Auto-build seerr latest release with PR #1855 (hide requested media)#1
Conversation
|
Warning Review limit reached
Next review available in: 34 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
WalkthroughAdds a new GitHub Actions workflow that automatically rebuilds and publishes a Docker image applying a specific upstream pull request diff onto new upstream releases, tracks build state via a ChangesAutomated PR-tracking build workflow
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Scheduler as GitHub Actions Scheduler
participant Workflow as build.yml Workflow
participant UpstreamAPI as Upstream GitHub API
participant GitRepo as Workflow Repo (.last-built)
participant GHCR as GHCR Registry
Scheduler->>Workflow: Trigger scheduled/manual run
Workflow->>UpstreamAPI: Check upstream PR merge/close status
alt PR merged or closed
Workflow->>UpstreamAPI: Create notification issue
Workflow->>Workflow: Disable workflow
else PR open
Workflow->>UpstreamAPI: Fetch latest release tag
Workflow->>GitRepo: Compare tag against .last-built
alt New release detected
Workflow->>UpstreamAPI: Clone upstream at release tag
Workflow->>UpstreamAPI: Fetch PR diff
alt Diff applies cleanly
Workflow->>GHCR: Build and push Docker image
Workflow->>GitRepo: Update .last-built and commit
else Diff conflict
Workflow->>UpstreamAPI: Create conflict issue
end
else No new release
Workflow->>GitRepo: Perform keepalive commit if stale
end
end
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
97-149: 🔒 Security & Privacy | 🔵 TrivialSupply-chain consideration: the live PR diff is fetched and auto-published to
:latestwith no human review.Each run pulls the current state of PR
#1855(Line 108) and, on any new upstream release, builds and pushes it to${IMAGE}:latest— which Unraid consumes directly. If the PR head is force-pushed with malicious changes (compromised author account or a hijacked fork), the next scheduled run silently builds and ships that code to your production image.The tag-format validation (Lines 72-75) guards against branch/tag injection, but nothing pins the contents of the patch. Consider one of:
- Pin to a reviewed PR head SHA (fetch the diff for a known-good commit) and bump it deliberately, or
- Gate publication of
:latestbehind a manual approval/notification while still auto-tracking releases.This is inherent to the auto-tracking design, so it may be an accepted trade-off — flagging it so the risk is explicit.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yml around lines 97 - 149, The workflow auto-fetches the live PR diff and publishes it directly to ${IMAGE}:latest, which creates an unreviewed supply-chain risk. Update the release flow in build.yml around the Fetch upstream source at release tag, Apply PR 1855 diff, and Build and push image steps to either pin the patch to a reviewed PR head SHA or require a manual approval gate before pushing :latest, while still allowing release tracking if desired.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 9-11: The fenced image snippet in the README is a bare code fence,
which markdownlint flags. Update the fenced block around the image reference to
use an explicit text language label, using the existing README snippet as the
target so the fence is recognized without implying code.
---
Nitpick comments:
In @.github/workflows/build.yml:
- Around line 97-149: The workflow auto-fetches the live PR diff and publishes
it directly to ${IMAGE}:latest, which creates an unreviewed supply-chain risk.
Update the release flow in build.yml around the Fetch upstream source at release
tag, Apply PR 1855 diff, and Build and push image steps to either pin the patch
to a reviewed PR head SHA or require a manual approval gate before pushing
:latest, while still allowing release tracking if desired.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: cd1ea408-8f6d-4ee2-a245-d740114a3b3e
📒 Files selected for processing (3)
.github/workflows/build.yml.last-builtREADME.md
Addresses CodeRabbit supply-chain finding: the build no longer fetches the PR diff from the network. The reviewed diff (pinned at PR head cfeeb8ce) is committed under patches/ and can only change via a reviewed commit in this repo.
…ions Also labels the bare code fence as text (markdownlint MD040).
Two review findings on the vendored PR code, fixed in a separate fixup patch so pr1855.diff stays verbatim upstream: - getRelatedMedia join now excludes DECLINED and COMPLETED requests, so a declined title reappears in Discover instead of being hidden forever - the join selects only request id and status instead of serializing full MediaRequest rows into every related-media response Validated: both patches apply cleanly to v3.3.0 in sequence, and server + client typecheck passes on the fully patched tree.
1 participant
What this is
A daily GitHub Actions pipeline that publishes
ghcr.io/danieldjupvik/seerr:latest— the latest official seerr release with upstream PR #1855 (hide already requested media) applied. Drop-in replacement forghcr.io/seerr-team/seerr:lateston Unraid. The image name is derived from the repo (ghcr.io/${{ github.repository }}), so future renames just work, and additional patches can be added later as extra diff-apply steps.How it behaves
forcerebuild flag)..last-builtmarker; occasional keepalive commit prevents GitHub auto-disabling the schedule after 60 idle days).:latest+:vX.Y.Z-pr1855to GHCR.Safety notes
env, not inline interpolation.GITHUB_TOKEN(no PATs, no secrets to manage).linux/amd64only (Unraid).After merging
seerr→ Package settings → Change visibility → Public (one time; lets Unraid pull without credentials).ghcr.io/danieldjupvik/seerr:latest.Verified before opening this PR: the PR #1855 diff applies cleanly to both current
developand thev3.3.0release tag.