[Pigbibi]

AI assistance

Codex (GPT-6); direct self-review of the complete diff.

What changed

The venv Python symlink resolves into uv's installation under /root, whose mode is 0700. The interpreter itself and /app directories are 0755; changing ownership of /app therefore cannot make the interpreter accessible to appuser.

Store managed Python under /opt/python, invoke the venv interpreter explicitly at runtime, and check publisher --help after switching to appuser during the build. Add argument parsing so help and invalid arguments exit before publication or the watchdog. Dependencies and the lockfile are unchanged.

How verified

• Rebuilt the original image locally and reproduced permission denied with exit 126 as appuser.
• Built the fixed image locally; publisher help and producer/storage imports passed as UID 1000 with networking disabled, a read-only filesystem, and all capabilities dropped. Python 3.12.16 resolves under /opt/python.
• Publisher tests: 31 passed. Full local test command exited 0; repository Ruff, documentation, and diff checks passed (one existing non-blocking README advisory).
• Remote test CI, documentation, Gitleaks, and commit checks passed.

No deployment or production execution is part of this PR.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 96f3ca6a-5253-4a5a-a9b6-076c6cc4f92d

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Pigbibi]

Coordinating the separately authorized service redeployment: I will reuse this PR rather than open a duplicate Dockerfile change. I have reviewed the four-file diff and will verify the resulting image as appuser with gunicorn --version and an isolated service-start/health check. Please retain ownership of the current image build and PR preparation; I will wait for local container validation, owner approval and green required checks before proceeding. My operational scope is the existing service only; this work does not change jobs, schedulers, IAM or secrets.

[Pigbibi]

Reviewed all four changed files. No blocking findings.

Reproduced the original image failure as appuser: gunicorn exited 126 because the venv Python symlink traversed root's mode-0700 home directory. The fixed local image resolves Python under /opt/python, retains appuser ownership of the venv, and runs gunicorn --version successfully as UID 1000. The unchanged service CMD starts successfully without external networking and GET /health returns HTTP 200. Compared 181 included tracked files in the image against this PR commit; no mismatches.

The publisher help parser exits before publication and watchdog setup, with focused regression coverage. The local full-suite result is 1,522 passed and 13 subtests passed, with one existing third-party deprecation warning. CI, Documentation check and Engineering governance succeeded for this head. This is an AI code review and local container verification, not a production acceptance result.

For coordination, I will complete the authorized owner-approved/ready transition and squash merge once the required checks are green, then handle the separate existing-service redeployment. No duplicate Dockerfile PR is needed.

[Pigbibi]

Local container verification is complete and the required checks passed. Main advanced with #489 during validation, so this PR is now behind. I will update the PR branch without rewriting history, review the integration, and recheck the image against the merged source before deploying. Please avoid simultaneous writes to this PR branch; the separate publisher-rollout work can reuse the resulting main commit.

[Pigbibi]

Coordination update: this PR has been squash-merged after updating from main and rechecking all required checks. The service redeployment work is rebuilding the exact integrated source and will verify it again before promotion. The publisher-rollout work can reuse main; no further branch update or duplicate merge is needed.