fix: hub pinned at specific tag/digest#7923
Conversation
WalkthroughThe pull request updates container image pinning for the Formbricks Hub across multiple configuration and template files. In production (Helm charts and 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@charts/formbricks/templates/_helpers.tpl`:
- Around line 109-115: The helper formbricks.hubImage currently falls back to a
mutable "latest" tag when both .Values.hub.image.digest and
.Values.hub.image.tag are empty; update the template logic in the
formbricks.hubImage definition to detect the case where .Values.hub.image.digest
is empty/undefined AND .Values.hub.image.tag is empty/undefined and call fail
with a clear error message (e.g., instructing to set either hub.image.digest or
hub.image.tag) instead of printing ":latest", keeping the existing behavior of
using repository@digest when digest exists and repository:tag when tag is
provided.
In `@docker/README.md`:
- Around line 36-37: Update the README to clarify the required format for the
HUB_IMAGE_DIGEST override: state that HUB_IMAGE_DIGEST must be a full digest
including the "sha256:" prefix (not a bare tag), give a concrete example format
(e.g. sha256:<64-hex-chars>), and explain briefly how to obtain it (e.g. via
docker buildx imagetools inspect ghcr.io/formbricks/hub:0.3.0) and where to
place it (docker/.env) so that using HUB_IMAGE_DIGEST results in a valid image
reference like ghcr.io/formbricks/hub@sha256:...
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 7af6424a-2717-4666-b07b-c132285fd17c
📒 Files selected for processing (9)
.env.examplecharts/formbricks/README.mdcharts/formbricks/templates/_helpers.tplcharts/formbricks/templates/hub-deployment.yamlcharts/formbricks/templates/hub-migration-job.yamlcharts/formbricks/values.yamldocker-compose.dev.ymldocker/README.mddocker/docker-compose.yml
BhagyaAmarasinghe
left a comment
BhagyaAmarasinghe
left a comment
There was a problem hiding this comment.
The production compose file now pins Hub to a fixed digest, but docker/formbricks.sh update_formbricks still only runs docker compose pull/down/up. New installs will keep this exact Hub digest forever while ghcr.io/formbricks/formbricks:latest continues advancing, so a normal self-host update can run a newer app against an old Hub/migration image. Either the update flow needs to refresh/rewrite the Hub digest, or the production compose default should remain a moving tag with an explicit opt-in digest pin.
Fixed by the later suggestion, removed the digest pinning from prod compose and added explicit opt-in digest pin, also updated the README |
|
2 participants
What does this PR do?
Fixes ENG-767
Pins the
ghcr.io/formbricks/hubimage so dev, CI, and production deployments all resolve to a known, reproducible image instead of silently reusing whatever:latesthappens to be cached locally.Today every reference to the Hub image uses
:latest. Docker does not re-pull a tag that already exists locally, so devs (and CI) can run a Hub image monthsout of sync with the current branch. We hit this in practice: a stale
:latestcache was missing the goose/river migration binaries the newer compose expects,and
pnpm gofailed withMigration tools (goose/river) not in image.Same class of issue blocks reproducibility for onboarding and breaks thechain-of-custody story for the Hub image.
This PR:
docker-compose.dev.yml): bothhubandhub-migratenow referenceghcr.io/formbricks/hub:${HUB_IMAGE_TAG:-0.2.0}. Single sharedvariable so the two services cannot drift apart. Override via
HUB_IMAGE_TAGin the repo-root.env(auto-loaded by docker compose) or shell.docker/docker-compose.yml): bothhubandhub-migratenow referenceghcr.io/formbricks/hub@${HUB_IMAGE_DIGEST:-sha256:14db7b3d285b6e9165b55693f9b83d08beff840a255fd77dd12882ee0a62f5cb}. Pinned by immutable digest with a singleoverride knob.
hub.image.digesttovalues.yamland a newformbricks.hubImagehelper template. Hub deployment (init container + main container)and hub migration job all render through the helper, so the deployment, init container, and migration job always resolve to the exact same image. When
digestis set it takes precedence over
tag; tag remains as a dev fallback.charts/formbricks/values.yamlhadtag: "1.0.0"but the registry only publishes0.1.0,0.2.0, andlatest. The defaulthelm install would have 404'd on the image pull. Corrected to
0.2.0, which matches the pinned digest above.docker/README.mddocuments the new override knobs (HUB_IMAGE_DIGESTfor prod,HUB_IMAGE_TAGfor dev) alongside the existingHUB_DATABASE_URL/CUBEJS_DB_*overrides..env.exampleadds a commentedHUB_IMAGE_TAGline so devs see the knob.The digest
sha256:14db7b3d285b6e9165b55693f9b83d08beff840a255fd77dd12882ee0a62f5cbcorresponds toghcr.io/formbricks/hub:0.2.0(verified directly againstghcr.io/v2/formbricks/hub/manifests/0.2.0).Fixes #(issue)
How should this be tested?
Dev compose (
docker-compose.dev.yml):pnpm db:down && docker image rm ghcr.io/formbricks/hub:latest ghcr.io/formbricks/hub:0.2.0 || truepnpm goand confirm bothhubandhub-migratecontainers come up healthy andhub-migrateexits 0.docker inspect $(docker compose -f docker-compose.dev.yml ps -q hub) --format '{{.Image}}'and... ps -q hub-migrate— confirm both report the same imageID (no drift).
HUB_IMAGE_TAG=0.1.0in repo-root.env, re-runpnpm db:up, and confirm both services pull0.1.0.Prod compose (
docker/docker-compose.yml):cd docker && HUB_API_KEY=test CUBEJS_API_SECRET=test docker compose config | grep "ghcr.io/formbricks/hub"— confirm bothhubandhub-migrateresolveto the same
@sha256:...digest.echo "HUB_IMAGE_DIGEST=sha256:<other>" >> docker/.env && docker compose configand confirm both services pick up the override.Helm chart:
helm template charts/formbricks --set hub.enabled=true | grep "image:.*hub"— confirm 3 occurrences (deployment init container, deployment main container,migration job), all rendering the same
repo@sha256:....helm template charts/formbricks --set hub.image.digest="" | grep "image:.*hub"— confirm fallback torepo:0.2.0.Checklist
Required
pnpm buildconsole.logsgit pull origin mainAppreciated
docker/README.md)