Refactor container workflows to use dynamic registry and repository owner#10
Merged
Refactor container workflows to use dynamic registry and repository owner#10
Conversation
- Fix critical bug: push condition used broken input comparison that would push images on pull_request events. Restored safe guard: github.event_name != 'pull_request' (build always, push only on merge) - Remove dead code: unused metadata-action step, date tag step, RETRY_TIMES/RETRY_DELAY env vars, and IMAGE_NAME/SINGULARITY_IMAGE_NAME - Standardize Docker login to use github.repository_owner across all jobs - Standardize Singularity install (eWaterCycle/setup-singularity@v7) and auth (singularity remote login --password-stdin) across all jobs, replacing fragile apt-get || true and env-var-based auth - Replace all hardcoded bigbio refs in push URIs with github.repository_owner - Remove redundant docker pull (image already loaded via load: true) https://claude.ai/code/session_01UFH8ge5154Z8q4DCEbQCTX
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe workflow configuration was refactored to use dynamic registry namespacing ( Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Refactors the quantms-containers GitHub Actions workflow to reduce hardcoded GHCR/org values by introducing a workflow-level registry variable and using the repository owner dynamically, while also updating Singularity setup/auth steps.
Changes:
- Introduces a workflow-level
REGISTRYenv var and replaces hardcoded org/repo references with${{ github.repository_owner }}in multiple image operations. - Updates container publish/auth flows to rely on
${{ secrets.GITHUB_TOKEN }}and useseWaterCycle/setup-singularity@v7instead of inline package installs. - Adds/adjusts job guards and refactors Docker→Singularity conversion/push steps.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
132
to
137
| - name: Build and Push DiaNN ${{ matrix.context }} image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: ./${{ matrix.context }} | ||
| push: ${{ (github.event.inputs.push_images == true || github.event.inputs.push_images == '') }} | ||
| push: ${{ github.event_name != 'pull_request' }} | ||
| load: true |
Comment on lines
164
to
170
| - name: Login and Deploy Container | ||
| if: ${{ (github.event.inputs.push_images == true || github.event.inputs.push_images == '') }} | ||
| if: github.event_name != 'pull_request' | ||
| run: | | ||
| echo ${{ secrets.GITHUB_TOKEN }} | singularity remote login -u ${{ github.actor }} --password-stdin oras://ghcr.io | ||
| echo ${{ secrets.GITHUB_TOKEN }} | singularity remote login -u ${{ github.repository_owner }} --password-stdin oras://ghcr.io | ||
|
|
||
| # Push with version tag | ||
| singularity push ${{ matrix.context }}.sif oras://${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.sif }} |
Comment on lines
234
to
236
| run: | | ||
| sudo apt-get update && sudo apt-get install -y singularity-container || true | ||
| docker save ${{ matrix.tag }} -o image.tar | ||
| singularity build image.sif docker-archive://image.tar |
Comment on lines
275
to
+277
| docker pull ghcr.io/openms/openms-tools-thirdparty:latest | ||
| docker tag ghcr.io/openms/openms-tools-thirdparty:latest ghcr.io/bigbio/openms-tools-thirdparty:${{ env.OPENMS_VERSION }} | ||
| docker push ghcr.io/bigbio/openms-tools-thirdparty:${{ env.OPENMS_VERSION }} | ||
| docker tag ghcr.io/openms/openms-tools-thirdparty:latest ghcr.io/${{ github.repository_owner }}/openms-tools-thirdparty:${{ env.OPENMS_VERSION }} | ||
| docker push ghcr.io/${{ github.repository_owner }}/openms-tools-thirdparty:${{ env.OPENMS_VERSION }} |
Comment on lines
291
to
+293
| run: | | ||
| sudo apt-get update && sudo apt-get install -y singularity-container || true | ||
| export SINGULARITY_DOCKER_USERNAME=${{ github.actor }} | ||
| export SINGULARITY_DOCKER_PASSWORD=${{ secrets.GITHUB_TOKEN }} | ||
| echo ${{ secrets.GITHUB_TOKEN }} | singularity remote login -u ${{ github.repository_owner }} --password-stdin oras://ghcr.io | ||
|
|
secrets.GITHUB_TOKEN is scoped to the workflow actor, so the login username must match. Using github.repository_owner causes 401 errors when the actor differs from the owner (e.g. collaborators, bots). Applies to all 3 Docker logins and all 3 Singularity logins. https://claude.ai/code/session_01UFH8ge5154Z8q4DCEbQCTX
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR refactors the quantms-containers GitHub Actions workflow to use dynamic registry and repository owner variables instead of hardcoded values. This enables the workflow to be more flexible and work across different organizations and registries.
Key Changes
REGISTRY: ghcr.ioas a workflow-level environment variable for consistencybigbioreferences with${{ github.repository_owner }}to support forked repositories and different organizations${{ github.repository_owner }}instead of${{ github.actor }}and switched from customGHCR_TOKENto standard${{ secrets.GITHUB_TOKEN }}apt-getinstallation with dedicatedeWaterCycle/setup-singularity@v7action for better reliability and maintainabilitysingularity remote logincommand with piped token instead of environment variablesgithub.repository_owner == 'bigbio'conditions to build-relink and sync-openms jobs to prevent unauthorized pushesimage.tarNotable Implementation Details
bigbioorganizationhttps://claude.ai/code/session_01UFH8ge5154Z8q4DCEbQCTX
Summary by CodeRabbit