introduce a nightly and on push to main github action for the image#1
Open
cooktheryan wants to merge 6 commits into
Open
introduce a nightly and on push to main github action for the image#1cooktheryan wants to merge 6 commits into
cooktheryan wants to merge 6 commits into
Conversation
Signed-off-by: Ryan Cook <rcook@redhat.com>
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that builds and pushes per-architecture container images (linux/amd64, linux/arm64) to quay.io, runs an amd64 smoke-test that bootstraps and validates OpenClaw and its gateway, and assembles/pushes a multi-arch manifest (nightly for schedule, latest otherwise). ChangesCI/CD: multi-arch image build, smoke-test, manifest
Sequence DiagramsequenceDiagram
participant GH as GitHub Actions
participant RunnerA as Runner (amd64)
participant RunnerB as Runner (arm64)
participant Quay as quay.io
participant Smoke as Smoke-test Job
participant Image as Built Image (amd64)
participant Gateway as OpenClaw Gateway Container
GH->>RunnerA: start build (amd64)
GH->>RunnerB: start build (arm64)
RunnerA->>Quay: push `${{ github.sha }}-amd64`
RunnerB->>Quay: push `${{ github.sha }}-arm64`
GH->>Smoke: trigger smoke-test (after build)
Smoke->>Quay: pull `${{ github.sha }}-amd64`
Smoke->>Image: run checks & `/usr/libexec/tank-os/bootstrap-openclaw` -> generate config
Smoke->>Gateway: start gateway container with mounted config
Gateway-->>Smoke: respond on 127.0.0.1:18789 (HTTP)
Smoke->>Smoke: verify HTTP 200–399 and container running
GH->>Quay: create & push multi-arch manifest (`nightly` or `latest`)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~40 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 9 minutes and 14 seconds.Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
.github/workflows/build-push.yml (2)
22-23: Addtimeout-minutesto each job.The arm64 build under QEMU and the
Wait for OpenClaw to be readyloop (60s) plus container startup can all hang on bad days; without a job-level timeout, a stuck step inherits the default 6-hour limit and burns runner minutes (and blocks the concurrency slot). A modesttimeout-minutes: 60onbuildandtimeout-minutes: 20onsmoke-test/manifestwould be a cheap safety net.Also applies to: 52-54, 217-219
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/build-push.yml around lines 22 - 23, Add a job-level timeout to prevent stuck steps from consuming runner time: set timeout-minutes: 60 on the build job (the job named "build") and set timeout-minutes: 20 on the smoke-test and manifest jobs (the jobs named "smoke-test" and "manifest"); apply the same changes to the other occurrences noted (the other build/smoke-test/manifest blocks referenced near the second and third occurrences) so each job has the appropriate timeout.
24-26: Use native arm64 runners instead of QEMU emulation.Building
linux/arm64via QEMU emulation on amd64 hardware is substantially slower and occasionally flakier than native execution. GitHub offers freeubuntu-24.04-arm/ubuntu-22.04-armrunners for public repositories; usingruns-on: ${{ matrix.runner }}with separate matrix entries for architecture and runner would eliminate QEMU and improve build performance and reliability.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/build-push.yml around lines 24 - 26, The current strategy.matrix.platform uses platform: [linux/arm64, linux/amd64] which forces QEMU emulation for arm64; replace that with a matrix that separates architecture and runner (e.g., matrix.arch and matrix.runner) and update the job to use runs-on: ${{ matrix.runner }} so arm64 jobs use native GitHub arm runners (for example ubuntu-24.04-arm or ubuntu-22.04-arm) while amd64 uses the appropriate ubuntu runner, ensuring native arm64 execution instead of QEMU emulation.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/build-push.yml:
- Around line 151-164: The workflow action "Start OpenClaw container" currently
launches ghcr.io/openclaw/openclaw:latest directly which bypasses the built
bootc image and its quadlet; update this step so it either (a) reads/parses the
quadlet used by the built image and uses those exact Image=, PublishPort=,
Volume= and env var values when invoking podman run (replace hardcoded values in
the "Start OpenClaw container" step with variables sourced from the quadlet), or
(b) instead runs the built bootc image itself (with --privileged and systemd
enabled) so the quadlet inside the image brings up the gateway; if you cannot
implement (a) or (b) immediately, at minimum replace
ghcr.io/openclaw/openclaw:latest with the exact digest referenced by the quadlet
to prevent silent tag drift.
- Around line 13-15: The concurrency config uses group: `${{ github.workflow
}}-${{ github.ref }}` and cancel-in-progress: true which causes scheduled runs
to be cancelled by pushes to main; update the concurrency grouping or
cancellation logic so scheduled/nightly runs aren't killed — for example,
include `${{ github.event_name }}` or `${{ github.sha }}` in the concurrency
group (e.g., append `${{ github.event_name }}`) or conditionally disable
cancel-in-progress for schedule events (check `github.event_name == 'schedule'`)
so the concurrency/group and cancel-in-progress settings in the workflow's
concurrency block avoid cancelling long-running nightly builds.
- Around line 33-50: The build step tags the image as `${{ github.sha }}` but
the push step expects `${{ github.sha }}-amd64` or `-arm64`; update the build
step (the "Build image" step that uses redhat-actions/buildah-build, id: build)
to produce the per-arch tag to match the push step by changing its `tags:` value
to include the platform suffix (e.g. `${{ github.sha }}-${{ matrix.platform ==
'linux/arm64' && 'arm64' || 'amd64' }}`) so the image pushed by the "Push
per-arch image to quay.io" step (uses: redhat-actions/push-to-registry) exists
in local storage.
- Around line 250-256: The cleanup loop using "skopeo delete" suppresses
failures with "|| true" and doesn't supply the Podman auth file, so
authentication errors can be masked; update the loop that runs skopeo delete
(the for arch in arm64 amd64; do ... skopeo delete
"docker://${REGISTRY}/${IMAGE_NAME}:${COMMIT_SHA}-${arch}" ...) to pass the
Podman auth file via --authfile "${REGISTRY_AUTH_FILE}" and remove the "|| true"
so deletion failures (e.g., 401) surface in the workflow logs; ensure
REGISTRY_AUTH_FILE remains exported by the login step so the value is available
to the cleanup step.
---
Nitpick comments:
In @.github/workflows/build-push.yml:
- Around line 22-23: Add a job-level timeout to prevent stuck steps from
consuming runner time: set timeout-minutes: 60 on the build job (the job named
"build") and set timeout-minutes: 20 on the smoke-test and manifest jobs (the
jobs named "smoke-test" and "manifest"); apply the same changes to the other
occurrences noted (the other build/smoke-test/manifest blocks referenced near
the second and third occurrences) so each job has the appropriate timeout.
- Around line 24-26: The current strategy.matrix.platform uses platform:
[linux/arm64, linux/amd64] which forces QEMU emulation for arm64; replace that
with a matrix that separates architecture and runner (e.g., matrix.arch and
matrix.runner) and update the job to use runs-on: ${{ matrix.runner }} so arm64
jobs use native GitHub arm runners (for example ubuntu-24.04-arm or
ubuntu-22.04-arm) while amd64 uses the appropriate ubuntu runner, ensuring
native arm64 execution instead of QEMU emulation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 235b9ca2-b553-40ca-b0aa-5d410a32e119
📒 Files selected for processing (1)
.github/workflows/build-push.yml
Signed-off-by: Ryan Cook <rcook@redhat.com>
Signed-off-by: Ryan Cook <rcook@redhat.com>
- Replace QEMU emulation with native GitHub arm64 runners (ubuntu-24.04-arm) so each arch builds natively in parallel - Fix tag mismatch: build step now produces the per-arch suffixed tag that the push step expects - Remove per-arch tag cleanup step from manifest job Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/build-push.yml (1)
156-169:⚠️ Potential issue | 🟠 Major | 🏗️ Heavy liftSmoke test still bypasses the image’s actual runtime wiring.
This step hardcodes
Image=, ports, env, and the command instead of exercisingbootc/rootfs/etc/containers/systemd/users/1000/openclaw.container. A regression in the quadlet can still pass CI because the workflow never runs the built bootc image the way users consume it.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/build-push.yml around lines 156 - 169, The workflow step currently invokes podman run with hardcoded Image, ports, env and command which bypasses the container unit file; instead run the built bootc image through podman run so systemd/quadlet reads bootc/rootfs/etc/containers/systemd/users/1000/openclaw.container (do not hardcode PORT/ENV/COMMAND). Concretely, replace the manual podman run invocation with a podman run that uses the workflow’s built bootc image/artifact, mounts the built bootc rootfs (so /etc/containers/systemd/users/1000/openclaw.container is available), and enables systemd/quadlet (so the unit file wires ports, env and command); remove the explicit -p, -e and command overrides so the container’s unit file defines runtime wiring. Ensure the step references the built image variable from the build step and still mounts ${RUNNER_TEMP}/openclaw-home for test state.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/build-push.yml:
- Around line 227-236: The Determine tag step (id: tag) currently treats
workflow_dispatch like other non-schedule runs and emits tag=latest, which can
overwrite latest from non-main refs; update this step to: if EVENT_NAME ==
"schedule" set tag=nightly, else if EVENT_NAME == "workflow_dispatch" set a
distinct tag (e.g., tag=manual-${GITHUB_REF#refs/heads/} or tag=manual) or
output a flag to skip pushing the manifest, and only emit tag=latest when
GITHUB_REF (or github.ref) equals refs/heads/main; keep the step id: tag and env
EVENT_NAME usage but add the GITHUB_REF check to gate latest to main and handle
manual runs separately.
---
Duplicate comments:
In @.github/workflows/build-push.yml:
- Around line 156-169: The workflow step currently invokes podman run with
hardcoded Image, ports, env and command which bypasses the container unit file;
instead run the built bootc image through podman run so systemd/quadlet reads
bootc/rootfs/etc/containers/systemd/users/1000/openclaw.container (do not
hardcode PORT/ENV/COMMAND). Concretely, replace the manual podman run invocation
with a podman run that uses the workflow’s built bootc image/artifact, mounts
the built bootc rootfs (so /etc/containers/systemd/users/1000/openclaw.container
is available), and enables systemd/quadlet (so the unit file wires ports, env
and command); remove the explicit -p, -e and command overrides so the
container’s unit file defines runtime wiring. Ensure the step references the
built image variable from the build step and still mounts
${RUNNER_TEMP}/openclaw-home for test state.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: cc5b498f-4083-47db-a165-5ea95115b022
📒 Files selected for processing (1)
.github/workflows/build-push.yml
Comment on lines
+227
to
+236
| - name: Determine tag | ||
| id: tag | ||
| run: | | ||
| if [[ "${EVENT_NAME}" == "schedule" ]]; then | ||
| echo "tag=nightly" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "tag=latest" >> "$GITHUB_OUTPUT" | ||
| fi | ||
| env: | ||
| EVENT_NAME: ${{ github.event_name }} |
There was a problem hiding this comment.
Don't publish latest for manual runs from non-main refs.
workflow_dispatch falls into the latest branch here, so dispatching this workflow from refs/heads/nightly or any future topic branch will overwrite the public latest tag with an unmerged commit. Please gate latest behind refs/heads/main, and give manual runs a separate tag or skip the manifest push for them.
Suggested change
- name: Determine tag
id: tag
run: |
if [[ "${EVENT_NAME}" == "schedule" ]]; then
echo "tag=nightly" >> "$GITHUB_OUTPUT"
- else
+ elif [[ "${GITHUB_REF}" == "refs/heads/main" ]]; then
echo "tag=latest" >> "$GITHUB_OUTPUT"
+ else
+ echo "tag=manual-${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
fi
env:
EVENT_NAME: ${{ github.event_name }}
+ GITHUB_REF: ${{ github.ref }}
+ COMMIT_SHA: ${{ github.sha }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/build-push.yml around lines 227 - 236, The Determine tag
step (id: tag) currently treats workflow_dispatch like other non-schedule runs
and emits tag=latest, which can overwrite latest from non-main refs; update this
step to: if EVENT_NAME == "schedule" set tag=nightly, else if EVENT_NAME ==
"workflow_dispatch" set a distinct tag (e.g.,
tag=manual-${GITHUB_REF#refs/heads/} or tag=manual) or output a flag to skip
pushing the manifest, and only emit tag=latest when GITHUB_REF (or github.ref)
equals refs/heads/main; keep the step id: tag and env EVENT_NAME usage but add
the GITHUB_REF check to gate latest to main and handle manual runs separately.
- Remove workflow_dispatch trigger to prevent accidental overwrites of the latest tag from non-main branches - Smoke test now extracts Image, Environment, PublishPort, Volume, RunInit, and Exec from the quadlet baked into the built image rather than hardcoding them, so quadlet drift is caught in CI Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/build-push.yml:
- Around line 155-186: The workflow extracts the quadlet into QUADLET but
ignores the quadlet's UserNS and User directives, so the generated podman run
(constructed via ARGS and used with podman run $ARGS "$OC_IMAGE" $EXEC_CMD)
doesn't preserve production user/namespace semantics; modify the parsing of
QUADLET (the same block that builds ARGS, reads
Environment/PublishPort/Volume/Exec) to translate UserNS=keep-id into adding
--userns=keep-id to ARGS and parse User=%U:%G (or concrete UID:GID values) to
add --user UID:GID (or --user="%U:%G" after expanding) so podman run uses the
same user/namespace as the quadlet, or alternatively invoke the quadlet directly
instead of reconstructing the podman run command to guarantee identical
behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6df35c8e-c62f-40e8-9d29-604baf3e5649
📒 Files selected for processing (1)
.github/workflows/build-push.yml
Translates UserNS=keep-id to --userns=keep-id and expands User=%U:%G to the runner's UID:GID so the smoke test matches production user/namespace semantics. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit