Repository navigation
Log the Docker Task's Build-Base Leg In to Docker Hub - #3124
Conversation
The docker-build-base job ran the caller's hook with no Docker Hub login, and a composite action cannot read secrets, so a hook asked to push its base image had no credentials to push with. The job now checks and uses the same credentials build-docker does before the hook runs, and passes the hook branch and smoke, the inputs the core selects its platforms from, so a base build can match the product images built on it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The platform selection is decided once in the task, so the hook now receives that resolved list instead of the smoke flag it would have to re-derive the selection from. A composite action reads a boolean input as a string, so a hook copying the core's expression would never select multi-arch. The selection moves to workflow-level env so both jobs read the one value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
A recorded local strict-review pass covers head |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly describes the main change: logging the Docker task's build-base job in to Docker Hub before running the hook. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
There was a problem hiding this comment.
🟡 Changes recommended
The workflow’s top-level platform expression is invalid and must be moved to job scope before approval.
1 open finding
What changed in this PR
This PR enables Docker base-image hooks to authenticate with Docker Hub and receive the resolved build platforms, with the hook contract documented.
Changes:
- Adds Docker Hub credential validation and login before the base hook.
- Passes
branchandplatformsto the hook. - Documents the expanded hook contract.
| File | Summary |
|---|---|
docs/reusable-workflows.md |
Documents the Docker base-hook contract. |
.github/workflows/build-docker-task.yml |
Adds authentication and hook inputs; requires fixing the invalid top-level inputs expression. |
🧠 Review effort: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #3124 +/- ##
==========================================
Coverage ? 63.94%
==========================================
Files ? 17
Lines ? 9145
Branches ? 0
==========================================
Hits ? 5848
Misses ? 3297
Partials ? 0
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
… Fixes to Main (#3146) - #3135 makes `gh-write-guard` read a gh write's subcommand and target the way gh parses them: the subcommand is found past flags before the command and before the subcommand, an `R` inside a short-option cluster is read as a target, `GH_REPO` is read as a target, a run-time repository owner on a write fails closed, and a run-time word where `pr` or `merge` goes fails closed beside `--admin` or where word splitting may split it - #3139 releases the bootstrap lock when a `bootstrap.ps1` run ends rather than when its process does, so a second run typed at the same pwsh prompt is no longer refused the lock - #3130 matches tool names and the `all` keyword by case in the Windows agents loaders, as the Linux loaders already do - #3128 reads CodeRabbit's rate limit on a reply to an explicit review command in `pr_review.py` - #3126 reconciles VSCode-Server-DotNetCore in the hub after its resync - #3124 logs the Docker task's build-base leg in to Docker Hub - #3122 names the carried skill and the skipped review correctly - #3120 states the subprocess encoding rule in `CODESTYLE.md`, where carriers read Python style - #3118 and #3111 move the release-guard tests' workflow-command checks onto `runner_commands`, and test the alternatives wiring at the `audit_repo` and `fidelity_pass` call sites - #3116 stops the doc gates' printed names forging workflow commands - #3113 adds a catalog snippet for the release-with-smoke caller - #3109 moves the `workflow_reuse` fetch onto `audit.contents_text` - #3105 accepts `.codecov.yml` as an alternative to `codecov.yml` - #3103 adds a pip ecosystem to the carried Dependabot snippet - #3100 prefers the venv's ruff and pyright for a declared pip directory - #3098 tracks composite action pins in Dependabot - #3096 reads an uppercase Markdown suffix as Markdown at every prose gate branch After this merges, the host-safety installer payload changes, so the maintainer runs the installer after promotion. Closes #1416 Closes #1425 Closes #1578 Closes #1874 Closes #1892 Closes #1899 Closes #2804 Closes #2850 Closes #2852 Closes #2854 Closes #2996 Closes #3065 Closes #3067 Closes #3069 Closes #3079 Closes #3080 Closes #3089 Closes #3093 Closes #3101 Closes #3106 Closes #3107 Closes #3137 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a pull-request smoke build that runs when relevant release files change and reports the combined validation and build status. * Repository audits now recognize `.codecov.yml` as an alternative to `codecov.yml`. * **Improvements** * Python linting and type checks use tools from declared project environments when available, with fallbacks for missing tools. * Workflow and lint reports safely display unusual filenames and command-like text. * GitHub write-target checks now account for additional command forms and fail closed when targets cannot be verified. * Rate-limit detection now recognizes another CodeRabbit response format. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Summary
build-docker-task.yml'sdocker-build-basejob now runs the same "Require Docker Hub credentials" and "Login to Docker Hub" steps thebuild-dockerjob carries, ahead of the caller's hook. A composite action cannot readsecrets, so before this a hook asked to push its base image had no credentials to push with.branchandplatforms, the platform list the core builds the product images for, so a base build matches them rather than inferring them frompush. The selection moves from thebuild-dockerjob'senvto workflow-levelenv, so both jobs read one value. The handoff namedbranchandsmoke, the issue offered either those or the resolved platforms, and the local review pass foundsmokewould make each hook re-derive a selection the file header says is decided once here. A composite action also reads that boolean as a string, so a hook copying the core's expression would never select multi-arch.docs/reusable-workflows.md"The Docker Family" states the hook contract: the login before the hook, the four inputs it receives, and that the hook sets up its own QEMU and Buildx for a multi-arch list.pushandrefgets a runner "Unexpected input(s)" warning until it declares the two new inputs, and the run does not fail.A live Docker Hub push cannot be exercised from a local session, so verification is actionlint, markdownlint, editorconfig-checker, the prose and repo gates,
spec/validate.py, and the unittest suite.Closes on promotion: #1892
🤖 Generated with Claude Code
Summary by CodeRabbit