it also writes the image’s tool version manifest
during build, and keep the extracted version list in sync with the tools
installed there (using the same NODE_VERSION, BUN_VERSION, OXLINT_VERSION, and
OXFMT_VERSION symbols).
- Around line 33-40: The Node.js/Bun install step in the Dockerfile currently
installs global tools as root, which leaves oxlint and oxfmt unavailable after
switching to USER ${USERNAME}; update the install flow so bun globals are
installed into a shared location or the final user’s PATH/BUN_INSTALL is
configured to include the install bin directory. Also extend the same build step
that handles ARCH and bun install so it emits the tool manifest at
/usr/local/share/tool-versions.txt during the image build.
In `@images/ubuntu-bun/Dockerfile`:
- Around line 28-39: The Dockerfile currently only adds image labels after
installing Bun, oxlint, and oxfmt, but it never writes the required
/usr/local/share/tool-versions.txt during the build. Update the ubuntu-bun
Dockerfile build steps near the bun install and LABEL section to generate that
tool-version file with the installed tool versions so it is available in the
final image; use the existing version symbols BUN_VERSION, OXLINT_VERSION, and
OXFMT_VERSION to keep the file in sync.
- Line 20: The OXFMT_VERSION pin in the ubuntu-bun image is out of sync with the
Bun image. Update the ARG OXFMT_VERSION value in the ubuntu-bun Dockerfile to
match the version used by the bun Dockerfile so both images install the same
formatter release and stay consistent.
- Around line 5-6: The Bun source stage is using the Alpine image, which
produces a musl-linked binary that can break the Ubuntu/glibc install flow.
Update the Dockerfile’s bun_source stage to use a glibc-compatible Bun image
(for example the non-Alpine oven/bun image) or install Bun directly in the
Ubuntu base, and keep the rest of the multi-stage copy/install logic aligned
with that source.
In `@images/ubuntu-tools/Dockerfile`:
- Around line 21-27: Restore the missing tool-version artifact in the
ubuntu-tools Dockerfile: the RUN step that installs `agy` should also write
/usr/local/share/tool-versions.txt during the build. Update the tool-version
extraction logic in this Dockerfile so it stays accurate for the installed
tools, including the newly added `agy`, and ensure the artifact is created
alongside the existing install steps.
- Around line 14-18: The USERNAME handling in the Dockerfile setup block is
unsafe and drops passwordless sudo for pre-existing non-root users. Update the
RUN logic around the username check to keep sudo/group/sudoers setup for any
non-root USERNAME, not only when the user is newly created, and quote all
${USERNAME} expansions in the useradd/usermod/id commands. Also ensure the
sudoers entry is written only after validating USERNAME so the existing non-root
user path preserves the passwordless sudo behavior.
In `@package.json`:
- Line 6: The bs package script is executing a mutable remote bootstrap script
directly, which is unsafe. Update the package.json bs entry to avoid piping or
running code from a branch URL; instead vendor the bootstrap logic locally, or
pin the fetch in the bootstrap command to an immutable commit and add checksum
or signature verification before execution. Use the bs script name as the
location to replace the current curl-and-run workflow.
- Line 3: The prepare script still invokes husky even though it is no longer
present in devDependencies, so fix the hook bootstrap by either restoring husky
as a dev dependency or removing/changing the prepare command in package.json.
Update the package.json prepare entry and the related husky setup path so fresh
installs either initialize hooks correctly or no longer expect husky at all.
In `@README.md`:
- Around line 132-133: The README entry for oxfmt contains a typo in the
description. Update the text in the markdown list item for oxfmt so “prettier
alterntive” becomes “prettier alternative”, keeping the rest of the oxlint/oxfmt
wording unchanged.
- Around line 132-154: Synchronize the documentation terms across README.md and
IMAGE_VARIANTS.md: the tool references in IMAGE_VARIANTS.md still use ESLint
while README.md now uses oxlint/oxfmt, and the ubuntu-tools exclusion text
should match that naming in both places. Also reconcile the ubuntu-bun-node
Node.js version so both docs show the same value, updating the IMAGE_VARIANTS.md
sections and any related variant descriptions to keep the image/tool names and
formatting consistent.
---
Outside diff comments:
In `@AGENTS.md`:
- Around line 14-20: The Tooling section in AGENTS.md still refers to the old
Bun/TypeScript workflow, so update it to match the new stack used by
package.json. Replace the references to bun install, bun run check, and bun run
f with the current install and verification/format commands backed by oxlint and
oxfmt, and remove or revise the bun.lock mention since Bun-based tooling is
being removed. Use the updated script names from the package.json changes to
keep the instructions accurate.
In `@docs/IMAGE_VARIANTS.md`:
- Around line 89-97: Update the runtime/tools wording in IMAGE_VARIANTS
documentation to match the new oxlint/oxfmt naming used elsewhere. Replace the
outdated ESLint references in the image summary and Included Tools section with
the corresponding oxlint/oxfmt terms, keeping the rest of the runtime/tool list
unchanged.
- Around line 239-240: Update the ubuntu-tools description in IMAGE_VARIANTS to
match the new wording used in README.md by replacing the “No ESLint” reference
with “No oxlint/oxfmt”. Keep the rest of the capability list unchanged and
verify the updated text stays consistent wherever this environment description
is referenced.
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: e58342a1-9ba0-4ad7-9a3f-e4901896e8c9
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (63)
.devcontainer/devcontainer.json.dockerignore.github/actions/cleanup-images/action.yml.github/actions/git-operations/action.yml.github/actions/notes/action.yml.github/actions/update-docs/action.yml.github/renovate.json.github/workflows/cla.yml.github/workflows/releases.yml.github/workflows/sync.yml.gitignore.husky/pre-commit.oxfmtrc.json.prettierignore.prettierrc.vscode/tasks.jsonAGENTS.mdCHANGELOG.mdREADME.mdcontainer-versions.jsondocs/BUILD_COMMANDS.mddocs/IMAGE_VARIANTS.mddocs/SETUP.mdeslint.config.jsimages/bun-node/Dockerfileimages/bun-node/devcontainer.jsonimages/bun/Dockerfileimages/bun/devcontainer.jsonimages/ubuntu-bun-node/Dockerfileimages/ubuntu-bun/Dockerfileimages/ubuntu-tools/Dockerfilepackage.jsonplans/add-btop-plan.mdplans/eslint-setup-plan.mdrenovate.jsonscripts/author.shscripts/changeDetector.tsscripts/changelogManager.tsscripts/cleanup-untagged-images.shscripts/dvcntnr.shscripts/hooks/atlas-hook.ps1scripts/hooks/comment-checker.ps1scripts/hooks/comment-checker.shscripts/hooks/pre-compact.ps1scripts/hooks/pre-compact.shscripts/hooks/prompt-submit.ps1scripts/hooks/prompt-submit.shscripts/hooks/session-start.ps1scripts/hooks/session-start.shscripts/hooks/session-stop.ps1scripts/hooks/session-stop.shscripts/hooks/subagent-start.ps1scripts/hooks/subagent-start.shscripts/hooks/write-guard.ps1scripts/hooks/write-guard.shscripts/imageOperations.tsscripts/issueManager.tsscripts/registryClient.tsscripts/releaseOrchestrator.tsscripts/toolVersionExtractor.tsscripts/types.tsscripts/versionManager.tstsconfig.json
💤 Files with no reviewable changes (40)
- .prettierignore
- plans/eslint-setup-plan.md
- scripts/hooks/prompt-submit.ps1
- scripts/dvcntnr.sh
- scripts/toolVersionExtractor.ts
- container-versions.json
- scripts/hooks/comment-checker.sh
- .dockerignore
- scripts/hooks/prompt-submit.sh
- scripts/hooks/write-guard.sh
- scripts/hooks/session-start.ps1
- scripts/hooks/subagent-start.sh
- .github/actions/cleanup-images/action.yml
- eslint.config.js
- plans/add-btop-plan.md
- scripts/issueManager.ts
- scripts/changelogManager.ts
- scripts/hooks/session-start.sh
- scripts/hooks/pre-compact.sh
- scripts/registryClient.ts
- .github/actions/git-operations/action.yml
- scripts/types.ts
- scripts/hooks/pre-compact.ps1
- renovate.json
- scripts/imageOperations.ts
- scripts/hooks/session-stop.ps1
- scripts/hooks/comment-checker.ps1
- scripts/changeDetector.ts
- scripts/hooks/atlas-hook.ps1
- scripts/cleanup-untagged-images.sh
- tsconfig.json
- scripts/versionManager.ts
- scripts/hooks/session-stop.sh
- .prettierrc
- scripts/hooks/subagent-start.ps1
- scripts/hooks/write-guard.ps1
- .github/actions/update-docs/action.yml
- scripts/releaseOrchestrator.ts
- scripts/author.sh
- .gitignore
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
22 issues found across 64 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/actions/notes/action.yml">
<violation number="1" location=".github/actions/notes/action.yml:43">
P2: Release notes build Docker Hub URLs from `github.repository_owner`, but images are actually published under `GL_USERNAME` (`vikshan`), so generated links are incorrect.</violation>
<violation number="2" location=".github/actions/notes/action.yml:46">
P1: sed pattern `\| \*\*$IMG_NAME\*\* \|` expects exactly one space before the pipe, but the README table uses multiple spaces for alignment (e.g., `| **bun** |`). The replacement will silently fail — no lines will match, so sizes won't be updated.</violation>
</file>
<file name="images/ubuntu-bun-node/Dockerfile">
<violation number="1" location="images/ubuntu-bun-node/Dockerfile:35">
P2: `TARGETARCH` handling is too broad: any non-`amd64` architecture is forced to `arm64`, causing wrong Node binary selection for other target platforms.</violation>
<violation number="2" location="images/ubuntu-bun-node/Dockerfile:36">
P1: The Node tarball is streamed directly into `tar` without checksum verification, introducing a supply-chain integrity risk.</violation>
</file>
<file name=".github/workflows/releases.yml">
<violation number="1" location=".github/workflows/releases.yml:40">
P2: Tag is created before image builds — if build-bases or build-derivatives fail, an orphan tag exists on the repo with no corresponding published images.</violation>
<violation number="2" location=".github/workflows/releases.yml:164">
P2: Race condition: `skopeo inspect` reads `:latest` immediately after push — registry eventual consistency may serve the old image, yielding stale metadata.</violation>
<violation number="3" location=".github/workflows/releases.yml:165">
P2: Skopeo/jq size output will contain JSON-escaped quotes (e.g., `"123 MB"`) instead of plain text because `tostring` followed by string concatenation produces a JSON string value.</violation>
<violation number="4" location=".github/workflows/releases.yml:266">
P2: `finalize` can run even when no image jobs produced artifacts, causing `download-artifact` (pattern `metadata-*`) to fail with “No artifacts found”.</violation>
<violation number="5" location=".github/workflows/releases.yml:319">
P2: GHCR cleanup targets `container: devcontainers`, but builds publish packages as `devcontainers/<image>`, so the prune step won’t clean the actual image packages.</violation>
</file>
<file name="README.md">
<violation number="1" location="README.md:16">
P2: Duplicate `## Available Images` heading — the added heading mirrors the one directly below it, creating a redundant section in the rendered document.</violation>
<violation number="2" location="README.md:137">
P3: Typo: "Typescript" should be "TypeScript" (capital S).</violation>
</file>
<file name=".github/renovate.json">
<violation number="1" location=".github/renovate.json:56">
P2: Security concern: `pinDigests: false` means GitHub Actions won't be pinned to SHA digests, which is a supply-chain security risk (tags can be moved by a compromised maintainer).</violation>
</file>
<file name="images/ubuntu-bun/Dockerfile">
<violation number="1" location="images/ubuntu-bun/Dockerfile:27">
P2: Removed the /usr/local/share/tool-versions.txt generation block, violating the project convention documented in AGENTS.md. This is relied upon by downstream processes.</violation>
</file>
<file name="AGENTS.md">
<violation number="1" location="AGENTS.md:34">
P3: This statement is now stale: the Dockerfiles switched to OCI label metadata and no longer generate `/usr/local/share/tool-versions.txt`. Update this convention text so it matches the current build outputs.</violation>
</file>
<file name="images/bun/Dockerfile">
<violation number="1" location="images/bun/Dockerfile:7">
P2: OXLINT_VERSION "0.4.3" is extremely outdated (latest is ~0.71.0). Bump to a recent version so the image ships a useful tool from the start.</violation>
</file>
<file name="images/bun-node/Dockerfile">
<violation number="1" location="images/bun-node/Dockerfile:19">
P1: `NODE_VERSION` ARG and `apk add nodejs` are decoupled — Renovate bumps the ARG default but `apk add` ignores it, silently installing whatever Alpine ships. Metadata label will claim the Renovate-tracked version, not the installed one.</violation>
</file>
<file name=".oxfmtrc.json">
<violation number="1" location=".oxfmtrc.json:7">
P3: `insertPragma` is not supported by oxfmt. Oxfmt silently ignores unsupported Prettier options — this is dead config.</violation>
<violation number="2" location=".oxfmtrc.json:12">
P3: `requirePragma` is not supported by oxfmt. This option has no effect.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Owner
Author
|
I have read the CLA Document and I hereby sign the CLA |
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Contributor
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 7 file(s) based on 10 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken:
Lines 47–55
- name: Set Final Tag
id: tag
+ env:
+ TAG_OVERRIDE: ${{ github.event.inputs.tag_override }}
run: |
- if [ -n "${{ github.event.inputs.tag_override }}" ]; then
- echo "new_tag=${{ github.event.inputs.tag_override }}" >> $GITHUB_OUTPUT
+ if [ -n "$TAG_OVERRIDE" ]; then
+ # Validate tag format (e.g., v1.0.5)
+ if echo "$TAG_OVERRIDE" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+ echo "new_tag=$TAG_OVERRIDE" >> $GITHUB_OUTPUT
+ else
+ echo "Error: Invalid tag format. Expected format: v1.0.5"
+ exit 1
+ fi
else
echo "new_tag=${{ steps.auto_tag.outputs.new_tag }}" >> $GITHUB_OUTPUT
fiLines 161–171 mkdir -p metadata
# 1. Extract Size from remote manifest
- skopeo inspect docker://${{ env.GHCR_BASE }}/${{ matrix.image }}:latest | \
+ skopeo inspect docker://${{ env.GHCR_BASE }}/${{ matrix.image }}:${{ needs.prepare.outputs.new_tag }} | \
jq '[.LayersData[] | .Size] | add / 1048576 | floor | tostring + " MB"' > metadata/${{ matrix.image }}.size
# 2. Extract specific devcontainer.tool.* OCI Labels
- skopeo inspect docker://${{ env.GHCR_BASE }}/${{ matrix.image }}:latest | \
+ skopeo inspect docker://${{ env.GHCR_BASE }}/${{ matrix.image }}:${{ needs.prepare.outputs.new_tag }} | \
jq -r '.Labels | to_entries[] | select(.key | startswith("devcontainer.tool.")) | "\(.key | sub("devcontainer\\.tool\\."; ""))=\(.value)"' > metadata/${{ matrix.image }}.versions
- name: Upload MetadataLines 243–253 mkdir -p metadata
# 1. Extract Size from remote manifest
- skopeo inspect docker://${{ env.GHCR_BASE }}/${{ matrix.image }}:latest | \
+ skopeo inspect docker://${{ env.GHCR_BASE }}/${{ matrix.image }}:${{ needs.prepare.outputs.new_tag }} | \
jq '[.LayersData[] | .Size] | add / 1048576 | floor | tostring + " MB"' > metadata/${{ matrix.image }}.size
# 2. Extract specific devcontainer.tool.* OCI Labels
- skopeo inspect docker://${{ env.GHCR_BASE }}/${{ matrix.image }}:latest | \
+ skopeo inspect docker://${{ env.GHCR_BASE }}/${{ matrix.image }}:${{ needs.prepare.outputs.new_tag }} | \
jq -r '.Labels | to_entries[] | select(.key | startswith("devcontainer.tool.")) | "\(.key | sub("devcontainer\\.tool\\."; ""))=\(.value)"' > metadata/${{ matrix.image }}.versions
- name: Upload MetadataLines 291–296 steps:
- name: Checkout
uses: actions/checkout@v4.1.7
+ with:
+ ref: ${{ github.ref }}
+ fetch-depth: 1
+
+ - name: Pull Latest Changes
+ run: git pull origin ${{ github.ref_name }}
- name: Push README to DockerHub
uses: peter-evans/dockerhub-description@v4.0.0
Lines 9–15 release:
types: [published]
schedule:
- - cron: "0 */6 * * *"
+ - cron: '0 */6 * * *'
workflow_dispatch:
jobs: |
Fixed 7 file(s) based on 10 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (4)
docs/SETUP.md (1)
38-59: 📐 Maintainability & Code Quality | 🟠 Major | ⚖️ Poor tradeoffUpdate VS Code extensions to match current tooling.
The setup guide recommends
dbaeumer.vscode-eslintandesbenp.prettier-vscodefor thebunimage, but the image now bundlesoxlint/oxfmt. Update the extension recommendations to align with the actual installed tools, or users will have a broken IDE experience.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/SETUP.md` around lines 38 - 59, The setup guide still recommends VS Code extensions that no longer match the tooling in the Bun devcontainer. Update the extension list in the devcontainer setup section so it aligns with the image’s bundled lint/format tools, and adjust the `customizations.vscode.extensions` guidance in the devcontainer JSON example accordingly. Keep the recommendations consistent with the current `bun` image and related setup instructions so users install the right editor integrations.docs/IMAGE_VARIANTS.md (2)
81-123: 📐 Maintainability & Code Quality | 🟠 Major | ⚖️ Poor tradeoffUpdate VS Code extensions to match installed tools.
The
bun-nodeimage description saysoxlint/oxfmtare pre-installed, but the exampledevcontainer.jsonstill recommendsdbaeumer.vscode-eslintandesbenp.prettier-vscodeextensions. Users following this configuration won't have language support for the actual bundled tools.Update the extension recommendations to match the oxlint/oxfmt tooling, or remove them if no suitable extensions exist yet.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/IMAGE_VARIANTS.md` around lines 81 - 123, The example devcontainer configuration for the bun-node image is recommending VS Code extensions that don’t match the bundled tooling, so update the `devcontainer.json` example in `IMAGE_VARIANTS.md` to align with the preinstalled `oxlint/oxfmt` tools. In the example under the Bun/Node full-stack image description, replace the current extension recommendations in the `customizations.vscode.extensions` list with extensions that support oxlint/oxfmt, or remove the mismatched `dbaeumer.vscode-eslint` and `esbenp.prettier-vscode` entries if no appropriate replacements exist. Keep the `bun-node` example consistent with the image’s stated toolset.
171-218: 📐 Maintainability & Code Quality | 🟠 Major | ⚖️ Poor tradeoffUpdate VS Code extensions to match installed tools.
The
ubuntu-bun-nodeimage description saysoxlint/oxfmtare included, but the exampledevcontainer.jsonstill recommendsdbaeumer.vscode-eslintandesbenp.prettier-vscodeextensions. This creates a mismatch between the documented tooling and the recommended IDE setup.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/IMAGE_VARIANTS.md` around lines 171 - 218, The ubuntu-bun-node example configuration is out of sync with the tools listed in the image description. Update the VS Code extensions in the example devcontainer JSON to match the included linting/formatting toolchain exposed by the ubuntu-bun-node image, and remove the old ESLint/Prettier recommendations if they are no longer the intended default. Keep the change localized to the ubuntu-bun-node section and the example configuration block.README.md (1)
141-155: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAlign the README Node.js version with
images/ubuntu-bun-node/Dockerfile
README.mdlists v25.2.0, butimages/ubuntu-bun-node/Dockerfilestill pinsNODE_VERSION="22.11.0".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` around lines 141 - 155, The Node.js version documented in the Ubuntu-based images section is out of sync with the actual image definition. Update the Node.js version in README.md to match the value used by the ubuntu-bun-node Dockerfile, and keep the ubuntu-bun-node entry consistent with the Dockerfile’s NODE_VERSION setting so both references show the same version.
♻️ Duplicate comments (1)
README.md (1)
132-133: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winFix typo: "alterntive" → "alternative".
Line 133 still has "prettier alterntive" which should be "prettier alternative". This was flagged in a previous review and appears to remain unfixed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` around lines 132 - 133, The README tooling list still has a typo in the oxfmt description, where “alterntive” should be corrected to “alternative.” Update the markdown entry for oxfmt in the README so the wording matches the oxlint description and the typo is fully fixed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@docs/IMAGE_VARIANTS.md`:
- Around line 81-123: The example devcontainer configuration for the bun-node
image is recommending VS Code extensions that don’t match the bundled tooling,
so update the `devcontainer.json` example in `IMAGE_VARIANTS.md` to align with
the preinstalled `oxlint/oxfmt` tools. In the example under the Bun/Node
full-stack image description, replace the current extension recommendations in
the `customizations.vscode.extensions` list with extensions that support
oxlint/oxfmt, or remove the mismatched `dbaeumer.vscode-eslint` and
`esbenp.prettier-vscode` entries if no appropriate replacements exist. Keep the
`bun-node` example consistent with the image’s stated toolset.
- Around line 171-218: The ubuntu-bun-node example configuration is out of sync
with the tools listed in the image description. Update the VS Code extensions in
the example devcontainer JSON to match the included linting/formatting toolchain
exposed by the ubuntu-bun-node image, and remove the old ESLint/Prettier
recommendations if they are no longer the intended default. Keep the change
localized to the ubuntu-bun-node section and the example configuration block.
In `@docs/SETUP.md`:
- Around line 38-59: The setup guide still recommends VS Code extensions that no
longer match the tooling in the Bun devcontainer. Update the extension list in
the devcontainer setup section so it aligns with the image’s bundled lint/format
tools, and adjust the `customizations.vscode.extensions` guidance in the
devcontainer JSON example accordingly. Keep the recommendations consistent with
the current `bun` image and related setup instructions so users install the
right editor integrations.
In `@README.md`:
- Around line 141-155: The Node.js version documented in the Ubuntu-based images
section is out of sync with the actual image definition. Update the Node.js
version in README.md to match the value used by the ubuntu-bun-node Dockerfile,
and keep the ubuntu-bun-node entry consistent with the Dockerfile’s NODE_VERSION
setting so both references show the same version.
---
Duplicate comments:
In `@README.md`:
- Around line 132-133: The README tooling list still has a typo in the oxfmt
description, where “alterntive” should be corrected to “alternative.” Update the
markdown entry for oxfmt in the README so the wording matches the oxlint
description and the typo is fully fixed.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 228c1124-3dd9-43c9-ac6e-a6a8b57d75c8
📒 Files selected for processing (9)
.oxfmtrc.json.vscode/tasks.jsonCHANGELOG.mdREADME.mddocs/IMAGE_VARIANTS.mddocs/SETUP.mdimages/bun/devcontainer.jsonimages/ubuntu-bun-node/Dockerfileimages/ubuntu-bun/Dockerfile
Contributor
There was a problem hiding this comment.
1 issue found across 7 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/actions/notes/action.yml">
<violation number="1" location=".github/actions/notes/action.yml:43">
P2: Release notes build Docker Hub URLs from `github.repository_owner`, but images are actually published under `GL_USERNAME` (`vikshan`), so generated links are incorrect.</violation>
<violation number="2" location=".github/actions/notes/action.yml:46">
P1: sed pattern `\| \*\*$IMG_NAME\*\* \|` expects exactly one space before the pipe, but the README table uses multiple spaces for alignment (e.g., `| **bun** |`). The replacement will silently fail — no lines will match, so sizes won't be updated.</violation>
</file>
<file name=".github/workflows/releases.yml">
<violation number="1" location=".github/workflows/releases.yml:40">
P2: Tag is created before image builds — if build-bases or build-derivatives fail, an orphan tag exists on the repo with no corresponding published images.</violation>
<violation number="2" location=".github/workflows/releases.yml:164">
P2: Race condition: `skopeo inspect` reads `:latest` immediately after push — registry eventual consistency may serve the old image, yielding stale metadata.</violation>
<violation number="3" location=".github/workflows/releases.yml:165">
P2: Skopeo/jq size output will contain JSON-escaped quotes (e.g., `"123 MB"`) instead of plain text because `tostring` followed by string concatenation produces a JSON string value.</violation>
<violation number="4" location=".github/workflows/releases.yml:266">
P2: `finalize` can run even when no image jobs produced artifacts, causing `download-artifact` (pattern `metadata-*`) to fail with “No artifacts found”.</violation>
<violation number="5" location=".github/workflows/releases.yml:319">
P2: GHCR cleanup targets `container: devcontainers`, but builds publish packages as `devcontainers/<image>`, so the prune step won’t clean the actual image packages.</violation>
</file>
<file name="README.md">
<violation number="1" location="README.md:16">
P2: Duplicate `## Available Images` heading — the added heading mirrors the one directly below it, creating a redundant section in the rendered document.</violation>
<violation number="2" location="README.md:137">
P3: Typo: "Typescript" should be "TypeScript" (capital S).</violation>
</file>
<file name=".github/renovate.json">
<violation number="1" location=".github/renovate.json:56">
P2: Security concern: `pinDigests: false` means GitHub Actions won't be pinned to SHA digests, which is a supply-chain security risk (tags can be moved by a compromised maintainer).</violation>
</file>
<file name="images/ubuntu-bun/Dockerfile">
<violation number="1" location="images/ubuntu-bun/Dockerfile:27">
P2: Removed the /usr/local/share/tool-versions.txt generation block, violating the project convention documented in AGENTS.md. This is relied upon by downstream processes.</violation>
</file>
<file name="AGENTS.md">
<violation number="1" location="AGENTS.md:34">
P3: This statement is now stale: the Dockerfiles switched to OCI label metadata and no longer generate `/usr/local/share/tool-versions.txt`. Update this convention text so it matches the current build outputs.</violation>
</file>
<file name="images/bun/Dockerfile">
<violation number="1" location="images/bun/Dockerfile:7">
P2: OXLINT_VERSION "0.4.3" is extremely outdated (latest is ~0.71.0). Bump to a recent version so the image ships a useful tool from the start.</violation>
</file>
<file name="images/bun-node/Dockerfile">
<violation number="1" location="images/bun-node/Dockerfile:19">
P1: `NODE_VERSION` ARG and `apk add nodejs` are decoupled — Renovate bumps the ARG default but `apk add` ignores it, silently installing whatever Alpine ships. Metadata label will claim the Renovate-tracked version, not the installed one.</violation>
</file>
<file name=".oxfmtrc.json">
<violation number="1" location=".oxfmtrc.json:7">
P3: `insertPragma` is not supported by oxfmt. Oxfmt silently ignores unsupported Prettier options — this is dead config.</violation>
<violation number="2" location=".oxfmtrc.json:12">
P3: `requirePragma` is not supported by oxfmt. This option has no effect.</violation>
</file>
<file name="images/bun/devcontainer.json">
<violation number="1" location="images/bun/devcontainer.json:27">
P2: The Bun devcontainer dropped ESLint and Prettier VS Code extensions after switching to oxlint/oxfmt, but did not add the OXC VS Code extension (`oxc.oxc-vscode`) to provide equivalent in-editor lint/format integration.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="images/ubuntu-bun-node/Dockerfile">
<violation number="1" location="images/ubuntu-bun-node/Dockerfile:38">
P2: Checksum validation is not anchored to an independent trust source. Both the Node.js tarball and `SHASUMS256.txt` are downloaded from the same origin (`nodejs.org/dist/...`), so `sha256sum -c` only detects transfer corruption, not server-side tampering or a compromised checksum manifest. For stronger integrity, the build should verify the GPG-signed `SHASUMS256.txt.asc` (as done in official docker-node images).</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
| RUN ARCH="$(case "$TARGETARCH" in amd64) echo x64 ;; arm64) echo arm64 ;; *) echo "Unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; esac)" \ | ||
| && NODE_TARBALL="node-v${NODE_VERSION}-linux-${ARCH}.tar.xz" \ | ||
| && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/${NODE_TARBALL}" \ | ||
| && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" \ |
Contributor
There was a problem hiding this comment.
P2: Checksum validation is not anchored to an independent trust source. Both the Node.js tarball and SHASUMS256.txt are downloaded from the same origin (nodejs.org/dist/...), so sha256sum -c only detects transfer corruption, not server-side tampering or a compromised checksum manifest. For stronger integrity, the build should verify the GPG-signed SHASUMS256.txt.asc (as done in official docker-node images).
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At images/ubuntu-bun-node/Dockerfile, line 38:
<comment>Checksum validation is not anchored to an independent trust source. Both the Node.js tarball and `SHASUMS256.txt` are downloaded from the same origin (`nodejs.org/dist/...`), so `sha256sum -c` only detects transfer corruption, not server-side tampering or a compromised checksum manifest. For stronger integrity, the build should verify the GPG-signed `SHASUMS256.txt.asc` (as done in official docker-node images).</comment>
<file context>
@@ -32,8 +32,13 @@ RUN ln -s /usr/local/bin/bun /usr/local/bin/bunx
+RUN ARCH="$(case "$TARGETARCH" in amd64) echo x64 ;; arm64) echo arm64 ;; *) echo "Unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; esac)" \
+ && NODE_TARBALL="node-v${NODE_VERSION}-linux-${ARCH}.tar.xz" \
+ && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/${NODE_TARBALL}" \
+ && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" \
+ && grep " ${NODE_TARBALL}$" SHASUMS256.txt | sha256sum -c - \
+ && tar -xJf "${NODE_TARBALL}" -C /usr/local --strip-components=1 \
</file context>
Contributor
|
Want your agent to iterate on Greptile's feedback? Try greploops. |
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
… up devcontainer configurations
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (8)
README.md (1)
142-142: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winNode.js version for
ubuntu-bun-nodedoesn't match Dockerfile.README.md claims
Node.js v25.2.1, butimages/ubuntu-bun-node/DockerfilepinsNODE_VERSION="22.11.0". Synchronize with the pinned build version or remove the specific version claim to avoid documentation drift.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 142, The Node.js version documented for ubuntu-bun-node is out of sync with the pinned version used in the Docker build. Update the version claim in README.md to match the value defined in the ubuntu-bun-node Dockerfile’s NODE_VERSION setting, or remove the exact version number entirely if it should not be documented. Keep the README wording aligned with the build source of truth so the Node.js version reference stays accurate.docs/IMAGE_VARIANTS.md (2)
89-97: 🗄️ Data Integrity & Integration | 🟠 Major | ⚖️ Poor tradeoffVersion claims for
bun-nodedon't match the Dockerfile.The
bun-nodeDockerfile installs Node.js viaapk add nodejs npmwithout version pinning (seeimages/bun-node/Dockerfile), yet this document asserts specific versions (Bun 1.3.3,Node.js v22.11.0,npm 10.9.0). These claims are unverifiable and likely stale copy-paste fromubuntu-bun-node. Either pin the versions in the Dockerfile with Renovate-trackable ARGs or remove the specific version claims from this description.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/IMAGE_VARIANTS.md` around lines 89 - 97, The bun-node documentation is claiming specific tool versions that are not actually guaranteed by its Dockerfile. Update the IMAGE_VARIANTS description for bun-node to either remove the exact Bun/Node.js/npm version statements or align them with pinned, Renovate-trackable version ARGs in the bun-node Dockerfile; use the existing bun-node and Included Tools sections to keep the wording generic unless the build is version-pinned.
189-191: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winCritical version mismatch:
ubuntu-bun-nodeNode.js version doesn't match Dockerfile.The document claims
Node.js v25.2.0/npm 11.6.2, butimages/ubuntu-bun-node/DockerfilepinsNODE_VERSION="22.11.0"and the Node.js v22.11.0 release ships with npm 10.9.0, not 11.6.2. These values are inconsistent with both the build contract and each other. Update to match the pinned Dockerfile ARG or fix the Dockerfile if v25.2.0 is intended.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/IMAGE_VARIANTS.md` around lines 189 - 191, The version list in the ubuntu-bun-node section is inconsistent with the pinned build contract and the Node/npm versions each other. Update the documented Node.js and npm versions to match the `NODE_VERSION` used by `images/ubuntu-bun-node/Dockerfile`, or adjust that Dockerfile if the newer Node.js release is intended, and keep the `oxlint/oxfmt` entry unchanged..github/workflows/releases.yml (2)
70-75: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winUse double quotes for YAML strings.
The path filter values are single-quoted. As per coding guidelines,
**/*.{json,yml,yaml}files should use double quotes.Suggested fix
- bun: 'images/bun/**' - ubuntu_tools: 'images/ubuntu-tools/**' - bun_node: 'images/bun-node/**' - ubuntu_bun: 'images/ubuntu-bun/**' - ubuntu_bun_node: 'images/ubuntu-bun-node/**' + bun: "images/bun/**" + ubuntu_tools: "images/ubuntu-tools/**" + bun_node: "images/bun-node/**" + ubuntu_bun: "images/ubuntu-bun/**" + ubuntu_bun_node: "images/ubuntu-bun-node/**"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/releases.yml around lines 70 - 75, The path filter strings in the releases workflow are using single quotes, but the YAML style guide requires double quotes in `.yml` files. Update the `filters` entries in the workflow block to use double-quoted strings, keeping the same keys and paths, so the formatting is consistent with the repository convention.Source: Coding guidelines
83-92: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winRebuild derivatives when their base image changes.
On push events, a change under
images/ubuntu-tools/**only addsubuntu-toolstoBASES, and a change underimages/bun/**only addsbun. The dependent derivative images will keep using the previous base until a scheduled/manual full build.Suggested fix
if [ "${{ github.event_name }}" == "schedule" ] || [ "${{ github.event_name }}" == "workflow_dispatch" ]; then BASES=("bun" "ubuntu-tools") DERIVATIVES=("bun-node" "ubuntu-bun" "ubuntu-bun-node") else - [ "${{ steps.filter.outputs.bun }}" == "true" ] && BASES+=("bun") - [ "${{ steps.filter.outputs.ubuntu_tools }}" == "true" ] && BASES+=("ubuntu-tools") - [ "${{ steps.filter.outputs.bun_node }}" == "true" ] && DERIVATIVES+=("bun-node") - [ "${{ steps.filter.outputs.ubuntu_bun }}" == "true" ] && DERIVATIVES+=("ubuntu-bun") - [ "${{ steps.filter.outputs.ubuntu_bun_node }}" == "true" ] && DERIVATIVES+=("ubuntu-bun-node") + add_base() { [[ " ${BASES[*]} " == *" $1 "* ]] || BASES+=("$1"); } + add_derivative() { [[ " ${DERIVATIVES[*]} " == *" $1 "* ]] || DERIVATIVES+=("$1"); } + + if [ "${{ steps.filter.outputs.bun }}" == "true" ]; then + add_base "bun" + add_derivative "bun-node" + fi + if [ "${{ steps.filter.outputs.ubuntu_tools }}" == "true" ]; then + add_base "ubuntu-tools" + add_derivative "ubuntu-bun" + add_derivative "ubuntu-bun-node" + fi + [ "${{ steps.filter.outputs.bun_node }}" == "true" ] && add_derivative "bun-node" + [ "${{ steps.filter.outputs.ubuntu_bun }}" == "true" ] && add_derivative "ubuntu-bun" + [ "${{ steps.filter.outputs.ubuntu_bun_node }}" == "true" ] && add_derivative "ubuntu-bun-node" fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/releases.yml around lines 83 - 92, The release workflow’s image-selection logic only rebuilds the changed base images in the shell block that populates BASES and DERIVATIVES, so derivative images can miss base updates on push events. Update the decision logic in the releases workflow so changes under images/bun/** or images/ubuntu-tools/** also enqueue the dependent derivative images (bun-node, ubuntu-bun, ubuntu-bun-node) when their base changes, while keeping the scheduled/workflow_dispatch full-build path unchanged..github/actions/notes/action.yml (1)
10-10: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winUse double quotes for YAML scalar values.
These YAML strings are single-quoted. As per coding guidelines,
**/*.{json,yml,yaml}files should use double quotes.Suggested fix
-runs: - using: 'composite' +runs: + using: "composite" @@ - commit_message: 'docs: update CHANGELOG, README, and variants documentation for ${{ inputs.tag_name }} [skip ci]' - file_pattern: 'CHANGELOG.md README.md docs/IMAGE_VARIANTS.md docs/SETUP.md' + commit_message: "docs: update CHANGELOG, README, and variants documentation for ${{ inputs.tag_name }} [skip ci]" + file_pattern: "CHANGELOG.md README.md docs/IMAGE_VARIANTS.md docs/SETUP.md"Also applies to: 92-93
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/actions/notes/action.yml at line 10, The YAML scalar values in the composite action definition use single quotes instead of the required double quotes. Update the quoted scalars in the action.yml content, including the using field and the other referenced quoted entries around the same section, to match the repository guideline for YAML files. Use the existing composite action block as the location guide and keep the values unchanged except for switching the quote style.Source: Coding guidelines
images/ubuntu-bun-node/Dockerfile (1)
35-42: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winMake checksum verification independent of pipefail.
The Node tarball verification currently depends on a pipeline. Writing the matched checksum to a file keeps the integrity check explicit and satisfies the Dockerfile lint warning without assuming a shell-level
pipefailsetup.Suggested fix
RUN ARCH="$(case "$TARGETARCH" in amd64) echo x64 ;; arm64) echo arm64 ;; *) echo "Unsupported TARGETARCH: $TARGETARCH" >&2; exit 1 ;; esac)" \ && NODE_TARBALL="node-v${NODE_VERSION}-linux-${ARCH}.tar.xz" \ && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/${NODE_TARBALL}" \ && curl -fsSLO "https://nodejs.org/dist/v${NODE_VERSION}/SHASUMS256.txt" \ - && grep " ${NODE_TARBALL}$" SHASUMS256.txt | sha256sum -c - \ + && grep " ${NODE_TARBALL}$" SHASUMS256.txt > "${NODE_TARBALL}.sha256" \ + && sha256sum -c "${NODE_TARBALL}.sha256" \ && tar -xJf "${NODE_TARBALL}" -C /usr/local --strip-components=1 \ - && rm -f "${NODE_TARBALL}" SHASUMS256.txt \ + && rm -f "${NODE_TARBALL}" "${NODE_TARBALL}.sha256" SHASUMS256.txt \ && bun install -g oxlint@${OXLINT_VERSION} oxfmt@${OXFMT_VERSION}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@images/ubuntu-bun-node/Dockerfile` around lines 35 - 42, The Node tarball integrity check in the Dockerfile currently relies on a grep-to-sha256sum pipeline, which makes it depend on shell pipefail behavior. Update the RUN block that builds NODE_TARBALL in the Node installation step to avoid the pipeline by writing the matched checksum for the tarball into a temporary file and validating against that file with sha256sum, then clean up the temp file along with the tarball and SHASUMS256.txt.Source: Linters/SAST tools
images/bun-node/Dockerfile (1)
13-17: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winDo not publish inherited tool versions from disconnected ARG defaults.
This child image inherits Bun/oxlint/oxfmt from
ghcr.io/iamvikshan/devcontainers/bun:${BASE_TAG}, but it republishes those versions from local ARG defaults instead of the parent source of truth. That is already wrong foroxlint:images/bun/Dockerfilepins0.7.1, while this file still labels0.4.3. Because the release workflow and notes action turn these labels intometadata/*.versions, this image will ship false release metadata.Also applies to: 29-33
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@images/bun-node/Dockerfile` around lines 13 - 17, The ARG defaults for Bun/oxlint/oxfmt in this Dockerfile are republishing version metadata from local values instead of the parent image’s source of truth. Update the version labels in the Bun child image so they match the inherited versions from the base image used by this Dockerfile, and align any duplicate declarations in the related ARG block to avoid shipping stale metadata. Use the existing Dockerfile ARG symbols (BUN_VERSION, OXLINT_VERSION, OXFMT_VERSION) to locate and correct the inherited tool version values.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/notes/update_docs.py:
- Around line 53-81: The row rebuild logic in update_docs.py overwrites all
table cells for Size/Bun Version/Node.js and replaces missing metadata with
placeholders, which breaks partial releases. Update the update_docs.py table
refresh flow to preserve existing cells for headers not present in metadata/
instead of inserting “-” or “❌”, and only replace values for images actually
built in the current run. Use the existing row update blocks and the re.sub
replacements for Size, Bun Version, and Node.js as the main places to adjust.
In `@AGENTS.md`:
- Around line 22-23: The formatting guidance in AGENTS.md is stale because it
still references Prettier defaults instead of the repo’s current formatter.
Update the formatting note to point to oxfmt and reference .oxfmtrc.json as the
source of truth, keeping the existing TypeScript style guidance accurate while
removing the Prettier wording.
- Around line 6-10: Remove the stale scripts/*.ts implementation pointer from
AGENTS.md and update the Primary Implementation Areas list to match the new
release automation location. Keep the guidance aligned with the current
implementation by referencing the existing .github/actions/notes/update_docs.py
and GitHub Actions workflow area instead of scripts/*.ts.
In `@docs/IMAGE_VARIANTS.md`:
- Line 118: The bun-node example still lists the stale dbaeumer.vscode-eslint
extension, which is inconsistent with the other image examples and the move to
oxc. Update the extensions array in the bun-node image variant entry to remove
dbaeumer.vscode-eslint, keeping only the existing bun and oxc extensions so it
matches the other examples.
- Line 213: The ubuntu-bun-node example still lists the stale ESLint extension,
which no longer matches the move to oxlint/oxfmt. Update the extension list in
the IMAGE_VARIANTS content so the example keeps only the Bun, ESLint-related
replacement, and Oxc entries, and remove dbaeumer.vscode-eslint from that list.
In `@README.md`:
- Line 131: The oxfmt entry in README.md is too vague compared with the oxlint
bullet, so update the oxfmt description to use the same style of functional
wording. Keep the existing list item but replace the current “prettier
alternative” text with a parallel description such as “Fast
JavaScript/TypeScript formatter” so the purpose is immediately clear.
---
Outside diff comments:
In @.github/actions/notes/action.yml:
- Line 10: The YAML scalar values in the composite action definition use single
quotes instead of the required double quotes. Update the quoted scalars in the
action.yml content, including the using field and the other referenced quoted
entries around the same section, to match the repository guideline for YAML
files. Use the existing composite action block as the location guide and keep
the values unchanged except for switching the quote style.
In @.github/workflows/releases.yml:
- Around line 70-75: The path filter strings in the releases workflow are using
single quotes, but the YAML style guide requires double quotes in `.yml` files.
Update the `filters` entries in the workflow block to use double-quoted strings,
keeping the same keys and paths, so the formatting is consistent with the
repository convention.
- Around line 83-92: The release workflow’s image-selection logic only rebuilds
the changed base images in the shell block that populates BASES and DERIVATIVES,
so derivative images can miss base updates on push events. Update the decision
logic in the releases workflow so changes under images/bun/** or
images/ubuntu-tools/** also enqueue the dependent derivative images (bun-node,
ubuntu-bun, ubuntu-bun-node) when their base changes, while keeping the
scheduled/workflow_dispatch full-build path unchanged.
In `@docs/IMAGE_VARIANTS.md`:
- Around line 89-97: The bun-node documentation is claiming specific tool
versions that are not actually guaranteed by its Dockerfile. Update the
IMAGE_VARIANTS description for bun-node to either remove the exact
Bun/Node.js/npm version statements or align them with pinned, Renovate-trackable
version ARGs in the bun-node Dockerfile; use the existing bun-node and Included
Tools sections to keep the wording generic unless the build is version-pinned.
- Around line 189-191: The version list in the ubuntu-bun-node section is
inconsistent with the pinned build contract and the Node/npm versions each
other. Update the documented Node.js and npm versions to match the
`NODE_VERSION` used by `images/ubuntu-bun-node/Dockerfile`, or adjust that
Dockerfile if the newer Node.js release is intended, and keep the `oxlint/oxfmt`
entry unchanged.
In `@images/bun-node/Dockerfile`:
- Around line 13-17: The ARG defaults for Bun/oxlint/oxfmt in this Dockerfile
are republishing version metadata from local values instead of the parent
image’s source of truth. Update the version labels in the Bun child image so
they match the inherited versions from the base image used by this Dockerfile,
and align any duplicate declarations in the related ARG block to avoid shipping
stale metadata. Use the existing Dockerfile ARG symbols (BUN_VERSION,
OXLINT_VERSION, OXFMT_VERSION) to locate and correct the inherited tool version
values.
In `@images/ubuntu-bun-node/Dockerfile`:
- Around line 35-42: The Node tarball integrity check in the Dockerfile
currently relies on a grep-to-sha256sum pipeline, which makes it depend on shell
pipefail behavior. Update the RUN block that builds NODE_TARBALL in the Node
installation step to avoid the pipeline by writing the matched checksum for the
tarball into a temporary file and validating against that file with sha256sum,
then clean up the temp file along with the tarball and SHASUMS256.txt.
In `@README.md`:
- Line 142: The Node.js version documented for ubuntu-bun-node is out of sync
with the pinned version used in the Docker build. Update the version claim in
README.md to match the value defined in the ubuntu-bun-node Dockerfile’s
NODE_VERSION setting, or remove the exact version number entirely if it should
not be documented. Keep the README wording aligned with the build source of
truth so the Node.js version reference stays accurate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 062f5bcc-eab6-47ed-8bae-923cb38c7752
📒 Files selected for processing (17)
.devcontainer/devcontainer.json.github/actions/notes/action.yml.github/actions/notes/update_docs.py.github/workflows/releases.yml.github/workflows/sync.yml.oxfmtrc.jsonAGENTS.mdREADME.mddocs/IMAGE_VARIANTS.mddocs/devcontainer.jsonexamples/bun-node-example/.devcontainer.jsonexamples/bun/.devcontainer.jsonimages/bun-node/Dockerfileimages/bun-node/devcontainer.jsonimages/bun/Dockerfileimages/ubuntu-bun-node/Dockerfileimages/ubuntu-tools/Dockerfile
💤 Files with no reviewable changes (4)
- examples/bun/.devcontainer.json
- examples/bun-node-example/.devcontainer.json
- .oxfmtrc.json
- images/bun-node/devcontainer.json
Contributor
There was a problem hiding this comment.
5 issues found across 16 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="images/ubuntu-bun-node/Dockerfile">
<violation number="1" location="images/ubuntu-bun-node/Dockerfile:38">
P2: Checksum validation is not anchored to an independent trust source. Both the Node.js tarball and `SHASUMS256.txt` are downloaded from the same origin (`nodejs.org/dist/...`), so `sha256sum -c` only detects transfer corruption, not server-side tampering or a compromised checksum manifest. For stronger integrity, the build should verify the GPG-signed `SHASUMS256.txt.asc` (as done in official docker-node images).</violation>
</file>
<file name="AGENTS.md">
<violation number="1" location="AGENTS.md:9">
P3: Update this implementation pointer to the current release-automation location. Referencing `scripts/*.ts` here sends contributors to the wrong place after the workflow/action migration.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
| - **Primary Implementation Areas**: | ||
| - `images/*` for image Dockerfiles and shell bootstrap scripts. | ||
| - `.devcontainer/` and `images/*/devcontainer.json` for VS Code container manifests. | ||
| - `scripts/*.ts` for release/version automation. |
Contributor
There was a problem hiding this comment.
P3: Update this implementation pointer to the current release-automation location. Referencing scripts/*.ts here sends contributors to the wrong place after the workflow/action migration.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At AGENTS.md, line 9:
<comment>Update this implementation pointer to the current release-automation location. Referencing `scripts/*.ts` here sends contributors to the wrong place after the workflow/action migration.</comment>
<file context>
@@ -1,46 +1,31 @@
+- **Primary Implementation Areas**:
+ - `images/*` for image Dockerfiles and shell bootstrap scripts.
+ - `.devcontainer/` and `images/*/devcontainer.json` for VS Code container manifests.
+ - `scripts/*.ts` for release/version automation.
+ - `docs/*.md` and `README.md` for user-facing documentation.
+
</file context>
Suggested change
| - `scripts/*.ts` for release/version automation. | |
| - `.github/workflows/releases.yml` and `.github/actions/notes/update_docs.py` for release/version automation. |
Contributor
There was a problem hiding this comment.
1 issue found across 7 files (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="images/bun-node/Dockerfile">
<violation number="1" location="images/bun-node/Dockerfile:15">
P2: Hardcoded `OXLINT_VERSION` in a child image can drift from the inherited base image. The binary comes from `ghcr.io/iamvikshan/devcontainers/bun:${BASE_TAG}`, but the label is set from a local ARG. If `BASE_TAG` is overridden, the OCI label `devcontainer.tool.oxlint` will be incorrect, misleading downstream tooling such as Skopeo.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
| # renovate: datasource=docker depName=oven/bun | ||
| ARG BUN_VERSION="1.1.17" | ||
| # renovate: datasource=npm depName=oxlint | ||
| ARG OXLINT_VERSION="0.7.1" |
Contributor
There was a problem hiding this comment.
P2: Hardcoded OXLINT_VERSION in a child image can drift from the inherited base image. The binary comes from ghcr.io/iamvikshan/devcontainers/bun:${BASE_TAG}, but the label is set from a local ARG. If BASE_TAG is overridden, the OCI label devcontainer.tool.oxlint will be incorrect, misleading downstream tooling such as Skopeo.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At images/bun-node/Dockerfile, line 15:
<comment>Hardcoded `OXLINT_VERSION` in a child image can drift from the inherited base image. The binary comes from `ghcr.io/iamvikshan/devcontainers/bun:${BASE_TAG}`, but the label is set from a local ARG. If `BASE_TAG` is overridden, the OCI label `devcontainer.tool.oxlint` will be incorrect, misleading downstream tooling such as Skopeo.</comment>
<file context>
@@ -12,7 +12,7 @@ ARG BASE_TAG
ARG BUN_VERSION="1.1.17"
# renovate: datasource=npm depName=oxlint
-ARG OXLINT_VERSION="0.4.3"
+ARG OXLINT_VERSION="0.7.1"
# renovate: datasource=npm depName=oxfmt
ARG OXFMT_VERSION="0.56.0"
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…cicncy.
Summary by cubic
Streamlined DevContainer images with safer defaults, automated weekly releases, and faster, smaller builds. Adds a lean
ubuntu-toolsbase, multi-stage Bun copy, aligned tool versions, automated docs/release notes, Docker-in-Docker devcontainers, andoxfmtformatting.New Features
images/**path filter and optional tag override; compositenotesaction updates README/CHANGELOG and publishes a GitHub Release..github/renovate.jsonregex manager auto-bumps Dockerfile ARGs (e.g.,UBUNTU_VERSION,BUN_VERSION,OXFMT_VERSION,OXLINT_VERSION) and base tags.ghcr.io/devcontainers/features/docker-in-docker:4(no host Docker socket); adds.vscode/tasks.jsonfor local image builds; VS Code extensions updated (oxc.oxc-vscode).ubuntu-tools.Refactors
ubuntu-bun*now FROMubuntu-toolsand copy Bun via multi-stage;bunpinsBUN_VERSIONand global tools (oxlint,oxfmt);bun-nodebuilds FROM ourbun.oxfmtand a minimal Husky hook.oxlint/oxfmtversion pins and labels across Dockerfiles.Written for commit 13684f4. Summary will update on new commits.
Confidence Score: 3/5
The release automation and image-family restructuring are mostly sound, but two correctness issues in the OCI labeling scheme will cause the Skopeo-based release notes to advertise wrong tool versions the moment these images are built.
Ubuntu images install oxlint@0.4.3 while the rest of the family installs 0.7.1, and the devcontainer.tool.oxlint label that drives the release notes pipeline reflects this stale value. Independently, bun-node labels are populated from tracking-only ARG defaults rather than the actual installed versions, so any future base-image update will silently produce a release with wrong version metadata. Both issues affect the same release pipeline that was a primary motivation for the PR.
images/ubuntu-bun/Dockerfile and images/ubuntu-bun-node/Dockerfile (OXLINT_VERSION mismatch) and images/bun-node/Dockerfile (labels not tied to actual installed versions).
Reviews (9): Last reviewed commit: "fixes" | Re-trigger Greptile
Context used: