[amazing-cat]

Closes #478

Changes

• The base image hash calculation moves from the inline step of release.yml to scripts/base-image-meta.sh; the script body is unchanged, so existing runtime-<hash> / builder-<hash> tags keep their values.
• container.yml gets a base-images job that runs in the same Wolfi SDK container as release.yml, calculates the tags with that script and checks that the images are published. The build then passes them as BUILDER_BASE_IMAGE_TAG / RUNTIME_BASE_IMAGE_TAG.
• If the images for the checked-out revision are not published (the revision changes build/base/** or build/packages/**), the job emits a warning and falls back to builder-latest / runtime-latest for that image, so such pull requests keep building.
• tests/ci/base-images.sh (run by release-check.yml) keeps the pieces that feed the hash identical in both workflows: the SDK image digest, build revision, config paths, OCI values, descriptions and hashFiles inputs.

Verification

• bash tests/ci/base-images.sh and bash tests/ci/release-tags.sh pass; scripts/base-image-meta.sh was run locally with stubbed apko/melange and produces the expected outputs.
• The workflows themselves are exercised by this pull request's CI run.

Open points

• A revision that changes the base images still builds against *-latest until the images are published; building them in CI would need the privileged Melange/apko flow of release.yml.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Improvements
  • Container image builds now select runtime and builder images based on relevant source revisions. If a matching image is unavailable, builds fall back to the corresponding latest image.
  • Release validation now checks that release and container builds use consistent base-image settings and metadata inputs.
  • Required image configuration and source information are validated before release tags are generated, helping surface incomplete or invalid build inputs earlier.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The release and container workflows use shared base-image metadata. The container workflow checks for revision-matched images, warns and falls back to latest tags when needed, and passes the selected tags to the build.

Changes: Base-image metadata and container build

Layer / File(s)	Summary
Calculate shared base-image metadata scripts/base-image-meta.sh, .github/workflows/release.yml	The script validates configuration and calculates runtime and builder hashes, source revisions, and image tags. The release workflow invokes the script to produce metadata outputs.
Resolve and pass container base-image tags .github/workflows/container.yml	The workflow calculates runtime and builder tags, checks for valid linux/amd64 manifests, and warns before falling back to the corresponding latest tag when a matching image is unavailable. The build receives the selected tags.
Check metadata consistency in CI tests/ci/base-images.sh, .github/workflows/release-check.yml	The test compares metadata inputs and required workflow references. Release-check runs the test for relevant pull request and main changes.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant ContainerWorkflow
  participant MetadataScript
  participant Registry
  participant DockerBuild
  ContainerWorkflow->>MetadataScript: Calculate runtime and builder tags
  MetadataScript-->>ContainerWorkflow: Return tags and source revisions
  ContainerWorkflow->>Registry: Check linux/amd64 manifests
  Registry-->>ContainerWorkflow: Report manifest availability
  ContainerWorkflow->>DockerBuild: Pass selected base-image tags

Loading

Possibly related PRs

• cattr-app/server-application#400: This PR introduced the container workflow that this change updates with base-image tag resolution.
• cattr-app/server-application#338: This PR established release-time base-image hashes that this change reuses in the shared metadata script.

Suggested reviewers: vermorag

Merge Risk: Minimal · up to 05b0a

No actionable merge-blocking risk remains identified for this change.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "ci: build the container check against the base images matching the checkout" matches the main change. The PR makes container.yml resolve base-image tags that match the checked-out revision,…
Linked Issues check		Issue #478 requires four coding outcomes. (1) container.yml must resolve base images by the same content hash as release.yml. Met: the new base-images job in container.yml runs scripts/base-image-meta…
Out of Scope Changes check		All changed files support issue #478. container.yml adds the base-images job, passes the resolved tags as build args, and updates comments. release.yml delegates its metadata calculation to scripts/ba…

Full details: Title check

Explanation

The title "ci: build the container check against the base images matching the checkout" matches the main change. The PR makes container.yml resolve base-image tags that match the checked-out revision, using a hash calculation shared with release.yml via scripts/base-image-meta.sh. It also adds fallback to runtime-latest or builder-latest with a warning when matching images are unpublished. The title is specific and concise. It omits the shared script and the fallback behavior, which is acceptable because the title does not need every detail. Note that the linked objectives describe the outcome as a fallback, not a build against unpublished matching images, so the title's wording "build ... against the base images matching the checkout" can be read as slightly broader than the fallback outcome.

Full details: Linked Issues check

Explanation

Issue #478 requires four coding outcomes. (1) container.yml must resolve base images by the same content hash as release.yml. Met: the new base-images job in container.yml runs scripts/base-image-meta.sh, the same script release.yml calls, inside the same pinned Wolfi SDK digest. (2) The hash calculation must be shared, not duplicated. Met for the calculation: both workflows call scripts/base-image-meta.sh. The hashFiles inputs and env values remain in both YAML files, and tests/ci/base-images.sh checks that they match. (3) The CI build must build against the matching images. Met for published images: the build job passes BUILDER_BASE_IMAGE_TAG and RUNTIME_BASE_IMAGE_TAG from the base-images job outputs. (4) When matching images are unpublished, the build must warn explicitly instead of falling back silently. Met: the resolve step emits ::warning:: and then falls back to runtime-latest or builder-latest. The issue accepts this fallback when the warning is explicit. Automated coverage: tests/ci/base-images.sh is added and run by release-check.yml. The builder tag is checked against RUNTIME_IMAGE, the same repository release.yml publishes builder tags to, so the check target is consistent.

Full details: Out of Scope Changes check

Explanation

All changed files support issue #478. container.yml adds the base-images job, passes the resolved tags as build args, and updates comments. release.yml delegates its metadata calculation to scripts/base-image-meta.sh, so both workflows share one hash path. scripts/base-image-meta.sh holds the shared calculation. tests/ci/base-images.sh checks the shared inputs, and release-check.yml runs that test and adds the new paths to its filters. The Trivy scan mentioned in the workflow is existing advisory behavior, not a new change. No unrelated change was found in the reviewed evidence.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 2 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

ast-grep (0.51.1)

ast-grep could not parse rule config: /ast-grep-rules/ast-grep-essentials/rules/ruby/security/dynamic-method-send-params-ruby.yml

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: cattr-app/server-application
• Branch: main
• File: .coderabbit.yaml
• Commit: 9691333
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 707e811e-5dc5-45c7-9f5e-995eb8392806

Commits

Reviewing files that changed from the base of the PR and between fd9204e and 05b0a42.

Files selected for processing: 1

• tests/ci/base-images.sh

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

[cattr-cla]

Contributor License Agreement

✅ Every human contributor has accepted Cattr CLA version 1.

• ✅ @vermorag

CLA SHA-256: 68cb254dc87c899f320d5a8977e7e380fd8f6cf6f9388e51d07d936f3a8ce38b

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T00:42:51.638484Z	fd9204e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[vermorag]

@coderabbitai review

[coderabbitai]

Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR