Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 0 additions & 17 deletions .github/workflows/build.yml

This file was deleted.

42 changes: 42 additions & 0 deletions .github/workflows/docker.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
name: Build and Publish Multi-Arch Docker Image

on:
push:
branches: [ main, development ]
pull_request:
branches: [ main, development ]
workflow_dispatch:

jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write

steps:
- name: Checkout
uses: actions/checkout@v4

- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Login to GHCR
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ secrets.GHCR_USERNAME }}
password: ${{ secrets.GHCR_TOKEN }}
Comment on lines +31 to +32

Copilot AI Nov 18, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For GitHub Container Registry authentication, use ${{ github.actor }} for username and ${{ secrets.GITHUB_TOKEN }} for password instead of custom secrets. The built-in GITHUB_TOKEN is automatically available and has appropriate permissions when packages: write is set.

Suggested change
username: ${{ secrets.GHCR_USERNAME }}
password: ${{ secrets.GHCR_TOKEN }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

Copilot uses AI. Check for mistakes.

- name: Build and Push Multi-Arch Image
uses: docker/build-push-action@v6
with:
context: .
push: true

Copilot AI Nov 18, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow unconditionally pushes images on pull requests, which will fail without write permissions and may publish unreviewed code. Consider only pushing on branch pushes, not pull requests. Add a conditional like push: ${{ github.event_name != 'pull_request' }} to prevent push attempts during PR builds.

Suggested change
push: true
push: ${{ github.event_name != 'pull_request' }}

Copilot uses AI. Check for mistakes.
platforms: linux/amd64,linux/arm64,linux/arm/v7
tags: |
ghcr.io/autonomy-logic/openplc-runtime:latest
ghcr.io/autonomy-logic/openplc-runtime:${{ github.sha }}
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
.vscode/
#.*/
/venvs/
.venv/
__pycache__/
.clinerules

Expand Down
23 changes: 14 additions & 9 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -1,19 +1,24 @@
# Dockerfile
FROM debian:bookworm-slim
# syntax=docker/dockerfile:1

RUN apt-get update && apt-get install -y \
python3 python3-venv python3-pip bash \
pkg-config \
&& rm -rf /var/lib/apt/lists/*
FROM debian:bookworm-slim

WORKDIR /workdir

# Copy source code
COPY . .
RUN mkdir -p /var/run/runtime

# Setup runtime directory and permissions
RUN mkdir -p /var/run/runtime && \
chmod +x install.sh scripts/* start_openplc.sh

# Clean any existing build artifacts to ensure clean Docker build
RUN rm -rf build/ venvs/ 2>/dev/null || true
RUN chmod +x install.sh scripts/* start_openplc.sh
RUN rm -rf build/ venvs/ .venv/ 2>/dev/null || true

Copilot AI Nov 18, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cleanup command redirects stderr to /dev/null and uses || true, which may hide actual errors. Since you're explicitly copying files with COPY . . and want a clean build, consider using .dockerignore to exclude build artifacts instead of removing them after copying.

Copilot uses AI. Check for mistakes.

# Run installation script
RUN ./install.sh

# Expose webserver port
EXPOSE 8443

# Default execution - Start OpenPLC Runtime
CMD ["bash", "./start_openplc.sh"]
5 changes: 4 additions & 1 deletion core/src/drivers/plugin_driver.c
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,9 @@ int plugin_driver_init(plugin_driver_t *driver)
// Call the Python init function with proper capsule
PyObject *result =
PyObject_CallFunctionObjArgs(plugin->python_plugin->pFuncInit, args, NULL);
Py_SET_REFCNT(args, UINT64_MAX);

// Store the capsule reference for the lifetime of the plugin
plugin->python_plugin->args_capsule = args;

if (!result)
{
Expand Down Expand Up @@ -639,6 +641,7 @@ static void python_plugin_cleanup(plugin_instance_t *plugin)
Py_XDECREF(plugin->python_plugin->pFuncStop);
Py_XDECREF(plugin->python_plugin->pFuncCleanup);
Py_XDECREF(plugin->python_plugin->pModule);
Py_XDECREF(plugin->python_plugin->args_capsule);

free(plugin->python_plugin);
plugin->python_plugin = NULL;
Expand Down
3 changes: 2 additions & 1 deletion core/src/drivers/python_plugin_bridge.h
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ typedef struct
PyObject *pFuncStart;
PyObject *pFuncStop;
PyObject *pFuncCleanup;
PyObject *args_capsule; // Capsule containing plugin_runtime_args_t for lifetime management
} python_binds_t;

#endif // __PYTHON_PLUGIN_BRIDGE_H
#endif // __PYTHON_PLUGIN_BRIDGE_H
3 changes: 2 additions & 1 deletion install.sh
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ install_deps_apt() {
gcc \
make \
cmake \
pkg-config \
&& rm -rf /var/lib/apt/lists/*
}

Expand Down Expand Up @@ -167,4 +168,4 @@ else
echo "ERROR: Build process failed!" >&2
echo "Please check the error messages above for details." >&2
exit 1
fi
fi
1 change: 1 addition & 0 deletions webserver/app.py
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,7 @@ def run_https():
ssl_context=context,
use_reloader=False,
log_output=False,
allow_unsafe_werkzeug=True,

Copilot AI Nov 18, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The allow_unsafe_werkzeug=True flag disables important security warnings in Werkzeug. This parameter should only be used in development environments, not production. Since this appears to be production code (running HTTPS server), this flag should be removed or conditionally set based on environment.

Copilot uses AI. Check for mistakes.
)

except FileNotFoundError:
Expand Down
1 change: 1 addition & 0 deletions webserver/debug_websocket.py
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
from flask_jwt_extended import decode_token
from flask_socketio import SocketIO, emit
from jwt.exceptions import ExpiredSignatureError, InvalidTokenError

from webserver.logger import get_logger

logger, _ = get_logger("debug_ws", use_buffer=True)
Expand Down
Loading