[WIP] konflux: use RHAI base image #1074
Conversation
WalkthroughAdds a Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Developer / CI
participant Tekton as Tekton Pipeline
participant Build as Build Task / Container build
participant Repo as RPM Repos (redhat.repo / rpms.lock)
participant Registry as Image Registry
Dev->>Tekton: start pipeline (params include build-args-file)
Tekton->>Build: trigger build task with matrix (BUILD_ARGS_FILE)
Build->>Repo: resolve RPMs using redhat.repo and rpms.lock
Build->>Build: apply Containerfile ARGs (BUILDER_BASE_IMAGE, RUNTIME_BASE_IMAGE, DNF commands)
Build->>Registry: push built image
Registry-->>Dev: image available / build completed
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
Containerfile (1)
57-85: Add ARG RUNTIME_DNF_COMMAND to the final stage to fix empty variable expansion.ARGs declared before the first
FROM(line 3) have global scope but are not automatically available inside build stages. At line 85,${RUNTIME_DNF_COMMAND}expands to empty, causing the command to fail withinstall: invalid option -- 'y'. Re-declare the ARG in the final stage.Fix
FROM ${RUNTIME_BASE_IMAGE} +ARG RUNTIME_DNF_COMMAND ARG APP_ROOT=/app-root WORKDIR /app-root
raptorsun
force-pushed
the
rhai-base-image
branch
from
6f0def9 to
5b1c8c8
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
Containerfile (1)
59-87:⚠️ Potential issue | 🔴 CriticalCritical: Same ARG scoping issue in the runtime stage.
RUNTIME_DNF_COMMANDis undefined afterFROM ${RUNTIME_BASE_IMAGE}. This will cause the same pipeline failure at line 87.🐛 Proposed fix to re-declare ARG in runtime stage
FROM ${RUNTIME_BASE_IMAGE} +ARG RUNTIME_DNF_COMMAND=microdnf ARG APP_ROOT=/app-root WORKDIR /app-root
🤖 Fix all issues with AI agents
In `@Containerfile`:
- Around line 2-7: The build ARGs declared before the first FROM (ARG
BUILDER_BASE_IMAGE, ARG BUILDER_DNF_COMMAND, ARG RUNTIME_BASE_IMAGE, ARG
RUNTIME_DNF_COMMAND) are not available inside the builder stage, causing
${BUILDER_DNF_COMMAND} to be empty; re-declare the required ARGs immediately
after the corresponding FROM lines (e.g., after "FROM ${BUILDER_BASE_IMAGE} AS
builder" add "ARG BUILDER_DNF_COMMAND" and any other builder ARGs you need) so
RUN steps that reference ${BUILDER_DNF_COMMAND} resolve correctly, and likewise
re-declare runtime ARGs after the runtime FROM if used in that stage.
|
/retest |
raptorsun
force-pushed
the
rhai-base-image
branch
2 times, most recently
from
44fb3d1 to
31d6b47
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@rpms.lock.yaml`:
- Around line 7-178: The repoids listed in rpms.lock.yaml
(rhel-9-for-aarch64-appstream-eus-rpms, rhel-9-for-aarch64-baseos-eus-rpms,
rhel-9-for-x86_64-appstream-eus-rpms, rhel-9-for-x86_64-baseos-eus-rpms) are
missing from redhat.repo; add matching repository stanzas for each repoid in
redhat.repo using the correct id names, set appropriate baseurl or mirrorlist
(pointing to the EUS CDN or internal mirror), enable=1, gpgcheck and gpgkey
settings consistent with other RHEL 9 repos, and ensure the
enabled/priority/gpgkey values mirror the existing appstream/baseos entries so
the packages in rpms.lock.yaml can be resolved.
31d6b47 to
fe8023c
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI agents
In `@requirements.hashes.source.txt`:
- Around line 951-953: The new trl 0.27.2 removes the warnings_issued attribute
and changes SFTTrainer init behavior (for transformers < v5) and DPO
preprocessing EOS handling; search the codebase for any use of warnings_issued
and replace it with an alternative (e.g., use Python's warnings module or trl's
current API for tracking warnings), verify SFTTrainer instantiation code
(references to SFTTrainer) to match the updated constructor semantics for older
transformers or pin trl to a prior version if you rely on the old behavior, and
check any DPO preprocessing code that assumes extra EOS tokens and update it to
the corrected preprocessing logic; run tests after making these changes.
- Around line 586-670: The requirements.hashes.source.txt entry lists a
nonexistent version "polyleven==0.10.0"; either replace it with the valid PyPI
release "polyleven==0.9.0" and regenerate/replace the corresponding --hash
lines, or remove the entire polyleven block if the package is not required (note
requirements-build.txt has "# polyleven" commented), and ensure any references
to "polyleven==0.10.0" are updated/removed consistently.
- Around line 302-304: The requirements entry pins a non-existent package
version "litellm==1.81.7" which will break installs; update the line in
requirements.hashes.source.txt to the valid release "litellm==1.81.6" and update
or recompute the associated --hash values accordingly, or if you intended a
pre-release/nightly specify the exact source/tag (e.g., v1.81.7-nightly) and
point to that index or VCS URL so the installer can resolve it.
🧹 Nitpick comments (2)
Containerfile (1)
2-5: Consider aligning default base-image ARGs with the new RHAI config.Right now local builds without a build-args file will still default to UBI images. If that’s not desired, consider updating defaults to match the Konflux build-args file so local and CI builds behave consistently.
🔧 Optional diff to align defaults
-ARG BUILDER_BASE_IMAGE=registry.access.redhat.com/ubi9/python-312 -ARG BUILDER_DNF_COMMAND=dnf -ARG RUNTIME_BASE_IMAGE=registry.access.redhat.com/ubi9/python-312-minimal -ARG RUNTIME_DNF_COMMAND=microdnf +ARG BUILDER_BASE_IMAGE=registry.redhat.io/rhai/base-image-cpu-rhel9:3.2 +ARG BUILDER_DNF_COMMAND=dnf +ARG RUNTIME_BASE_IMAGE=registry.redhat.io/rhai/base-image-cpu-rhel9:3.2 +ARG RUNTIME_DNF_COMMAND=dnfrequirements.hashes.source.txt (1)
180-182: huggingface-hub 0.36.1 is secure but significantly outdated.Version 0.36.1 has no known security vulnerabilities (the historical vulnerability affecting versions < 0.13.4 was patched long ago). However, the latest stable release is 1.3.7 (Feb 2, 2026), with major version 1.0.0 released in October 2025. Since this file is auto-generated by
uv pip compile, the pinned version is likely a transitive dependency constraint; verify whether the underlying requirements should be updated to allow newer versions.
| litellm==1.81.7 \ | ||
| --hash=sha256:442ff38708383ebee21357b3d936e58938172bae892f03bc5be4019ed4ff4a17 \ | ||
| --hash=sha256:58466c88c3289c6a3830d88768cf8f307581d9e6c87861de874d1128bb2de90d |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
litellm 1.81.7 release notes changelog
💡 Result:
I couldn’t find any LiteLLM v1.81.7 release/tag or release notes.
- PyPI currently shows the latest
litellmpackage release as 1.81.6 (uploaded Feb 1, 2026), not 1.81.7. [1] - GitHub tags likewise show
v1.81.6-nightly(Feb 1, 2026) and do not list any v1.81.7 tag. [2] - The official Release Notes index also lists v1.81.6 and does not include v1.81.7. [3]
If you meant a different variant (e.g., v1.81.7-stable, -nightly, -rc, or a Docker image tag), tell me the exact tag string and where you saw it, and I’ll track down the corresponding changelog.
Sources: [1] [2] [3]
litellm 1.81.7 does not exist—correct the version to 1.81.6 or clarify the intended version.
PyPI shows litellm 1.81.6 (released Feb 1, 2026) as the latest available version. Version 1.81.7 is not present in PyPI, GitHub tags, or official release notes. The current specification will fail during dependency installation. If you intend to pin the latest stable version, use 1.81.6 instead. If targeting a specific pre-release or nightly build, provide the exact tag (e.g., v1.81.7-nightly or similar) and its source.
🤖 Prompt for AI Agents
In `@requirements.hashes.source.txt` around lines 302 - 304, The requirements
entry pins a non-existent package version "litellm==1.81.7" which will break
installs; update the line in requirements.hashes.source.txt to the valid release
"litellm==1.81.6" and update or recompute the associated --hash values
accordingly, or if you intended a pre-release/nightly specify the exact
source/tag (e.g., v1.81.7-nightly) and point to that index or VCS URL so the
installer can resolve it.
| polyleven==0.10.0 \ | ||
| --hash=sha256:00e8aeaccd5e40a6e0685e1a4bdc404fbf009b498597373bc3a83ebb41b360ee \ | ||
| --hash=sha256:03a22a7f4d129a1f82362c8da050ceda44d58842da8703180863888bca62efd0 \ | ||
| --hash=sha256:04f321bf1d3e4de4095393356caa399e0b3ae9f4610908b9c09b45cbbf3c09fe \ | ||
| --hash=sha256:0513c5018e5941839da331e910b8e694c4dda56317b8c68f73a9571b184b7b6e \ | ||
| --hash=sha256:074c5ead1f0ee5d429d0d45d1bd33fdee29757e9bfb07aabfd55eb0f6058b758 \ | ||
| --hash=sha256:08d8103f4052fecf0a86020a3623b03b676c0b5a6d288c8c5e51a1256310b2b0 \ | ||
| --hash=sha256:09a718a521a61893ab989a120eca259208690bd9c82e5bbe9d2f8d715e2c0d1e \ | ||
| --hash=sha256:0a33c50d15ae3bf7c10b18df8fcea8ce2d67286f81219bcf47976a9c61c8297c \ | ||
| --hash=sha256:0e50a96ec039b0e6ebddad4e16968b5ba48e47279c1b8049c4cffddea06306b0 \ | ||
| --hash=sha256:10d7bc1312f1a2431679a49cc4ba0f70cbd82e3d674120a84545b8c39e21ff62 \ | ||
| --hash=sha256:13bb198acb966b94e4f9b08f66062ce6f84829cd5adc4559e26ba690a54d684c \ | ||
| --hash=sha256:1c9d0148436ce0ca86675a0d79c40e135166447e102b1ed1465ced2e1eb589f5 \ | ||
| --hash=sha256:2081ab2afe7d7b6e0f28d6d21ed38c56fe06b437843ecf0ee3f84e92c0dc8203 \ | ||
| --hash=sha256:20cd7950f067973fcbd6e976e86fce9b5646593300cba35444ecf4219f095022 \ | ||
| --hash=sha256:21ee3982e2ed0b696070096fc973178f50fb6c63c9a1ecacb46c7345936ac55f \ | ||
| --hash=sha256:22b4ed4fc73f28e7aa44a4e6146bf88dcb3d0a175f08c0978f3a486f0009bce2 \ | ||
| --hash=sha256:25e7f8ec69af11888d3ded84569b437f78ddfbbb8bb3ceeee278e2ca85b87a2d \ | ||
| --hash=sha256:288470f18b6af376bc90ef26db58b42c2daebdbf3e6ef8c736e667d466e7c082 \ | ||
| --hash=sha256:2b429266edd6dc672f35b0834bef93e3afca06ccbc39d119a4923dbe278a8c70 \ | ||
| --hash=sha256:2cdb62d17d36ebe811d402fbd3ca09a95e6863bd18e21bfc81c82c1a0e91e5e9 \ | ||
| --hash=sha256:343ab52ad8d111e46ba800f938484c4346524e6db13dfd99ee2693cb680e4ef6 \ | ||
| --hash=sha256:3517df703f0071582d23246343d35eaa860d206169502fd1ff83843c275b6626 \ | ||
| --hash=sha256:3679ce75add5a4418530b1ffd798192aab454524fd592276ea324d7d740e5451 \ | ||
| --hash=sha256:3732c6b93ab755155041303fbe52b9ab3d641a271b8c78034d338366d77e29bb \ | ||
| --hash=sha256:37f5fa2018efac4b243f1f62bd81d8cc830245407258940119c26a4f95ab301a \ | ||
| --hash=sha256:3876f0f2f67f1f183f10ead6c226cfa8e65f682225e3295c311df7b371ce9f71 \ | ||
| --hash=sha256:3a3a3e9e5f7733f64b8aea794beb757e20cca8b7a90a52d8dfe02e973746e457 \ | ||
| --hash=sha256:3f4b30a8054b9c31f477a15d727dc944bc7450a7d84f6c90e30d354da90a4388 \ | ||
| --hash=sha256:412996ddf16b6b73bbfc21ee8f16120b2b3fa5249c68f746fa9ef521c0321546 \ | ||
| --hash=sha256:41c8d61a8c742921a7ebc286e2d5dee03cd6659e22702e573329de84f4abfe98 \ | ||
| --hash=sha256:4c92ae3f6d3c5b14f0c9ea2f8054346e7bcd5fbd643d58e0960c0408bb004aed \ | ||
| --hash=sha256:5011e9ce10e875cf0f487b0bff7b21c3320287087fe9d91a7be0ceb23b463b54 \ | ||
| --hash=sha256:50d2c2dcaae06253bc97e53a8a537d5c48d259e1a3bd3b85f90daa77649c85aa \ | ||
| --hash=sha256:546ca556f85f6972ae1a2393d875d57fabf5679162650c2ad777aa9a5af2867c \ | ||
| --hash=sha256:547e9b4197230e2fae8110d0ac57f5de8d65dbf0aa94f4882fe5faf3f8e7c700 \ | ||
| --hash=sha256:595d8d0cd934e1e4042abbff9838b3a673eda6d269c3fa5727eec313c3df3d60 \ | ||
| --hash=sha256:5a189e57cf00f185333402967201071fda1db78446ea40c8a91d5fe27865eae3 \ | ||
| --hash=sha256:5ad04871576432e00129c3a8c5408eb0ecbf0321883a8332accf6c8011e9c003 \ | ||
| --hash=sha256:617f6da9704d0affa0f9619e6a7ef79ef535ab28e1f69e9d2e2a137bff985738 \ | ||
| --hash=sha256:6280eaeb216435de74e9c35a3276fbdb681f6f912ed428f649c27acdc39dd1d0 \ | ||
| --hash=sha256:644cd3730f43580cf90557fa1a149ea0e09571c2ddef9d9c3071ea0bd3b00b4a \ | ||
| --hash=sha256:675db0544b1e4fc08a78c7c777b40c56c1a6a8a1b538bd177610c3cdc3c6934e \ | ||
| --hash=sha256:68f3f7eac393d71ab767f3273b77e207fcd1ac096e5617b82acbf9bf899e6939 \ | ||
| --hash=sha256:6e765e51ef7931a9e5724f2a2f00aecd974db329be43cf878f7b56f07433f41f \ | ||
| --hash=sha256:713e87bf29592ef16d773b07dc4bad8a5575f230f89ccddf1fdde2e92d4b19b9 \ | ||
| --hash=sha256:745e70fd5dc8cb61f040a35a0a5b6565d8d955d72ad6cd8aac17306db4cf8ce3 \ | ||
| --hash=sha256:74af72c34ebbf9ef3a82652fc2f50a13a00999577dda969bab589ca79d78fa07 \ | ||
| --hash=sha256:75426e16960fe5f29be8ddcb64ab9c2c075ea1f835157023fc2a7792d740cdc0 \ | ||
| --hash=sha256:7a7c939fd2999413235b20d7442605cdb5361213981e70932d63a08d1090036a \ | ||
| --hash=sha256:7b128bc626199b3071f33c1aadd8dd535185abb7370f011ef58f4ca93b753032 \ | ||
| --hash=sha256:7b4df9d778c5c55ba377dceb3ff39ca46291fcff278ac9c558299051be38c0fb \ | ||
| --hash=sha256:7d5722484164e5529975d40b5e99290f221d259084b3d0b824c914f50cd103d2 \ | ||
| --hash=sha256:7eb189e7c2f713d9a3c24eeb8d2a03064d7365a3ec1eeb1667d3f82284a56833 \ | ||
| --hash=sha256:7fb473bfa1a68597cae78d14a4cb5fce75f619b978d5469f4bfb15e1b43f6214 \ | ||
| --hash=sha256:84edc2c9517fc30dd6c5ff3f140e4bac1f3dcc37e2c36f1ce67edaef7497777c \ | ||
| --hash=sha256:8777b2d3a67516803a86dc5bdaa66455f6c22dd98c6421f8506c0beac84ca9ff \ | ||
| --hash=sha256:89c481dcd59b9e7ca31d27a0633575b06909a246db1eb3e4318a5050a770234f \ | ||
| --hash=sha256:91bc30479d1b66a081c877473f7ff2943daa7d2573f192492abeabe4deca1db8 \ | ||
| --hash=sha256:93658d6c6d3581adfebc419866123dd317d37c28862d1b5f44c2949d816d6943 \ | ||
| --hash=sha256:99a4e6e89ff4f1e73dd3e160a3b87df0f7600513fefe8ea436cc66fd9e4719c3 \ | ||
| --hash=sha256:9d83ddc05fba8b75cd23404bc218a3fea888778f061300e220a705e7b303f24c \ | ||
| --hash=sha256:a1de0caaf1670feb7e4e55cb5c8a5a26026fac232c9d3ab8b8c0bc9257207882 \ | ||
| --hash=sha256:a37e658e0fd7baf10af94a477ad23737c9d944122976636a87728dee7e6ffff9 \ | ||
| --hash=sha256:a805860e131531732409152055af8fed1e26c83e26b1ccc8ee68bb34699781df \ | ||
| --hash=sha256:aab2104152bc7faae45ea8e43c59abea1db6e9d3f8a6d9eef65bb44042137d0e \ | ||
| --hash=sha256:ab8ac71db516befeda8f4ab61875c938b1c67315f2872fa262f0ba3856de6c73 \ | ||
| --hash=sha256:b527a11223d0a57dacbac342f464861dff98bf8e047c4daa4c1787134d1b53f3 \ | ||
| --hash=sha256:b67f1dbdb354f6015ab9780a89cfa3db0628608eee85db32ffcb3595009d99ca \ | ||
| --hash=sha256:bfe59466799c86a1d7a026303460a41cc3bd990bf05a2477af5e42fe20e77339 \ | ||
| --hash=sha256:c5a2da058154d456fbbd69c3e4a956546c28a62507ff175fbbb1e23bfe53ab8d \ | ||
| --hash=sha256:ccfbb44da427c66040b668fa67ebfa5d87a21919a5ba1771c4ea67affd492a26 \ | ||
| --hash=sha256:d0e2cac82d683bccebed36b1d85d2833c0b0db46c78c8e2212763b3f93943fd3 \ | ||
| --hash=sha256:d1c5363e0582ac88edf3d3a7aafe24300ac3bc8a9aa8bc54ea3cb544da2cfeeb \ | ||
| --hash=sha256:d607c7fcf345ca76a6b00df4abe5fd1f0628c402c6144118f7da82bb883aec57 \ | ||
| --hash=sha256:d9bf0338d263fb859cfb70c00e283524ad0f1e01a96810dabba8d81f3f154645 \ | ||
| --hash=sha256:db3752b0630be1ad87ff02040cee76fdd9f83cb4f8c335d7da6988de0e6a1f0f \ | ||
| --hash=sha256:e85c4fcb4f0d1622a38b1619067167f2aed8b814c2e08ec03b1437f60070f1d8 \ | ||
| --hash=sha256:ea096c4cc8e8f089f082fe1caefb152267b138eb314d378103fee63418490cc3 \ | ||
| --hash=sha256:ea673445dee5a2cfe303edb96541d7a5b359070b57357ecd14a1b63b39abb370 \ | ||
| --hash=sha256:eab7347c4aedf6d76e6eb27a84d6f5875ba41152c15f61508c6c23658ece976e \ | ||
| --hash=sha256:f486a2755894438d26110034a5d0b7ec02bab41a674998aa35c7fe0b453ae722 \ | ||
| --hash=sha256:f7bb2367cba98c1f356e8085f9689207aea9b42416d9d2c9d44c3b89a3f097cc \ | ||
| --hash=sha256:f9d14ca3ee1dfab08f29d61bf81159d830bf016bf951e3e8fcfd20c551272aef \ | ||
| --hash=sha256:fc0ea0d503ea8c18b37c951b972ce0f5e6e6bd51ec74febc109df56f891b2efc |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
polyleven Python package latest version and security vulnerabilities
💡 Result:
- Latest version (PyPI):
polyleven 0.9.0, released Feb 26, 2025. [1] - Known security vulnerabilities: Safety’s vulnerability database reports no known vulnerabilities for
polyleven(and indicates the latest non-vulnerable version is 0.9.0). [2]
Sources: [1] [2]
🏁 Script executed:
# Check the codebase for context about polyleven dependency
# Look in pyproject.toml and requirements files
find . -type f \( -name "pyproject.toml" -o -name "requirements*.txt" \) | head -20Repository: lightspeed-core/lightspeed-stack
Length of output: 239
🏁 Script executed:
# Check pyproject.toml for polyleven dependency
cat ./pyproject.toml | head -100Repository: lightspeed-core/lightspeed-stack
Length of output: 2811
🏁 Script executed:
# Check requirements-build.txt for polyleven
grep -n "polyleven" ./requirements-build.txtRepository: lightspeed-core/lightspeed-stack
Length of output: 97
🏁 Script executed:
# Check if 0.10.0 is mentioned elsewhere in requirements files
grep -r "polyleven" . --include="*.txt" --include="*.toml"Repository: lightspeed-core/lightspeed-stack
Length of output: 171
Incorrect package version: polyleven 0.10.0 does not exist on PyPI.
The version 0.10.0 listed in requirements.hashes.source.txt is invalid. PyPI's latest version is 0.9.0 (released Feb 26, 2025), and no version 0.10.0 exists. Additionally, the package is only commented out in requirements-build.txt (# polyleven at line 127), suggesting it should not be an active dependency. Verify whether this entry should be removed or updated to a valid version.
🤖 Prompt for AI Agents
In `@requirements.hashes.source.txt` around lines 586 - 670, The
requirements.hashes.source.txt entry lists a nonexistent version
"polyleven==0.10.0"; either replace it with the valid PyPI release
"polyleven==0.9.0" and regenerate/replace the corresponding --hash lines, or
remove the entire polyleven block if the package is not required (note
requirements-build.txt has "# polyleven" commented), and ensure any references
to "polyleven==0.10.0" are updated/removed consistently.
| trl==0.27.2 \ | ||
| --hash=sha256:05fbaa257d5d55bc659d8470c4d189eb046c18332d34dbe679e595bd5d6553cc \ | ||
| --hash=sha256:b0a5b3ba4c28cf3736647b77925feccee8c542c509f63f4f5df070f3abe602df |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
trl 0.27.2 release notes changelog
💡 Result:
Hugging Face TRL v0.27.2 (released Feb 3, 2026) — changelog (github.com)
- Removed access to
warnings_issued(PR#4960) (github.com) - Fixed
SFTTrainerinit logic: only removeTrainingArguments.push_to_hub_tokenfortransformers < v5(PR#4942) (github.com) - Fixed an extra EOS token being appended in DPO preprocessing for conversational data (PR
#4908) (github.com)
Citations:
- 1: https://github.com/huggingface/trl/releases
- 2: https://github.com/huggingface/trl/releases
- 3: https://github.com/huggingface/trl/releases
- 4: https://github.com/huggingface/trl/releases
Aware of the breaking API change in trl 0.27.2.
This patch (released Feb 3, 2026) contains bug fixes but no security updates: it removes access to warnings_issued, fixes SFTTrainer init logic for transformers < v5, and fixes an extra EOS token issue in DPO preprocessing. Ensure any code using warnings_issued from trl is updated.
🤖 Prompt for AI Agents
In `@requirements.hashes.source.txt` around lines 951 - 953, The new trl 0.27.2
removes the warnings_issued attribute and changes SFTTrainer init behavior (for
transformers < v5) and DPO preprocessing EOS handling; search the codebase for
any use of warnings_issued and replace it with an alternative (e.g., use
Python's warnings module or trl's current API for tracking warnings), verify
SFTTrainer instantiation code (references to SFTTrainer) to match the updated
constructor semantics for older transformers or pin trl to a prior version if
you rely on the old behavior, and check any DPO preprocessing code that assumes
extra EOS tokens and update it to the corrected preprocessing logic; run tests
after making these changes.
Signed-off-by: Haoyu Sun <hasun@redhat.com>
raptorsun
force-pushed
the
rhai-base-image
branch
from
fe8023c to
4df9239
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
requirements-build.txt (1)
31-48:⚠️ Potential issue | 🟠 MajorConflicting
hatchlingversions indicate unresolvable dependency constraint.The file contains both
hatchling==1.26.3(line 31) andhatchling==1.28.0(line 36) required by different transitive dependencies. Notably,hatch-fancy-pypi-readmedepends on both versions, making this an unresolvable conflict. While the file is autogenerated bypip-compile, this state indicates a dependency graph problem upstream that prevents successful installation—pip cannot satisfy both constraints simultaneously.
🤖 Fix all issues with AI agents
In `@requirements.overrides.txt`:
- Line 17: The pinned jiter version is inconsistent: requirements.overrides.txt
contains "jiter==0.12" while requirements.hashes.wheel.txt uses "jiter==0.12.0";
pick one canonical form and make both files match (either change "jiter==0.12"
to "jiter==0.12.0" or vice versa) so the two requirement files use the exact
same version string and avoid confusion.
🧹 Nitpick comments (1)
Containerfile (1)
86-89: Consider cleaning DNF cache after installation.The runtime stage installs packages but doesn't clean the DNF cache afterward. While
--setopt=keepcache=0prevents caching downloaded packages, the DNF metadata may still consume space.♻️ Optional: Clean DNF cache to reduce image size
USER root # Additional tools for derived images -RUN ${RUNTIME_DNF_COMMAND} install -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs jq patch +RUN ${RUNTIME_DNF_COMMAND} install -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs jq patch && \ + ${RUNTIME_DNF_COMMAND} clean all
| faiss-cpu==1.12.0 | ||
| sqlalchemy==2.0.45 | ||
| setuptools==80.9 | ||
| jiter==0.12 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, examine the requirements.overrides.txt file structure and header
head -20 requirements.overrides.txtRepository: lightspeed-core/lightspeed-stack
Length of output: 474
🏁 Script executed:
# Check for jiter mentions in the codebase
rg -n 'jiter' --glob '*.yaml' --glob '*.txt' --glob '*.md'Repository: lightspeed-core/lightspeed-stack
Length of output: 166
🏁 Script executed:
# Examine the tekton pipeline file context around line 50
cat -n .tekton/lightspeed-stack-push.yaml | sed -n '40,60p'Repository: lightspeed-core/lightspeed-stack
Length of output: 1967
🏁 Script executed:
# Check the requirements.overrides.txt full content to understand its purpose
cat -n requirements.overrides.txtRepository: lightspeed-core/lightspeed-stack
Length of output: 593
Ensure version consistency: jiter is pinned as 0.12 in requirements.overrides.txt but as 0.12.0 in requirements.hashes.wheel.txt.
These version formats are equivalent in Python packaging but should be aligned across requirement files to avoid confusion. Update one file to match the other's format.
🤖 Prompt for AI Agents
In `@requirements.overrides.txt` at line 17, The pinned jiter version is
inconsistent: requirements.overrides.txt contains "jiter==0.12" while
requirements.hashes.wheel.txt uses "jiter==0.12.0"; pick one canonical form and
make both files match (either change "jiter==0.12" to "jiter==0.12.0" or vice
versa) so the two requirement files use the exact same version string and avoid
confusion.
1 participant
Description
use RHAI base image, that comes with dependant libraries such as openMPI already installed.
Type of change
Tools used to create PR
Identify any AI code assistants used in this PR (for transparency and review context)
Related Tickets & Documents
Checklist before requesting a review
Testing
Summary by CodeRabbit