fix bug#67
Merged
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
📝 WalkthroughWalkthroughInfrastructure configuration is modernized for production readiness: consolidated deploy to GHCR with VPS atomic env handling and health verification, Docker Compose healthchecks and conditional starts, backend/ml_core run as non-root users, Nginx enables HTTP/2 and adds security headers, and CI Python runtime bumped to 3.12. ChangesProduction Infrastructure Modernization
Sequence Diagram(s)sequenceDiagram
participant GitHub
participant GHCR
participant VPS
participant Compose
participant BackendAPI
GitHub->>GHCR: build & push images
GitHub->>VPS: run SSH deploy script
VPS->>Compose: docker compose pull & up
Compose->>BackendAPI: run migrations / start
VPS->>BackendAPI: curl /api/health
BackendAPI-->>VPS: 200 OK / non-200
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
h00yaday
commented
May 11, 2026
Collaborator
Author
h00yaday
left a comment
h00yaday
left a comment
There was a problem hiding this comment.
Вроде все работает
Reviewed in CodeRabbit Review Stack
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy.yml:
- Around line 30-38: The workflow currently only builds and pushes the backend
image, so add equivalent build and push steps for the frontend and ml_core
images using the same tagging scheme (use env.IMAGE_PREFIX with :${{ github.sha
}} and :latest) so the remote docker compose pull && up -d will fetch the
updated images; specifically duplicate the docker build and docker push commands
for ./frontend and ./ml_core (same tags as backend) so IMAGE_PREFIX, frontend,
ml_core and the :${{ github.sha }}/:latest tags are used consistently.
- Around line 49-57: The .env.tmp keys written by the workflow don’t match what
docker-compose expects; update the echo lines so the environment variable names
match Compose (e.g., write POSTGRES_USER and POSTGRES_PASSWORD instead of
PROD_DB_USER/PROD_DB_PASSWORD, and add POSTGRES_DB using the appropriate secret
like secrets.PROD_DB_NAME), and either remove or map unused keys (DATABASE_URL,
PROD_REDIS_URL) to the environment names docker-compose actually reads;
specifically change the echo lines that write PROD_DB_USER/PROD_DB_PASSWORD to
echo "POSTGRES_USER=${{ secrets.PROD_DB_USER }}" and echo "POSTGRES_PASSWORD=${{
secrets.PROD_DB_PASSWORD }}", add echo "POSTGRES_DB=${{ secrets.PROD_DB_NAME }}"
(or the correct DB-name secret), and adjust or drop DATABASE_URL and
PROD_REDIS_URL so names align with docker-compose.yml.
- Around line 21-24: Update the GitHub Actions step references to supported,
pinned versions: replace actions/checkout@v3 with actions/checkout@v6,
docker/login-action@v2 with docker/login-action@v4, and change
appleboy/ssh-action@master to a specific stable tag (e.g.,
appleboy/ssh-action@v1 or appleboy/ssh-action@v1.2.5) so the workflow uses
supported runtimes and avoids mutable branch references; locate the three uses
of actions by their identifiers (actions/checkout, docker/login-action,
appleboy/ssh-action) and update the version tags accordingly in the deploy
workflow.
In `@backend/Dockerfile`:
- Line 28: The CMD invoking uvicorn currently uses --proxy-headers but omits
--forwarded-allow-ips, so Uvicorn will ignore forwarded headers from Docker
Compose networking; update the uvicorn startup command (the CMD array that
starts uvicorn for main:app) to include --forwarded-allow-ips "*" (or the
specific Docker network CIDR) alongside --proxy-headers so X-Forwarded-Proto and
X-Forwarded-For are respected.
In `@docker-compose.yml`:
- Around line 79-84: The healthcheck for the backend_api service uses curl which
isn't installed in the backend image; change the healthcheck test to use the
Python binary already in the image (instead of "curl") to perform an HTTP GET
against /api/health and exit non-zero on failure so Docker reports healthy
correctly; update the healthcheck block (the healthcheck: test: entry for
backend_api) to run a python one-liner that opens a connection to
localhost:8000, requests /api/health, checks for a 200 response, and exits with
code 0 on success or non-zero on any error or non-200 status.
- Around line 193-198: The minio-init service never receives MINIO_ROOT_PASSWORD
so the entrypoint line running `mc alias set myminio ... admin
$${MINIO_ROOT_PASSWORD}` authenticates with an empty password; fix by adding an
environment mapping for MINIO_ROOT_PASSWORD to the minio-init service (e.g.
environment: - MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}) so the container has
the value, and adjust the entrypoint to use the in-container shell variable
(single $) in the `mc alias set` call (refer to the minio-init service, its
entrypoint, the `mc alias set` invocation, and the MINIO_ROOT_PASSWORD
variable).
In `@frontend/Dockerfile`:
- Around line 21-25: The Dockerfile currently creates appgroup/appuser (RUN
addgroup -S appgroup && adduser -S appuser -G appgroup) then runs chown -R
appuser:appgroup /app and sets USER appuser, but /app does not exist and running
Nginx as a non-root user on port 80 will fail; fix by changing the chown target
to the actual asset path (chown -R appuser:appgroup /usr/share/nginx/html) or
remove the chown entirely, and then choose one of two approaches for Nginx:
either run as root by removing the USER appuser line so Nginx can bind to port
80, or reconfigure Nginx to listen on a >=1024 port and update EXPOSE
accordingly; apply these changes around the RUN chown and USER appuser
statements and any EXPOSE/NGINX config references.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7fd9d79e-ded2-4b7f-9270-f6cb1bd80bf2
📒 Files selected for processing (7)
.github/workflows/ci.yml.github/workflows/deploy.ymlbackend/Dockerfiledocker-compose.ymlfrontend/Dockerfileinfra/nginx/default.confml_core/Dockerfile
h00yaday
force-pushed
the
infra/resolveproblems
branch
from
68a46db to
9b52c06
Compare
mashta-lilia
approved these changes
May 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Security
Chores