Updates/bazel fixes #2441

Merged
mfreeman451 merged 10 commits from refs/pull/2441/head into main 2025-11-20 23:58:38 +00:00
mfreeman451 commented 2025-11-20 23:58:31 +00:00 (Migrated from github.com)
Owner

Imported from GitHub pull request.

Original GitHub pull request: #1973
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/pull/1973
Original created: 2025-11-20T23:58:31Z
Original updated: 2025-11-20T23:59:59Z
Original head: carverauto/serviceradar:updates/bazel_fixes
Original base: main
Original merged: 2025-11-20T23:58:38Z by @mfreeman451

User description

IMPORTANT: Please sign the Developer Certificate of Origin

Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include
a DCO sign-off statement indicating the DCO acceptance in one commit message. Here
is an example DCO Signed-off-by line in a commit message:

Signed-off-by: J. Doe <j.doe@domain.com>

Describe your changes

Code checklist before requesting a review

  • I have signed the DCO?
  • The build completes without errors?
  • All tests are passing when running make test?

PR Type

Enhancement, Bug fix


Description

  • Disable Turbopack globally in Bazel builds to avoid sandbox issues

  • Remove Proton package from build configuration

  • Fix CI/CD release workflow to use local execution with rpmbuild

  • Copy web sources to bin directory for proper package.json resolution


Diagram Walkthrough

flowchart LR
  A["Bazel Build Configuration"] --> B["Disable Turbopack Globally"]
  A --> C["Remove Proton Package"]
  D["CI/CD Release Workflow"] --> E["Install rpmbuild Locally"]
  E --> F["Use Local Execution"]
  G["Web Build"] --> H["Copy Sources to Bin"]
  H --> I["Force Webpack in Config"]

File Walkthrough

Relevant files
Configuration changes
.bazelrc
Disable Turbopack globally in Bazel configuration               

.bazelrc

  • Add environment variables to disable Turbopack globally for all Bazel
    builds
  • Set NEXT_PRIVATE_SKIP_TURBOPACK=1 and TURBOPACK=0 in build
    configuration
+2/-0     
release.yml
Switch release workflow to local rpmbuild execution           

.github/workflows/release.yml

  • Install rpmbuild package before running release workflow
  • Replace remote RBE execution with local-only execution using
    --config=no_remote
  • Add bazel clean --expunge to regenerate external repos with rpmbuild
    available
  • Use host platform configuration to ensure local toolchain availability
+19/-14 
packages.bzl
Remove Proton package from Bazel build                                     

packaging/packages.bzl

  • Remove entire Proton package definition including dependencies, files,
    and systemd configuration
  • Simplify package configuration by eliminating unused stream processing
    engine component
+0/-58   
components.json
Remove Proton component from package manifest                       

packaging/components.json

  • Remove Proton component definition including external binary
    configuration
  • Remove Proton-specific config files, systemd service, and additional
    directories
+0/-72   
Bug fix
BUILD.bazel
Copy web sources to bin and disable Turbopack                       

web/BUILD.bazel

  • Add environment variables to standalone build to disable Turbopack
  • Change allow_execroot_entry_point_with_no_copy_data_to_bin from True
    to False
  • Add comment explaining need to copy sources to bin for proper
    package.json resolution
+7/-1     
next.config.bazel.mjs
Force webpack and disable Turbopack in Next.js config       

web/next.config.bazel.mjs

  • Add environment variable checks to force Turbopack disabled at startup
  • Add experimental configuration to disable Turbo in Next.js
  • Ensure webpack is used instead of Turbopack for Bazel builds
+11/-0   

Imported from GitHub pull request. Original GitHub pull request: #1973 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/pull/1973 Original created: 2025-11-20T23:58:31Z Original updated: 2025-11-20T23:59:59Z Original head: carverauto/serviceradar:updates/bazel_fixes Original base: main Original merged: 2025-11-20T23:58:38Z by @mfreeman451 --- ### **User description** ## IMPORTANT: Please sign the Developer Certificate of Origin Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include a [DCO sign-off statement]( https://developercertificate.org/) indicating the DCO acceptance in one commit message. Here is an example DCO Signed-off-by line in a commit message: ``` Signed-off-by: J. Doe <j.doe@domain.com> ``` ## Describe your changes ## Issue ticket number and link ## Code checklist before requesting a review - [ ] I have signed the DCO? - [ ] The build completes without errors? - [ ] All tests are passing when running make test? ___ ### **PR Type** Enhancement, Bug fix ___ ### **Description** - Disable Turbopack globally in Bazel builds to avoid sandbox issues - Remove Proton package from build configuration - Fix CI/CD release workflow to use local execution with rpmbuild - Copy web sources to bin directory for proper package.json resolution ___ ### Diagram Walkthrough ```mermaid flowchart LR A["Bazel Build Configuration"] --> B["Disable Turbopack Globally"] A --> C["Remove Proton Package"] D["CI/CD Release Workflow"] --> E["Install rpmbuild Locally"] E --> F["Use Local Execution"] G["Web Build"] --> H["Copy Sources to Bin"] H --> I["Force Webpack in Config"] ``` <details> <summary><h3> File Walkthrough</h3></summary> <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Configuration changes</strong></td><td><table> <tr> <td> <details> <summary><strong>.bazelrc</strong><dd><code>Disable Turbopack globally in Bazel configuration</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> .bazelrc <ul><li>Add environment variables to disable Turbopack globally for all Bazel <br>builds<br> <li> Set <code>NEXT_PRIVATE_SKIP_TURBOPACK=1</code> and <code>TURBOPACK=0</code> in build <br>configuration</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1973/files#diff-544556920c45b42cbfe40159b082ce8af6bd929e492d076769226265f215832f">+2/-0</a>&nbsp; &nbsp; &nbsp; </td> </tr> <tr> <td> <details> <summary><strong>release.yml</strong><dd><code>Switch release workflow to local rpmbuild execution</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> .github/workflows/release.yml <ul><li>Install rpmbuild package before running release workflow<br> <li> Replace remote RBE execution with local-only execution using <br><code>--config=no_remote</code><br> <li> Add <code>bazel clean --expunge</code> to regenerate external repos with rpmbuild <br>available<br> <li> Use host platform configuration to ensure local toolchain availability</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1973/files#diff-87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34">+19/-14</a>&nbsp; </td> </tr> <tr> <td> <details> <summary><strong>packages.bzl</strong><dd><code>Remove Proton package from Bazel build</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> packaging/packages.bzl <ul><li>Remove entire Proton package definition including dependencies, files, <br>and systemd configuration<br> <li> Simplify package configuration by eliminating unused stream processing <br>engine component</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1973/files#diff-9bfe2a5141a9e402bb5a5a8fca53b9eea64396ec18108c535392e1054c90b913">+0/-58</a>&nbsp; &nbsp; </td> </tr> <tr> <td> <details> <summary><strong>components.json</strong><dd><code>Remove Proton component from package manifest</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> packaging/components.json <ul><li>Remove Proton component definition including external binary <br>configuration<br> <li> Remove Proton-specific config files, systemd service, and additional <br>directories</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1973/files#diff-3ae5949d89b0252d10fce9bf950231c8151a73b2154dccfe4e7261acc116582c">+0/-72</a>&nbsp; &nbsp; </td> </tr> </table></td></tr><tr><td><strong>Bug fix</strong></td><td><table> <tr> <td> <details> <summary><strong>BUILD.bazel</strong><dd><code>Copy web sources to bin and disable Turbopack</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> web/BUILD.bazel <ul><li>Add environment variables to standalone build to disable Turbopack<br> <li> Change <code>allow_execroot_entry_point_with_no_copy_data_to_bin</code> from True <br>to False<br> <li> Add comment explaining need to copy sources to bin for proper <br>package.json resolution</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1973/files#diff-1d59088f07bd1569a5a928ec3d13f6a85f7277c23483e5b7fa05a12d5fcaa394">+7/-1</a>&nbsp; &nbsp; &nbsp; </td> </tr> <tr> <td> <details> <summary><strong>next.config.bazel.mjs</strong><dd><code>Force webpack and disable Turbopack in Next.js config</code>&nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> web/next.config.bazel.mjs <ul><li>Add environment variable checks to force Turbopack disabled at startup<br> <li> Add experimental configuration to disable Turbo in Next.js<br> <li> Ensure webpack is used instead of Turbopack for Bazel builds</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1973/files#diff-02dc3251220daf4ccac6e0ef65f430fb0191cdfc7920e65a05aa7a2586615584">+11/-0</a>&nbsp; &nbsp; </td> </tr> </table></td></tr></tr></tbody></table> </details> ___
qodo-code-review[bot] commented 2025-11-20 23:59:02 +00:00 (Migrated from github.com)
Author
Owner

Imported GitHub PR comment.

Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1973#issuecomment-3560702246
Original created: 2025-11-20T23:59:02Z

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
Audit Logging: The new release workflow steps execute package publishing without adding any explicit
audit logging of critical actions or outcomes within the workflow context.

Referred Code
sudo apt-get update -y
sudo apt-get install -y rpm

# Nuking externals so the rpmbuild toolchain repo is regenerated with rpmbuild present.
bazel clean --expunge

# Run locally to ensure rpmbuild is available and avoid executor-specific tool gaps.
bazel run \
  --config=no_remote \
  --host_platform=@local_config_platform//:host \
  --platforms=@local_config_platform//:host \
  --remote_executor= \
  --remote_cache= \
  --noremote_accept_cached \
  --noremote_upload_local_results \
  --jobs=8 \
  --stamp \
  //release:publish_packages \
  -- "${args[@]}"

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Missing Fallback: The updated workflow forces local Bazel execution without the prior fallback/conditional
error handling, reducing resilience if local tooling or installs fail.

Referred Code
# Run locally to ensure rpmbuild is available and avoid executor-specific tool gaps.
bazel run \
  --config=no_remote \
  --host_platform=@local_config_platform//:host \
  --platforms=@local_config_platform//:host \
  --remote_executor= \
  --remote_cache= \
  --noremote_accept_cached \
  --noremote_upload_local_results \
  --jobs=8 \
  --stamp \
  //release:publish_packages \
  -- "${args[@]}"

Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
- Requires Further Human Verification
🏷️ - Compliance label
Imported GitHub PR comment. Original author: @qodo-code-review[bot] Original URL: https://github.com/carverauto/serviceradar/pull/1973#issuecomment-3560702246 Original created: 2025-11-20T23:59:02Z --- ## PR Compliance Guide 🔍 <!-- https://github.com/carverauto/serviceradar/commit/babf786dce63b14c768d49e2c630f952e827165e --> Below is a summary of compliance checks for this PR:<br> <table><tbody><tr><td colspan='2'><strong>Security Compliance</strong></td></tr> <tr><td>🟢</td><td><details><summary><strong>No security concerns identified</strong></summary> No security vulnerabilities detected by AI analysis. Human verification advised for critical code. </details></td></tr> <tr><td colspan='2'><strong>Ticket Compliance</strong></td></tr> <tr><td>⚪</td><td><details><summary>🎫 <strong>No ticket provided </strong></summary> - [ ] Create ticket/issue <!-- /create_ticket --create_ticket=true --> </details></td></tr> <tr><td colspan='2'><strong>Codebase Duplication Compliance</strong></td></tr> <tr><td>⚪</td><td><details><summary><strong>Codebase context is not defined </strong></summary> Follow the <a href='https://qodo-merge-docs.qodo.ai/core-abilities/rag_context_enrichment/'>guide</a> to enable codebase context checks. </details></td></tr> <tr><td colspan='2'><strong>Custom Compliance</strong></td></tr> <tr><td rowspan=4>🟢</td><td> <details><summary><strong>Generic: Meaningful Naming and Self-Documenting Code</strong></summary><br> **Objective:** Ensure all identifiers clearly express their purpose and intent, making code <br>self-documenting<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Secure Error Handling</strong></summary><br> **Objective:** To prevent the leakage of sensitive system information through error messages while <br>providing sufficient detail for internal debugging.<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Secure Logging Practices</strong></summary><br> **Objective:** To ensure logs are useful for debugging and auditing without exposing sensitive <br>information like PII, PHI, or cardholder data.<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Security-First Input Validation and Data Handling</strong></summary><br> **Objective:** Ensure all data inputs are validated, sanitized, and handled securely to prevent <br>vulnerabilities<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td rowspan=2>⚪</td> <td><details> <summary><strong>Generic: Comprehensive Audit Trails</strong></summary><br> **Objective:** To create a detailed and reliable record of critical system actions for security analysis <br>and compliance.<br> **Status:** <br><a href='https://github.com/carverauto/serviceradar/pull/1973/files#diff-87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34R238-R256'><strong>Audit Logging</strong></a>: The new release workflow steps execute package publishing without adding any explicit <br>audit logging of critical actions or outcomes within the workflow context.<br> <details open><summary>Referred Code</summary> ```yaml sudo apt-get update -y sudo apt-get install -y rpm # Nuking externals so the rpmbuild toolchain repo is regenerated with rpmbuild present. bazel clean --expunge # Run locally to ensure rpmbuild is available and avoid executor-specific tool gaps. bazel run \ --config=no_remote \ --host_platform=@local_config_platform//:host \ --platforms=@local_config_platform//:host \ --remote_executor= \ --remote_cache= \ --noremote_accept_cached \ --noremote_upload_local_results \ --jobs=8 \ --stamp \ //release:publish_packages \ -- "${args[@]}" ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td><details> <summary><strong>Generic: Robust Error Handling and Edge Case Management</strong></summary><br> **Objective:** Ensure comprehensive error handling that provides meaningful context and graceful <br>degradation<br> **Status:** <br><a href='https://github.com/carverauto/serviceradar/pull/1973/files#diff-87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34R244-R256'><strong>Missing Fallback</strong></a>: The updated workflow forces local Bazel execution without the prior fallback/conditional <br>error handling, reducing resilience if local tooling or installs fail.<br> <details open><summary>Referred Code</summary> ```yaml # Run locally to ensure rpmbuild is available and avoid executor-specific tool gaps. bazel run \ --config=no_remote \ --host_platform=@local_config_platform//:host \ --platforms=@local_config_platform//:host \ --remote_executor= \ --remote_cache= \ --noremote_accept_cached \ --noremote_upload_local_results \ --jobs=8 \ --stamp \ //release:publish_packages \ -- "${args[@]}" ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td align="center" colspan="2"> <!-- placeholder --> <!-- /compliance --update_compliance=true --> </td></tr></tbody></table> <details><summary>Compliance status legend</summary> 🟢 - Fully Compliant<br> 🟡 - Partial Compliant<br> 🔴 - Not Compliant<br> ⚪ - Requires Further Human Verification<br> 🏷️ - Compliance label<br> </details>
qodo-code-review[bot] commented 2025-11-20 23:59:59 +00:00 (Migrated from github.com)
Author
Owner

Imported GitHub PR comment.

Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1973#issuecomment-3560703834
Original created: 2025-11-20T23:59:59Z

PR Code Suggestions

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
High-level
Justify removal of the Proton component

The PR removes the "proton" stream processing engine without justification. The
suggestion requests an explanation for this major architectural change and its
impact.

Examples:

packaging/components.json [283]
    "name": "web",
packaging/packages.bzl [475]
    "zen": {

Solution Walkthrough:

Before:

// packaging/components.json
[
  ...
  {
    "name": "nats",
    ...
  },
  {
    "name": "proton",
    "package_name": "serviceradar-proton",
    "description": "ServiceRadar Proton Server (Stream Processing Engine)",
    ...
  },
  {
    "name": "web",
    ...
  }
]

After:

// packaging/components.json
[
  ...
  {
    "name": "nats",
    ...
  },
  {
    "name": "web",
    ...
  }
]

Suggestion importance[1-10]: 9

__

Why: This suggestion correctly identifies the unexplained removal of the proton component, a major architectural change that is critical for understanding the PR's purpose and overall impact on the system.

High
General
Avoid installing unnecessary recommended packages

Add the --no-install-recommends flag to the apt-get install command to prevent
the installation of non-essential recommended packages.

.github/workflows/release.yml [238-239]

 sudo apt-get update -y
-sudo apt-get install -y rpm
+sudo apt-get install -y --no-install-recommends rpm
  • Apply / Chat
Suggestion importance[1-10]: 6

__

Why: This is a valid best practice for CI/CD workflows that improves efficiency by reducing installation time and disk usage, and minimizes the potential attack surface by not installing unnecessary packages.

Low
Possible issue
Use a stricter check for undefined variables

Change the environment variable checks from a falsy check (!process.env.VAR) to
a strict undefined check (process.env.VAR === undefined) to avoid overwriting
intentionally empty variables.

web/next.config.bazel.mjs [17-23]

 // Force webpack for Bazel builds to avoid Turbopack symlink checks in the sandbox.
-if (!process.env.TURBOPACK) {
+if (process.env.TURBOPACK === undefined) {
   process.env.TURBOPACK = "0";
 }
-if (!process.env.NEXT_PRIVATE_SKIP_TURBOPACK) {
+if (process.env.NEXT_PRIVATE_SKIP_TURBOPACK === undefined) {
   process.env.NEXT_PRIVATE_SKIP_TURBOPACK = "1";
 }
  • Apply / Chat
Suggestion importance[1-10]: 3

__

Why: The suggestion is technically correct about the difference between a falsy check and an undefined check, but in this specific context, the impact is negligible as an empty string is not a meaningful value for these environment variables.

Low
  • More
Imported GitHub PR comment. Original author: @qodo-code-review[bot] Original URL: https://github.com/carverauto/serviceradar/pull/1973#issuecomment-3560703834 Original created: 2025-11-20T23:59:59Z --- ## PR Code Suggestions ✨ <!-- babf786 --> Explore these optional code suggestions: <table><thead><tr><td><strong>Category</strong></td><td align=left><strong>Suggestion&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </strong></td><td align=center><strong>Impact</strong></td></tr><tbody><tr><td rowspan=1>High-level</td> <td> <details><summary>Justify removal of the Proton component</summary> ___ **The PR removes the "proton" stream processing engine without justification. The <br>suggestion requests an explanation for this major architectural change and its <br>impact.** ### Examples: <details> <summary> <a href="https://github.com/carverauto/serviceradar/pull/1973/files#diff-3ae5949d89b0252d10fce9bf950231c8151a73b2154dccfe4e7261acc116582cR283-R283">packaging/components.json [283]</a> </summary> ```json "name": "web", ``` </details> <details> <summary> <a href="https://github.com/carverauto/serviceradar/pull/1973/files#diff-9bfe2a5141a9e402bb5a5a8fca53b9eea64396ec18108c535392e1054c90b913R475-R475">packaging/packages.bzl [475]</a> </summary> ```starlark "zen": { ``` </details> ### Solution Walkthrough: #### Before: ```starlark // packaging/components.json [ ... { "name": "nats", ... }, { "name": "proton", "package_name": "serviceradar-proton", "description": "ServiceRadar Proton Server (Stream Processing Engine)", ... }, { "name": "web", ... } ] ``` #### After: ```starlark // packaging/components.json [ ... { "name": "nats", ... }, { "name": "web", ... } ] ``` <details><summary>Suggestion importance[1-10]: 9</summary> __ Why: This suggestion correctly identifies the unexplained removal of the `proton` component, a major architectural change that is critical for understanding the PR's purpose and overall impact on the system. </details></details></td><td align=center>High </td></tr><tr><td rowspan=1>General</td> <td> <details><summary>Avoid installing unnecessary recommended packages</summary> ___ **Add the <code>--no-install-recommends</code> flag to the <code>apt-get install</code> command to prevent <br>the installation of non-essential recommended packages.** [.github/workflows/release.yml [238-239]](https://github.com/carverauto/serviceradar/pull/1973/files#diff-87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34R238-R239) ```diff sudo apt-get update -y -sudo apt-get install -y rpm +sudo apt-get install -y --no-install-recommends rpm ``` - [ ] **Apply / Chat** <!-- /improve --apply_suggestion=1 --> <details><summary>Suggestion importance[1-10]: 6</summary> __ Why: This is a valid best practice for CI/CD workflows that improves efficiency by reducing installation time and disk usage, and minimizes the potential attack surface by not installing unnecessary packages. </details></details></td><td align=center>Low </td></tr><tr><td rowspan=1>Possible issue</td> <td> <details><summary>Use a stricter check for undefined variables</summary> ___ **Change the environment variable checks from a falsy check (<code>!process.env.VAR</code>) to <br>a strict <code>undefined</code> check (<code>process.env.VAR === undefined</code>) to avoid overwriting <br>intentionally empty variables.** [web/next.config.bazel.mjs [17-23]](https://github.com/carverauto/serviceradar/pull/1973/files#diff-02dc3251220daf4ccac6e0ef65f430fb0191cdfc7920e65a05aa7a2586615584R17-R23) ```diff // Force webpack for Bazel builds to avoid Turbopack symlink checks in the sandbox. -if (!process.env.TURBOPACK) { +if (process.env.TURBOPACK === undefined) { process.env.TURBOPACK = "0"; } -if (!process.env.NEXT_PRIVATE_SKIP_TURBOPACK) { +if (process.env.NEXT_PRIVATE_SKIP_TURBOPACK === undefined) { process.env.NEXT_PRIVATE_SKIP_TURBOPACK = "1"; } ``` - [ ] **Apply / Chat** <!-- /improve --apply_suggestion=2 --> <details><summary>Suggestion importance[1-10]: 3</summary> __ Why: The suggestion is technically correct about the difference between a falsy check and an `undefined` check, but in this specific context, the impact is negligible as an empty string is not a meaningful value for these environment variables. </details></details></td><td align=center>Low </td></tr> <tr><td align="center" colspan="2"> - [ ] More <!-- /improve --more_suggestions=true --> </td><td></td></tr></tbody></table>
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
carverauto/serviceradar!2441
No description provided.