feat: add Docker support and deployment workflow#70
Conversation
- Introduced a Dockerfile for building the pengine web image, serving the static bundle. - Added a docker-compose.yml for deploying the web app on a remote host. - Created a GitHub Actions workflow for automated deployment of the web app to GHCR and SSH rollout. - Updated .env.production to define the public site URL. - Enhanced the application to support lazy loading of routes for improved performance. - Updated versioning across package.json and Cargo files to 1.0.2.
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 48 minutes and 17 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThis PR introduces a complete web application deployment pipeline. It adds Docker containerization for the web frontend, a GitHub Actions CI/CD workflow that builds and deploys to a remote host via SSH, production environment configuration, frontend code-splitting optimizations, and comprehensive deployment documentation. Application version is bumped to 1.0.2 across package metadata files. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
src/shared/appMeta.ts (1)
1-2: Consider logging/asserting when the fallback is used in production.Since
VITE_APP_ORIGINis substituted at build time, a misconfigured Docker build (missing--build-arg) would silently bake in thehttps://pengine.netfallback with no indication. The current default is correct for the intended prod host, but if this module is ever reused in another deployment the silent fallback could mask a misconfiguration. Optional: narrow the fallback to dev-only, or emit a one-time warning whenimport.meta.env.PROD && !import.meta.env.VITE_APP_ORIGIN.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/shared/appMeta.ts` around lines 1 - 2, Detect when import.meta.env.VITE_APP_ORIGIN is missing and import.meta.env.PROD is true, and emit a one-time warning or throw to avoid silently using the fallback; specifically modify APP_ORIGIN initialization in appMeta.ts to check import.meta.env.VITE_APP_ORIGIN and import.meta.env.PROD, and if PROD && no VITE_APP_ORIGIN then either console.error/processLogger.error or assert/throw (or restrict the fallback to dev-only) so the missing build arg is surfaced; ensure the check is performed at module load and references APP_ORIGIN, import.meta.env.VITE_APP_ORIGIN and import.meta.env.PROD.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/web-deploy.yml:
- Around line 89-94: Replace the runtime ssh-keyscan approach in the "Trust host
key" step: stop using ssh-keyscan -H "$DEPLOY_HOST" and instead read the
expected host key or fingerprint from a secret (e.g. a new secret like
DEPLOY_HOST_KEY or DEPLOY_HOST_FINGERPRINT) and write that exact value into
~/.ssh/known_hosts before connecting; update the step that references
DEPLOY_HOST and known_hosts to use the secret variable rather than generating
keys at deploy time so the workflow trusts only the pre-provisioned host key.
- Around line 40-56: The checkout step is still using the default workflow ref
so manual deployments can build the wrong commit; update the actions/checkout@v4
invocation to check out the requested tag when provided by the manual input (the
same TAG/VERSION logic used in the Resolve version step with id ver) by passing
the input tag/ref (e.g. use the TAG value or github.event.inputs.tag ||
github.ref) into the checkout step’s ref parameter so the job actually checks
out the requested tag before building and pushing the image.
In `@doc/guides/deploying-web.md`:
- Line 3: The Markdown link to the production env file is incorrect
(../.env.production resolves to doc/.env.production); update the link in
doc/guides/deploying-web.md so it points to the repository root file (change the
reference '../.env.production' to '../../.env.production') so the
VITE_APP_ORIGIN reference resolves correctly for the Vite production build.
---
Nitpick comments:
In `@src/shared/appMeta.ts`:
- Around line 1-2: Detect when import.meta.env.VITE_APP_ORIGIN is missing and
import.meta.env.PROD is true, and emit a one-time warning or throw to avoid
silently using the fallback; specifically modify APP_ORIGIN initialization in
appMeta.ts to check import.meta.env.VITE_APP_ORIGIN and import.meta.env.PROD,
and if PROD && no VITE_APP_ORIGIN then either console.error/processLogger.error
or assert/throw (or restrict the fallback to dev-only) so the missing build arg
is surfaced; ensure the check is performed at module load and references
APP_ORIGIN, import.meta.env.VITE_APP_ORIGIN and import.meta.env.PROD.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 471c5123-010e-4032-a3cd-4ad0736b378c
⛔ Files ignored due to path filters (2)
package-lock.jsonis excluded by!**/package-lock.jsonsrc-tauri/Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (14)
.dockerignore.env.production.github/workflows/web-deploy.ymldeploy/Dockerfiledeploy/docker-compose.ymldoc/README.mddoc/guides/deploying-web.mdpackage.jsonsrc-tauri/Cargo.tomlsrc-tauri/tauri.conf.jsonsrc/App.tsxsrc/shared/appMeta.tssrc/vite-env.d.tsvite.config.ts
| - name: Trust host key | ||
| env: | ||
| DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} | ||
| run: | | ||
| mkdir -p ~/.ssh | ||
| ssh-keyscan -H "$DEPLOY_HOST" >>~/.ssh/known_hosts 2>/dev/null |
There was a problem hiding this comment.
Avoid trusting the deploy host key from the network during the deploy.
ssh-keyscan accepts whatever key is presented at runtime, so a MITM at deploy time can get trusted. Prefer storing the expected host key/fingerprint as a secret and writing that to known_hosts.
🔐 Proposed fix
- name: Trust host key
env:
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+ DEPLOY_HOST_KEY: ${{ secrets.DEPLOY_HOST_KEY }}
run: |
mkdir -p ~/.ssh
- ssh-keyscan -H "$DEPLOY_HOST" >>~/.ssh/known_hosts 2>/dev/null
+ printf '%s\n' "$DEPLOY_HOST_KEY" >>~/.ssh/known_hosts📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Trust host key | |
| env: | |
| DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} | |
| run: | | |
| mkdir -p ~/.ssh | |
| ssh-keyscan -H "$DEPLOY_HOST" >>~/.ssh/known_hosts 2>/dev/null | |
| - name: Trust host key | |
| env: | |
| DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} | |
| DEPLOY_HOST_KEY: ${{ secrets.DEPLOY_HOST_KEY }} | |
| run: | | |
| mkdir -p ~/.ssh | |
| printf '%s\n' "$DEPLOY_HOST_KEY" >>~/.ssh/known_hosts |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/web-deploy.yml around lines 89 - 94, Replace the runtime
ssh-keyscan approach in the "Trust host key" step: stop using ssh-keyscan -H
"$DEPLOY_HOST" and instead read the expected host key or fingerprint from a
secret (e.g. a new secret like DEPLOY_HOST_KEY or DEPLOY_HOST_FINGERPRINT) and
write that exact value into ~/.ssh/known_hosts before connecting; update the
step that references DEPLOY_HOST and known_hosts to use the secret variable
rather than generating keys at deploy time so the workflow trusts only the
pre-provisioned host key.
- Added optional support for `DEPLOY_HOST_KNOWN_HOSTS` in the deployment workflow to improve SSH security. - Updated the deployment YAML to allow tag-based builds and ensure known hosts are handled correctly. - Enhanced the app metadata validation in `appMeta.ts` to throw an error if `VITE_APP_ORIGIN` is missing in production. - Adjusted documentation to reflect the new optional secret for known hosts.
1 participant
Summary by CodeRabbit
New Features
Documentation
Chores