[mohit-nagaraj]

Summary

• load and validate the browser-visible Core API URL at container runtime instead of freezing it during next build
• route Axios, OAuth, SSE, log, terminal, build, import, resource, and workflow traffic through one runtime configuration helper
• build and browser-smoke linux/amd64 and linux/arm64 images on pull requests and before release publication
• publish a multi-platform candidate with SPDX SBOM and SLSA provenance, then attach a GitHub digest attestation
• verify platforms and evidence before assigning the immutable digest to the version and latest tags and creating the GitHub Release
• document the runtime contract, supported platforms, digest verification, and failure diagnosis

Runtime contract

The standalone server exposes a no-store /runtime-config.js initialization script and loads it before hydration. NEXT_PUBLIC_API_URL is therefore read when the container runs, while existing statically generated UI routes remain static. The Docker health check validates both this configuration endpoint and the UI root.

The supported OrchCLI value remains:

NEXT_PUBLIC_API_URL=http://localhost:3000/v1/api

Release flow

1. Require the tag commit to be contained in main.
2. Serialize tag releases in a non-cancelling queue.
3. Build and smoke each platform independently under its target architecture.
4. Publish a uniquely named multi-platform candidate with BuildKit SBOM and provenance.
5. Attest and verify the immutable candidate digest.
6. Assign only that verified digest to the version and latest tags and record it in the GitHub Release.

BuildKit attestation descriptors report unknown/unknown; platform verification filters those descriptors and requires the runnable set to be exactly linux/amd64,linux/arm64.

Verification

• npm run test:run (100 tests)
• npm run type-check
• npm run build
• changed-file ESLint and Prettier checks
• actionlint v1.7.12, except its schema does not yet include GitHub's accepted concurrency.queue key
• ShellCheck
• git diff --check
• local AMD64 container build, UID/architecture/health checks, and browser-to-Core smoke
• local ARM64 container build under emulation, UID/architecture/health checks, and browser-to-Core smoke
• Playwright CLI verification of the rendered login flow and configured /auth/methods request

Closes #110

[coderabbitai]

📝 Walkthrough

Walkthrough

The change adds runtime API configuration served before hydration, updates client requests and streams to use it, adds container and browser smoke tests, and changes release workflows to publish verified amd64 and arm64 images with SBOM and provenance.

Changes

Runtime configuration and client integration

Layer / File(s)	Summary
Runtime configuration contract lib/runtime-config.ts, lib/runtime-config.server.ts, app/runtime-config.js/route.ts, app/layout.tsx, lib/__tests__/runtime-config.test.ts	The UI validates NEXT_PUBLIC_API_URL, serves it through /runtime-config.js, initializes it before hydration, and tests normalization, serialization, initialization, and route failures.
Client runtime URL integration lib/api.ts, lib/hooks/*, hooks/useNotificationSSE.ts, components/auth/LoginForm.tsx, components/auth/RegisterForm.tsx	API requests, streams, WebSocket connections, and OAuth redirects now use getApiBaseUrl().
Container and browser smoke validation .github/scripts/*, Dockerfile, .github/workflows/frontend.yml, package.json	Smoke coverage validates architectures, non-root execution, Node architecture, health checks, browser configuration, and browser-to-Core requests on both platforms.
Multi-platform release publication .github/workflows/docker-publish.yml, README.md, docs/DEVELOPMENT.md, docs/RELEASE.md	The release workflow validates tag ancestry, publishes amd64 and arm64 images, verifies SBOM and provenance, promotes the verified digest to latest, and documents the process.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to 0fa84

The PR adds runtime API routing and attested multi-architecture release promotion, but runtime URL validation still accepts an unsafe form, pull-request CI can expose checkout credentials with broader-than-explicit token authority, and a version-tagged image is published before later verification. These bounded correctness, security, and release-state risks should be fixed or explicitly accepted before merge.

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant SmokeContainer
  participant UIContainer
  participant MockCore
  participant ReleaseRegistry
  GitHubActions->>SmokeContainer: build and test amd64 and arm64 images
  SmokeContainer->>UIContainer: start image with runtime API URL
  UIContainer->>MockCore: request authentication methods
  MockCore-->>SmokeContainer: return successful API response
  GitHubActions->>ReleaseRegistry: publish versioned multi-platform image
  GitHubActions->>ReleaseRegistry: attach and verify SBOM and provenance
  GitHubActions->>ReleaseRegistry: promote verified digest to latest

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 17 functions across 18 files. (7 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes address issue #110: they add runtime API configuration, preserve non-root execution and health checks, build and smoke-test linux/amd64 and linux/arm64 images, publish and verify SBOM and …
Out of Scope Changes check	✅ Passed	The reviewed changes are related to issue #110. They implement the runtime configuration contract, release workflow, platform and browser smoke tests, health-check updates, dependency support, and req…
Title check	✅ Passed	The title clearly identifies the primary release change: publishing an attested multi-architecture UI image.
Description check	✅ Passed	The description directly covers the runtime configuration, multi-platform smoke tests, attestations, verification, promotion, and documentation changes in the changeset.

Full details: Linked Issues check

Explanation

The changes address issue #110: they add runtime API configuration, preserve non-root execution and health checks, build and smoke-test linux/amd64 and linux/arm64 images, publish and verify SBOM and provenance attestations, block promotion on verification failures, and document release verification and failure diagnosis.

Full details: Out of Scope Changes check

Explanation

The reviewed changes are related to issue #110. They implement the runtime configuration contract, release workflow, platform and browser smoke tests, health-check updates, dependency support, and required documentation without introducing unrelated product behavior.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 17 functions across 18 files. (7 skipped: 7 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/multiarch-ui-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 8e696f11-650a-405a-93a8-4fab6e3f8978

📥 Commits

Reviewing files that changed from the base of the PR and between 6544423 and 0fa841d.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (25)

• .github/scripts/mock-core.mjs
• .github/scripts/smoke-browser.mjs
• .github/scripts/smoke-container.sh
• .github/workflows/docker-publish.yml
• .github/workflows/frontend.yml
• Dockerfile
• README.md
• app/layout.tsx
• app/runtime-config.js/route.ts
• components/auth/LoginForm.tsx
• components/auth/RegisterForm.tsx
• docs/DEVELOPMENT.md
• docs/RELEASE.md
• hooks/useNotificationSSE.ts
• lib/__tests__/runtime-config.test.ts
• lib/api.ts
• lib/hooks/useBuildStream.ts
• lib/hooks/useImportStream.ts
• lib/hooks/useLogStream.ts
• lib/hooks/useResourceStatusStream.ts
• lib/hooks/useTerminal.ts
• lib/hooks/useWorkflowStatusStream.ts
• lib/runtime-config.server.ts
• lib/runtime-config.ts
• package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

All three findings were addressed in cbf5877, confirmed in-thread, and the follow-up CodeRabbit status plus all CI checks pass.