chore(ci): disable inherited upstream workflows, add publish-flex-image#24
Merged
Conversation
These five workflows were inherited from upstream open-webui/open-webui and were not producing artifacts on flex (none of them triggered on the flex branch). Renaming to .disabled mirrors the existing convention (codespell.disabled, lint-*.disabled) and keeps the diff vs upstream minimal while remaining reversible. - build-release.yml — upstream release pipeline, not relevant - docker-build.yaml — publishes to ghcr.io, replaced by publish-flex-image - format-backend.yaml — autoformat, not part of flex CI - format-build-frontend.yaml — autoformat, not part of flex CI - release-pypi.yml — upstream PyPI release, not relevant
Manual workflow (workflow_dispatch only) that builds the Flexion-customized Docker image for linux/arm64 and pushes it to AWS ECR under the chosen environment's repository (open-webui-dev or open-webui-prod) with the caller-supplied version tag. Design notes: - ARM-native runner (ubuntu-24.04-arm) matches the Fargate ARM deploy target — no QEMU overhead. - Only linux/arm64 is built. Multi-arch would double build time for no current benefit; can be extended later if x86 deploys are needed. - AWS auth via OIDC: assumes GitHubActionsOpenWebUIDev for environment=dev and GitHubActionsOpenWebUIProd for environment=prod. The prod role's trust policy was extended in flexion/flexion-open-webui-infra#461 to accept tokens from this repo's flex branch. - Tag overwrite guard: refuses to push if the tag already exists in ECR. Prevents accidental republishes that would mask source-of-truth provenance. Operator must delete the existing tag manually to retag. - ECR tag = upstream release tag verbatim (e.g. v0.9.5, not v9.5) — the 0. prefix is preserved end-to-end through to the CDK pin in the infra repo.
Author
|
@copilot review this PR |
Completed review on commit |
Copilot stopped work on behalf of
bdruth due to an error
May 19, 2026 03:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR A of the flex-CI-setup plan. Two coherent changes:
Why now
Today's container image promotion is a manual `docker push` from someone's laptop. This PR replaces that with auditable CI:
What's in `publish-flex-image.yml`
Required prerequisites (all complete)
Test plan
After merge:
```
gh workflow run publish-flex-image.yml -f version=v0.9.5 -f environment=dev
```
Expect: fails at "Refuse to overwrite an existing tag" (dev:v0.9.5 already exists).
```
gh workflow run publish-flex-image.yml -f version=flex-smoke-$(date +%s) -f environment=dev
```
Expect: success. Then `aws ecr batch-delete-image --image-ids imageTag=`.
Follow-ups