Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .dockerignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
/target
.env*
.venv
dist
__pycache__/
*.so
40 changes: 21 additions & 19 deletions .github/workflows/cd.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,6 @@ jobs:
permissions:
contents: read
packages: write
needs: release
steps:
- uses: actions/checkout@v4
- name: Docker setup
Expand All @@ -139,27 +138,30 @@ jobs:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Docker meta
id: meta
- name: Docker meta kubimo
id: meta-kubimo
uses: docker/metadata-action@v5
with:
images: ghcr.io/aqora-io/cli
flavor: |
latest=false
images: ghcr.io/aqora-io/cli-kubimo
bake-target: docker-metadata-kubimo
tags: |
type=schedule
type=ref,event=branch,prefix=${{ env.TAG_PREFIX }}branch-
type=ref,event=tag,prefix=${{ env.TAG_PREFIX }}tag-
type=ref,event=pr,prefix=${{ env.TAG_PREFIX }}pr-
type=raw,value=latest,prefix=${{ env.TAG_PREFIX }},enable={{is_default_branch}}
- name: Docker build and push
uses: docker/build-push-action@v5
with:
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
type=ref,event=branch
type=ref,event=pr
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
- name: Build and push
uses: docker/bake-action@v6
with:
set: |
kubimo*.cache-from=type=registry,ref=ghcr.io/aqora-io/cli-kubimo:latest
*.cache-to=type=inline
files: |
./docker-bake.hcl
cwd://${{ steps.meta-kubimo.outputs.bake-file }}
Comment on lines +156 to +161
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Verify bake inputs reference the correct targets.

The set and files inputs reference kubimo* and docker-metadata-kubimo targets. Confirm that:

  • ./docker-bake.hcl defines a kubimo target and docker-metadata-kubimo target
  • The cache registry reference (ghcr.io/aqora-io/cli-kubimo:latest) aligns with your image naming strategy
  • The cwd://${{ steps.meta-kubimo.outputs.bake-file }} correctly resolves to the metadata action's output file

🏁 Script executed:

#!/bin/bash
# Verify docker-bake.hcl structure for required targets and default groups

# Check for kubimo target definition
rg -A 10 'target "kubimo"' docker-bake.hcl

# Check for docker-metadata-kubimo target definition
rg -A 10 'target "docker-metadata-kubimo"' docker-bake.hcl

# Check for default group that includes kubimo
rg -A 5 'group "default"' docker-bake.hcl

Length of output: 351



---

🏁 Script executed:

```shell
#!/bin/bash
# Verify the meta-kubimo step in cd.yaml and its docker-metadata configuration

# Find the meta-kubimo step and surrounding context
rg -B 5 -A 15 'id: meta-kubimo|name: .*meta.*kubimo' .github/workflows/cd.yaml

# Check for docker-metadata action usage and bake-file output
rg -B 2 -A 10 'docker/metadata-action' .github/workflows/cd.yaml

Length of output: 131



---

🏁 Script executed:

```shell
#!/bin/bash
# Find workflow files and locate meta-kubimo step

# List workflow files
fd -t f 'cd\.(yml|yaml)' .github/workflows/

# Find meta-kubimo step in any workflow file
rg -B 5 -A 15 'id: meta-kubimo' .github/workflows/

# Check for docker-metadata action in workflows
rg -B 2 -A 10 'docker/metadata-action' .github/workflows/

Length of output: 2094



---

🏁 Script executed:

```shell
#!/bin/bash
# Get the complete bake step configuration and verify the full context

# Find the Build and push step and show full configuration (lines around 156-161)
rg -B 2 -A 20 'name: Build and push' .github/workflows/cd.yaml | head -60

# Also check line count to understand context better
wc -l .github/workflows/cd.yaml

Length of output: 750



---

🌐 Web query:

```web
docker/metadata-action v5 outputs bake-file

💡 Result:

Yes — docker/metadata-action@v5 can generate bake files. It exposes file outputs you can pass to docker/bake-action (examples):

  • Outputs (v5): bake-file-tags, bake-file-labels, bake-file-annotations. Use them as files with docker/bake-action via cwd://${{ steps.meta.outputs.bake-file-tags }} (or the other bake-file outputs). [1]

Example snippet:

  • name: Docker meta
    id: meta
    uses: docker/metadata-action@v5
    with:
    images: name/app

  • uses: docker/bake-action@v6
    with:
    files: |
    ./docker-bake.hcl
    cwd://${{ steps.meta.outputs.bake-file-tags }}
    cwd://${{ steps.meta.outputs.bake-file-annotations }}
    targets: build

References: Docker metadata-action README (outputs and bake-file usage). [1][2]

Sources:
[1] docker/metadata-action README — outputs & bake-file examples.
[2] docker/metadata-action Marketplace usage (bake definition example).


Fix bake-file output reference — incorrect output name will cause workflow failure.

Line 161: cwd://${{ steps.meta-kubimo.outputs.bake-file }} references a non-existent output. docker/metadata-action@v5 produces outputs bake-file-tags, bake-file-labels, and bake-file-annotations, not a plain bake-file output.

Update line 161 to use the correct output, e.g., cwd://${{ steps.meta-kubimo.outputs.bake-file-tags }}.

🤖 Prompt for AI Agents
.github/workflows/cd.yaml around lines 156 to 161: the workflow references a
non-existent output `steps.meta-kubimo.outputs.bake-file`; replace that
reference with the correct output name produced by docker/metadata-action@v5
(for example `steps.meta-kubimo.outputs.bake-file-tags`) so the line becomes
`cwd://${{ steps.meta-kubimo.outputs.bake-file-tags }}` (or use another valid
bake-file-* output if more appropriate).

# TODO: change before merging
# push: ${{ github.event_name != 'pull_request' }}
push: true

Comment on lines +141 to 165
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Avoid unconditional image pushes from all events

The metadata + bake wiring for the kubimo image looks good now, but:

          # TODO: change before merging
          # push: ${{ github.event_name != 'pull_request' }}
          push: true

With push: true, this job will attempt to push images even for pull_request events, which is usually undesirable (and may fail for forked PRs due to permissions). Recommend switching back to an event-gated push before merging, e.g.:

-          # TODO: change before merging
-          # push: ${{ github.event_name != 'pull_request' }}
-          push: true
+          push: ${{ github.event_name != 'pull_request' }}

so PRs still build but only non‑PR refs publish images.

🤖 Prompt for AI Agents
.github/workflows/cd.yaml lines 141-165: current bake step unconditionally sets
push: true which causes image pushes on pull_request events; change the push
setting to be event-gated (for example set push to ${{ github.event_name !=
'pull_request' }} or only push for branch refs like main/release) so PRs still
build but images are only published for non-PR events or targeted branches.

npm:
name: Build and publish npm package
Expand Down
14 changes: 7 additions & 7 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 0 additions & 7 deletions Dockerfile

This file was deleted.

8 changes: 8 additions & 0 deletions docker-bake.dev.hcl
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
variable "TAG" {
default = "dev"
}

target "docker-metadata-kubimo" {
tags = ["ghcr.io/aqora-io/cli-kubimo:${TAG}"]
}

11 changes: 11 additions & 0 deletions docker-bake.hcl
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
group "default" {
targets = ["kubimo"]
}

target "docker-metadata-kubimo" {}

target "kubimo" {
inherits = ["docker-metadata-kubimo"]
context = "."
dockerfile = "docker/Dockerfile.kubimo"
}
25 changes: 25 additions & 0 deletions docker/Dockerfile.kubimo
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
FROM ghcr.io/aqora-io/kubimo-marimo:main AS build

USER 0
RUN curl https://sh.rustup.rs -sSf | bash -s -- -y --no-update-default-toolchain
ENV PATH="/root/.cargo/bin:${PATH}"

WORKDIR /build
COPY rust-toolchain .
RUN rustc --version
COPY . .
RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
--mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
--mount=type=cache,target=target,sharing=locked \
cargo build --release \
&& cp target/release/aqora /bin/aqora

WORKDIR /workspace
RUN aqora new dataset-marimo -s user/workspace -v 0.0.0 . && rm readme.py

FROM ghcr.io/aqora-io/kubimo-marimo:main

COPY --chown=1000:1000 ./docker/kubimo/marimo /home/me/.config/marimo
COPY --from=build /bin/aqora /bin/aqora
COPY --chown=1000:1000 --from=build /workspace/* .
RUN uv venv && uv sync
17 changes: 17 additions & 0 deletions docker/kubimo/marimo/marimo.css
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
@import url("https://fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900&family=Noto+Sans+Mono:[email protected]&display=swap");

:root {
--background: hsl(0 0% 99.2%);
--marimo-monospace-font: "Noto Sans Mono", monospace;
--marimo-text-font: "Inter", sans-serif;
--marimo-heading-font: "Inter", sans-serif;
}

#App[data-config-width="full"] > div {
padding-inline: calc(var(--spacing, 0.25rem) * 10);
}

#App[data-config-width="full"][data-command="run"] > div {
padding-left: 0;
padding-top: 0;
}
78 changes: 78 additions & 0 deletions docker/kubimo/marimo/marimo.toml
Original file line number Diff line number Diff line change
@@ -0,0 +1,78 @@
[completion]
activate_on_typing = true
copilot = false

[language_servers.ty]
enabled = true

[language_servers.basedpyright]

[language_servers.pylsp]
enable_pyflakes = false
enable_mypy = true
enabled = false
enable_pylint = false
enable_flake8 = false
enable_pydocstyle = false
enable_ruff = true

[save]
format_on_save = false
autosave = "after_delay"
autosave_delay = 1000

[runtime]
auto_reload = "off"
std_stream_max_bytes = 1000000
reactive_tests = true
watcher_on_save = "lazy"
output_max_bytes = 8000000
default_auto_download = ["html"]
on_cell_change = "autorun"
auto_instantiate = false
default_sql_output = "auto"
dotenv = [".env"]

[package_management]
manager = "uv"

[formatting]
line_length = 79

[diagnostics]
enabled = false

[ai]
rules = ""
mode = "manual"

[ai.models]
custom_models = []
displayed_models = []

[experimental]

[keymap]
preset = "default"
destructive_delete = true

[keymap.overrides]

[display]
default_table_max_columns = 50
default_table_page_size = 10
cell_output = "below"
default_width = "full"
theme = "light"
code_editor_font_size = 14
dataframes = "rich"
reference_highlighting = false
custom_css = ["/home/me/.config/marimo/marimo.css"]
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Fix hardcoded user-specific path.

The custom CSS path /home/me/.config/marimo/marimo.css is hardcoded with a specific username that won't work in containerized or multi-user environments.

Consider one of these approaches:

  • Use a container-relative path like /home/marimo/.config/marimo/marimo.css or /app/config/marimo.css
  • Use an environment variable for the home directory: ${HOME}/.config/marimo/marimo.css
  • Place the CSS file in a standard location that's consistent across deployments

Apply this diff to use a more generic path:

-custom_css = ["/home/me/.config/marimo/marimo.css"]
+custom_css = ["/home/marimo/.config/marimo/marimo.css"]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
custom_css = ["/home/me/.config/marimo/marimo.css"]
custom_css = ["/home/marimo/.config/marimo/marimo.css"]
🤖 Prompt for AI Agents
In docker/kubimo/marimo/marimo.toml at line 70, the custom_css entry uses a
hardcoded user path (/home/me/...) which will fail in containerized or
multi-user environments; change it to a generic, deployable path such as
${HOME}/.config/marimo/marimo.css or a container-relative path like
/app/config/marimo.css (or /home/marimo/.config/marimo/marimo.css) and update
any container mounts or startup env to ensure HOME or the chosen directory
exists and contains marimo.css; if TOML parsing in this app doesn't expand
${HOME}, prefer the fixed container path (/app/config/marimo.css) and document
or mount that file in your Docker setup.


[server]
follow_symlink = false
browser = "default"

[snippets]
include_default_snippets = true
custom_paths = []
Loading
Loading