feat: enable Turbo remote cache in Docker builds#7734
feat: enable Turbo remote cache in Docker builds#7734paulbalaji wants to merge 3 commits intomainfrom
Conversation
… improved .dockerignore - Expand .dockerignore to exclude .git/, .github/, docs/, coverage/, .turbo/, etc. - Expand rust/.dockerignore to exclude unnecessary files - Add pnpm store cache mount to all TypeScript Dockerfiles for faster installs - Enable Turbo remote cache (Depot) during Docker builds via secure secret mount - Pass TURBO_TOKEN as Docker build secret to avoid exposing in build logs - Graceful fallback when TURBO_TOKEN unavailable (fork PRs still work)
paulbalaji
requested review from
Mo-Hussain,
ameten,
kamiyaa,
nambrot and
yjamin
as code owners
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.
📝 WalkthroughWalkthroughThis PR integrates Turbo remote caching into the Docker build pipeline by passing authentication credentials (TURBO_TEAM and TURBO_TOKEN) through GitHub Actions workflows to multiple service Dockerfiles, while expanding .dockerignore patterns to reduce build context size. Changes
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly Related PRs
Suggested Reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
♻️ Rebalancer Docker Image Built SuccessfullyImage Tags: |
🕵️ Warp Monitor Docker Image Built SuccessfullyImage Tags: |
paulbalaji
changed the title
🐳 Monorepo Docker Image Built SuccessfullyImage Tags: |
🦀 Rust Agent Docker Image Built SuccessfullyImage Tags: |
🔍 CCIP Server Docker Image Built SuccessfullyImage Tags: |
paulbalaji
requested review from
antigremlin
and removed request for
kamiyaa and
yjamin
There was a problem hiding this comment.
Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.dockerignore (1)
22-35: Good context shrink; keeping.git/is a fair trade, but it’s a chunky onion layer.
Since.git/can bloat context a lot, consider a later improvement where vergen metadata is injected via build-args/env (commit/describe) so you can ignore.git/again—no need for this PR, just a heads-up.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (10)
.dockerignore.github/workflows/ccip-server-docker.yml.github/workflows/monorepo-docker.yml.github/workflows/rebalancer-docker.yml.github/workflows/warp-monitor-docker.ymlDockerfilerust/.dockerignoretypescript/ccip-server/Dockerfiletypescript/rebalancer/Dockerfiletypescript/warp-monitor/Dockerfile
🧰 Additional context used
🧠 Learnings (5)
📚 Learning: 2025-12-29T19:45:12.592Z
Learnt from: paulbalaji
Repo: hyperlane-xyz/hyperlane-monorepo PR: 7545
File: typescript/infra/src/rebalancer/helm.ts:82-83
Timestamp: 2025-12-29T19:45:12.592Z
Learning: In the hyperlane-xyz/hyperlane-monorepo repository, Docker image tags in Helm managers (e.g., typescript/infra/src/rebalancer/helm.ts) are intentionally hardcoded for reproducibility and explicit version control, rather than using dynamically generated CI tags.
Applied to files:
typescript/rebalancer/DockerfileDockerfile
📚 Learning: 2025-08-13T16:53:55.163Z
Learnt from: paulbalaji
Repo: hyperlane-xyz/hyperlane-monorepo PR: 6891
File: typescript/infra/config/environments/mainnet3/funding.ts:22-22
Timestamp: 2025-08-13T16:53:55.163Z
Learning: In Hyperlane mainnet3 configs, funding.ts uses 'gcr.io/abacus-labs-dev/hyperlane-monorepo' docker image while agent.ts uses 'gcr.io/abacus-labs-dev/hyperlane-agent' docker image. These are different images with independent tag cycles, so tag consistency across them is not expected.
Applied to files:
typescript/rebalancer/Dockerfile
📚 Learning: 2025-12-22T16:50:19.890Z
Learnt from: paulbalaji
Repo: hyperlane-xyz/hyperlane-monorepo PR: 7565
File: typescript/ccip-server/Dockerfile:10-11
Timestamp: 2025-12-22T16:50:19.890Z
Learning: Standardize Foundry installation in Dockerfiles by using the official curl -L https://foundry.paradigm.xyz | bash followed by foundryup. This pattern is already used across multiple Dockerfiles in the repo and should be retained for consistency and reliability wherever Foundry is installed.
Applied to files:
typescript/rebalancer/Dockerfiletypescript/warp-monitor/Dockerfiletypescript/ccip-server/DockerfileDockerfile
📚 Learning: 2025-08-26T13:45:52.227Z
Learnt from: paulbalaji
Repo: hyperlane-xyz/hyperlane-monorepo PR: 6943
File: rust/main/config/testnet_config.json:34-35
Timestamp: 2025-08-26T13:45:52.227Z
Learning: Skip reviewing mainnet_config.json and testnet_config.json configuration files in typescript/infra/config/ and rust/main/config/ directories as requested by paulbalaji to reduce review noise.
Applied to files:
rust/.dockerignore.dockerignore
📚 Learning: 2025-11-26T13:28:51.658Z
Learnt from: paulbalaji
Repo: hyperlane-xyz/hyperlane-monorepo PR: 7410
File: typescript/cli/package.json:20-20
Timestamp: 2025-11-26T13:28:51.658Z
Learning: In the hyperlane-xyz/hyperlane-monorepo repository, hyperlane-xyz/registry is maintained in a separate repository and published to npm, so it should use a pinned version (e.g., "23.6.0") rather than the workspace protocol ("workspace:*") that other internal Hyperlane packages use.
Applied to files:
Dockerfile
🔇 Additional comments (9)
rust/.dockerignore (1)
1-6: Looks good for trimming Rust build context; just ensure nothing indocs//*.mdis needed at build time.
If any crate build script or Dockerfile step reads README/docs (rare, but it happens), this will cause a confusing “file not found” duringdocker build..github/workflows/ccip-server-docker.yml (1)
111-116: Nice and clean wiring for Turbo cache (team as arg, token as secret).
Just make sure this pairs with an optional secret mount in the Dockerfile, so non-secret builds don’t choke..github/workflows/warp-monitor-docker.yml (1)
111-116: Same story here: good Turbo secret/arg plumbing; verify missing-secret behavior end-to-end.
If the builder runs withoutDEPOT_TURBO_TOKEN, the Dockerfile should still build (just without remote cache).Dockerfile (1)
58-65: The code already provides the graceful fallback through BuildKit's default secret mount behavior (required=false). Thecat ... 2>/dev/null || echo ""safely handles missing secrets. Addingrequired=falseexplicitly would only clarify intent but isn't required to prevent failures.Likely an incorrect or invalid review comment.
.github/workflows/monorepo-docker.yml (1)
131-133: Turbo remote cache wiring looks solid.The TURBO_TEAM build-arg and TURBO_TOKEN secret are properly configured. Using the secrets block ensures the token won't leak into build logs or image layers.
.github/workflows/rebalancer-docker.yml (1)
114-116: LGTM on the Turbo integration.Consistent with the monorepo workflow, this wires the cache credentials securely into the build process.
typescript/rebalancer/Dockerfile (1)
65-71: Consistent Turbo setup across services.Same secure pattern as the warp-monitor Dockerfile - secret mount with graceful fallback. Keeps things tidy and predictable.
typescript/ccip-server/Dockerfile (1)
74-80: Turbo cache integration matches the pattern.The ccip-server now uses the same secure Turbo remote cache setup as the other services. Running
buildinstead ofbundleis the right call for this service.typescript/warp-monitor/Dockerfile (1)
65-71: Secret handling looks solid.The fallback pattern
$(cat /run/secrets/TURBO_TOKEN 2>/dev/null || echo "")keeps things working for fork PRs without the secret, and mounting astype=secretkeeps it out of the layers where it doesn't belong. Good call on disabling telemetry too.The endpoint
https://cache.depot.devis the right one for Depot's remote cache—that's all sorted. Your Turbo setup here is properly configured, layers are clean, and secrets stay where they should be. Nothing wrong with this.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7734 +/- ##
=======================================
Coverage 77.02% 77.02%
=======================================
Files 117 117
Lines 2651 2651
Branches 244 244
=======================================
Hits 2042 2042
Misses 593 593
Partials 16 16
🚀 New features to boost your workflow:
|
Pull request was closed
1 participant
Summary
Enables Depot's Turbo remote cache during Docker builds, allowing
pnpm turbo runcommands to skip rebuilding unchanged packages by hitting the same cache used in CI.Also includes a drive-by expansion of
.dockerignoreto reduce build context size.Build Time Comparison
Changes
Turbo remote cache:
TURBO_TEAMas build-arg andTURBO_TOKENas Docker build secret to all TypeScript Docker workflows$(cat /run/secrets/TURBO_TOKEN 2>/dev/null || echo "")ensures fork PRs still workDrive-by
.dockerignoreimprovements:.github/,.changeset/,.vscode/,.turbo/,coverage/,docs/, etc..git/is intentionally NOT excluded (needed by rust/Dockerfile for vergen)Security
TURBO_TOKENis passed as a Docker build secret (--mount=type=secret) rather than a build arg, so it never appears in build logs or image layers.Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.