feat: build apisix-runtime against an arbitrary apisix-nginx-module ref - #482
feat: build apisix-runtime against an arbitrary apisix-nginx-module ref#482AlinsRan wants to merge 4 commits into
Conversation
`build-apisix-runtime.sh` already honours an `apisix_nginx_module_ver` override, but neither the Makefile nor the runtime Dockerfiles passed it through, so the only way to build against an unreleased module branch was to edit the pinned default. Thread the value through `build_runtime` and both runtime Dockerfiles (empty keeps the pinned default), and add a workflow_dispatch job that builds the deb for a given module ref and uploads it as an artifact.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 21 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe PR adds a manually dispatched workflow for building and publishing ChangesRuntime build configuration
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Maintainer
participant GitHubActions
participant Makefile
participant Docker
participant ArtifactStorage
Maintainer->>GitHubActions: dispatch workflow with build inputs
GitHubActions->>GitHubActions: validate inputs and install dependencies
GitHubActions->>Docker: build apisix-runtime Debian package
Makefile->>Docker: pass APISIX_NGINX_MODULE_VER for runtime builds
Docker-->>GitHubActions: return package and smoke-test result
GitHubActions->>ArtifactStorage: upload .deb artifact
Possibly related PRs
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…image Adds a workflow_dispatch trigger to the existing runtime deb job with inputs for the runtime version, the apisix-nginx-module ref and the base image, all defaulting to what the scheduled/PR runs already used. The deb filename is now discovered from the output directory instead of being spelled out, since it carries the base image codename. A separate dispatch-only workflow would not have been usable: GitHub only resolves workflow_dispatch for workflows that exist on the default branch.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-apisix-runtime-deb-dispatch.yml:
- Line 76: Update the workflow step using actions/upload-artifact to reference
the intended v4 release by its complete commit SHA instead of the mutable `@v4`
tag, preserving the existing artifact upload configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7d590c6f-2b99-4cf4-adab-5f7d3af05905
📒 Files selected for processing (4)
.github/workflows/build-apisix-runtime-deb-dispatch.ymlMakefiledockerfiles/Dockerfile.apisix-runtime.debdockerfiles/Dockerfile.apisix-runtime.rpm
| " | ||
|
|
||
| - name: Publish artifact | ||
| uses: actions/upload-artifact@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file=".github/workflows/build-apisix-runtime-deb-dispatch.yml"
sed -n '1,115p' "$file"
printf '\n-- upload-artifact references --\n'
rg -n -C 2 'actions/upload-artifact@' .github/workflows
printf '\n-- current v4 tag target --\n'
git ls-remote https://github.com/actions/upload-artifact.git \
'refs/tags/v4' 'refs/tags/v4^{}' || trueRepository: api7/apisix-build-tools
Length of output: 260
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '-- workflow files --'
git ls-files '.github/workflows/*' | sed -n '1,160p'
printf '%s\n' '-- matching workflow names and action references --'
rg -n -i -C 2 'build-apisix-runtime-deb-dispatch|actions/upload-artifact@|upload-artifact' .github 2>/dev/null || true
printf '%s\n' '-- repository status --'
git status --shortRepository: api7/apisix-build-tools
Length of output: 5653
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '-- repository revision --'
git rev-parse HEAD
git remote -v
printf '%s\n' '-- candidate path in Git objects --'
git cat-file -e HEAD:.github/workflows/build-apisix-runtime-deb-dispatch.yml 2>&1 || true
printf '%s\n' '-- action tag refs --'
git ls-remote https://github.com/actions/upload-artifact.git \
'refs/tags/v4' 'refs/tags/v4^{}' 2>&1 || trueRepository: api7/apisix-build-tools
Length of output: 570
Security Misconfiguration (CWE-829): Inclusion of Functionality from Untrusted Control Sphere
Reachability: External
Pin actions/upload-artifact to a full commit SHA.
@v4 follows a mutable tag. Pin the intended release to prevent upstream tag changes from altering code executed with the workflow token and workspace access.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-apisix-runtime-deb-dispatch.yml at line 76, Update
the workflow step using actions/upload-artifact to reference the intended v4
release by its complete commit SHA instead of the mutable `@v4` tag, preserving
the existing artifact upload configuration.
The validation already accepted a ref containing slashes, but the checkout
directory was named after the ref verbatim, so a branch ref such as
`feat/foo` produced a nested `apisix-nginx-module-feat/foo` and every path
relative to it broke:
cd apisix-nginx-module-feat/var-index-access/patch
./patch.sh: pushd: ../../openresty-1.29.2.4/bundle/nginx-1.29.2: No such file
Replace the slashes when building the directory name and keep the ref itself
for the clone.
Lets two builds that differ only by the module ref be told apart by the package name instead of by which run produced them.
1 participant
build-apisix-runtime.shalready honours anapisix_nginx_module_veroverride, but neither the Makefile nor the runtime Dockerfiles passed it through, so the only way to build against an unreleased module branch was to edit the pinned default.apisix_nginx_module_verthroughbuild_runtimeand both runtime Dockerfiles; empty keeps the default pinned inbuild-apisix-runtime.shbuild-apisix-runtime-deb-dispatch.yml: aworkflow_dispatchjob that builds the deb for a given module ref, smoke checks it withdpkg -i+openresty -V, and uploads it as an artifactNeeded to perf test api7/apisix-nginx-module#124 without tagging a runtime release first.
Summary by CodeRabbit
New Features
Improvements