[delete-cloud]

Summary

• Pass Debian mirror build args into the app image build so runtime apt-get does not stall on deb.debian.org from o6n Woodpecker.
• Keep deploy-tools image publishing manual-only so a static tooling image cannot block app image publication on every main push.
• Add the same apt mirror args and bounded curl retries to the manual deploy-tools image build.

Verification

• woodpecker-cli lint --strict .woodpecker/ci.yml
• git diff --check -- .woodpecker/ci.yml coding-agent/Dockerfile docker/deploy-tools.Dockerfile
• DOCKER_BUILDKIT=1 docker build --target runtime --build-arg PYTHON_BASE_IMAGE=python:3.12-slim --build-arg PIP_DEFAULT_TIMEOUT=120 --build-arg PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple --build-arg UV_DEFAULT_INDEX=https://mirrors.aliyun.com/pypi/simple --build-arg APT_DEBIAN_MIRROR=https://mirrors.aliyun.com/debian --build-arg APT_DEBIAN_SECURITY_MIRROR=https://mirrors.aliyun.com/debian-security -f coding-agent/Dockerfile coding-agent
• Forgejo Woodpecker pipeline feat: add remote workspace retention CLI #171 passed and published git.mesh.kinaz.me/kina/coding-agent:7f3a0b700a2e1b14f69adea3c359066c060b96a2

Summary by CodeRabbit

• New Features

  • Added support for manual pipeline runs in addition to existing automatic triggers.
  • Added configurable Debian package mirror settings for build and runtime images.

• Bug Fixes

  • Improved package source handling during image builds to better support alternate Debian mirrors.
  • Made tool downloads more resilient with stronger retry and timeout behavior.

[coderabbitai]

Warning

Review limit reached

@delete-cloud, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 49 minutes and 45 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c45d5b21-4531-4a34-b55f-64506fd60c68

📥 Commits

Reviewing files that changed from the base of the PR and between a446663 and 25d6171.

📒 Files selected for processing (2)

• coding-agent/Dockerfile
• docker/deploy-tools.Dockerfile

📝 Walkthrough

Walkthrough

Adds two Debian APT mirror build arguments (APT_DEBIAN_MIRROR, APT_DEBIAN_SECURITY_MIRROR) to coding-agent/Dockerfile and docker/deploy-tools.Dockerfile, with conditional sed-based rewriting of /etc/apt/sources.list.d/debian.sources. The CI pipeline propagates these via Kaniko --build-arg, adds a manual trigger, and changes the build-deploy-tools job from push to manual.

Changes

Configurable Debian APT mirrors

Layer / File(s)	Summary
Dockerfile ARG declarations and APT mirror rewriting coding-agent/Dockerfile, docker/deploy-tools.Dockerfile	Both Dockerfiles declare APT_DEBIAN_MIRROR and APT_DEBIAN_SECURITY_MIRROR ARGs and conditionally rewrite /etc/apt/sources.list.d/debian.sources via sed before apt-get update. deploy-tools.Dockerfile additionally replaces direct curl calls with a fetch() helper for downloading kubectl and Helm artifacts.
CI trigger and Kaniko --build-arg wiring .woodpecker/ci.yml	Adds manual to top-level event triggers, passes the new mirror variables as --build-arg in both build-image and build-deploy-tools Kaniko invocations, and changes build-deploy-tools trigger from push to manual.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• delete-cloud/Coding-Agent-Loop#390: Also modifies the Kaniko build-image job in .woodpecker/ci.yml, updating executor arguments in the same block.
• delete-cloud/Coding-Agent-Loop#398: Also changes when conditions in .woodpecker/ci.yml for build jobs between push and manual triggers.
• delete-cloud/Coding-Agent-Loop#642: Also adds --build-arg values to the Kaniko build-image invocation and updates coding-agent/Dockerfile to consume new build-time args.

Poem

🐇 A mirror, a mirror, for packages dear,
With sed and with ARG the sources appear,
No more fixed URLs baked in stone,
The rabbit now builds from a mirror of its own,
manual the trigger, the deploy stands tall,
Curl gets a helper to fetch() them all! 🪄

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main CI goal: unblocking image builds on o6n.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/o6n-image-build-unblock

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.woodpecker/ci.yml (1)

84-86: 🔒 Security & Privacy | 🔵 Trivial

Add a refresh path for the manual-only tooling image.

Making build-deploy-tools manual-only avoids blocking app publishes, but it also means base-image and package security fixes will never land unless someone remembers to rebuild it. Consider a separate scheduled job or documented rebuild cadence so this image does not age indefinitely.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.woodpecker/ci.yml around lines 84 - 86, The manual-only build-deploy-tools
job in the CI config needs a refresh path so the tooling image does not go
stale. Update the workflow around the build-deploy-tools job to add a scheduled
rebuild option or another explicit refresh mechanism, and keep the manual
trigger intact; use the existing build-deploy-tools job definition in the CI
config as the place to add the schedule or document the rebuild cadence clearly.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@coding-agent/Dockerfile`:
- Around line 57-63: The mirror rewrite in the Dockerfile only handles deb822
sources via the existing apt block, so classic /etc/apt/sources.list-based
Debian images still keep deb.debian.org unchanged. Update the apt mirror setup
in the Dockerfile to also detect and rewrite entries in /etc/apt/sources.list
when present, using the same APT_DEBIAN_MIRROR and APT_DEBIAN_SECURITY_MIRROR
args, and apply the same fallback in docker/deploy-tools.Dockerfile so both
base-image layouts are supported consistently.

---

Nitpick comments:
In @.woodpecker/ci.yml:
- Around line 84-86: The manual-only build-deploy-tools job in the CI config
needs a refresh path so the tooling image does not go stale. Update the workflow
around the build-deploy-tools job to add a scheduled rebuild option or another
explicit refresh mechanism, and keep the manual trigger intact; use the existing
build-deploy-tools job definition in the CI config as the place to add the
schedule or document the rebuild cadence clearly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: bd86f651-3353-4f16-8ae3-563aeedbb9d5

📥 Commits

Reviewing files that changed from the base of the PR and between 52b1cd5 and a446663.

📒 Files selected for processing (3)

• .woodpecker/ci.yml
• coding-agent/Dockerfile
• docker/deploy-tools.Dockerfile