feat: on-demand Azure VM lifecycle with start/stop workflows#142
Conversation
Provision a VM with no reserved public IP; start/stop GitHub Actions workflows (OIDC auth) create/delete the IP and arm an auto-shutdown timer so idle cost is disk-only. Services now restart: unless-stopped so the stack recovers on boot; deploy resolves the dynamic IP at runtime. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe PR adds manual Azure VM start and stop workflows, moves public IP management into runtime workflows, resolves the VM IP for Ansible deployment, updates Terraform networking, and adds restart policies to core Compose services. ChangesAzure VM operations
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant AzureLogin
participant AzureCLI
participant PublicIP
participant AzureVM
GitHubActions->>AzureLogin: Authenticate with OIDC
GitHubActions->>AzureCLI: Ensure and attach public IP
AzureCLI->>PublicIP: Create or update public IP
AzureCLI->>AzureVM: Start VM
AzureCLI->>AzureVM: Configure auto-shutdown
AzureCLI-->>GitHubActions: Return public IP and shutdown time
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/deploy-ansible.yml (1)
67-80: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRemove the redundant
ssh-keyscanstep.The
ssh-keyscancommand is unnecessary here because the generated Ansible inventory explicitly disables strict host key checking (-o StrictHostKeyChecking=no). Ansible will automatically accept the host key when it connects.Furthermore, because this workflow runs shortly after the VM starts, the SSH service might not be fully ready yet. If
ssh-keyscanruns before SSH is up, it will silently fail to gather the key anyway. Relying on Ansible's connection step (which can retry) alongsideStrictHostKeyChecking=nois more robust for ephemeral IPs.♻️ Proposed refactor
- - name: Scan VM Host Key - run: ssh-keyscan -H "$VM_IP" >> ~/.ssh/known_hosts - - name: Write inventory with the resolved IP run: | cat > infra/inventory.ini <<EOF [web] $VM_IP [all:vars] ansible_user=azureuser ansible_ssh_private_key_file=~/.ssh/id_rsa ansible_ssh_common_args='-o StrictHostKeyChecking=no' ansible_python_interpreter=/usr/bin/python3.10 EOF🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deploy-ansible.yml around lines 67 - 80, Remove the ssh-keyscan step preceding “Write inventory with the resolved IP” in the workflow, leaving the inventory’s StrictHostKeyChecking=no configuration and Ansible connection flow unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/vm-start.yml:
- Around line 61-68: The vm-start workflow directly interpolates the
user-controlled hours input into shell scripts, enabling command injection. In
.github/workflows/vm-start.yml lines 61-68, add an HOURS environment variable to
the “Arm auto-shutdown timer” step and use $HOURS in the date command; apply the
same environment binding and shell-variable substitution in lines 70-83 for the
other affected step.
---
Nitpick comments:
In @.github/workflows/deploy-ansible.yml:
- Around line 67-80: Remove the ssh-keyscan step preceding “Write inventory with
the resolved IP” in the workflow, leaving the inventory’s
StrictHostKeyChecking=no configuration and Ansible connection flow unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 8e6f7c2c-d0de-475e-a183-c3f428a5f3fd
⛔ Files ignored due to path filters (1)
infra/id_rsa.pubis excluded by!**/*.pub
📒 Files selected for processing (6)
.github/workflows/deploy-ansible.yml.github/workflows/vm-start.yml.github/workflows/vm-stop.ymlinfra/docker-compose.ymlinfra/inventory.iniinfra/main.tf
…te-level timer The hours input was interpolated directly into run: scripts (command injection). Bind it via env and reference the shell var instead. Switch the input to minutes (default 120) for finer auto-shutdown granularity. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2 participants
Summary
On-demand Azure VM lifecycle. The VM has no reserved public IP; Start/Stop GitHub Actions workflows (OIDC auth) create/delete the IP and arm an auto-shutdown timer, so idle cost is disk-only. All services now use
restart: unless-stoppedso the stack recovers on boot, and the deploy workflow resolves the dynamic IP at runtime.Type of change
API changes
api/openapi.yamlupdated andapi/scripts/gen-all.shre-runDefinition of Done
Summary by CodeRabbit
New Features
Bug Fixes
Infrastructure