ci: smoke-test the container image on every PR - #323
Merged
Conversation
The test job installs the package from the source tree with `pip install -e`, so nothing in CI ever built or ran the image we publish. A change to the Dockerfile could pass every check and still produce a container that exits during boot, which docker-publish would then push as `latest`. Add a docker-smoke job that builds the image, runs it against a pgvector service and waits for /healthz, failing fast with container logs if the container exits first. Verified against a known-bad image: it reports healthy in ~3s for the current Dockerfile and fails immediately when the application package is missing from site-packages. Also document why the Dockerfile installs twice. The second install looks redundant but is what puts `server/` into site-packages, since the first runs before `COPY . .`; without it `alembic upgrade head` in start.sh fails with ModuleNotFoundError. Marked `--no-deps` to make it explicit that only the application package is installed there. Closes #293
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #293.
Why
Two related gaps, both surfaced while reviewing #321:
testjob runspip install -e ".[dev]"against the source tree, so a Dockerfile change can pass every check and still produce a container that exits during boot — anddocker-publishwould push it aslatestwith no smoke test between build and push.pip installruns beforeCOPY . ., so hatchling (packages = ["server"]) builds a wheel with no application code. The second install is what actually putsserver/intosite-packages.start.shrunsalembic upgrade headfirst, and the alembic console script doesn't put the working directory onsys.path— so removing it makes the container exit before uvicorn starts.What
docker-smokeCI job — builds the image, runs it against a pgvector service, waits for/healthz, and fails fast with container logs if the container exits first.--no-depson the second install, making it explicit that only the application package is installed there (dependencies come from the cached layer above).Verified locally
--no-depsvariant (this PR)serverpresent in site-packagesThat last row is the point: this job catches the exact regression that passed CI green.