Skip to content

Conversation

@MH0386
Copy link
Contributor

@MH0386 MH0386 commented Oct 19, 2025

Summary by Sourcery

Enhance CI workflows and refactor core application startup and configuration to improve flexibility, error handling, and developer experience

New Features:

  • Add new Gradio GUI method in App class for creating Blocks-based chat interface
  • Introduce AGENTS.md with guidelines for building, linting, testing, and coding standards
  • Add Docker Compose file for local development with Qdrant and voice generation services

Enhancements:

  • Refactor App builder to use class methods, integrate Poml templates for prompts, and improve error handling in memory and tool setup
  • Rework Settings with enhanced Pydantic validators to auto-generate MCP config and manage directories and logging
  • Centralize logging configuration with RichHandler and ignore deprecation warnings

Build:

  • Update Dockerfile to accept an INSTALL_SOURCE build argument for flexible installation source
  • Upgrade pyproject dependencies and add Ruff configuration for linting

CI:

  • Parameterize Docker workflows with dynamic registry, install_source, and version extraction, and add job summaries and improved conditions
  • Add Opencode job triggered by issue comments and refine concurrency and trunk settings
  • Consolidate CI tools workflows and refine branch handling in Mergify config

Documentation:

  • Add AGENTS.md documentation for agent guidelines and code style

Tests:

  • Enhance test workflow to include dependency tree in job summary

Introduces a check to compare the current Git ref name with the package version defined in `pyproject.toml`.

Skips the `uv version` command, auto-commit, and tag update steps if the Git ref name already matches the `pyproject.toml` version. This avoids unnecessary modifications to the repository and redundant tag pushes when the version is already correctly set.
Copilot AI review requested due to automatic review settings October 19, 2025 14:22
@gitnotebooks
Copy link

gitnotebooks bot commented Oct 19, 2025

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Oct 19, 2025

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch ci

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@sourcery-ai
Copy link
Contributor

sourcery-ai bot commented Oct 19, 2025

Reviewer's Guide

This PR significantly enhances the CI/CD pipelines and refactors the core application setup, improving error handling, configurability, and developer ergonomics across the builder, settings, Dockerfile, workflows, and project scaffolding.

Sequence diagram for improved error handling in App.create()

sequenceDiagram
    participant App
    participant MCPClient
    participant Logger
    App->>Logger: Set settings
    App->>MCPClient: Read MCP config file
    alt File read error
        MCPClient-->>Logger: OSError
        Logger-->>App: Log warning
    else JSON parse error
        MCPClient-->>Logger: ValueError/TypeError
        Logger-->>App: Log warning
    else Other error
        MCPClient-->>Logger: Exception
        Logger-->>App: Log warning
    end
    App->>App: Setup LLM
    App->>App: Bind tools
    App->>App: Setup memory
    App->>App: Setup graph
    App-->>App: Return instance
Loading

Entity relationship diagram for new/modified settings and directory structure

erDiagram
    DIRECTORY_SETTINGS ||--o| LOG_DIRECTORY : contains
    DIRECTORY_SETTINGS ||--o| ASSETS_DIRECTORY : contains
    ASSETS_DIRECTORY ||--o| AUDIO_DIRECTORY : contains
    ASSETS_DIRECTORY ||--o| PROMPTS_DIRECTORY : contains
    MCP_SETTINGS ||--|{ MCP_CONFIG_FILE : references
    MODEL_SETTINGS {
        url AnyUrl
        name string
        api_key SecretStr
        temperature float
    }
    DIRECTORY_SETTINGS {
        base DirectoryPath
        assets DirectoryPath
        log DirectoryPath
        audio DirectoryPath
        prompts DirectoryPath
    }
    MCP_SETTINGS {
        path FilePath
    }
Loading

Class diagram for refactored App and Settings classes

classDiagram
    class App {
        +Settings settings
        +ChatOpenAI _llm
        +Runnable _model
        +list[BaseTool] _tools
        +Memory _memory
        +CompiledStateGraph _graph
        +async create(settings: Settings) Self
        +_setup_graph() CompiledStateGraph
        +_setup_llm() ChatOpenAI
        +async _setup_memory() Memory
        +async _setup_tools(_mcp_client: MultiServerMCPClient) list[BaseTool]
        +draw_graph() None
        +gui() Blocks
        +async generate_response(message: str, history: list[ChatMessage]) AsyncGenerator[tuple[str, list[ChatMessage], Path|None, Path|None]]
        +_is_url(value: str|None) bool
        +_download_file(url: HttpUrl, path: Path) None
    }
    class Settings {
        +MemorySettings memory
        +VectorDatabaseSettings vector_database
        +MCPSettings mcp
        +DirectorySettings directory
        +ModelSettings model
        +logger
    }
    class MemorySettings {
        +collection_name: str
        +embedding_dims: int
    }
    class VectorDatabaseSettings {
        +url: AnyUrl
        +name: str
    }
    class MCPSettings {
        +path: FilePath
        +create_init_mcp() Self
        +is_valid() Self
    }
    class DirectorySettings {
        +base: DirectoryPath
        +assets: DirectoryPath
        +log: DirectoryPath
        +audio: DirectoryPath
        +prompts: DirectoryPath
        +create_missing_dirs() Self
    }
    class ModelSettings {
        +url: AnyUrl
        +name: str
        +api_key: SecretStr
        +temperature: float
        +check_api_key_exist() Self
    }
    App --> Settings
    Settings --> MemorySettings
    Settings --> VectorDatabaseSettings
    Settings --> MCPSettings
    Settings --> DirectorySettings
    Settings --> ModelSettings
Loading

File-Level Changes

Change Details Files
Refactor App builder to class-based setup methods and enhance Gradio UI & response streaming
  • Convert instance methods to @classmethod and extract setup_llm, setup_memory, setup_tools, setup_graph helpers
  • Integrate LangchainPomlTemplate for prompt templating in _call_model
  • Implement generate_response as an async stream with audio download and URL detection
  • Add gui() to build Gradio Blocks interface and helper methods _is_url and _download_file
  • Enhance error handling and logging throughout the App flow
src/chattr/app/builder.py
Enhance settings management in Settings module
  • Set default MCPSettings.path and auto-create initial mcp.json via model_validator
  • Extend DirectorySettings to include audio/prompts dirs and register FileHandler for logs
  • Refine ModelSettings validator to remove system_message and provide custom error messages
  • Reorder dotenv and logger initialization for consistent startup
src/chattr/app/settings.py
Revamp CI workflows for flexible registry & dynamic version handling
  • Add registry and install_source inputs in .github/workflows/.docker.yaml with dynamic login and build args
  • Inject job summary steps (success/failure) and detect Python version for build args
  • Auto-commit version bumps and force-update tags in .github/workflows/build.yaml
  • Introduce opencode job on issue comments in ci_tools.yaml
  • Embed dependency tree summary in test.yaml and adjust conditional triggers across workflows
.github/workflows/.docker.yaml
.github/workflows/build.yaml
.github/workflows/ci_tools.yaml
.github/workflows/test.yaml
Introduce build-time INSTALL_SOURCE support in Dockerfile
  • Define ARG INSTALL_SOURCE in Dockerfile
  • Use INSTALL_SOURCE in uv tool install command to support PyPI or Git installs
Dockerfile
Add project guidelines and logging config files
  • Add AGENTS.md with build, lint, test, style and logging guidelines
  • Create src/chattr/app/logger.py with RichHandler configuration
  • Include compose-dev.yaml for local dev environment
  • Add trunk and ruff configuration files for consistent linting
AGENTS.md
src/chattr/app/logger.py
.trunk/configs/.yamllint.yaml
.trunk/configs/ruff.toml
compose-dev.yaml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@MH0386 MH0386 changed the base branch from main to enhance October 19, 2025 14:22
@gemini-code-assist
Copy link
Contributor

Summary of Changes

Hello @MH0386, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the project's continuous integration and development experience by migrating from devenv to a uv/Docker Compose setup. It introduces robust automation for PR management and integrates advanced multimedia generation capabilities through new MCP services for voice and video. The core application logic has been refactored for better structure and dynamic prompt handling, alongside the establishment of new code quality standards and improved logging infrastructure.

Highlights

  • Development Environment Migration: The project has fully migrated from devenv (Nix-based development environment) to uv for dependency management and Docker Compose for service orchestration, simplifying setup and ensuring consistency.
  • Enhanced CI/CD Automation: Mergify rules have been updated to include automated merging for 'Upgrade trunk' pull requests from github-actions[bot] and automatic deletion of head branches upon PR closure, streamlining the CI/CD pipeline.
  • New Multimedia Generation Capabilities: The application now integrates new Multi-agent Communication Protocol (MCP) services for voice and video generation, allowing the AI agent to produce rich multimedia responses. This includes new Docker Compose configurations for qdrant and vocalizr.
  • Application Core Refactoring: Significant refactoring of the App class has occurred, moving GUI logic directly into the class, enhancing memory management with mem0, and adopting LangchainPomlTemplate for dynamic system messages, improving modularity and extensibility.
  • Code Quality and Standardization: New configurations for Ruff (.trunk/configs/ruff.toml) and AGENTS.md guidelines have been introduced to standardize Python code style, linting, and development practices across the project, ensuring higher code quality.
  • Improved Logging and Directory Structure: Logging has been centralized with a new chattr.app.logger.py module, and the directory structure has been enhanced to include dedicated folders for audio and prompt templates, improving organization and maintainability.
Ignored Files
  • Ignored by pattern: .github/workflows/** (7)
    • .github/workflows/.docker.yaml
    • .github/workflows/.lint.yaml
    • .github/workflows/build.yaml
    • .github/workflows/ci_tools.yaml
    • .github/workflows/release.yaml
    • .github/workflows/test.yaml
    • .github/workflows/version.yaml
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@gemini-code-assist
Copy link
Contributor

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

Copy link
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey there - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@deepsource-io
Copy link

deepsource-io bot commented Oct 19, 2025

Here's the code health analysis summary for commits 2e667e2..bb19a43. View details on DeepSource ↗.

Analysis Summary

AnalyzerStatusSummaryLink
DeepSource Shell LogoShell✅ SuccessView Check ↗
DeepSource Python LogoPython✅ SuccessView Check ↗
DeepSource Docker LogoDocker✅ SuccessView Check ↗
DeepSource Secrets LogoSecrets✅ SuccessView Check ↗

💡 If you’re a repository administrator, you can configure the quality gates from the settings.

@sonarqubecloud
Copy link

@mergify
Copy link
Contributor

mergify bot commented Oct 19, 2025

🧪 CI Insights

Here's what we observed from your CI run for bb19a43.

🟢 All jobs passed!

But CI Insights is watching 👀

@MH0386
Copy link
Contributor Author

MH0386 commented Oct 19, 2025

🔍 Vulnerabilities of ghcr.io/alphaspheredotai/chattr:a073345-pr-422

📦 Image Reference ghcr.io/alphaspheredotai/chattr:a073345-pr-422
digestsha256:608d16d653d3cfc33c8175ed83ddace15b8cf281fce8d7514b0de6112ba14057
vulnerabilitiescritical: 0 high: 2 medium: 1 low: 0
platformlinux/amd64
size325 MB
packages500
critical: 0 high: 1 medium: 0 low: 0 pdfjs-dist 3.11.174 (npm)

pkg:npm/[email protected]

# Dockerfile (30:30)
COPY --from=builder --chown=nonroot:nonroot --chmod=555 /home/nonroot/.local/ /home/nonroot/.local/

high 8.8: CVE--2024--4367 Improper Check for Unusual or Exceptional Conditions

Affected range<=4.1.392
Fixed version4.2.67
CVSS Score8.8
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score35.103%
EPSS Percentile97th percentile
Description

Impact

If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

The patch removes the use of eval:
mozilla/pdf.js#18015

Workarounds

Set the option isEvalSupported to false.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

critical: 0 high: 1 medium: 0 low: 0 gradio 5.49.1 (pypi)

pkg:pypi/[email protected]

# Dockerfile (30:30)
COPY --from=builder --chown=nonroot:nonroot --chmod=555 /home/nonroot/.local/ /home/nonroot/.local/

high 8.1: CVE--2023--6572 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range<2023-11-06
Fixed versionNot Fixed
CVSS Score8.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score1.662%
EPSS Percentile81st percentile
Description

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository gradio-app/gradio prior to main.

critical: 0 high: 0 medium: 1 low: 0 pip 24.3.1 (pypi)

pkg:pypi/[email protected]

# Dockerfile (30:30)
COPY --from=builder --chown=nonroot:nonroot --chmod=555 /home/nonroot/.local/ /home/nonroot/.local/

medium 5.9: CVE--2025--8869 Improper Link Resolution Before File Access ('Link Following')

Affected range<=25.2
Fixed versionNot Fixed
CVSS Score5.9
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score0.018%
EPSS Percentile3rd percentile
Description

Summary

In the fallback extraction path for source distributions, pip used Python’s tarfile module without verifying that symbolic/hard link targets resolve inside the intended extraction directory. A malicious sdist can include links that escape the target directory and overwrite arbitrary files on the invoking host during pip install.

Impact

Successful exploitation enables arbitrary file overwrite outside the build/extraction directory on the machine running pip. This can be leveraged to tamper with configuration or startup files and may lead to further code execution depending on the environment, but the direct, guaranteed impact is integrity compromise on the vulnerable system.

Conditions

The issue is triggered when installing an attacker-controlled sdist (e.g., from an index or URL) and the fallback extraction code path is used. No special privileges are required beyond running pip install; active user action is necessary.

Remediation

The fix, while available as a patch that can be manually applied, has not yet been put into a numbered version but is planned for 25.3. Using a Python interpreter that implements the safe-extraction behavior described by PEP 706 provides additional defense in depth for other tarfile issues but is not a substitute for upgrading pip for this specific flaw.

@MH0386 MH0386 merged commit 87a2f0a into enhance Oct 19, 2025
23 of 26 checks passed
@MH0386 MH0386 deleted the ci branch October 19, 2025 14:28
@mergify
Copy link
Contributor

mergify bot commented Oct 19, 2025

Thank you for your contribution @MH0386! Your pull request has been merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants