[INFRA-208] Reorganize deployment structure and update build workflows#7391
[INFRA-208] Reorganize deployment structure and update build workflows#7391sriramveeraghanta merged 4 commits intopreviewfrom
Conversation
- Restructure deployment directories from deploy/ to deployments/ - Move selfhost files to deployments/cli/community/ - Add new AIO community deployment setup - Update GitHub Actions workflows for new directory structure - Add Caddy proxy configuration for CE deployment - Remove deprecated AIO build files and workflows - Update build context paths in install scripts
WalkthroughThis change removes the legacy AIO (All-In-One) Docker build system, including Dockerfiles, scripts, and CI workflows, and introduces a new community-oriented AIO deployment under Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant GitHub Actions
participant Build Script
participant Docker
participant Artifact Store
User->>GitHub Actions: Triggers build-branch workflow (aio_build=true)
GitHub Actions->>Build Script: Run community AIO build script (build.sh)
Build Script->>Docker: Build AIO image using new Dockerfile
Build Script->>Artifact Store: Upload build assets
GitHub Actions->>Docker: Push built AIO image to registry
GitHub Actions->>Artifact Store: Upload deployment assets for release
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Pull Request Linked with Plane Work Items Comment Automatically Generated by Plane |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🔭 Outside diff range comments (1)
deployments/aio/community/variables.env (1)
52-54: Second exposed secret
LIVE_SERVER_SECRET_KEYhas the same problem – rotate & externalise it.
🧹 Nitpick comments (7)
deployments/cli/community/install.sh (1)
199-200: Guard against missingbuild.ymlIf the branch being installed doesn’t contain
deployments/cli/community/build.ymlthe script aborts with “No such file or directory”.
Wrap the copy in an existence check to fall back gracefully:-if [ -f "$PLANE_TEMP_CODE_DIR/deployments/cli/community/build.yml" ]; then - cp "$PLANE_TEMP_CODE_DIR/deployments/cli/community/build.yml" "$PLANE_TEMP_CODE_DIR/build.yml" -else - echo "build.yml not found in branch $BRANCH; aborting." >&2 - exit 1 -fi +cp "$PLANE_TEMP_CODE_DIR/deployments/cli/community/build.yml" "$PLANE_TEMP_CODE_DIR/build.yml"deployments/cli/community/docker-compose.yml (1)
230-237: Host-mode ports prevent horizontal scalingExposing 80/443 with
mode: hostbinds the node’s ports directly, meaning:• only one replica can run per Swarm node
• rolling updates briefly fail if the replacement container can’t bindUnless you depend on
hostnetworking for performance, considermode: ingress(default) to allow seamless rolling updates and multi-replica proxying.deployments/aio/community/Dockerfile (1)
48-48: Consider minimizing additional packages.Some packages like
vimandncdumight be unnecessary for production deployments and could increase the image size and attack surface.Consider creating a separate debug/development variant or making these packages optional:
-RUN apk add --no-cache nss-tools bash curl uuidgen ncdu vim +RUN apk add --no-cache nss-tools bash curl uuidgendeployments/aio/community/start.sh (2)
90-108: Domain validator prints to STDOUT – side-effect in command substitution
validate_domain_nameechoes “IP/FQDN/INVALID”, which is subsequently stored indomain_type. That output is also printed to the console, cluttering logs. Redirect within the caller orechoonly on error.local domain_type domain_type=$(validate_domain_name "$DOMAIN_NAME")and silence the function unless
INVALID.
3-9:clearmay be unavailable in minimal Docker imagesBusyBox/Alpine images often miss
clear; failures will terminate the script because of-e. Usecommand -v clear >/dev/null && clearor remove..github/workflows/build-branch.yml (2)
286-296: Unquoted expressions trigger ShellCheck SC2086Variables expanded inside the inline script (
${{ … }}) should be quoted to avoid word-splitting:- bash ./build.sh --release $aio_version + bash ./build.sh --release "$aio_version"
288-288: Trailing whitespace flagged by yamllintRemove trailing spaces on blank line 288 to keep CI linters green.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (6)
deployments/cli/community/images/download.pngis excluded by!**/*.pngdeployments/cli/community/images/migrate-error.pngis excluded by!**/*.pngdeployments/cli/community/images/restart.pngis excluded by!**/*.pngdeployments/cli/community/images/started.pngis excluded by!**/*.pngdeployments/cli/community/images/stopped.pngis excluded by!**/*.pngdeployments/cli/community/images/upgrade.pngis excluded by!**/*.png
📒 Files selected for processing (26)
.github/workflows/build-aio-base.yml(0 hunks).github/workflows/build-aio-branch.yml(0 hunks).github/workflows/build-branch.yml(8 hunks)aio/Dockerfile-app(0 hunks)aio/Dockerfile-base-full(0 hunks)aio/Dockerfile-base-slim(0 hunks)aio/env.sh(0 hunks)aio/nginx.conf(0 hunks)aio/pg-setup.sh(0 hunks)aio/postgresql.conf(0 hunks)aio/supervisord-app(0 hunks)aio/supervisord-full-base(0 hunks)aio/supervisord-slim-base(0 hunks)apps/proxy/Caddyfile.ce(1 hunks)apps/proxy/Dockerfile.ce(1 hunks)deployments/aio/community/Dockerfile(1 hunks)deployments/aio/community/README.md(1 hunks)deployments/aio/community/build.sh(1 hunks)deployments/aio/community/start.sh(1 hunks)deployments/aio/community/supervisor.conf(1 hunks)deployments/aio/community/variables.env(1 hunks)deployments/cli/community/docker-compose.yml(3 hunks)deployments/cli/community/install.sh(2 hunks)deployments/cli/community/variables.env(3 hunks)deployments/kubernetes/community/README.md(1 hunks)deployments/swarm/community/swarm.sh(2 hunks)
💤 Files with no reviewable changes (12)
- aio/supervisord-app
- aio/env.sh
- aio/supervisord-full-base
- aio/pg-setup.sh
- aio/supervisord-slim-base
- aio/Dockerfile-base-slim
- aio/Dockerfile-base-full
- aio/nginx.conf
- aio/postgresql.conf
- .github/workflows/build-aio-branch.yml
- aio/Dockerfile-app
- .github/workflows/build-aio-base.yml
🧰 Additional context used
🧬 Code Graph Analysis (1)
deployments/aio/community/build.sh (1)
deployments/aio/community/start.sh (2)
update_env_file(111-156)main(158-167)
🪛 Gitleaks (8.26.0)
deployments/aio/community/README.md
77-77: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
deployments/aio/community/variables.env
29-29: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
53-53: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🪛 Shellcheck (0.10.0)
deployments/aio/community/start.sh
[warning] 114-114: Declare and assign separately to avoid masking return values.
(SC2155)
[warning] 164-164: Quote this to prevent word splitting.
(SC2046)
deployments/aio/community/build.sh
[warning] 54-54: Quote this to prevent word splitting.
(SC2046)
🪛 actionlint (1.7.7)
.github/workflows/build-branch.yml
286-286: shellcheck reported issue in this script: SC2086:info:9:44: Double quote to prevent globbing and word splitting
(shellcheck)
333-333: shellcheck reported issue in this script: SC2016:info:8:8: Expressions don't expand in single quotes, use double quotes for that
(shellcheck)
🪛 YAMLlint (1.37.1)
.github/workflows/build-branch.yml
[warning] 272-272: wrong indentation: expected 6 but found 8
(indentation)
[warning] 273-273: wrong indentation: expected 6 but found 8
(indentation)
[warning] 274-274: wrong indentation: expected 6 but found 8
(indentation)
[warning] 275-275: wrong indentation: expected 6 but found 8
(indentation)
[warning] 276-276: wrong indentation: expected 6 but found 8
(indentation)
[warning] 277-277: wrong indentation: expected 6 but found 8
(indentation)
[warning] 278-278: wrong indentation: expected 6 but found 8
(indentation)
[warning] 279-279: wrong indentation: expected 4 but found 6
(indentation)
[error] 288-288: trailing spaces
(trailing-spaces)
[warning] 400-400: too many blank lines (1 > 0)
(empty-lines)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Analyze (javascript)
🔇 Additional comments (24)
deployments/kubernetes/community/README.md (2)
1-1: Validate title consistency across deployment docsThe new heading (“Helm Chart: Plane Community”) looks fine in isolation, but other READMEs still use “Helm Chart” (without the suffix). For searchability and a uniform UX, double-check that all sibling deployment docs follow the same naming convention.
5-5: Artifact Hub badge URL verifiedThe badge in deployments/kubernetes/community/README.md now points to https://artifacthub.io/packages/helm/makeplane/plane-ce and correctly resolves to the public Plane CE Helm package. No further changes needed.
deployments/cli/community/install.sh (1)
12-12: 👍 Path realignment looks correct
FALLBACK_DOWNLOAD_URLnow points at the new community CLI tree – matches the repository move.deployments/swarm/community/swarm.sh (2)
12-12: Consistent fallback URLThe fallback now mirrors the CLI installer – good catch.
153-154: Style / correctness fix confirms conditional executionMoving
thenonto the same line avoids a POSIX shell-syntax error in strict sh.deployments/cli/community/docker-compose.yml (1)
27-36: Environment variable drift – double-check defaults
LISTEN_HTTP_PORTderives its default fromLISTEN_PORT, which is no longer defined anywhere after the rename.
Either introduceLISTEN_PORTin variables.env for compatibility or change this to self-reference:- LISTEN_HTTP_PORT: ${LISTEN_PORT:-80} + LISTEN_HTTP_PORT: ${LISTEN_HTTP_PORT:-80}Same for
LISTEN_HTTPS_PORT.
Without this, a fresh install will expose no ports when the user omits the new vars.deployments/cli/community/variables.env (3)
3-3: Good addition of SSL configuration flag.The SSL boolean flag provides a clear way to enable/disable SSL functionality.
13-14: Well-structured port configuration.Separating HTTP and HTTPS ports provides clarity and flexibility for different deployment scenarios.
43-54: Comprehensive ACME certificate configuration.The SSL certificate configuration covers both standard ACME and DNS challenge scenarios with helpful comments for users.
apps/proxy/Caddyfile.ce (2)
1-19: Well-structured reverse proxy configuration.The proxy snippet provides clear routing for different services with appropriate request body size limits. The routing hierarchy is logical with the catch-all route at the end.
21-30: Comprehensive global configuration.The global configuration includes proper ACME settings, server limits, and trusted proxy configuration. The use of environment variables with defaults provides good flexibility.
deployments/aio/community/build.sh (3)
11-32: Robust argument parsing implementation.The flag parsing logic correctly handles both
--flag valueand--flag=valuesyntax, providing good user experience.
78-94: Comprehensive environment file update function.The function properly handles both updating existing keys and adding new ones, with cross-platform sed compatibility.
114-120: Verify service port mappings in CaddyfileFile: deployments/aio/community/build.sh (lines 114–120)
The replacement commands update Caddyfile ports as follows:
- web:3000 → localhost:3001
- space:3000 → localhost:3002
- admin:3000 → localhost:3003
- api:8000 → localhost:3004
- live:3000 → localhost:3005
No matching port definitions were found in supervisor.conf, any docker-compose.yml, or environment files. Please manually confirm these mappings align with the actual AIO service configurations.
deployments/aio/community/README.md (4)
1-16: Comprehensive service overview.The introduction clearly explains what's included in the AIO image with specific port mappings, making it easy for users to understand the architecture.
32-46: Well-documented environment variables.The required environment variables are clearly categorized and explained, making deployment straightforward for users.
76-77: False positive security warning.The static analysis tool flagged this as a security issue, but this is clearly an example API key in documentation (contains obvious placeholder values like "5MV45J9NF5TEFZWYCRAX").
136-175: Excellent troubleshooting and production guidance.The troubleshooting section and production considerations provide valuable guidance for deployment and operational concerns.
deployments/aio/community/Dockerfile (4)
1-13: Well-structured multi-stage build.The approach of pulling pre-built images for different components is efficient and follows good containerization practices.
22-25: Appropriate runtime dependencies.The Alpine packages (libpq, libxslt, xmlsec) are necessary for the Python application runtime requirements.
38-39: Good optimization with cache cleanup.Removing Next.js cache directories helps reduce the final image size.
57-60: Proper directory setup and permissions.The directory creation and permission setting for logs, data, and startup script is correctly implemented.
deployments/aio/community/supervisor.conf (1)
2-5: Running supervisord as root – evaluate threat model
user=rootinside a container is sometimes acceptable, but still increases blast-radius if any process escapes the jail. Consider using an unprivileged user and only elevate where absolutely needed..github/workflows/build-branch.yml (1)
341-343:sednever expands${REL_VERSION}– release placeholder stays literalSingle-quotes stop variable interpolation:
- sed -i 's/${APP_RELEASE:-stable}/${APP_RELEASE:-'${REL_VERSION}'}/g' deployments/cli/community/docker-compose.yml + sed -i "s|\${APP_RELEASE:-stable}|\${APP_RELEASE:-${REL_VERSION}}|g" deployments/cli/community/docker-compose.ymlSame issue appears in the
publish_releasejob.Likely an incorrect or invalid review comment.
- Changed `apk add` command in Dockerfile to use `--no-cache` for better image size management. - Updated `build.sh` to ensure proper directory navigation with quotes around `dirname "$0"`. - Modified `supervisor.conf` to set `stderr_logfile_maxbytes` to 50MB and added `stderr_logfile_backups` for better log management across multiple services.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
deployments/aio/community/build.sh (1)
54-54: Still unquoted – path with spaces will breakcdPrevious review already highlighted this. Quoting is required to avoid word-splitting:
-cd $(dirname "$0") +cd "$(dirname "$0")"
🧹 Nitpick comments (1)
deployments/aio/community/build.sh (1)
56-76:sedhelpers are fragile for special-character patterns
string_replaceandremove_linetreat the search string as a basic regex; any/,&,.or*in the pattern will change the meaning. If the values you substitute (e.g., URLs) ever contain these characters the replacement will mis-behave.A safer approach is to escape the search string:
local search_escaped search_escaped=$(printf '%s\n' "$search" | sed 's/[\/&]/\\&/g') sed -i ... "s|$search_escaped|$replace|g" "$file"Optional, but will save you subtle bugs later.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
apps/proxy/Dockerfile.ce(1 hunks)deployments/aio/community/build.sh(1 hunks)deployments/aio/community/supervisor.conf(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
- apps/proxy/Dockerfile.ce
- deployments/aio/community/supervisor.conf
🧰 Additional context used
🧬 Code Graph Analysis (1)
deployments/aio/community/build.sh (1)
deployments/aio/community/start.sh (2)
update_env_file(111-156)main(158-167)
🪛 Shellcheck (0.10.0)
deployments/aio/community/build.sh
[warning] 54-54: Quote this to prevent word splitting.
(SC2046)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Analyze (javascript)
#7391) * refactor: reorganize deployment structure and update build workflows - Restructure deployment directories from deploy/ to deployments/ - Move selfhost files to deployments/cli/community/ - Add new AIO community deployment setup - Update GitHub Actions workflows for new directory structure - Add Caddy proxy configuration for CE deployment - Remove deprecated AIO build files and workflows - Update build context paths in install scripts * chore: update Dockerfile and supervisor configuration - Changed `apk add` command in Dockerfile to use `--no-cache` for better image size management. - Updated `build.sh` to ensure proper directory navigation with quotes around `dirname "$0"`. - Modified `supervisor.conf` to set `stderr_logfile_maxbytes` to 50MB and added `stderr_logfile_backups` for better log management across multiple services. * chore: consistent node and python version --------- Co-authored-by: sriramveeraghanta <veeraghanta.sriram@gmail.com>
2 participants
deploy/->deployments/deployments/cli/community/Description
Type of Change
Screenshots and Media (if applicable)
Test Scenarios
References
Summary by CodeRabbit
Summary by CodeRabbit
New Features
Improvements
Bug Fixes
Chores