Speed up deploy builds: Blacksmith + layer cache#392
Conversation
|
Updates to Preview Branch (feature/speed-up-deploy-builds) ↗︎
Tasks are run on every commit but only new migration files are pushed.
View logs for this Workflow Run ↗︎. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThis PR refactors the build pipeline to replace ChangesBuild performance and mechanism optimization
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
🐝 Review App Deployed Homepage: https://hover-pr-392.fly.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fly-deploy.yml:
- Around line 69-75: In the Fly deploy workflow replace the floating action refs
and tighten checkout credentials: pin useblacksmith/build-push-action@v1 to a
specific immutable commit SHA in both occurrences (the steps that currently read
"uses: useblacksmith/build-push-action@v1" in the build-shared and
build-analysis jobs) and update the actions/checkout@v6 steps in those same jobs
to include persist-credentials: false so credentials are not persisted to the
workspace. Ensure both places are updated consistently.
- Line 54: Replace every occurrence of "uses: actions/checkout@v6" in the
workflow with a pinned commit SHA and explicitly disable credential persistence;
specifically update each checkout step (the ones currently using
actions/checkout@v6) to use "uses: actions/checkout@<COMMIT_SHA>" and add a
"with: persist-credentials: false" block for that step so the checkout is pinned
and tokens are not persisted.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 84ed12b4-a982-4e53-b174-7e454c1855c2
📒 Files selected for processing (3)
.github/workflows/fly-deploy.ymlDockerfileDockerfile.analysis
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/review-apps.yml:
- Line 471: Replace tag-based actions with pinned commit SHAs and disable
credential persistence: update each usage of actions/checkout@v6 to a specific
commit SHA (instead of the tag) and add with: persist-credentials: false to
those steps; similarly replace useblacksmith/build-push-action@v1 with its
corresponding pinned commit SHA. Locate the occurrences by the action
identifiers actions/checkout@v6 and useblacksmith/build-push-action@v1 in the
workflow and update both instances so checkout sets persist-credentials: false
and both actions reference exact SHAs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: e36bdfd2-74ed-4df4-bfae-15645f610b90
📒 Files selected for processing (1)
.github/workflows/review-apps.yml
|
🐝 Review App Deployed Homepage: https://hover-pr-392.fly.dev |
Release VersionsApp patch: ChangelogChanged
|
|
🐝 Review App Deployed Homepage: https://hover-pr-392.fly.dev |
Speed up deploy builds: Blacksmith + layer cache
1 participant
Summary
Cuts Fly Deploy build time (and removes the recurring builder flake) by building images on the Blacksmith runner with a sticky layer cache, instead of shipping the build to Fly's shared remote builder.
useblacksmith/build-push-action@v1(auth viaflyctl auth docker, push toregistry.fly.io) rather thanflyctl deploy --build-only --push. This removes theerror releasing builder: deadline_exceeded/graceful_stopfailures that have flaked the deploy repeatedly./go/pkg/mod) and build cache (/root/.cache/go-build) inDockerfileandDockerfile.analysis. Blacksmith's sticky disk persists these across runs, so dependency compiles are incremental instead of cold every deploy. For the analysis image the Chromium/Lighthouse layers also cache.Release/reconcile/autoscaler jobs are unchanged — they still consume
needs.build-*.outputs.image, which now points at the Blacksmith-pushed tag.Expected impact
Test plan
flyctl auth docker+ Blacksmith push wiring).Need help on this PR? Tag
@codesmithwith what you need. Autofix is disabled.Summary by CodeRabbit
Chores
Documentation