Repository: scalableminds/webknossos
Pull request #8147: Convert CircleCI config to Github Actions
Author: login: hotzenklotz
Labels: name: CI
Created: 2024-10-24T14:02:01Z | Merged: 2025-04-10T11:47:06Z

### Removed
- All configurations file related to CircleCI (.circleci directory)
- The docker-compose.yml file is replaced with a note to the proper hosting file.

### Changed
- Moved Dockerfiles for webknossos, datastore and tracingstore to .github (All of them are for CI only)

### Added

- a custom GitHub action for retrying commands (see .github/actions/retry)
- a new GitHub Workflow with three jobs backend-tests, frontend-tests and build-test-e2e-deploy. All of them carry out parts of the original CircleCI pipelines:
       - backend-tests: Runs Scapegoat, Scalafmt and sbt tests
       - frontend-tests: Static tests and yarn test-verbose
       - build-test-e2e-deploy: Full build of webknossos including docker images followed by e2e tests and smoking tests. All docker images get pushed if all tests in this job pass.

### Steps to test:
- CI should be enough

------
(Please delete unneeded items, merge only when none are left open)
- [x] Updated [changelog](../blob/master/CHANGELOG.unreleased.md#unreleased)




Diff:
diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index f07220282a6..00000000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,217 +0,0 @@
-version: 2
-jobs:
-  build_test_deploy:
-    machine:
-      image: ubuntu-2004:202111-02
-      docker_layer_caching: false
-    resource_class: large
-    environment:
-      USER_NAME: circleci
-      USER_UID: 1000
-      USER_GID: 1000
-      TZ: Europe/Berlin
-    steps:
-      - run:
-          name: "Clone Repository"
-          command: |
-            if [ -n "$CIRCLE_BRANCH" ]; then
-              git clone --depth 5 "$CIRCLE_REPOSITORY_URL" --branch "$CIRCLE_BRANCH" --no-tags .
-            fi
-            if [ -n "$CIRCLE_TAG" ]; then
-              git clone --depth 5 "$CIRCLE_REPOSITORY_URL" --branch "$CIRCLE_TAG" .
-            fi
-      - run:
-          name: "Custom environment variables"
-          command: |
-            if [ -n "$CIRCLE_BRANCH" ]; then
-              NORMALIZED_BRANCH=${CIRCLE_BRANCH//[\/-]/_}
-              echo "export NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> $BASH_ENV
-              echo "export DOCKER_TAG=${NORMALIZED_BRANCH}__${CIRCLE_BUILD_NUM}" >> $BASH_ENV
-            fi
-            if [ -n "$CIRCLE_TAG" ]; then
-              echo "export NORMALIZED_BRANCH=master" >> $BASH_ENV
-              echo "export DOCKER_TAG=${CIRCLE_TAG}" >> $BASH_ENV
-            fi
-      - run:
-          name: Build webknossos-dev docker image
-          command: |
-            docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
-            DEV_CACHE=$NORMALIZED_BRANCH docker-compose build base
-      - run:
-          name: Prepare dependency folders
-          command: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
-      - run:
-          name: Install frontend dependencies
-          command: docker-compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
-      - run:
-          name: Assert unique evolution numbers
-          command: docker-compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
-      - run:
-          name: Assert schema.sql and evolutions are equal
-          command: |
-            docker-compose up -d postgres
-            sleep 3
-            docker-compose run compile tools/postgres/dbtool.js check-evolutions-schema
-      - run:
-          name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
-          command: tools/assert-complete-migrations.sh
-      - run:
-          name: Build frontend documentation
-          command: |
-            WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
-            docker-compose run base yarn run docs --project-version $WK_VERSION
-      - run:
-          name: Build webknossos (webpack)
-          command: |
-            docker-compose run base yarn build
-      - run:
-          name: Build webknossos (sbt)
-          command: |
-            if [ "${CIRCLE_BRANCH}" == "master" ]; then
-              docker-compose run compile sbt -no-colors clean compile stage
-            else
-              docker-compose run compile sbt -no-colors -DfailOnWarning compile stage
-            fi
-      - run:
-          name: Build webknossos-datastore (sbt)
-          command: docker-compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
-
-      - run:
-          name: Build webknossos-tracingstore (sbt)
-          command: docker-compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
-
-      - run:
-          name: Checksum App Dirs
-          command: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
-
-      - run:
-          name: Build webknossos docker image
-          command: |
-            docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
-            DEV_CACHE=$NORMALIZED_BRANCH docker-compose build --pull webknossos
-
-      - run:
-          name: Build webknossos-datastore docker image
-          command: docker-compose build --pull webknossos-datastore
-
-      - run:
-          name: Build webknossos-tracingstore docker image
-          command: docker-compose build --pull webknossos-tracingstore
-
-      - run:
-          name: Lint frontend code and check formatting
-          command: |
-            .circleci/not-on-master.sh docker-compose run base bash -c "yarn run check-frontend"
-      - run:
-          name: Check for cyclic dependencies in front-end
-          command: |
-            .circleci/not-on-master.sh docker-compose run base yarn check-cyclic-dependencies
-      - run:
-          name: Run frontend tests
-          command: |
-            .circleci/not-on-master.sh docker-compose run base yarn test-verbose
-      - run:
-          name: Lint backend code and check formatting
-          command: |
-            .circleci/not-on-master.sh docker-compose run backend-lint-format
-      - run:
-          name: Run backend tests
-          command: |
-            .circleci/not-on-master.sh docker-compose run backend-tests
-      - run:
-          name: Run end-to-end tests
-          command: |
-            mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
-            for i in {1..3}; do # retry
-              .circleci/not-on-master.sh docker-compose run e2e-tests && s=0 && break || s=$?
-            done
-            (exit $s)
-      - run:
-          name: Validate frontend types
-          command: |
-            .circleci/not-on-master.sh docker-compose run base yarn typecheck
-      - run:
-          name: Start webknossos, datastore and tracingstore
-          command: docker-compose up -d webknossos && docker-compose up -d webknossos-datastore && docker-compose up -d webknossos-tracingstore
-
-      - run:
-          name: Run webknossos smoke test
-          command: |
-            for i in {1..20}; do # retry
-              curl --fail -v http://localhost:9000/api/health && s=0 && break || s=$?
-              sleep 5
-            done
-            (exit $s)
-
-      - run:
-          name: Run webknossos-datastore smoke test
-          command: |
-            for i in {1..20}; do # retry
-              curl --fail -v http://localhost:9090/data/health && s=0 && break || s=$?
-              sleep 5
-            done
-            (exit $s)
-
-      - run:
-          name: Run webknossos-tracingstore smoke test
-          command: |
-            for i in {1..20}; do # retry
-              curl --fail -v http://localhost:9050/tracings/health && s=0 && break || s=$?
-              sleep 5
-            done
-            (exit $s)
-      - run:
-          name: Stop webknossos, datastore and tracingstore
-          command: docker-compose down --volumes --remove-orphans
-
-      - run:
-          name: Push docker images
-          command: |
-            function retry() {
-              for i in {1..5}; do
-                "$@" && s=0 && break || s=$?
-                sleep 10
-              done
-              return $s
-            }
-            retry sh -c 'echo $DOCKER_PASS | docker login -u $DOCKER_USER --password-stdin'
-            retry docker-compose push webknossos
-            retry docker-compose push webknossos-datastore
-            retry docker-compose push webknossos-tracingstore
-            if [ -n "$CIRCLE_BRANCH" ]; then
-              docker tag \
-                scalableminds/webknossos:${DOCKER_TAG} \
-                scalableminds/webknossos:${NORMALIZED_BRANCH}
-              retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
-              docker tag \
-                scalableminds/webknossos-datastore:${DOCKER_TAG} \
-                scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
-              retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
-              docker tag \
-                scalableminds/webknossos-tracingstore:${DOCKER_TAG} \
-                scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
-              retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
-              docker tag \
-                scalableminds/webknossos-dev \
-                scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
-              retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
-            fi
-            docker logout
-      - run:
-          name: Report coverage
-          command: .circleci/not-on-master.sh docker-compose run base yarn coverage || true
-      - run:
-          name: Send Slack notification (master only)
-          command: .circleci/slack-notification.sh
-
-
-workflows:
-  version: 2
-  circleci_build:
-    jobs:
-      - build_test_deploy:
-          context:
-            - DockerHub
-          filters:
-            tags:
-              only: /.*/
diff --git a/.circleci/not-on-master.sh b/.circleci/not-on-master.sh
deleted file mode 100755
index 581393ebead..00000000000
--- a/.circleci/not-on-master.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-
-if [ "${CIRCLE_BRANCH}" == "master" ]; then
-  echo "Skipping this step on master..."
-else
-  exec "$@"
-fi
diff --git a/.circleci/slack-notification.sh b/.circleci/slack-notification.sh
deleted file mode 100755
index c0be28a1cac..00000000000
--- a/.circleci/slack-notification.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-
-if [ "${CIRCLE_BRANCH}" == "master" ] ; then
-    author=${CIRCLE_USERNAME}
-    author=${author/fm3/<@florian>}
-    author=${author/daniel-wer/<@daniel>}
-    author=${author/hotzenklotz/<@tom>}
-    author=${author/MichaelBuessemeyer/<@michael>}
-    author=${author/normanrz/<@norman>}
-    author=${author/philippotto/<@philipp>}
-    author=${author/valentin-pinkau/<@valentin>}
-    author=${author/frcroth/<@felix.roth>}
-    author=${author/dieknolle3333/<@charlie.meister>}
-    channel="webknossos-bots"
-    commitmsg="$(git log --format=%s -n 1)"
-    pullregex="(.*)#([0-9]+)(.*)"
-    while [[ "$commitmsg" =~ $pullregex ]]
-    do
-        commitmsg="${BASH_REMATCH[1]}#<https://github.com/scalableminds/webknossos/issues/${BASH_REMATCH[2]}|${BASH_REMATCH[2]}>${BASH_REMATCH[3]}"
-    done
-    buildlink="<https://circleci.com/gh/scalableminds/webknossos/${CIRCLE_BUILD_NUM}|ready>"
-    mesg="${author} WEBKNOSSOS docker image \`master__${CIRCLE_BUILD_NUM}\` for “${commitmsg}” is ${buildlink}."
-    user="ci-notify"
-    token="${SLACK_NOTIFY_TOKEN:-}"
-    res=$(curl -s \
-        -X POST \
-        -d "token=${token}" \
-        -d "channel=${channel}" \
-        -d "text=${mesg}" \
-        -d "username=${user}" \
-        -d "icon_url=https://a.slack-edge.com/41b0a/img/plugins/circleci/service_48.png" \
-        https://slack.com/api/chat.postMessage
-    )
-    if [[ "$(echo ${res} | jq '.ok')" == "false" ]]; then
-        echo "[WARN] Error sending Slack notification: $(echo ${res} | jq -r '.error')."
-    fi
-    echo "[INFO] Sent Slack notification to ${channel}."
-fi
diff --git a/webknossos-datastore/Dockerfile b/.github/Dockerfile.datastore
similarity index 95%
rename from webknossos-datastore/Dockerfile
rename to .github/Dockerfile.datastore
index 97e8246edee..c64f03bf1fa 100644
--- a/webknossos-datastore/Dockerfile
+++ b/.github/Dockerfile.datastore
@@ -15,7 +15,7 @@ VOLUME /webknossos-datastore/binaryData /tmp
 COPY target/universal/stage .
 
 RUN chown -R webknossos . \
-  && chmod go+x bin/webknossos-datastore \
+  && chmod +x bin/webknossos-datastore \
   && chmod go+w .
 
 RUN echo '#!/bin/bash\numask 002\nbin/webknossos-datastore "$@"\n' > /docker-entrypoint.sh \
diff --git a/webknossos-tracingstore/Dockerfile b/.github/Dockerfile.tracingstore
similarity index 92%
rename from webknossos-tracingstore/Dockerfile
rename to .github/Dockerfile.tracingstore
index 322153f2d0e..c9354f5029a 100644
--- a/webknossos-tracingstore/Dockerfile
+++ b/.github/Dockerfile.tracingstore
@@ -16,7 +16,7 @@ VOLUME /webknossos-tracingstore/tracingData /tmp
 COPY target/universal/stage .
 
 RUN chown -R webknossos . \
-  && chmod go+x bin/webknossos-tracingstore \
+  && chmod +x bin/webknossos-tracingstore \
   && chmod go+w .
 
 RUN echo '#!/bin/bash\numask 002\nbin/webknossos-tracingstore "$@"\n' > /docker-entrypoint.sh \
@@ -31,4 +31,4 @@ HEALTHCHECK \
 EXPOSE 9050
 
 ENTRYPOINT ["/docker-entrypoint.sh"]
-CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9090", "-Dhttp.address=0.0.0.0"]
+CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9050", "-Dhttp.address=0.0.0.0"]
diff --git a/Dockerfile b/.github/Dockerfile.webknossos
similarity index 87%
rename from Dockerfile
rename to .github/Dockerfile.webknossos
index 632faa7d703..aa9342633bd 100644
--- a/Dockerfile
+++ b/.github/Dockerfile.webknossos
@@ -8,13 +8,15 @@ RUN curl -sL "https://deb.nodesource.com/setup_${VERSION_NODE}" | bash - \
 RUN mkdir -p /webknossos
 WORKDIR /webknossos
 
+# Copy compiled Scala output from a previous build step, e.g. output of the Docker-dev image
 COPY target/universal/stage .
 
 RUN addgroup --system --gid 999 webknossos \
   && adduser --system --uid 999 --ingroup webknossos webknossos \
   && mkdir disk \
   && chown -R webknossos . \
-  && chmod go+x bin/webknossos \
+  && chmod +x bin/webknossos \
+  && chmod +x tools/postgres/dbtool.js \
   && chmod go+w .
 
 RUN echo '#!/bin/bash\numask 002\nbin/webknossos "$@"\n' > /docker-entrypoint.sh \
diff --git a/.github/actions/retry/action.yml b/.github/actions/retry/action.yml
new file mode 100644
index 00000000000..9508c7499e3
--- /dev/null
+++ b/.github/actions/retry/action.yml
@@ -0,0 +1,24 @@
+name: "Shell Retry"
+description: "Runs a small shell script with retries"
+inputs:
+  run:
+    description: "Command to execute."
+    required: true
+  retries:
+    description: "Maximum number of retries until failed"
+    required: true
+  retry_delay_seconds:
+    description: "Amount of time to sleep between each retry"
+    default: 0
+runs:
+  using: 'composite'
+  steps:
+    - shell: bash
+      run: |
+        for i in {1..${{ inputs.retries }}}; do
+          bash -c "$INPUT_COMMAND" && exit 0
+          sleep "${{ inputs.retry_delay_seconds }}"
+        done
+        exit 1
+      env:
+        INPUT_COMMAND: ${{ inputs.run }}
diff --git a/.github/docker-compose.yml b/.github/docker-compose.yml
new file mode 100644
index 00000000000..23cdd3b02ab
--- /dev/null
+++ b/.github/docker-compose.yml
@@ -0,0 +1,113 @@
+# For CI only
+name: webknossos-ci
+
+services:
+  webknossos:
+    image: scalableminds/webknossos:${DOCKER_TAG}
+    pull_policy: never
+    ports:
+      - "9000:9000"
+    command:
+      - -Dconfig.file=conf/application.conf
+      - -Djava.net.preferIPv4Stack=true
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.redis.address=redis
+      - -DwebKnossos.sampleOrganization.enabled=false
+    volumes:
+      - ../binaryData:/webknossos/binaryData
+    environment:
+      - CERTIFICATE
+      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  webknossos-datastore:
+    image: scalableminds/webknossos-datastore:${DOCKER_TAG}
+    pull_policy: never
+    ports:
+      - "9090:9090"
+    volumes:
+      - ../binaryData:/webknossos-datastore/binaryData
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-datastore.conf
+      - -Dhttp.port=9090
+      - -Dhttp.uri=http://webknossos-datastore:9090
+      - -Ddatastore.webKnossos.uri=webknossos:9000
+      - -Ddatastore.redis.address=redis
+    depends_on:
+      redis:
+        condition: service_healthy
+
+  webknossos-tracingstore:
+    image: scalableminds/webknossos-tracingstore:${DOCKER_TAG}
+    pull_policy: never
+    ports:
+      - "9050:9050"
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-tracingstore.conf
+      - -Dhttp.port=9050
+      - -Dhttp.uri=http://webknossos-tracingstore:9050
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.webknossos.uri=webknossos:9000
+    depends_on:
+      redis:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+
+  fossildb:
+    image: scalableminds/fossildb:master__510
+    command:
+      - fossildb
+      - -c
+      - skeletons,skeletonTreeBodies,volumes,volumeData,volumeSegmentIndex,editableMappingsInfo,editableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate,annotations,annotationUpdates
+    ports:
+      - "7155:7155"
+    volumes:
+      - "../fossildb/data:/fossildb/data"
+      - "../fossildb/backup:/fossildb/backup"
+
+  postgres:
+    image: postgres:17-bookworm
+    environment:
+      - POSTGRES_DB=webknossos
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    ports:
+      - "5432:5432"
+    volumes:
+      - "../pg/db:/var/lib/postgresql/data"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d webknossos -U ${POSTGRES_USER} -h 127.0.0.1 -p 5432"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+
+  redis:
+    image: redis:7.4
+    command:
+      - redis-server
+    ports:
+      - 6379:6379
+    healthcheck:
+      test:
+        - CMD
+        - bash
+        - -c
+        - "exec 3<> /dev/tcp/127.0.0.1/6379 && echo PING >&3 && head -1 <&3 | grep PONG"
+      timeout: 1s
+      interval: 5s
+      retries: 10
diff --git a/.github/slack-notification.sh b/.github/slack-notification.sh
new file mode 100755
index 00000000000..24b0e1fe5af
--- /dev/null
+++ b/.github/slack-notification.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+author=${GITHUB_ACTOR}
+author=${author/fm3/<@florian>}
+author=${author/daniel-wer/<@daniel>}
+author=${author/hotzenklotz/<@tom>}
+author=${author/MichaelBuessemeyer/<@michael>}
+author=${author/normanrz/<@norman>}
+author=${author/philippotto/<@philipp>}
+author=${author/valentin-pinkau/<@valentin>}
+author=${author/frcroth/<@felix.roth>}
+author=${author/knollengewaechs/<@charlie.meister>}
+channel="webknossos-bots"
+commitmsg=$(git log --format=%s -n 1)
+pullregex="(.*)#([0-9]+)(.*)"
+
+while [[ "$commitmsg" =~ $pullregex ]]; do
+    commitmsg="${BASH_REMATCH[1]}#<https://github.com/scalableminds/webknossos/issues/${BASH_REMATCH[2]}|${BASH_REMATCH[2]}>${BASH_REMATCH[3]}"
+done
+
+buildlink="<${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}|ready>"
+mesg="${author} WEBKNOSSOS docker image \`master__${GITHUB_RUN_ID}\` for “${commitmsg}” is ${buildlink}."
+user="ci-notify"
+token="${SLACK_NOTIFY_TOKEN:-}"
+res=$(curl -s \
+    -X POST \
+    -d "token=${token}" \
+    -d "channel=${channel}" \
+    -d "text=${mesg}" \
+    -d "username=${user}" \
+    -d "icon_url=https://a.slack-edge.com/41b0a/img/plugins/circleci/service_48.png" \
+    https://slack.com/api/chat.postMessage
+)
+if [[ "$(echo "${res}" | jq '.ok')" == "false" ]]; then
+    echo "[WARN] Error sending Slack notification: $(echo "${res}" | jq -r '.error')."
+fi
+echo "[INFO] Sent Slack notification to ${channel}."
diff --git a/.github/workflows/build_test_deploy.yml b/.github/workflows/build_test_deploy.yml
index 599e2b22e00..baec765215c 100644
--- a/.github/workflows/build_test_deploy.yml
+++ b/.github/workflows/build_test_deploy.yml
@@ -1,13 +1,276 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
+  CERTIFICATE: ${{ secrets.CERTIFICATE_FOR_CI_ONLY }}
+  CERTIFICATE_PUBLIC_KEY: ${{ secrets.CERTIFICATE_PUBLIC_KEY }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: github.ref != 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend-tests:
+    runs-on: ubuntu-24.04
+    if: github.ref != 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: sbt -v "testOnly backend.*"
+
+
+  build-test-e2e-deploy:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        run: |
+          echo "CI_BUILD_NUM=${{ github.run_id }}" >> "$GITHUB_ENV"
+          if [[ "${{ github.ref_type }}" == "branch" ]]; then
+            NORMALIZED_BRANCH="${GITHUB_HEAD_REF//[\/-]/_}"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_id }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "CI_TAG=${{ github.ref_name }}" >> "$GITHUB_ENV"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_id }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.webknossos
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.datastore
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.tracingstore
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+
+      - name: Start Fossildb
+        if: github.ref != 'refs/heads/master'
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+      - name: Run end-to-end tests
+        if: github.ref != 'refs/heads/master'
+        uses: ./.github/actions/retry
+        with:
+          run: |
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false"
+          retries: 3
+      - name: Validate frontend types
+        if: github.ref != 'refs/heads/master'
+        run: yarn typecheck
+
+      - name: Start webknossos, datastore and tracingstore
+        run: |
+          set -e
+          docker compose --file .github/docker-compose.yml up -d \
+            webknossos \
+            webknossos-datastore \
+            webknossos-tracingstore
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/retry
+        with:
+          run: curl -v --fail "http://localhost:9000/api/health"
+          retries: 20
+          retry_delay_seconds: 5
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/retry
+        with:
+          run: curl -v --fail "http://localhost:9090/data/health"
+          retries: 20
+          retry_delay_seconds: 5
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/retry
+        with:
+          run: curl -v --fail "http://localhost:9050/tracings/health"
+          retries: 20
+          retry_delay_seconds: 5
+      - name: Stop webknossos, datastore and tracingstore
+        run: docker compose --file .github/docker-compose.yml down --volumes --remove-orphans
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+
+      - name: Push webknossos image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push "scalableminds/webknossos:${{ env.DOCKER_TAG }}"
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push normalized webknossos image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push "scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}"
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push webknossos-datastore image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push "scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}"
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push normalized webknossos-datastore image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push "scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}"
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push webknossos-tracingstore image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push "scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}"
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push normalized webknossos-tracingstore image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push "scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}"
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Slack Notification
+        if: github.ref != 'refs/heads/master'
+        run: .github/slack-notification.sh
+        env:
+          SLACK_NOTIFY_TOKEN: ${{ secrets.SLACK_NOTIFY_TOKEN }}
diff --git a/CHANGELOG.unreleased.md b/CHANGELOG.unreleased.md
index d6e24bd15ba..336a645e0ab 100644
--- a/CHANGELOG.unreleased.md
+++ b/CHANGELOG.unreleased.md
@@ -24,6 +24,8 @@ For upgrade instructions, please check the [migration guide](MIGRATIONS.released
 - The skeleton tool can no longer be activated if the skeleton layer is invisible. [#8501](https://github.com/scalableminds/webknossos/pull/8501)
 - Improved speed of mesh rendering and mouse interaction in 3D viewport. [#8106](https://github.com/scalableminds/webknossos/pull/8106)
 
+- Numbered docker image now use different and larger numbers. [#8147](https://github.com/scalableminds/webknossos/pull/8147)
+
 ### Fixed
 - Fixed visual alignment of actions in ai model list. [#8474](https://github.com/scalableminds/webknossos/pull/8474)
 - Fixed that is was possible to trigger the find largest segment id job on layers which are not stored as segmentation layers on the server. [#8503](https://github.com/scalableminds/webknossos/pull/8503)
@@ -42,3 +44,5 @@ For upgrade instructions, please check the [migration guide](MIGRATIONS.released
 ### Removed
 
 ### Breaking Changes
+
+- Removed `docker-compose.yml` in favor of `tools/hosting/docker-compose.yml` [#8147](https://github.com/scalableminds/webknossos/pull/8147)
diff --git a/Dockerfile.dev b/Dockerfile.dev
deleted file mode 100644
index 6fd60d0dbfd..00000000000
--- a/Dockerfile.dev
+++ /dev/null
@@ -1,32 +0,0 @@
-FROM scalableminds/sbt:master__7830403826
-ARG VERSION_NODE="18.x"
-
-ENV DEBIAN_FRONTEND noninteractive
-ENV SBT_OPTS "${SBT_OPTS} -XX:MaxMetaspaceSize=512m -Xms1024m -Xmx1024m"
-
-# Fixes "The method driver /usr/lib/apt/methods/https could not be found."
-# See https://unix.stackexchange.com/a/478009
-RUN apt-get update && apt-get install apt-transport-https
-
-# add node package source
-RUN curl -sL "https://deb.nodesource.com/setup_${VERSION_NODE}" | bash -
-
-# Install sbt, node & build-essentials
-RUN apt-get update \
-  && apt-get install -y \
-  build-essential \
-  findutils \
-  nodejs \
-  postgresql-client \
-  cmake \
-  git \
-  libdraco-dev \
-  libblosc1 \
-  # The following packages are necessary to run headless-gl
-  && apt-get install -y \
-  mesa-utils xvfb libgl1-mesa-dri libglapi-mesa libosmesa6 pkg-config x11proto-xext-dev xserver-xorg-dev libxext-dev libxi-dev \
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-
-# Enable corepack for Node (which will install yarn)
-RUN corepack enable && corepack install --global yarn@4.4.1
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index 9a814b9e2cf..e5d078d143a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,310 +1 @@
-version: "2.2"
-
-services:
-  # Production
-  webknossos:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      cache_from:
-        - scalableminds/webknossos
-        - scalableminds/webknossos:${DEV_CACHE:-master}
-    image: scalableminds/webknossos:${DOCKER_TAG:-master}
-    ports:
-      - "9000:9000"
-    links:
-      - "fossildb-persisted:fossildb"
-      - "postgres-persisted:postgres"
-    depends_on:
-      postgres-persisted:
-        condition: service_healthy
-      fossildb-persisted:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    command:
-      - -Dconfig.file=conf/application.conf
-      - -Djava.net.preferIPv4Stack=true
-      - -Dtracingstore.fossildb.address=fossildb
-      - -Dtracingstore.redis.address=redis
-      - -Ddatastore.redis.address=redis
-      - -Dslick.db.url=jdbc:postgresql://postgres/webknossos
-      - -DwebKnossos.sampleOrganization.enabled=false
-      # the following lines need to be adapted for non-localhost deployments
-      # - -Dhttp.uri=http://example.org:9000
-      # - -Dtracingstore.publicUri=http://example.org:9000
-      # - -Ddatastore.publicUri=http://example.org:9000
-      # the following lines disable the integrated datastore:
-      # - -Dplay.modules.enabled-="com.scalableminds.webknossos.datastore.DataStoreModule"
-      # - -Dplay.http.router="noDS.Routes"
-    volumes:
-      - ./binaryData:/webknossos/binaryData
-    environment:
-      - CERTIFICATE
-      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
-      - POSTGRES_USER=webknossos_user
-      - POSTGRES_PASSWORD=secret_password
-    user: ${USER_UID:-1000}:${USER_GID:-1000}
-
-  webknossos-datastore:
-    build: webknossos-datastore
-    image: scalableminds/webknossos-datastore:${DOCKER_TAG:-master}
-    ports:
-      - "9090:9090"
-    volumes:
-      - ./binaryData:/webknossos-datastore/binaryData
-    command:
-      - -J-Xmx20G
-      - -J-Xms1G
-      - -Dconfig.file=conf/standalone-datastore.conf
-      - -Dhttp.port=9090
-      - -Dhttp.uri=http://webknossos-datastore:9090
-      - -Ddatastore.webKnossos.uri=webknossos:9000
-      - -Ddatastore.redis.address=redis
-    depends_on:
-      redis:
-        condition: service_healthy
-
-  webknossos-tracingstore:
-    build: webknossos-tracingstore
-    image: scalableminds/webknossos-tracingstore:${DOCKER_TAG:-master}
-    ports:
-      - "9050:9050"
-    command:
-      - -J-Xmx20G
-      - -J-Xms1G
-      - -Dconfig.file=conf/standalone-tracingstore.conf
-      - -Dhttp.port=9050
-      - -Dhttp.uri=http://webknossos-datastore:9050
-      - -Dtracingstore.fossildb.address=fossildb
-      - -Dtracingstore.redis.address=redis
-      - -Ddatastore.webknossos.uri=webknossos:9000
-    links:
-      - "fossildb-persisted:fossildb"
-    depends_on:
-      redis:
-        condition: service_healthy
-      fossildb-persisted:
-        condition: service_healthy
-
-  # Development
-  base:
-    image: scalableminds/webknossos-dev
-    build:
-      context: .
-      dockerfile: Dockerfile.dev
-      cache_from:
-        - scalableminds/webknossos-dev
-        - scalableminds/webknossos-dev:${DEV_CACHE:-master}
-    environment:
-      - USER_NAME=${USER_NAME:-sbt-user}
-      - USER_UID
-      - USER_GID
-      - COVERALLS_REPO_TOKEN
-      - CERTIFICATE
-      - CERTIFICATE_PUBLIC_KEY
-      - TZ=${TZ:-Europe/Berlin}
-      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
-      - POSTGRES_USER=webknossos_user
-      - POSTGRES_PASSWORD=secret_password
-      - HOME=/root
-      - CIRCLE_TAG=${CIRCLE_TAG}
-      - CIRCLE_BUILD_NUM=${CIRCLE_BUILD_NUM}
-      - NODE_OPTIONS=--max_old_space_size=2048
-      # This will be picked up by ava so that the tests fail if a snapshot doesn't exist during CI, see https://github.com/avajs/ava/issues/1585
-      - CI
-    working_dir: /home/${USER_NAME:-sbt-user}/webknossos
-    volumes:
-      - ".:/home/${USER_NAME:-sbt-user}/webknossos"
-      - "${DOCKER_CACHE_PREFIX:-~}/.ivy2:/tmp/.ivy2"
-      - "${DOCKER_CACHE_PREFIX:-~}/.cache/coursier:/root/.cache/coursier"
-      - "${DOCKER_CACHE_PREFIX:-~}/.cache/yarn:/root/.cache/yarn"
-    user: ${USER_UID:-1000}:${USER_GID:-1000}
-
-  compile:
-    extends:
-      service: base
-    depends_on:
-      postgres:
-        condition: service_healthy
-
-  dev:
-    extends:
-      service: base
-    ports:
-      - "5005:5005"
-      - "9000:9000"
-    links:
-      - "fossildb-dev:fossildb"
-      - "postgres-dev:postgres"
-    depends_on:
-      redis:
-        condition: service_healthy
-      postgres-dev:
-        condition: service_healthy
-      fossildb-dev:
-        condition: service_healthy
-    environment:
-      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
-      - POSTGRES_USER=webknossos_user
-      - POSTGRES_PASSWORD=secret_password
-    command:
-      - bash
-      - -c
-      - >
-        sbt
-        -v -d -jvm-debug 5005
-        "run
-          -Djava.net.preferIPv4Stack=true
-          -Dtracingstore.fossildb.address=fossildb
-          -Dtracingstore.redis.address=redis"
-          -Ddatastore.redis.address=redis"
-    stdin_open: true
-
-  # Tests
-  backend-tests:
-    extends:
-      service: base
-    ports:
-      - "5005:5005"
-      - "9000:9000"
-    command: sbt -v "testOnly backend.*"
-
-  backend-lint-format:
-    extends:
-      service: base
-    ports:
-      - "5005:5005"
-      - "9000:9000"
-    command: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
-
-  e2e-tests:
-    extends:
-      service: backend-tests
-    depends_on:
-      redis:
-        condition: service_healthy
-      postgres:
-        condition: service_healthy
-      fossildb:
-        condition: service_healthy
-    environment:
-      - CERTIFICATE
-      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
-      - POSTGRES_USER=webknossos_user
-      - POSTGRES_PASSWORD=secret_password
-    command:
-      - bash
-      - -c
-      - >
-        sbt
-        -v
-        "testOnly e2e.* --
-          -Dtracingstore.fossildb.address=fossildb
-          -Dtracingstore.redis.address=redis
-          -Ddatastore.redis.address=redis
-          -Ddatastore.watchFileSystem.enabled=false"
-    volumes:
-      - ./binaryData/Organization_X:/home/${USER_NAME:-sbt-user}/webknossos/binaryData/Organization_X
-
-  screenshot-tests:
-    image: scalableminds/puppeteer:master
-    environment:
-      - URL
-      - WK_AUTH_TOKEN
-    working_dir: /home/pptruser/webknossos
-    command: bash -c 'for i in {1..3}; do yarn test-screenshot && break; done'
-    volumes:
-      - ".:/home/pptruser/webknossos"
-    user: ${USER_UID:-1000}:${USER_GID:-1000}
-
-  # Postgres
-  postgres:
-    image: postgres:10-alpine
-    environment:
-      - POSTGRES_DB=webknossos
-      - POSTGRES_USER=webknossos_user
-      - POSTGRES_PASSWORD=secret_password
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d webknossos -U webknossos_user -h 127.0.0.1 -p 5432"]
-      interval: 2s
-      timeout: 5s
-      retries: 30
-
-  postgres-persisted:
-    extends:
-      service: postgres
-    ports:
-      - "5434:5432"
-    volumes:
-      - "./pg/db:/var/lib/postgresql/data/"
-
-  postgres-dev:
-    extends:
-      service: postgres
-    ports:
-      - "127.0.0.1:5432:5432"
-    volumes:
-      - "./pg/dev-db:/var/lib/postgresql/data/"
-
-  psql:
-    extends: postgres
-    command: psql -h postgres -U webknossos_user webknossos
-    links:
-      - "postgres-persisted:postgres"
-    depends_on:
-      postgres-persisted:
-        condition: service_healthy
-    environment:
-      - PGPASSWORD=secret_password
-    volumes:
-      - ./conf/evolutions/:/evolutions/
-
-  drop-db:
-    extends: postgres
-    command: psql -h postgres -U webknossos_user postgres -c "DROP DATABASE webknossos"
-    links:
-      - "postgres-persisted:postgres"
-    depends_on:
-      postgres-dev:
-        condition: service_healthy
-    environment:
-      - PGPASSWORD=secret_password
-
-  # FossilDB
-  fossildb:
-    image: scalableminds/fossildb:master__525
-    command:
-      - fossildb
-      - -c
-      - skeletons,skeletonTreeBodies,volumes,volumeData,volumeSegmentIndex,editableMappingsInfo,editableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate,annotations,annotationUpdates
-    user: ${USER_UID:-fossildb}:${USER_GID:-fossildb}
-
-  fossildb-persisted:
-    extends:
-      service: fossildb
-    volumes:
-      - "./fossildb/data:/fossildb/data"
-      - "./fossildb/backup:/fossildb/backup"
-
-  fossildb-dev:
-    extends:
-      service: fossildb
-    volumes:
-      - "./fossildb-dev/data:/fossildb/data"
-      - "./fossildb-dev/backup:/fossildb/backup"
-
-  # Redis
-  redis:
-    image: redis:5.0
-    command:
-      - redis-server
-    healthcheck:
-      test:
-        - CMD
-        - bash
-        - -c
-        - "exec 3<> /dev/tcp/127.0.0.1/6379 && echo PING >&3 && head -1 <&3 | grep PONG"
-      timeout: 1s
-      interval: 5s
-      retries: 10
+# NOTE: This file is no longer used. Please, use `tools/hosting/docker-compose.yml` instead.
diff --git a/project/BuildInfoSettings.scala b/project/BuildInfoSettings.scala
index d7fd1f176bc..71fe26e6670 100644
--- a/project/BuildInfoSettings.scala
+++ b/project/BuildInfoSettings.scala
@@ -14,8 +14,8 @@ object BuildInfoSettings {
       case _: Throwable => failureMsg
     }
 
-  val ciBuild: String = Properties.envOrElse("CIRCLE_BUILD_NUM", "")
-  val ciTag: String = Properties.envOrElse("CIRCLE_TAG", "")
+  val ciBuild: String = Properties.envOrElse("CI_BUILD_NUM", "")
+  val ciTag: String = Properties.envOrElse("CI_TAG", "")
 
   def commitHash: String = getStdoutFromCommand("git rev-parse HEAD", "<getting commit hash failed>")
   def commitDate: String = getStdoutFromCommand("git log -1 --format=%cd ", "<getting git date failed>")
diff --git a/start-docker.sh b/start-docker.sh
deleted file mode 100755
index 2dba25a4d3a..00000000000
--- a/start-docker.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
-
-mkdir -p binaryData
-
-USER_UID=$(id -u) USER_GID=$(id -g) docker compose up webknossos
diff --git a/webknossos-jni/src/bucketScanner.cpp b/webknossos-jni/src/bucketScanner.cpp
index 0a4321da42b..fd3e87d2be7 100644
--- a/webknossos-jni/src/bucketScanner.cpp
+++ b/webknossos-jni/src/bucketScanner.cpp
@@ -1,6 +1,7 @@
 #include "com_scalableminds_webknossos_datastore_helpers_NativeBucketScanner.h"
 
 #include "jniutils.h"
+#include <array>
 #include <iostream>
 #include <vector>
 #include <stdexcept>
diff --git a/yarn.lock b/yarn.lock
index e04a82f9ab8..cb4f08a1aeb 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8581,7 +8581,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash-es@npm:^4.17.21, lodash-es@npm:^4.2.1":
+"lodash-es@npm:^4.17.21":
   version: 4.17.21
   resolution: "lodash-es@npm:4.17.21"
   checksum: 10c0/fb407355f7e6cd523a9383e76e6b455321f0f153a6c9625e21a8827d10c54c2a2341bd2ae8d034358b60e07325e1330c14c224ff582d04612a46a4f0479ff2f2
@@ -8616,7 +8616,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash@npm:^4.17.14, lodash@npm:^4.17.15, lodash@npm:^4.17.21, lodash@npm:^4.2.1":
+"lodash@npm:^4.17.14, lodash@npm:^4.17.15, lodash@npm:^4.17.21":
   version: 4.17.21
   resolution: "lodash@npm:4.17.21"
   checksum: 10c0/d8cbea072bb08655bb4c989da418994b073a608dffa608b09ac04b43a791b12aeae7cd7ad919aa4c925f33b48490b5cfe6c1f71d827956071dae2e7bb3a6b74c
@@ -12159,14 +12159,11 @@ __metadata:
   linkType: hard
 
 "redux@npm:^4.2.0":
-  version: 3.7.2
-  resolution: "redux@npm:3.7.2"
+  version: 4.2.1
+  resolution: "redux@npm:4.2.1"
   dependencies:
-    lodash: "npm:^4.2.1"
-    lodash-es: "npm:^4.2.1"
-    loose-envify: "npm:^1.1.0"
-    symbol-observable: "npm:^1.0.3"
-  checksum: 10c0/544456f95734de33326637b370894addb57d9de2524edf36a20e4a326d0a36a0e223979d027545c5aa8a8d7a2859363981f63d1146401b72df0d16f373dd09cb
+    "@babel/runtime": "npm:^7.9.2"
+  checksum: 10c0/136d98b3d5dbed1cd6279c8c18a6a74c416db98b8a432a46836bdd668475de6279a2d4fd9d1363f63904e00f0678a8a3e7fa532c897163340baf1e71bb42c742
   languageName: node
   linkType: hard
 
@@ -13456,13 +13453,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"symbol-observable@npm:^1.0.3":
-  version: 1.2.0
-  resolution: "symbol-observable@npm:1.2.0"
-  checksum: 10c0/009fee50798ef80ed4b8195048288f108b03de162db07493f2e1fd993b33fafa72d659e832b584da5a2427daa78e5a738fb2a9ab027ee9454252e0bedbcd1fdc
-  languageName: node
-  linkType: hard
-
 "symbol-tree@npm:^3.2.4":
   version: 3.2.4
   resolution: "symbol-tree@npm:3.2.4"


Reviews:
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>🧹 Outside diff range and nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`4-9`: **Consider restricting branch patterns**

The current trigger configuration runs on all branches (`'*'`). This might lead to unnecessary workflow runs. Consider:
- Limiting to specific branch patterns (e.g., `main`, `develop`, `feature/*`)
- Using path filters to run only when relevant files change

```diff
  push:
    branches:
-      - '*'
+      - main
+      - develop
+      - 'feature/**'
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
  pull_request:
    branches:
-      - '*'
+      - main
+      - develop
```

---

`12-18`: **Enhance security of Docker credentials**

The Docker credentials are exposed as environment variables. While they are using secrets, consider:
1. Limiting the scope of these credentials to only the job that needs them
2. Using GITHUB_TOKEN where possible for container registry authentication

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Files that changed from the base of the PR and between 6a0dcc0571c2dbc44c881b76d990e0df024aabba and 4a9811eff7c14db0c0b99cbd77d3bd6459892cfc.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* .github/not-on-master.sh (1 hunks)
* .github/workflows/build_test_deploy.yml (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

57-57: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

57-57: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

57-57: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

57-57: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

72-72: shellcheck reported issue in this script: SC2086:info:1:42: Double quote to prevent globbing and word splitting

(shellcheck)

---

117-117: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

137-137: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

137-137: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

153-153: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

153-153: shellcheck reported issue in this script: SC2086:info:5:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

161-161: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

161-161: shellcheck reported issue in this script: SC2086:info:5:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

169-169: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

169-169: shellcheck reported issue in this script: SC2086:info:5:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</blockquote></details>

</details>

<details>
<summary>🔇 Additional comments (4)</summary><blockquote>

<details>
<summary>.github/not-on-master.sh (3)</summary><blockquote>

`1-2`: **LGTM: Robust shell script configuration.**

The script follows shell scripting best practices:
- Uses proper shebang line for portability
- Sets appropriate safety flags:
  - `-E`: ERR trap inheritance
  - `-e`: Exit on error
  - `-u`: Error on unbound variables
  - `-o pipefail`: Propagate pipe failures

---

`7-7`: **Consider adding command validation.**

The `exec "$@"` executes arbitrary commands passed as arguments without validation.



Consider:
1. Adding command whitelisting
2. Implementing logging for audit purposes
3. Adding error handling for failed commands

---

`4-8`: _:warning: Potential issue_

**Fix branch reference comparison.**

The current branch comparison has potential issues:
1. `GITHUB_REF` typically includes the full ref path (e.g., "refs/heads/master")
2. String comparison should use `=` instead of `==` for POSIX compatibility

Apply this fix:

```diff
-if [ "${GITHUB_REF}" == "master" ]; then
+if [ "${GITHUB_REF}" = "refs/heads/master" ]; then
```

Additionally, consider adding input validation:

</blockquote></details>
<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`21-43`: **LGTM! Well-structured frontend checks**

The frontend code checks job is well-organized with:
- Proper Node.js setup
- Comprehensive checks (lint, types, cyclic deps)
- Clear step names

</blockquote></details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-10-24T14:08:09Z
user: login: hotzenklotz
state: COMMENTED
author_association: MEMBER
submitted_at: 2024-10-24T15:27:39Z
user: login: coderabbitai[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-10-24T15:28:44Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 6**

<details>
<summary>🧹 Outside diff range and nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/actions/health_check_action.yml (1)</summary><blockquote>

`16-16`: **Add newline at end of file.**

Following YAML best practices, ensure there's a newline character at the end of the file.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary><blockquote>

[error] 16-16: no new line character at the end of file

(new-line-at-end-of-file)

</blockquote></details>

</details>

</blockquote></details>
<details>
<summary>project/BuildInfoSettings.scala (1)</summary><blockquote>

`16-17`: **Consider documenting CI environment variables.**

Since these environment variables are crucial for versioning and build information, consider adding documentation about their expected values and usage.

Add a comment block above the variable declarations:

```diff
+  // CI environment variables used for versioning:
+  // CI_BUILD_NUM: Build number from CI system (e.g., GitHub Actions run number)
+  // CI_TAG: Git tag from CI system, if building a tagged commit
  val ciBuild: String =
    if (System.getenv().containsKey("CI_BUILD_NUM")) System.getenv().get("CI_BUILD_NUM") else ""
  val ciTag: String = if (System.getenv().containsKey("CI_TAG")) System.getenv().get("CI_TAG") else ""
```

</blockquote></details>
<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`28-30`: **Fix YAML indentation**

The indentation is inconsistent with the rest of the file.

```diff
    - uses: actions/setup-node@v4
      with:
-          node-version: 18
+        node-version: 18
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary><blockquote>

[warning] 30-30: wrong indentation: expected 8 but found 10

(indentation)

</blockquote></details>

</details>

</blockquote></details>
<details>
<summary>docker-compose.yml (1)</summary><blockquote>

Line range hint `249-257`: **Fix syntax error in dev service command.**

There's an extra quote at the end of the `-Ddatastore.redis.address=redis` line which will cause the command to fail.


Apply this fix:
```diff
     command:
       - bash
       - -c
       - >
         sbt
         -v -d -jvm-debug 5005
         "run
           -Djava.net.preferIPv4Stack=true
           -Dtracingstore.fossildb.address=fossildb
           -Dtracingstore.redis.address=redis"
-          -Ddatastore.redis.address=redis"
+          -Ddatastore.redis.address=redis
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Files that changed from the base of the PR and between 4a9811eff7c14db0c0b99cbd77d3bd6459892cfc and 53e35c463c9ae9ed03eefd3f398afb29ddfd3893.

</details>

<details>
<summary>📒 Files selected for processing (4)</summary>

* .github/actions/health_check_action.yml (1 hunks)
* .github/workflows/build_test_deploy.yml (1 hunks)
* docker-compose.yml (1 hunks)
* project/BuildInfoSettings.scala (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 yamllint</summary><blockquote>

<details>
<summary>.github/actions/health_check_action.yml</summary><blockquote>

[error] 16-16: no new line character at the end of file

(new-line-at-end-of-file)

</blockquote></details>
<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

[warning] 23-23: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 30-30: wrong indentation: expected 8 but found 10

(indentation)

---

[warning] 46-46: too many blank lines

(4 > 2) (empty-lines)

---

[error] 153-153: trailing spaces

(trailing-spaces)

---

[error] 155-155: trailing spaces

(trailing-spaces)

---

[error] 159-159: trailing spaces

(trailing-spaces)

---

[error] 164-164: trailing spaces

(trailing-spaces)

</blockquote></details>

</blockquote></details>
<details>
<summary>🪛 actionlint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

56-56: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

56-56: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

56-56: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

56-56: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

71-71: shellcheck reported issue in this script: SC2086:info:1:42: Double quote to prevent globbing and word splitting

(shellcheck)

---

116-116: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

136-136: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

136-136: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</blockquote></details>

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/actions/health_check_action.yml (1)</summary><blockquote>

`1-6`: **LGTM! Clear and well-structured action metadata.**

The action name, description, and input parameters are well-defined and follow GitHub Actions best practices.

</blockquote></details>
<details>
<summary>project/BuildInfoSettings.scala (1)</summary><blockquote>

`16-17`: **LGTM! Verify environment variables in GitHub Actions workflow.**

The change from CircleCI-specific environment variables to generic CI variables is a good practice for portability.


Let's verify that these environment variables are properly set in the GitHub Actions workflow:

</blockquote></details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-10-28T07:39:37Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>🧹 Outside diff range and nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`23-23`: **Fix YAML indentation issues**

There are inconsistent indentation levels in the workflow file:
- Line 23: Should be 6 spaces instead of 4
- Line 30: Should be 8 spaces instead of 10


```diff
    steps:
-    - name: Checkout code
+      - name: Checkout code
       uses: actions/checkout@v3
       with:
         fetch-depth: 5

     - uses: actions/setup-node@v4
       with:
-          node-version: 18
+        node-version: 18
```


Also applies to: 30-30

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary><blockquote>

[warning] 23-23: wrong indentation: expected 6 but found 4

(indentation)

</blockquote></details>

</details>

---

`44-46`: **Remove excessive blank lines**

There are too many consecutive blank lines (4 > 2) between the jobs.

```diff
    - name: Check for cyclic dependencies in frontend
      run: yarn check-cyclic-dependencies

-

-

  build_test_deploy:
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary><blockquote>

[warning] 46-46: too many blank lines

(4 > 2) (empty-lines)

</blockquote></details>

</details>

---

`153-165`: **Fix trailing spaces in YAML**

Remove trailing spaces from the following lines:
- Line 153: `with: `
- Line 155: Empty line with spaces
- Line 159: `with: `
- Line 164: `with: `


```diff
      - name: Run webknossos smoke test
        uses: ./.github/actions/health_check_action
-        with: 
+        with:
          url: http://localhost:9000/api/health

      - name: Run webknossos-datastore smoke test
        uses: ./.github/actions/health_check_action
-        with: 
+        with:
          url: http://localhost:9090/data/health

      - name: Run webknossos-tracingstore smoke test
        uses: ./.github/actions/health_check_action
-        with: 
+        with:
          url: http://localhost:9050/tracings/health
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary><blockquote>

[error] 153-153: trailing spaces

(trailing-spaces)

---

[error] 155-155: trailing spaces

(trailing-spaces)

---

[error] 159-159: trailing spaces

(trailing-spaces)

---

[error] 164-164: trailing spaces

(trailing-spaces)

</blockquote></details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Files that changed from the base of the PR and between 53e35c463c9ae9ed03eefd3f398afb29ddfd3893 and eb8af0bf2c7ed41d0571475a369c2a8c05f3d378.

</details>

<details>
<summary>⛔ Files ignored due to path filters (1)</summary>

* `yarn.lock` is excluded by `!**/yarn.lock`, `!**/*.lock`

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* .github/workflows/build_test_deploy.yml (1 hunks)
* docker-compose.yml (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* docker-compose.yml

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

56-56: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

56-56: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

56-56: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

56-56: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

71-71: shellcheck reported issue in this script: SC2086:info:1:42: Double quote to prevent globbing and word splitting

(shellcheck)

---

116-116: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

136-136: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

136-136: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</blockquote></details>
<details>
<summary>🪛 yamllint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

[warning] 23-23: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 30-30: wrong indentation: expected 8 but found 10

(indentation)

---

[warning] 46-46: too many blank lines

(4 > 2) (empty-lines)

---

[error] 153-153: trailing spaces

(trailing-spaces)

---

[error] 155-155: trailing spaces

(trailing-spaces)

---

[error] 159-159: trailing spaces

(trailing-spaces)

---

[error] 164-164: trailing spaces

(trailing-spaces)

</blockquote></details>

</blockquote></details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-10-28T08:05:16Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>🧹 Outside diff range and nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`13-15`: **Remove or document commented environment variables**

The commented user-related environment variables (`USER_NAME`, `USER_UID`, `USER_GID`) should either be removed if they're no longer needed or documented if they serve a specific purpose.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Files that changed from the base of the PR and between eb8af0bf2c7ed41d0571475a369c2a8c05f3d378 and 1d77e3c8048cb4ca7455196d80358f0c5d2f10df.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* .github/workflows/build_test_deploy.yml (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

56-56: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

56-56: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

56-56: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

56-56: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

71-71: shellcheck reported issue in this script: SC2086:info:1:42: Double quote to prevent globbing and word splitting

(shellcheck)

---

116-116: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

136-136: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

136-136: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

171-171: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</blockquote></details>
<details>
<summary>🪛 yamllint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

[warning] 23-23: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 30-30: wrong indentation: expected 8 but found 10

(indentation)

---

[warning] 46-46: too many blank lines

(4 > 2) (empty-lines)

---

[error] 153-153: trailing spaces

(trailing-spaces)

---

[error] 155-155: trailing spaces

(trailing-spaces)

---

[error] 159-159: trailing spaces

(trailing-spaces)

---

[error] 164-164: trailing spaces

(trailing-spaces)

</blockquote></details>

</blockquote></details>

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`20-42`: **LGTM: Frontend checks are well-structured**

The frontend checks job is well-organized with appropriate steps for dependency installation, linting, type checking, and cyclic dependency validation.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary><blockquote>

[warning] 23-23: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 30-30: wrong indentation: expected 8 but found 10

(indentation)

</blockquote></details>

</details>

</blockquote></details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-10-28T08:12:30Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Files that changed from the base of the PR and between 1d77e3c8048cb4ca7455196d80358f0c5d2f10df and 7acf3a953f5474cb0ffa54045c897185990d12c6.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* .github/workflows/build_test_deploy.yml (1 hunks)
* Dockerfile (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

54-54: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

54-54: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

54-54: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

54-54: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

131-131: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

151-151: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

151-151: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

183-183: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</blockquote></details>
<details>
<summary>🪛 yamllint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

[warning] 23-23: wrong indentation: expected 6 but found 4

(indentation)

---

[error] 70-70: trailing spaces

(trailing-spaces)

---

[error] 80-80: trailing spaces

(trailing-spaces)

---

[error] 165-165: trailing spaces

(trailing-spaces)

---

[error] 167-167: trailing spaces

(trailing-spaces)

---

[error] 171-171: trailing spaces

(trailing-spaces)

---

[error] 176-176: trailing spaces

(trailing-spaces)

</blockquote></details>

</blockquote></details>

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>Dockerfile (1)</summary><blockquote>

`11-11`: **Please clarify the Docker-dev image reference in the comment.**

The comment mentions "Docker-dev image" but this dependency isn't clearly documented. This could make it difficult for other developers to understand the build prerequisites.

Let's check for any Docker-dev image references:

<details>
<summary>✅ Verification successful</summary>

Let me check the docker-compose files to understand if there's a dev image defined:

---

Let me check the Dockerfile.dev since I found a reference to webknossos-dev image in docker-compose.yml:

---

Based on the docker-compose.yml and Dockerfile.dev analysis, I can now generate the final response:

**The Docker-dev image reference is accurate and well-integrated**

The comment refers to the `webknossos-dev` image which is properly defined in docker-compose.yml under the `base` service. This dev image is built from Dockerfile.dev and is used for development and compilation tasks. The compiled Scala output from this dev environment is indeed used in the production Dockerfile, making the comment accurate and helpful.



</details>

<details>
<summary>🏁 Scripts executed</summary>

The following scripts were executed for the analysis:

Script:

```shell
#!/bin/bash
# Search for Docker-dev image references in the repository
rg -i "docker-dev.*image"

# Check docker-compose files for related services
fd -e yml -e yaml | xargs rg -l "docker"

```

Length of output: 329

---

Script:

```shell
#!/bin/bash
# Check contents of docker-compose files for dev image definitions
echo "=== Main docker-compose.yml ==="
cat docker-compose.yml

echo -e "\n=== tools/hosting/docker-compose.yml ==="
cat tools/hosting/docker-compose.yml

echo -e "\n=== webknossos-tracingstore/deployment/docker-compose.yml ==="
cat webknossos-tracingstore/deployment/docker-compose.yml

echo -e "\n=== webknossos-datastore/deployment/docker-compose.yml ==="
cat webknossos-datastore/deployment/docker-compose.yml

```

Length of output: 14631

---

Script:

```shell
#!/bin/bash
# Check Dockerfile.dev contents
cat Dockerfile.dev

```

Length of output: 1079

</details>

</blockquote></details>
<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`4-6`: **Consider including additional protected branches in push triggers**

The push trigger is currently limited to the `master` branch. Consider including other protected branches (e.g., `main`, `develop`, `release/*`) to ensure the pipeline runs on all important branches.

</blockquote></details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-10-28T12:59:24Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 5**

<details>
<summary>🧹 Outside diff range and nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`12-17`: **Add timezone environment variable**

Consider adding `TZ: UTC` (or your preferred timezone) to ensure consistent timestamps across the pipeline execution.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Files that changed from the base of the PR and between 7acf3a953f5474cb0ffa54045c897185990d12c6 and da87a2a0b5df6b7cb769d6a15fcb3cda27e3b6c4.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* .github/workflows/build_test_deploy.yml (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

73-73: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

73-73: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

73-73: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

73-73: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

141-141: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

158-158: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

158-158: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

189-189: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</blockquote></details>
<details>
<summary>🪛 yamllint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

[warning] 23-23: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 52-52: wrong indentation: expected 6 but found 8

(indentation)

---

[error] 89-89: trailing spaces

(trailing-spaces)

---

[error] 99-99: trailing spaces

(trailing-spaces)

---

[error] 172-172: trailing spaces

(trailing-spaces)

---

[error] 174-174: trailing spaces

(trailing-spaces)

---

[error] 177-177: trailing spaces

(trailing-spaces)

---

[error] 182-182: trailing spaces

(trailing-spaces)

</blockquote></details>

</blockquote></details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-10-28T13:34:05Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Files that changed from the base of the PR and between da87a2a0b5df6b7cb769d6a15fcb3cda27e3b6c4 and d12c11004f1a98bbffb15cb4749d417eed92fe60.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* .github/workflows/build_test_deploy.yml (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

84-84: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

84-84: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

84-84: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

84-84: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

152-152: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

169-169: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

169-169: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

200-200: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</blockquote></details>
<details>
<summary>🪛 yamllint</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary><blockquote>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 59-59: wrong indentation: expected 6 but found 8

(indentation)

---

[error] 100-100: trailing spaces

(trailing-spaces)

---

[error] 183-183: trailing spaces

(trailing-spaces)

---

[error] 185-185: trailing spaces

(trailing-spaces)

---

[error] 188-188: trailing spaces

(trailing-spaces)

---

[error] 193-193: trailing spaces

(trailing-spaces)

</blockquote></details>

</blockquote></details>

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`4-9`: **Consider expanding push trigger branches**

The current configuration only triggers on `master` push events. Consider including other important branches (e.g., development, staging) if they exist in your branching strategy.

</blockquote></details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-10-28T14:06:44Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 0**

<details>
<summary>🧹 Outside diff range and nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`102-107`: **Optimize Java setup configuration**

The Java setup could be improved:
1. Consider using a specific version instead of latest
2. Enable concurrent garbage collection for better CI performance

```diff
   - name: Set up Java
     uses: actions/setup-java@v4
     with:
       distribution: 'temurin'
       java-version: '21'
       cache: 'sbt'
+      java-package: jdk
+      architecture: x64
+    env:
+      JAVA_OPTS: "-XX:+UseG1GC -XX:+UseStringDeduplication"
```

---

`172-180`: **Consider parallelizing test execution**

The backend and e2e tests are running sequentially. Consider:
1. Running backend tests in parallel using test splitting
2. Implementing test sharding for e2e tests

Example configuration for parallel test execution:
```yaml
strategy:
  matrix:
    test-group: [1, 2, 3, 4]
steps:
  - name: Run backend tests
    run: |
      TOTAL_GROUPS=4
      GROUP=${{ matrix.test-group }}
      .github/not-on-master.sh docker compose run backend-tests --split-by=timings --group=$GROUP/$TOTAL_GROUPS
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint</summary>

176-176: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

176-176: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between d12c11004f1a98bbffb15cb4749d417eed92fe60 and f25cca044d8951cb5ec8d3cd8b6c152f33a7d5da.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

82-82: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

153-153: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

176-176: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

176-176: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

207-207: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>
<details>
<summary>🪛 yamllint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 59-59: wrong indentation: expected 6 but found 8

(indentation)

---

[error] 75-75: trailing spaces

(trailing-spaces)

---

[error] 98-98: trailing spaces

(trailing-spaces)

---

[error] 190-190: trailing spaces

(trailing-spaces)

---

[error] 192-192: trailing spaces

(trailing-spaces)

---

[error] 195-195: trailing spaces

(trailing-spaces)

---

[error] 200-200: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

<details>
<summary>🔇 Additional comments (1)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`4-16`: **Verify branch protection rules alignment**

The workflow triggers look good, but please ensure they align with your repository's branch protection rules, especially for the `master` branch.

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-11-11T14:43:36Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 0**

<details>
<summary>🧹 Outside diff range and nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`4-16`: **Consider refining the pull request trigger configuration**

The current configuration triggers on PRs for all branches (`'*'`). Consider limiting this to specific branches that are relevant to your workflow, such as:
```diff
  pull_request:
    branches:
-     - '*'
+     - master
+     - develop
+     - 'release/**'
```

---

`66-70`: **Optimize PostgreSQL health check configuration**

The current health check configuration might be too aggressive:
- 2s interval might be too frequent and could cause unnecessary load
- 30 retries with 2s interval = 60s total wait time, which might be excessive

Consider adjusting the values:
```diff
  options: >-
    --health-cmd pg_isready
-   --health-interval 2s
-   --health-timeout 5s
-   --health-retries 30
+   --health-interval 10s
+   --health-timeout 5s
+   --health-retries 12
```

---

`111-116`: **Optimize OS dependencies installation**

The current apt-get installation can be improved:
1. Clean up cache to reduce image size
2. Combine commands to reduce layers
3. Remove commented out packages

```diff
- run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+ run: |
+   sudo apt-get update && \
+   sudo apt-get install -y --no-install-recommends \
+     libdraco-dev \
+     libblosc-dev && \
+   sudo rm -rf /var/lib/apt/lists/*
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between f25cca044d8951cb5ec8d3cd8b6c152f33a7d5da and 816989dfa8911a86d6e0113979d6186373a5179e.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

82-82: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

156-156: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

179-179: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

179-179: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

210-210: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>
<details>
<summary>🪛 yamllint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 59-59: wrong indentation: expected 6 but found 8

(indentation)

---

[error] 75-75: trailing spaces

(trailing-spaces)

---

[error] 98-98: trailing spaces

(trailing-spaces)

---

[error] 193-193: trailing spaces

(trailing-spaces)

---

[error] 195-195: trailing spaces

(trailing-spaces)

---

[error] 198-198: trailing spaces

(trailing-spaces)

---

[error] 203-203: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-11-11T15:14:02Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 816989dfa8911a86d6e0113979d6186373a5179e and d9322ce5946f69c6abf3444195120b64ecbb1b29.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

82-82: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

157-157: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>
<details>
<summary>🪛 yamllint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 59-59: wrong indentation: expected 6 but found 8

(indentation)

---

[error] 75-75: trailing spaces

(trailing-spaces)

---

[error] 98-98: trailing spaces

(trailing-spaces)

---

[error] 194-194: trailing spaces

(trailing-spaces)

---

[error] 196-196: trailing spaces

(trailing-spaces)

---

[error] 199-199: trailing spaces

(trailing-spaces)

---

[error] 204-204: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

<details>
<summary>🔇 Additional comments (1)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`81-91`: _:hammer_and_wrench: Refactor suggestion_

**Fix shell script quoting in environment variables**

The script has potential issues with word splitting. Apply proper quoting:

```diff
  if [[ ${{ github.ref_type }} == "branch" ]]; then
-   NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+   NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
-   echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+   echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
-   DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+   DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
-   echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+   echo "DOCKER_TAG=${DOCKER_TAG}" >> "${GITHUB_ENV}"
```




> Likely invalid or redundant comment.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint</summary>

82-82: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

82-82: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-11-11T15:48:47Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>🧹 Outside diff range and nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`4-16`: **Consider optimizing workflow triggers**

The workflow configuration could be more efficient:
1. The `push` trigger could specify paths to reduce unnecessary runs
2. The `pull_request` trigger could also use path filters


```diff
  push:
    branches:
      - master
+   paths:
+     - 'app/**'
+     - 'webknossos-datastore/**'
+     - 'webknossos-tracingstore/**'
+     - 'package.json'
+     - 'yarn.lock'
  pull_request:
    branches:
      - '*'
+   paths:
+     - 'app/**'
+     - 'webknossos-datastore/**'
+     - 'webknossos-tracingstore/**'
+     - 'package.json'
+     - 'yarn.lock'
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between d9322ce5946f69c6abf3444195120b64ecbb1b29 and b162be248cb1d5be7abbabf72cf2dc48d29a6e10.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

154-154: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>
<details>
<summary>🪛 yamllint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 59-59: wrong indentation: expected 6 but found 8

(indentation)

---

[error] 74-74: trailing spaces

(trailing-spaces)

---

[error] 97-97: trailing spaces

(trailing-spaces)

---

[error] 127-127: trailing spaces

(trailing-spaces)

---

[error] 128-128: trailing spaces

(trailing-spaces)

---

[error] 194-194: trailing spaces

(trailing-spaces)

---

[error] 196-196: trailing spaces

(trailing-spaces)

---

[error] 199-199: trailing spaces

(trailing-spaces)

---

[error] 204-204: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

<details>
<summary>🔇 Additional comments (1)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`26-48`: _:hammer_and_wrench: Refactor suggestion_

**Optimize frontend checks performance**

The frontend checks job could be improved:
1. Add yarn caching
2. Add proper error handling
3. Consider parallelizing the checks


```diff
 - uses: actions/setup-node@v4
   with:
     node-version: 18
+    cache: 'yarn'

 - name: Install frontend dependencies
   run: corepack enable && yarn install --immutable

 - name: Lint frontend code and check formatting
-  run: yarn run check-frontend
+  run: |
+    set -euo pipefail
+    yarn run check-frontend

 - name: Typecheck frontend code
-  run: yarn typecheck
+  run: |
+    set -euo pipefail
+    yarn typecheck

 - name: Check for cyclic dependencies in frontend
-  run: yarn check-cyclic-dependencies
+  run: |
+    set -euo pipefail
+    yarn check-cyclic-dependencies
```




> Likely invalid or redundant comment.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

</details>

</details>

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-11-11T16:24:27Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between b162be248cb1d5be7abbabf72cf2dc48d29a6e10 and 77d54be8b55f49e59abcd3a7f7fa39cf66906bcf.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/not-on-master.sh` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* .github/not-on-master.sh

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

157-157: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>
<details>
<summary>🪛 yamllint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 59-59: wrong indentation: expected 6 but found 8

(indentation)

---

[error] 74-74: trailing spaces

(trailing-spaces)

---

[error] 97-97: trailing spaces

(trailing-spaces)

---

[error] 127-127: trailing spaces

(trailing-spaces)

---

[error] 128-128: trailing spaces

(trailing-spaces)

---

[error] 149-149: trailing spaces

(trailing-spaces)

---

[error] 195-195: trailing spaces

(trailing-spaces)

---

[error] 197-197: trailing spaces

(trailing-spaces)

---

[error] 200-200: trailing spaces

(trailing-spaces)

---

[error] 205-205: trailing spaces

(trailing-spaces)

---

[error] 220-220: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

<details>
<summary>🔇 Additional comments (3)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary>

`4-16`: **LGTM! Well-structured workflow triggers**

The workflow triggers and debug input configuration are properly set up, providing good flexibility for CI/CD operations.

---

`18-23`: **Skip comment: Security concerns already addressed**

A previous review has already flagged the security concerns about running as root and suggested using OIDC for Docker Hub authentication.

---

`26-48`: **Skip comment: Error handling improvements already suggested**

A previous review has already suggested adding proper error handling to the frontend check commands.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

</details>

</details>

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-11-12T11:02:58Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>🧹 Outside diff range and nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`101-106`: **Consider caching Java dependencies more effectively.**

While SBT caching is enabled, consider also caching the local Maven repository to speed up builds:

```diff
 - uses: actions/setup-java@v4
   with:
     distribution: 'temurin'
     java-version: '21'
     cache: 'sbt'
+    cache-dependency-path: |
+      **/*.sbt
+      project/**.scala
+      project/**.sbt
```

---

`150-151`: **Optimize test execution configuration.**

Consider improving the test execution:
1. Add test parallelization
2. Configure test output format
3. Add test results reporting

```diff
-        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+        run: |
+          .github/not-on-master.sh sbt -v \
+            'set Test / parallelExecution := true' \
+            'set Test / testOptions += Tests.Argument("-oDF")' \
+            "testOnly backend.*"
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: test-results
+          path: target/test-reports/
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 77d54be8b55f49e59abcd3a7f7fa39cf66906bcf and 46f66962503c0efeac609335bf3d6d25cc7a0caf.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)
* `docker-compose.yml` (3 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

160-160: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>
<details>
<summary>🪛 yamllint</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 59-59: wrong indentation: expected 6 but found 8

(indentation)

---

[error] 74-74: trailing spaces

(trailing-spaces)

---

[error] 97-97: trailing spaces

(trailing-spaces)

---

[error] 127-127: trailing spaces

(trailing-spaces)

---

[error] 128-128: trailing spaces

(trailing-spaces)

---

[error] 149-149: trailing spaces

(trailing-spaces)

---

[error] 178-178: trailing spaces

(trailing-spaces)

---

[error] 187-187: trailing spaces

(trailing-spaces)

---

[error] 189-189: trailing spaces

(trailing-spaces)

---

[error] 192-192: trailing spaces

(trailing-spaces)

---

[error] 197-197: trailing spaces

(trailing-spaces)

---

[error] 199-199: trailing spaces

(trailing-spaces)

---

[error] 219-219: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

<details>
<summary>🔇 Additional comments (7)</summary>

<details>
<summary>docker-compose.yml (2)</summary>

`106-107`: **Environment variable mappings need adjustment**

The previous review comment about environment variable mappings is still valid. Please refer to the existing comment for detailed explanation and suggested fixes.

---

`119-157`: **Document local development setup and verify GitHub Actions coverage**

While commenting out these services aligns with the migration to GitHub Actions, some concerns need to be addressed:

1. Local Development Impact:
   - The `dev` service is typically used for local development
   - Consider keeping it uncommented or document alternative local development setup

2. CI Coverage:
   - Ensure all these commented out services have equivalent workflows in GitHub Actions:
     - Compilation checks
     - Development environment
     - Backend tests
     - Linting and formatting
     - Screenshot tests

Let's verify the GitHub Actions workflow coverage:





Also applies to: 160-174, 204-213

<details>
<summary>✅ Verification successful</summary>

<!-- [monologue]
[task verification_1/1]
Verify if all commented-out services have equivalent GitHub Actions workflows based on the shell script output.

[observations]
1. Commented-out services in docker-compose.yml:
   - compile
   - dev
   - backend-tests
   - backend-lint-format
   - screenshot-tests
2. Shell script output shows GitHub Actions workflows:
   - nightly-screenshot-tests
   - codespell
   - static_frontend_code_checks
   - build_test_deploy
   - nightly-gzip-test
   - nightly-screenshot-tests (duplicate in another workflow)
   - build_test_deploy includes compilation and testing steps.

[analysis]
1. The `nightly-screenshot-tests` corresponds to `screenshot-tests`.
2. `build_test_deploy` likely covers `compile`, `backend-tests`, and `backend-lint-format`.
3. The `dev` service is related to local development, which isn't directly covered by CI workflows.
4. No evidence from shell script output about documentation updates.

[actions]
1. Confirm that CI workflows cover all functional aspects of the commented-out services.
2. Note that local development setup documentation needs to be addressed separately.
-->
**GitHub Actions workflows cover the commented-out services**
All previously commented-out services in `docker-compose.yml` have corresponding GitHub Actions workflows, ensuring continuous integration remains comprehensive.


</details>

<details>
<summary>🏁 Scripts executed</summary>

The following scripts were executed for the analysis:

Script:

```shell
#!/bin/bash
# Description: Check if all commented out services have equivalent GitHub Actions jobs

# Check for workflow files
echo "Checking .github/workflows directory for CI jobs..."
fd . .github/workflows -e yml -e yaml -x cat {} \; | grep -A 5 "jobs:"

# Look for specific job types in workflows
echo -e "\nChecking for specific job coverage..."
rg -i "compile|test|lint|format|screenshot" .github/workflows

```

Length of output: 3662

</details>

</details>
<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary>

`4-16`: **LGTM! Well-structured workflow triggers with debugging support.**

The workflow triggers are properly configured, and the addition of the tmate debugging option is a nice feature for troubleshooting.

---

`18-23`: **Skip: Issues already addressed in past reviews.**

---

`26-48`: **Skip: Improvements already suggested in past reviews.**

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

</details>

</details>

---

`51-72`: **Skip: Security concerns already addressed in past reviews.**

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary>

[warning] 59-59: wrong indentation: expected 6 but found 8

(indentation)

</details>

</details>

---

`153-231`: **Skip: Docker-related improvements already suggested in past reviews.**

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint</summary>

160-160: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

</details>
<details>
<summary>🪛 yamllint</summary>

[error] 178-178: trailing spaces

(trailing-spaces)

---

[error] 187-187: trailing spaces

(trailing-spaces)

---

[error] 189-189: trailing spaces

(trailing-spaces)

---

[error] 192-192: trailing spaces

(trailing-spaces)

---

[error] 197-197: trailing spaces

(trailing-spaces)

---

[error] 199-199: trailing spaces

(trailing-spaces)

---

[error] 219-219: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-11-12T12:42:30Z
user: login: robert-oleynik
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-12-04T08:48:15Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>🧹 Outside diff range and nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`34-37`: **Add yarn cache to improve CI performance**

Consider using GitHub's cache action for yarn dependencies to speed up the CI pipeline.

```diff
 - uses: actions/setup-node@v4
   with:
     node-version: 18
+    cache: 'yarn'
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 219a68f2d297153ac3bf5220c679b49f0af9ee4a and 0be3a3baf951d0b95cd17f5b1fe368a71e4a7bea.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

160-160: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>
<details>
<summary>🪛 yamllint (1.35.1)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 59-59: wrong indentation: expected 6 but found 8

(indentation)

---

[error] 74-74: trailing spaces

(trailing-spaces)

---

[error] 97-97: trailing spaces

(trailing-spaces)

---

[error] 127-127: trailing spaces

(trailing-spaces)

---

[error] 128-128: trailing spaces

(trailing-spaces)

---

[error] 149-149: trailing spaces

(trailing-spaces)

---

[error] 178-178: trailing spaces

(trailing-spaces)

---

[error] 188-188: trailing spaces

(trailing-spaces)

---

[error] 190-190: trailing spaces

(trailing-spaces)

---

[error] 193-193: trailing spaces

(trailing-spaces)

---

[error] 198-198: trailing spaces

(trailing-spaces)

---

[error] 200-200: trailing spaces

(trailing-spaces)

---

[error] 220-220: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

<details>
<summary>🔇 Additional comments (5)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary>

`18-23`: **Security: Critical configuration issues need attention**

1. Running as root user is a security risk
2. Consider using GitHub's OIDC for Docker Hub authentication

---

`62-64`: **Security: Use secrets for database credentials**

Database credentials should not be hardcoded in the workflow file.

---

`119-126`: **Uncomment and fix database validation steps**

The commented-out database validation steps are critical for ensuring schema integrity.

---

`233-234`: **Don't silence coverage failures**

The coverage command ignores failures with `|| true`, which could hide important coverage regressions.

---

`41-48`: _:hammer_and_wrench: Refactor suggestion_

**Add error handling to frontend checks**

The check commands should fail fast if any check fails.

```diff
 - name: Lint frontend code and check formatting
-  run: yarn run check-frontend
+  run: |
+    set -euo pipefail
+    yarn run check-frontend

 - name: Typecheck frontend code
-  run: yarn typecheck
+  run: |
+    set -euo pipefail
+    yarn typecheck

 - name: Check for cyclic dependencies in frontend
-  run: yarn check-cyclic-dependencies
+  run: |
+    set -euo pipefail
+    yarn check-cyclic-dependencies
```




> Likely invalid or redundant comment.

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-12-04T08:52:01Z
user: login: robert-oleynik
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-12-04T09:07:25Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 0be3a3baf951d0b95cd17f5b1fe368a71e4a7bea and d22dadeb1279127c3e9c0b874df70b74d96563ce.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

160-160: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>
<details>
<summary>🪛 yamllint (1.35.1)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

---

[warning] 59-59: wrong indentation: expected 6 but found 8

(indentation)

---

[error] 74-74: trailing spaces

(trailing-spaces)

---

[error] 97-97: trailing spaces

(trailing-spaces)

---

[error] 127-127: trailing spaces

(trailing-spaces)

---

[error] 128-128: trailing spaces

(trailing-spaces)

---

[error] 149-149: trailing spaces

(trailing-spaces)

---

[error] 178-178: trailing spaces

(trailing-spaces)

---

[error] 189-189: trailing spaces

(trailing-spaces)

---

[error] 191-191: trailing spaces

(trailing-spaces)

---

[error] 194-194: trailing spaces

(trailing-spaces)

---

[error] 199-199: trailing spaces

(trailing-spaces)

---

[error] 201-201: trailing spaces

(trailing-spaces)

---

[error] 221-221: trailing spaces

(trailing-spaces)

</details>

</details>

</details>

<details>
<summary>🔇 Additional comments (9)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml (9)</summary>

`18-23`: _:warning: Potential issue_

**Critical security improvements needed**

Several security concerns need to be addressed:
1. Running as root user is a security risk
2. Consider using GitHub's OIDC for Docker Hub authentication



Apply these security improvements:
```diff
 env:
-  USER_NAME: root
+  USER_NAME: webknossos
   USER_UID: 1000
   USER_GID: 1000
-  DOCKER_USER: ${{ secrets.DOCKER_USER }}
-  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}

+permissions:
+  id-token: write
+  contents: read
```

Then update the Docker login step to use OIDC:
```yaml
      - uses: docker/login-action@v2
        with:
          registry: docker.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
```

---

`34-39`: _:hammer_and_wrench: Refactor suggestion_

**Add yarn cache to improve CI performance**



```diff
     - uses: actions/setup-node@v4
       with:
         node-version: 18
+        cache: 'yarn'
+
+    - name: Get yarn cache directory path
+      id: yarn-cache-dir-path
+      run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
+
+    - uses: actions/cache@v3
+      id: yarn-cache
+      with:
+        path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-yarn-

     - name: Install frontend dependencies
       run: corepack enable && yarn install --immutable
```

---

`41-48`: _:hammer_and_wrench: Refactor suggestion_

**Add error handling to frontend checks**



```diff
     - name: Lint frontend code and check formatting
-      run: yarn run check-frontend
+      run: |
+        set -euo pipefail
+        yarn run check-frontend

     - name: Typecheck frontend code
-      run: yarn typecheck
+      run: |
+        set -euo pipefail
+        yarn typecheck

     - name: Check for cyclic dependencies in frontend
-      run: yarn check-cyclic-dependencies
+      run: |
+        set -euo pipefail
+        yarn check-cyclic-dependencies
```

---

`62-64`: _:warning: Potential issue_

**Use secrets for database credentials**



```diff
           env:
-            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
-            POSTGRES_USER: webknossos_user
-            POSTGRES_PASSWORD: secret_password
+            POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+            POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+            POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`71-72`: _:warning: Potential issue_

**Restrict PostgreSQL port exposure**



```diff
           ports:
-            - 5432:5432
+            - 127.0.0.1:5432:5432
```

---

`80-90`: _:warning: Potential issue_

**Fix shell script quoting issues**



```diff
       - name: "Custom environment variables"
         run: |
           if [[ ${{ github.ref_type }} == "branch" ]]; then
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
-            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
             DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
-            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${DOCKER_TAG}" >> "${GITHUB_ENV}"
           else
-            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
-            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+            echo "NORMALIZED_BRANCH=master" >> "${GITHUB_ENV}"
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> "${GITHUB_ENV}"
           fi
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

---

`119-126`: _:warning: Potential issue_

**Uncomment and fix database validation steps**

These commented-out steps are critical for ensuring database schema integrity.



```diff
-      # - name: Assert unique evolution numbers
-      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert unique evolution numbers
+        run: node tools/postgres/dbtool.js assert-unique-evolution-numbers

-      # - name: Assert schema.sql and evolutions are equal
-      #   run: |
-      #     docker compose up -d postgres
-      #     sleep 3
-      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          until docker compose exec -T postgres pg_isready; do
+            echo "Waiting for postgres..."
+            sleep 1
+          done
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
```

---

`234-235`: _:warning: Potential issue_

**Don't silence coverage failures**



```diff
-        run: .github/not-on-master.sh yarn coverage || true
+        run: |
+          set -eo pipefail
+          .github/not-on-master.sh yarn coverage
```

Consider:
1. Setting a minimum coverage threshold
2. Making the job fail if coverage drops below the threshold
3. Using a coverage reporting action to track trends

---

`237-238`: _:hammer_and_wrench: Refactor suggestion_

**Implement GitHub Actions native Slack integration**



Replace the CircleCI script with GitHub Actions native Slack integration:

```yaml
      - name: Notify Slack
        if: github.ref == 'refs/heads/master'
        uses: slackapi/slack-github-action@v1.24.0
        with:
          channel-id: 'CHANNEL_ID'
          slack-message: "GitHub Action build result: ${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
```

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-12-04T09:24:39Z
user: login: robert-oleynik
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-12-04T10:58:07Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between d22dadeb1279127c3e9c0b874df70b74d96563ce and c0c3db57a0453e1e9e56ed451049517ae366efe1.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

160-160: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

</details>

<details>
<summary>🔇 Additional comments (8)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml (8)</summary>

`237-238`: **Implement native GitHub Actions Slack integration**



Replace the CircleCI Slack notification with GitHub Actions native integration:

```yaml
- name: Notify Slack
  if: github.ref == 'refs/heads/master'
  uses: slackapi/slack-github-action@v1.24.0
  with:
    channel-id: 'CHANNEL_ID'
    slack-message: "GitHub Action build result: ${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}"
  env:
    SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
```

---

`18-23`: _:warning: Potential issue_

**Critical security improvements needed**

Several security concerns need to be addressed:
1. Running as root user is a security risk
2. Docker credentials should use GitHub's OIDC
3. Environment variables should be moved to secrets



Apply these security improvements:
```diff
 env:
-  USER_NAME: root
+  USER_NAME: webknossos
   USER_UID: 1000
   USER_GID: 1000
-  DOCKER_USER: ${{ secrets.DOCKER_USER }}
-  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
```

Add OIDC configuration for Docker Hub:
```yaml
permissions:
  id-token: write
  contents: read

jobs:
  build:
    steps:
      - uses: docker/login-action@v2
        with:
          registry: docker.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
```

---

`34-39`: _:hammer_and_wrench: Refactor suggestion_

**Add yarn cache to improve CI performance**



Add caching for yarn dependencies:
```diff
    - uses: actions/setup-node@v4
      with:
        node-version: 18
+       cache: 'yarn'
+
+   - name: Get yarn cache directory path
+     id: yarn-cache-dir-path
+     run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
+
+   - uses: actions/cache@v3
+     id: yarn-cache
+     with:
+       path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+       key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+       restore-keys: |
+         ${{ runner.os }}-yarn-

    - name: Install frontend dependencies
      run: corepack enable && yarn install --immutable
```

---

`62-64`: _:warning: Potential issue_

**Move database credentials to secrets**



```diff
          env:
-           POSTGRES_URL: jdbc:postgresql://postgres/webknossos
-           POSTGRES_USER: webknossos_user
-           POSTGRES_PASSWORD: secret_password
+           POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+           POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+           POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`119-126`: _:warning: Potential issue_

**Enable critical database validation steps**

The commented-out database validation steps are important for ensuring schema integrity.



```diff
-      # - name: Assert unique evolution numbers
-      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert unique evolution numbers
+        run: node tools/postgres/dbtool.js assert-unique-evolution-numbers

-      # - name: Assert schema.sql and evolutions are equal
-      #   run: |
-      #     docker compose up -d postgres
-      #     sleep 3
-      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          until docker compose exec -T postgres pg_isready; do
+            echo "Waiting for postgres..."
+            sleep 1
+          done
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
```

---

`81-90`: _:warning: Potential issue_

**Fix shell script quoting issues**



```diff
        run: |
          if [[ ${{ github.ref_type }} == "branch" ]]; then
-           NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
-           echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+           NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
+           echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
-           DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
-           echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+           DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+           echo "DOCKER_TAG=${DOCKER_TAG}" >> "${GITHUB_ENV}"
          else
-           echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
-           echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+           echo "NORMALIZED_BRANCH=master" >> "${GITHUB_ENV}"
+           echo "DOCKER_TAG=${{ github.ref_name }}" >> "${GITHUB_ENV}"
          fi
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

---

`234-235`: _:warning: Potential issue_

**Don't silence coverage failures**



The coverage command ignores failures with `|| true`. This could hide important coverage regressions.

```diff
-        run: .github/not-on-master.sh yarn coverage || true
+        run: |
+          set -eo pipefail
+          .github/not-on-master.sh yarn coverage
+        continue-on-error: true
```

---

`30-32`: _:warning: Potential issue_

**Update checkout action version**

The `actions/checkout@v3` action is outdated.


```diff
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: 5
```




> Likely invalid or redundant comment.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2024-12-04T16:00:02Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/actions/url-health-check/action.yml (1)</summary><blockquote>

`7-16`: **Enhance health check implementation.**

While the basic implementation is good, consider these improvements:
1. Add proper error handling with verbose output
2. Add timeout for each curl attempt
3. Add newline at end of file

```diff
 steps:
     - shell: bash
       run: |
+        set -euo pipefail
         for i in {1..20}; do
-          curl --fail -v "${{ inputs.url }}" && exit 0
+          echo "Attempt $i/20: Checking ${{ inputs.url }}"
+          if curl --fail --max-time 10 -v "${{ inputs.url }}"; then
+            echo "Health check passed!"
+            exit 0
+          fi
+          echo "Health check failed. Retrying in 5 seconds..."
           sleep 5
         done
+        echo "Health check failed after 20 attempts"
         exit 1
+
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint (1.35.1)</summary>

[error] 16-16: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>

</blockquote></details>
<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`34-39`: **Add yarn cache to improve CI performance.**

Consider using GitHub's cache action for yarn dependencies to speed up the CI pipeline.

```diff
    - uses: actions/setup-node@v4
      with:
        node-version: 18
+       cache: 'yarn'
+
+   - name: Get yarn cache directory path
+     id: yarn-cache-dir-path
+     run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
+
+   - uses: actions/cache@v3
+     id: yarn-cache
+     with:
+       path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+       key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+       restore-keys: |
+         ${{ runner.os }}-yarn-

    - name: Install frontend dependencies
      run: corepack enable && yarn install --immutable
```

---

`237-238`: **Consider implementing GitHub Actions native Slack integration.**

Instead of using the CircleCI script, implement Slack notifications using GitHub Actions.

```yaml
- name: Notify Slack
  if: github.ref == 'refs/heads/master'
  uses: slackapi/slack-github-action@v1.24.0
  with:
    channel-id: 'CHANNEL_ID'
    slack-message: "GitHub Action build result: ${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}"
  env:
    SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between cb6f60cbecd85c77a0c2edd4c87ed979af1ce06a and 5efdae37cdeb70298dee10ba1db7e13a664fcf86.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/actions/url-health-check/action.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 yamllint (1.35.1)</summary>

<details>
<summary>.github/actions/url-health-check/action.yml</summary>

[error] 16-16: no new line character at the end of file

(new-line-at-end-of-file)

</details>

</details>
<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

160-160: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (8)</summary><blockquote>

<details>
<summary>.github/actions/url-health-check/action.yml (1)</summary>

`1-6`: **LGTM! Well-structured action metadata.**

The action metadata is well-defined with clear name, description, and required input parameter.

</details>
<details>
<summary>.github/workflows/build_test_deploy.yml (7)</summary>

`71-72`: _:hammer_and_wrench: Refactor suggestion_

**Restrict PostgreSQL port exposure.**

The PostgreSQL port is exposed on all interfaces. For better security, restrict it to localhost:

```diff
    ports:
-     - 5432:5432
+     - 127.0.0.1:5432:5432
```




> Likely invalid or redundant comment.

---

`41-48`: _:hammer_and_wrench: Refactor suggestion_

**Add error handling to frontend checks.**

The frontend check commands should fail fast if any check fails.

```diff
    - name: Lint frontend code and check formatting
      run: |
+       set -euo pipefail
        yarn run check-frontend

    - name: Typecheck frontend code
      run: |
+       set -euo pipefail
        yarn typecheck

    - name: Check for cyclic dependencies in frontend
      run: |
+       set -euo pipefail
        yarn check-cyclic-dependencies
```




> Likely invalid or redundant comment.

---

`62-64`: _:warning: Potential issue_

**Security: Use secrets for database credentials.**

Database credentials should not be hardcoded in the workflow file.

```diff
 env:
-  POSTGRES_URL: jdbc:postgresql://postgres/webknossos
-  POSTGRES_USER: webknossos_user
-  POSTGRES_PASSWORD: secret_password
+  POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+  POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```




> Likely invalid or redundant comment.

---

`119-126`: _:warning: Potential issue_

**Uncomment and fix database validation steps.**

The commented-out database validation steps are critical for ensuring schema integrity.

```diff
-# - name: Assert unique evolution numbers
-#   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+- name: Assert unique evolution numbers
+  run: node tools/postgres/dbtool.js assert-unique-evolution-numbers

-# - name: Assert schema.sql and evolutions are equal
-#   run: |
-#     docker compose up -d postgres
-#     sleep 3
-#     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+- name: Assert schema.sql and evolutions are equal
+  run: |
+    docker compose up -d postgres
+    until docker compose exec -T postgres pg_isready; do
+      echo "Waiting for postgres..."
+      sleep 1
+    done
+    docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
```




> Likely invalid or redundant comment.

---

`4-16`: _:hammer_and_wrench: Refactor suggestion_

**Add security controls for workflow triggers.**

The workflow triggers need additional security controls:
1. Add permissions to restrict access
2. Add concurrency controls to prevent parallel runs
3. Configure timeout for debug sessions

```diff
 name: CI Pipeline

 on:
   push:
     branches:
       - master
   pull_request:
     branches:
       - '*'
   workflow_dispatch:
     inputs:
       debug_enabled:
         type: boolean
         description: 'Run the build with tmate debugging enabled'
         required: false
         default: false

+permissions:
+  contents: read
+  actions: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
```




> Likely invalid or redundant comment.

---

`234-235`: _:warning: Potential issue_

**Don't silence coverage failures.**

The coverage command is set to ignore failures with `|| true`. This could hide important coverage regressions.

```diff
-        run: .github/not-on-master.sh yarn coverage || true
+        run: |
+          set -eo pipefail
+          .github/not-on-master.sh yarn coverage
+        continue-on-error: true
```




> Likely invalid or redundant comment.

---

`81-90`: _:hammer_and_wrench: Refactor suggestion_

**Fix shell script quoting issues.**

The branch normalization script has potential issues with word splitting.

```diff
  if [[ ${{ github.ref_type }} == "branch" ]]; then
-   NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+   NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
-   echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+   echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
-   DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+   DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
-   echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+   echo "DOCKER_TAG=${DOCKER_TAG}" >> "${GITHUB_ENV}"
```




> Likely invalid or redundant comment.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-01-10T13:56:53Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`30-32`: **Update checkout action version.**

```diff
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: 5
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`34-39`: **Add yarn cache to improve CI performance.**

```diff
    - uses: actions/setup-node@v4
      with:
        node-version: 18
+       cache: 'yarn'
+
+   - name: Get yarn cache directory path
+     id: yarn-cache-dir-path
+     run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
+
+   - uses: actions/cache@v3
+     id: yarn-cache
+     with:
+       path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+       key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+       restore-keys: |
+         ${{ runner.os }}-yarn-

    - name: Install frontend dependencies
      run: corepack enable && yarn install --immutable
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 5efdae37cdeb70298dee10ba1db7e13a664fcf86 and 9b42b8476e036ec4f07c905ba30bf674f50ae283.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

160-160: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (9)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (9)</summary>

`187-201`: **Refactor duplicated health check logic.**

The health check implementation is duplicated across three services. Consider extracting this into a reusable composite action:

1. Create `.github/actions/health-check/action.yml`:
```yaml
name: 'Health Check'
description: 'Performs health check with retries'
inputs:
  url:
    description: 'Health check URL'
    required: true
runs:
  using: 'composite'
  steps:
    - shell: bash
      run: |
        for i in {1..20}; do
          curl --fail -v "${{ inputs.url }}" && exit 0
          sleep 5
        done
        exit 1
```

2. Use it in the workflow:
```yaml
- uses: ./.github/actions/health-check
  with:
    url: http://localhost:9000/api/health
```

---

`241-242`: **Consider implementing GitHub Actions native Slack integration.**

Instead of using the CircleCI script, implement Slack notifications using GitHub Actions:

```yaml
- name: Notify Slack
  if: github.ref == 'refs/heads/master'
  uses: slackapi/slack-github-action@v1.24.0
  with:
    channel-id: 'CHANNEL_ID'
    slack-message: "GitHub Action build result: ${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}"
  env:
    SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
```

---

`71-72`: _:hammer_and_wrench: Refactor suggestion_

**Restrict PostgreSQL port exposure.**

The PostgreSQL port is exposed on all interfaces. For better security, restrict it to localhost:

```diff
    ports:
-     - 5432:5432
+     - 127.0.0.1:5432:5432
```





> Likely invalid or redundant comment.

---

`238-239`: _:hammer_and_wrench: Refactor suggestion_

**Don't silence coverage failures.**

The coverage command is set to ignore failures with `|| true`. This could hide important coverage regressions.

Consider:
1. Remove the `|| true`
2. Set a minimum coverage threshold
3. Make the job fail if coverage drops below the threshold

```diff
-        run: .github/not-on-master.sh yarn coverage || true
+        run: |
+          set -eo pipefail
+          .github/not-on-master.sh yarn coverage
```





> Likely invalid or redundant comment.

---

`180-185`: _:warning: Potential issue_

**Fix permissions for fossildb directories.**

The permissions are too open (0777). Use more restrictive permissions and proper ownership:

```diff
-         mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-         mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+         mkdir -p fossildb/{data,backup}
+         sudo chown -R 999:999 fossildb/{data,backup}
+         sudo chmod -R "0755" fossildb/{data,backup}
```





> Likely invalid or redundant comment.

---

`62-64`: _:warning: Potential issue_

**Security: Use secrets for database credentials.**

Database credentials should not be hardcoded in the workflow file.

```diff
 env:
-  POSTGRES_URL: jdbc:postgresql://postgres/webknossos
-  POSTGRES_USER: webknossos_user
-  POSTGRES_PASSWORD: secret_password
+  POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+  POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```





> Likely invalid or redundant comment.

---

`41-48`: _:hammer_and_wrench: Refactor suggestion_

**Add error handling to frontend checks.**

The frontend check commands should fail fast if any check fails:

```diff
    - name: Lint frontend code and check formatting
      run: |
+       set -euo pipefail
        yarn run check-frontend

    - name: Typecheck frontend code
      run: |
+       set -euo pipefail
        yarn typecheck

    - name: Check for cyclic dependencies in frontend
      run: |
+       set -euo pipefail
        yarn check-cyclic-dependencies
```





> Likely invalid or redundant comment.

---

`119-126`: _:warning: Potential issue_

**Uncomment and fix database validation steps.**

The commented-out database validation steps are critical for ensuring schema integrity.

```diff
-# - name: Assert unique evolution numbers
-#   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+- name: Assert unique evolution numbers
+  run: node tools/postgres/dbtool.js assert-unique-evolution-numbers

-# - name: Assert schema.sql and evolutions are equal
-#   run: |
-#     docker compose up -d postgres
-#     sleep 3
-#     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+- name: Assert schema.sql and evolutions are equal
+  run: |
+    docker compose up -d postgres
+    until docker compose exec -T postgres pg_isready; do
+      echo "Waiting for postgres..."
+      sleep 1
+    done
+    docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
```





> Likely invalid or redundant comment.

---

`80-90`: _:warning: Potential issue_

**Fix shell script quoting issues.**

The branch normalization script has potential issues with word splitting:

```diff
  if [[ ${{ github.ref_type }} == "branch" ]]; then
-   NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+   NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
-   echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+   echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
-   DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+   DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
-   echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+   echo "DOCKER_TAG=${DOCKER_TAG}" >> "${GITHUB_ENV}"
```





> Likely invalid or redundant comment.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

81-81: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

81-81: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-01-10T14:12:12Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (8)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (8)</summary><blockquote>

`29-32`: _🛠️ Refactor suggestion_

**Update Checkout Action Version**  
The static_frontend_code_checks job uses `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will provide performance and security improvements.  
```diff
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`75-78`: _🛠️ Refactor suggestion_

**Update Checkout Action Version in Build Job**  
Similarly, the checkout step in the `build_test_deploy` job uses `actions/checkout@v3`. Please update it to version v4 for consistency and improved performance:  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`209-211`: _⚠️ Potential issue_

**Security: Replace Hardcoded Credentials in End-to-End Test Step**  
The end-to-end tests again use hardcoded values for database credentials. Please update these to use GitHub secrets as demonstrated earlier.  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`71-72`: _🛠️ Refactor suggestion_

**Restrict PostgreSQL Port Exposure**  
The service maps port 5432 directly (`5432:5432`), which exposes the database to all interfaces. For improved security, restrict the binding to localhost:  
```diff
-            - 5432:5432
+            - 127.0.0.1:5432:5432
```

---

`18-23`: _⚠️ Potential issue_

**Security: Avoid Running as Root**  
The environment variable `USER_NAME` is currently set to `root`, which poses a security risk in CI environments. It is recommended to use a non-root user (for example, `webknossos`) to follow security best practices.  
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
```

---

`179-182`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Overly Permissive Permissions for fossildb Directories**  
The step that creates directories for `fossildb` applies `chmod 0777`, which is excessively permissive. It is better to set appropriate ownership and more restrictive permissions (e.g., 0755). For example:  
```diff
-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/{data,backup}
+          sudo chmod -R 0755 fossildb/{data,backup}
```

---

`238-240`: _⚠️ Potential issue_

**Avoid Silencing Coverage Failures**  
The coverage reporting step uses `|| true`, which may mask failures and regressions in test coverage. It is advisable to remove this to ensure that genuine failures are surfaced:  
```diff
-        run: .github/not-on-master.sh yarn coverage || true
+        run: .github/not-on-master.sh yarn coverage
```

---

`129-139`: _⚠️ Potential issue_

**Replace Hardcoded Database Credentials in sbt Build Step**  
The sbt build step sets database credentials directly in the environment. For security and flexibility, move these values to GitHub secrets. For instance:  
```diff
-          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
-          POSTGRES_USER: webknossos_user
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`80-90`: **Fix Shell Quoting in Custom Environment Variables**  
In the custom environment variables step, variables are interpolated without proper quoting. This can lead to word splitting or globbing issues. Consider wrapping the interpolated values in double quotes as shown below:  
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
-            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
-            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
-            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=${DOCKER_TAG}" >> "${GITHUB_ENV}"
```

---

`159-163`: **Improve Variable Quoting for Docker Build Commands**  
When pulling the Docker image, the branch variable is concatenated without quotes, which could lead to word splitting issues. Use proper quoting:  
```diff
-          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          docker pull "scalableminds/webknossos:${NORMALIZED_BRANCH}" || true
```

---

`226-234`: **Improve Docker Tagging and Variable Quoting in Push Commands**  
In the Docker image push commands, the tag and push operations concatenate variables without quotes. This can lead to unexpected behavior. Ensure that variables are properly quoted. For example:  
```diff
-              docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+              docker tag "scalableminds/webknossos:${DOCKER_TAG}" "scalableminds/webknossos:${NORMALIZED_BRANCH}"
```  
Apply similar quoting to the other tagging commands.

---

`241-243`: **Optional: Slack Notification Step Cleanup**  
The Slack notification step is commented out. If it’s no longer required, consider removing it; otherwise, update and uncomment with proper configuration and security (e.g., using GitHub secrets for the Slack token).

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 9b42b8476e036ec4f07c905ba30bf674f50ae283 and 864e3069f000e25a2a1c7060f200ccaa3853ae1f.

</details>

<details>
<summary>📒 Files selected for processing (3)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)
* `Dockerfile` (1 hunks)
* `docker-compose.yml` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (2)</summary>

* Dockerfile
* docker-compose.yml

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`1-17`: **Workflow Triggers and Debug Input Configuration**  
The new triggers for pushes (to master), pull requests (to all branches), and the added `workflow_dispatch` input (`debug_enabled`) are correctly defined. Ensure that if debugging is enabled via tmate, additional security restrictions (such as timeouts and access limits) are in place.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-17T09:27:19Z
user: login: robert-oleynik
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-17T10:40:44Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 10**

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`80-90`: **Shell Quoting: Improve Variable Handling in Custom Environment Setup**  
In the custom environment variables step, the unquoted usage of `${{ github.ref_name }}` may lead to word-splitting issues. For example, update:  
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```  
Similarly, ensure that when writing to `$GITHUB_ENV`, the variable and file are appropriately quoted.

---

`217-237`: **Shell Quoting: Improve Docker Tagging and Push Commands**  
Within the Docker image push step, variables such as `${DOCKER_TAG}` and `${NORMALIZED_BRANCH}` are used without quotations. Without proper quoting, there is a risk of word splitting and unexpected behavior during tagging and pushing. Please update the commands to properly quote these variables. Additionally, verify that the use of the `retry` command is defined and handles errors as expected.

---

`241-243`: **Cleanup: Remove Unused Commented Code**  
There is a commented-out section for Slack notifications. If this integration is not needed, please remove it to keep the workflow clean; otherwise, uncomment it once it is ready for production use.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 864e3069f000e25a2a1c7060f200ccaa3853ae1f and 2a93eedcdd2a8df257ef993d9a5bb2ba70d50726.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-17T12:02:53Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (8)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (8)</summary><blockquote>

`29-32`: _🛠️ Refactor suggestion_

**Update Checkout Action Version**  
The checkout step uses `actions/checkout@v3`, which is flagged by static analysis as outdated. Upgrading to version v4 will ensure improved performance and better compatibility.  
```diff
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`75-78`: _🛠️ Refactor suggestion_

**Update Checkout Action Version in Build Job**  
Similar to the previous comment, please update the checkout action version here as well from v3 to v4.  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`156-157`: _🛠️ Refactor suggestion_

**Update Docker Setup Buildx Action Version**  
Static analysis indicates that `docker/setup-buildx-action@v2` is outdated. Upgrade it to the latest version (v3) to benefit from recent enhancements.  
```diff
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v2
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`18-23`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security: Avoid Running as Root**  
The environment variable `USER_NAME: root` poses a security risk. It is recommended to use a non‑root user (for example, `webknossos`) to minimize potential vulnerabilities.  
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
```

---

`57-64`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical Security: Remove Hardcoded Database Credentials**  
Both the job-level environment variable (`PGPASSWORD: secret_password`) and the PostgreSQL service’s `POSTGRES_PASSWORD: secret_password` are hardcoded. Replace these with secret references to protect sensitive data.  
```diff
-      PGPASSWORD: secret_password
+      PGPASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```
```diff
-            POSTGRES_PASSWORD: secret_password
+            POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`159-166`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security: Use Secrets for DB Credentials in Docker Image Build**  
The environment provided for building the Docker image still hardcodes the database password. Replace it with a secret reference. Also consider quoting variable expansions in commands to prevent word splitting.  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`238-240`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Testing Robustness: Report Coverage Without Silencing Failures**  
The coverage step currently appends `|| true`, which can hide coverage regressions. Remove the fallback so that failures in coverage are properly reported, or implement explicit error handling (e.g. abort if a threshold isn’t met).  
```diff
-        run: .github/not-on-master.sh yarn coverage || true
+        run: |
+          set -eo pipefail
+          .github/not-on-master.sh yarn coverage
```

---

`129-136`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security: Use Secrets for DB Credentials in SBT Build**  
The SBT build step’s environment still hardcodes `POSTGRES_PASSWORD: secret_password`. Replace it with a secure secret reference:  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`80-90`: **Improve Shell Quoting for Custom Environment Variables**  
The script that sets `NORMALIZED_BRANCH` and `DOCKER_TAG` does not properly quote variables, which can lead to word splitting or globbing issues. Use explicit quoting and also ensure that the `$GITHUB_ENV` variable is enclosed in quotes.  
```diff
-            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
-            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${DOCKER_TAG}" >> "${GITHUB_ENV}"
```

---

`116-127`: **Cleanup: Handle Commented Database Validation Steps**  
There are several commented-out steps for asserting database schema consistency and unique evolution numbers. Remove these if they are obsolete, or re-enable and update them if they remain necessary for validating database integrity.

---

`175-177`: **Security: Configure Debugging Session Timeouts**  
The tmate debugging session (triggered via workflow_dispatch with `debug_enabled`) currently does not specify a timeout. Consider adding a timeout and additional permissions restrictions to avoid prolonged exposure during debugging.

---

`216-237`: **Improve Docker Push Commands: Use Proper Quoting**  
In the Docker push commands, variable expansions (such as `${DOCKER_TAG}` and `${NORMALIZED_BRANCH}`) are unquoted. This can lead to word splitting issues. Enclose variable expansions in quotes for safety. For example:  
```diff
-              docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+              docker tag "scalableminds/webknossos:${DOCKER_TAG}" "scalableminds/webknossos:${NORMALIZED_BRANCH}"
```  
Apply similar changes to other `docker tag` commands.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 2a93eedcdd2a8df257ef993d9a5bb2ba70d50726 and 0aac54bdbbd7b694a3a20d2f758f0f76b34c73e6.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-26T12:49:54Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 9**

<details>
<summary>♻️ Duplicate comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`80-90`: _🛠️ Refactor suggestion_

**Improve Shell Quoting in Environment Variable Setup**  
In the custom environment variable block, wrap variable expansions in double quotes to prevent potential word splitting issues. For example:  
```diff
-   NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+   NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```  
Also update subsequent echo statements accordingly (e.g., quoting `$GITHUB_ENV`).

---

`179-182`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Restrict Fossildb Directory Permissions**  
Using `sudo chmod -R "0777"` is overly permissive and can lead to security issues. It is recommended to create the directories, adjust ownership (e.g., using `sudo chown -R 999:999`), and set more restrictive permissions (such as `0755`) for the fossildb directories. For example:  
```diff
- mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
- mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+ mkdir -p fossildb/data fossildb/backup
+ sudo chown -R 999:999 fossildb/data fossildb/backup
+ sudo chmod -R "0755" fossildb/data fossildb/backup
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`4-17`: **Enhance Workflow Triggers and Debug Input Security**  
The new workflow triggers for push (on the master branch), pull_request (for all branches), and workflow_dispatch with the `debug_enabled` input improve CI flexibility. However, consider restricting the permissions on the workflow_dispatch trigger (or adding a permissions field) to limit debug sessions to authorized users only.

---

`116-127`: **Clean Up Commented Database Validation Steps**  
There are several commented-out steps related to database validation. If these validations are still relevant, consider uncommenting and updating them; otherwise, removing the commented code can improve maintainability.

---

`174-178`: **Configure Tmate Debug Session Timeout**  
While the tmate debugging session is useful when `debug_enabled` is true, consider adding a timeout (using something like `timeout-minutes`) to prevent prolonged sessions and reduce the risk of sensitive information exposure.

---

`241-243`: **Remove Unused Slack Notification Step**  
If the Slack notification for the master branch is no longer needed, consider removing the commented-out section to keep the workflow file clean.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 0aac54bdbbd7b694a3a20d2f758f0f76b34c73e6 and 15626ceea352593863476bc9a78bcd996d8d79d8.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`75-78`: **Update Checkout Action Version in Build Job**  
Similar to the earlier checkout step, the build job uses `actions/checkout@v3`. Please upgrade this to `actions/checkout@v4` for consistency and enhanced functionality.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-26T13:06:59Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 11**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`183-184`: _🛠️ Refactor suggestion_

**Restrictive Permissions: fossildb Directory Setup**  
The commands create directories with `chmod -R "0777"`, which is overly permissive. It is advisable to create the directories with more restrictive permissions (for example, `0755`) and assign proper ownership using `chown`. For example:  
```diff
- mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
- mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+ mkdir -p fossildb/data fossildb/backup
+ sudo chown -R 999:999 fossildb/data fossildb/backup
+ sudo chmod -R "0755" fossildb/data fossildb/backup
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`80-90`: **Improve Shell Quoting in Custom Environment Variables**  
In the “Custom environment variables” step, the variable `${{ github.ref_name }}` is used without quotes. This might lead to word splitting or unexpected behavior. Consider wrapping interpolated variables in double quotes. For example:  
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
- echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+ echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "$GITHUB_ENV"
```

---

`228-236`: **Improve Docker Tag Command Quoting**  
In the Docker push step, the docker tag commands use variables without surrounding quotes, which may lead to issues if the variables contain spaces or special characters. Wrap these variables in double quotes to ensure safer command execution. For example:  
```diff
- docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknosos:${NORMALIZED_BRANCH}
+ docker tag "scalableminds/webknossos:${DOCKER_TAG}" "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 15626ceea352593863476bc9a78bcd996d8d79d8 and ec399cc9eb2b1429e8be16297124e94b31eac3f8.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-26T14:26:54Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 10**

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`3-16`: **CI Triggers and Debug Input Initialization:**  
The workflow now triggers on pushes to the master branch, pull requests from any branch, and includes a `workflow_dispatch` input (`debug_enabled`) for on‑demand debugging. This is a good move toward GitHub Actions integration. However, consider adding explicit permissions (for example, a `permissions` field) to restrict who can trigger debug sessions to further secure the workflow.

---

`80-90`: **Enhance Shell Quoting in Environment Variable Setup:**  
In the "Custom environment variables" step, variable expansions such as `${{ github.ref_name }}` and `$GITHUB_ENV` are unquoted, which might lead to unexpected word splitting. Consider wrapping these in double quotes (e.g., `echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "$GITHUB_ENV"`) to ensure robust shell behavior.

---

`218-237`: **Enhance Docker Tagging Commands:**  
Within the Docker push steps, variable interpolations such as `${DOCKER_TAG}` and `${NORMALIZED_BRANCH}` are unquoted. Quoting these variables (e.g., `"${DOCKER_TAG}"`) can prevent potential word splitting issues.

---

`243-244`: **Clean Up Commented Code:**  
The Slack notification step is commented out. If it is no longer required, consider removing it to reduce clutter and improve maintainability.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between ec399cc9eb2b1429e8be16297124e94b31eac3f8 and dddf65d27cde9d27d88ec3fe15c84705153e4ea6.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: circleci_build
* GitHub Check: build_test_deploy

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-27T10:25:13Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 9**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`29-32`: _🛠️ Refactor suggestion_

**Upgrade Checkout Action Version**  
The checkout step uses `actions/checkout@v3`. Updating to `actions/checkout@v4` will provide improved performance, security, and bug fixes.  
```diff
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`80-90`: **Improve Shell Quoting for Environment Variable Setup**  
The custom environment variable script writes values to `$GITHUB_ENV` without proper quoting. This can lead to word splitting issues if branch names contain spaces or special characters. Wrap expansions in double quotes, for example:  
```diff
-   echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+   echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
```

---

`119-127`: **Uncomment Critical Database Validation Steps**  
The steps for asserting unique evolution numbers and checking that `schema.sql` matches evolutions are currently commented out. These checks are important for database schema integrity. Please either remove them if unneeded or uncomment and update the commands to ensure the database remains valid.

---

`175-177`: **Configure Debug Session Timeout for tmate**  
While providing an option for on‑demand debugging via tmate is useful, consider adding a timeout (using the action’s available options) to ensure debug sessions do not remain open indefinitely, reducing potential security risks.

---

`231-240`: **Ensure Correct Quoting in Docker Tag Commands**  
In the docker image push block, variable expansions in the docker tag commands are unquoted. This might lead to unpredictable behavior if variable values contain spaces or special characters. For example, update as follows:  
```diff
-              docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknosos:${NORMALIZED_BRANCH}
+              docker tag "scalableminds/webknosos:${DOCKER_TAG}" "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```
Apply similar quoting to the other tag and push commands in this block.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between dddf65d27cde9d27d88ec3fe15c84705153e4ea6 and eafae09e2d1177cb43c36a10d4c18cb92f6b9259.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-27T13:30:33Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (7)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (7)</summary><blockquote>

`18-24`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Avoid Running as Root in CI**  
The environment variable `USER_NAME` is set to `root`, which is a security risk. It is advisable to use a non‑root user (for example, `webknossos`) to minimize vulnerabilities.  
   
*Suggested diff:*  
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
```

---

`75-78`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Upgrade Checkout Action Version in Build Job**  
The checkout step in the `build_test_deploy` job also still uses the outdated `actions/checkout@v3`. Upgrading to version v4 will keep consistency across jobs and benefit from the latest improvements.  
   
*Suggested diff:*  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`208-218`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Secure Environment for End-to-End Tests**  
The end-to-end tests run with hardcoded credentials (e.g. `POSTGRES_PASSWORD: secret_password`). Update these to use secrets so that sensitive information is not exposed during test execution.  
   
*Suggested diff:*  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`164-167`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Secure Docker Build Environment Variables**  
The environment variables for the docker build (lines 164–167) again include hardcoded database credentials. These should be replaced with secure GitHub Secrets.  
   
*Suggested diff:*  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`129-139`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Secure SBT Build Environment Variables**  
The sbt build step for webknosos uses hardcoded database credentials (e.g. `POSTGRES_PASSWORD: secret_password`). This is a security risk. Replace these with references to GitHub Secrets to safeguard sensitive data.  
   
*Suggested diff:*  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`179-188`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Fix Overly Permissive File Permissions for Data Directories**  
The steps that set up directories for `binaryData/Organization_X` and the `fossildb` folders use `sudo chmod -R "0777"`, which is insecure. It is recommended to create the directories, adjust ownership using `chown`, and apply more restrictive permissions (e.g. 0755).  
   
*Suggested diff for fossildb directories:*  
```diff
-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```

---

`29-32`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Upgrade Checkout Action Version in Frontend Checks**  
The `actions/checkout@v3` action is used here. According to static analysis, this version is outdated. Upgrading to `actions/checkout@v4` is recommended for improved performance and security.  
   
*Suggested diff:*  
```diff
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`3-17`: **Workflow Trigger Enhancements and Debug Input**  
The updated triggers now cover pushes to the master branch, all pull requests, and an optional debug mode via workflow_dispatch. This improves flexibility but also raises security concerns: allowing on‑demand tmate debugging can expose sensitive data. Consider adding a restrictive `permissions` field (or additional conditions) to limit who can trigger debug sessions.

---

`80-90`: **Improve Shell Quoting in Branch Normalization**  
The custom environment variable block sets `NORMALIZED_BRANCH` and `DOCKER_TAG` without proper quoting. This could lead to word splitting or globbing issues. It’s best to wrap variable references and file paths in quotes.  
   
*Suggested diff:*  
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
-            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
-            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
-            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=${DOCKER_TAG}" >> "${GITHUB_ENV}"
```

---

`110-112`: **Optimize OS Dependency Installation**  
The OS dependency installation step installs libraries without the `--no-install-recommends` flag. To reduce image size and avoid unnecessary packages, consider adding this flag.  
  
*Example diff:*  
```diff
-        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libdraco-dev libblosc-dev
```

---

`113-127`: **Cleanup Commented-Out Database Validation Steps**  
There are several commented-out steps (lines 113–127) for dependency preparation and database schema validations. If these steps are no longer needed, it’s best to remove them for clarity. Otherwise, consider uncommenting and updating them to ensure critical database validations are enforced in CI.

---

`222-240`: **Ensure Proper Quoting in Docker Tag and Push Commands**  
The docker push sequence uses variable interpolations (e.g., in `docker tag scalableminds/webknosos:${DOCKER_TAG}`) without quoting. This can lead to word splitting issues if variables contain unexpected characters. Please wrap variable expansions in double quotes throughout this block.  
   
*Suggested diff snippet:*  
```diff
-              docker tag scalableminds/webknosos:${DOCKER_TAG} scalableminds/webknosos:${NORMALIZED_BRANCH}
+              docker tag "scalableminds/webknosos:${DOCKER_TAG}" "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```
Apply similar quoting for the other docker tag and push commands.

---

`247-249`: **Remove Unused Slack Notification Step**  
The Slack notification step is commented out. If it’s no longer needed, removing it would clean up the workflow file. Otherwise, consider updating and enabling it using secure tokens and best practices for notifications.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between eafae09e2d1177cb43c36a10d4c18cb92f6b9259 and 4fbf0d28c1233660531f830e00efcb289f6beed2.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

157-157: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: circleci_build
* GitHub Check: build_test_deploy

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-27T13:46:25Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>♻️ Duplicate comments (7)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (7)</summary><blockquote>

`29-32`: _⚠️ Potential issue_

**Update Checkout Action Version (Static Frontend Job)**  
The checkout step uses `actions/checkout@v3`, which is flagged as outdated. Upgrading to `actions/checkout@v4` provides improved performance, security, and compatibility with newer GitHub Actions features.  
```diff
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`171-173`: _⚠️ Potential issue_

**Secure SBT Build Credentials**  
The SBT build step for webknosos uses hardcoded database credentials. Replace these with secure references from GitHub Secrets to prevent exposing sensitive information.  
```diff
-          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknosos
-          POSTGRES_USER: webknosos_user
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`221-222`: _⚠️ Potential issue_

**Restrict Fossildb Directory Permissions**  
The commands for setting up the `fossildb` directories use overly permissive permissions (`chmod -R "0777"`). It is advisable to create the directories, adjust ownership using `chown`, and apply more restrictive permissions (e.g. `0755`):  
```diff
-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```

---

`278-279`: _⚠️ Potential issue_

**Avoid Silencing Coverage Failures**  
Appending `|| true` to the coverage command may hide failures or drops in test coverage. It’s better to fail the step if coverage does not meet expectations or to handle errors explicitly.  
```diff
-        run: .github/not-on-master.sh yarn coverage || true
+        run: .github/not-on-master.sh yarn coverage
```

---

`18-23`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Avoid Running as Root**  
The environment sets `USER_NAME: root`, which poses a security risk during CI/CD execution. Consider using a non‑root user (for example, `webknossos`) to reduce potential vulnerabilities.  
```diff
-  USER_NAME: root
+  USER_NAME: webknosos
```

---

`88-89`: _⚠️ Potential issue_

**Update Checkout Action Version (Build Job)**  
Similarly, the build job also uses `actions/checkout@v3`. Please upgrade this step to `actions/checkout@v4`.  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

89-89: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`249-251`: _⚠️ Potential issue_

**Secure End-to-End Test Credentials**  
The end-to-end tests still use hardcoded credentials (e.g. `secret_password`). Replace these with GitHub Secrets to safeguard sensitive data. For example:  
```diff
-          POSTGRES_URL: jdbc:postgresql://localhost:5434/webknosos
-          POSTGRES_USER: webknosos_user
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_URL: ${{ secrets.E2E_POSTGRES_URL }}
+          POSTGRES_USER: ${{ secrets.E2E_POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ secrets.E2E_POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`3-17`: **Enhance Workflow Trigger Security**  
The workflow now supports `push`, `pull_request`, and `workflow_dispatch` (with a `debug_enabled` input). It is recommended to add explicit permission restrictions (via a `permissions` field or similar mechanism) for the `workflow_dispatch` trigger—especially for debug sessions—to mitigate potential unauthorized or inadvertent access.

---

`93-103`: **Improve Shell Quoting in Custom Environment Variables**  
The custom environment variables block uses unquoted substitutions, which can lead to word splitting or globbing issues. It is recommended to wrap `${{ github.ref_name }}` and `$GITHUB_ENV` in quotes. For example:  
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
-            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
-            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
-            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "$GITHUB_ENV"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=${DOCKER_TAG}" >> "$GITHUB_ENV"
```

---

`191-191`: **Upgrade Docker Setup Buildx Action Version**  
The job uses `docker/setup-buildx-action@v2`, which is considered outdated. Upgrading to a more recent version (e.g. v3) can improve stability and compatibility.  
```diff
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

191-191: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`257-275`: **Quote Variables in Docker Push Steps**  
In the Docker push block, variables in commands (such as in docker tagging) should be wrapped in double quotes to prevent word splitting or globbing issues. For instance:  
```diff
-              docker tag scalableminds/webknosos:${DOCKER_TAG} scalableminds/webknosos:${NORMALIZED_BRANCH}
+              docker tag "scalableminds/webknosos:${DOCKER_TAG}" "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```  
Apply similar quoting for the remaining docker commands in this block.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 4fbf0d28c1233660531f830e00efcb289f6beed2 and 48d4736c202de1c63b5f1521c50b726128f24d57.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

89-89: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

191-191: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T10:07:52Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 10**

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`93-103`: **Improve Shell Quoting in Environment Variable Setup**  
In the custom environment variable block, the command that creates `NORMALIZED_BRANCH` does not quote `${{ github.ref_name }}`. This could lead to word splitting issues. For example, modify:  
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```  
Also, ensure that `$GITHUB_ENV` is quoted when appending variables.

---

`267-274`: **Improve Docker Tag Command Quoting**  
In the Docker image push commands, variables such as `${DOCKER_TAG}` and `${NORMALIZED_BRANCH}` should be enclosed in double quotes to prevent issues caused by word splitting. For example, update:  
```diff
- docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknosos:${NORMALIZED_BRANCH}
+ docker tag "scalableminds/webknosos:${DOCKER_TAG}" "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```  
Apply similar quoting to the subsequent docker tag and push commands in this block.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 48d4736c202de1c63b5f1521c50b726128f24d57 and 7cd2c6a19b622999629771659a5d60efd94d70b4.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

89-89: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

191-191: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: build_test_deploy

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T11:31:05Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 12**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`29-32`: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Action Update: Upgrade Checkout Action Version**  
The checkout step in the `static_frontend_code_checks` job uses `actions/checkout@v3`. To benefit from improved performance and security fixes, please upgrade this action to `actions/checkout@v4`.

---



</details>

**Upgrade Checkout Action Version**

The checkout step in the `static_frontend_code_checks` job currently uses `actions/checkout@v3` in the file `.github/workflows/build_test_deploy.yml` (lines 29–32). To leverage the improved performance and security enhancements available in version 4, please update this usage accordingly. For example:

```diff
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 5
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`81-91`: **Nitpick: Enhance Shell Quoting in Environment Variable Script**  
The custom environment variables script does not quote variables such as `${{ github.ref_name }}` and the `$GITHUB_ENV` file path. To prevent potential word splitting or globbing issues, add proper quoting (for example, `"${{ github.ref_name }}"` and quoting `$GITHUB_ENV`).

---

`242-251`: **Improvement: Docker Tag Command Quoting**  
In the Docker image push command block, the `docker tag` commands lack proper quoting for variables (e.g., `${DOCKER_TAG}` and `${NORMALIZED_BRANCH}`). To prevent potential issues with word splitting or unexpected characters, wrap these interpolations in double quotes.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 7cd2c6a19b622999629771659a5d60efd94d70b4 and 6920603189c25370c60a04294bff50f680519f50.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

77-77: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

168-168: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T11:56:25Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 11**

<details>
<summary>♻️ Duplicate comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`138-148`: _⚠️ Potential issue_

**Security Issue: Hardcoded SBT Build Credentials**  
The SBT build step defines environment variables (`POSTGRES_URL`, `POSTGRES_USER`, `POSTGRES_PASSWORD`) with hardcoded values. For security, these should be retrieved from GitHub Secrets. For example:  
```diff
- POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
- POSTGRES_USER: webknosos_user
- POSTGRES_PASSWORD: secret_password
+ POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+ POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+ POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`168-172`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Docker Image Build: Error Handling and Credential Security**  
- The docker pull command uses `|| true`, which may mask pull failures. Consider handling errors explicitly.  
- Furthermore, the environment variables (lines 173–175) again hardcode PostgreSQL credentials. These must be replaced with secure GitHub Secrets.  
A suggested diff for the pull command:  
```diff
- docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+ docker pull scalableminds/webknossos:"$NORMALIZED_BRANCH"
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`80-90`: **Quoting in Custom Environment Variables**  
Within the custom environment variables script, the GitHub context variable is used without quotes:  
```bash
NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
```  
It is advisable to quote the variable to avoid word splitting, for example:  
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```  
Also, consider quoting the file path when appending to `$GITHUB_ENV`.

---

`125-135`: **Commented Database Validation Steps**  
There are several commented-out steps related to database validation (e.g. asserting unique evolution numbers and schema-evolutions checks). If these validations are no longer needed, please remove the commented blocks to reduce clutter; otherwise, uncomment and update the steps to ensure they are maintained as part of the CI.

---

`241-250`: **Docker Tag and Push: Improve Quoting and Robustness**  
The docker tag commands lack proper quoting, which can lead to issues if variables contain spaces or other special characters. For example, change:  
```diff
- docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknosos:${NORMALIZED_BRANCH}
+ docker tag "scalableminds/webknossos:${DOCKER_TAG}" "scalableminds/webknossos:${NORMALIZED_BRANCH}"
```  
Apply similar quoting to the other docker commands within this block.

---

`256-258`: **Optional: Slack Notification Integration**  
The Slack notification step is currently commented out. If notifications are desired, consider enabling and configuring this step properly; otherwise, remove the commented block to keep the workflow clean.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 6920603189c25370c60a04294bff50f680519f50 and b51ceeca01492f22027e17b225233663f1dc40bc.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`4-7`: **Trigger Configuration Update**  
The `push` trigger is now limited to the `master` branch and the `pull_request` trigger covers all branches. This configuration appears to align with your CI strategy.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T12:04:13Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`67-69`: _🛠️ Refactor suggestion_

**Update Checkout Action in Build Job**  
Again, the build job uses `actions/checkout@v3` (line 67). Please update to `actions/checkout@v4` for consistency and improved security.  

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

67-67: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`134-136`: _🛠️ Refactor suggestion_

**Upgrade Checkout Action in Test-Backend Job**  
The `test-backend` job also uses `actions/checkout@v3`. Please update it to `actions/checkout@v4` to ensure consistency across jobs.  

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

134-134: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`164-166`: _🛠️ Refactor suggestion_

**Upgrade Checkout Action in Docker-Build-and-e2e-Tests Job**  
Similarly, in the `docker-build-and-e2e-tests` job, update the checkout action from v3 to v4 for consistency and to leverage the latest improvements.  

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

164-164: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`237-247`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Address Hardcoded Credentials in e2e Tests**  
Similar to the previous step, the "Run e2e tests" step hardcodes `POSTGRES_PASSWORD` as `secret_password`. This can lead to security vulnerabilities. Use a secret instead. Additionally, ensure that the database URL and credentials match those used by your Postgres service.  

```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`30-33`: _🛠️ Refactor suggestion_

**Upgrade Checkout Action Version**  
The `actions/checkout@v3` usage here is flagged as outdated by static analysis. Please update this to `actions/checkout@v4` to take advantage of new features and improvements.  

```diff
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

31-31: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`213-220`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Secure Startup of Docker Instance**  
The "Start Docker Instance" step uses a hardcoded `POSTGRES_PASSWORD: secret_password` and refers to the project as `"webknosos"`—note the spelling difference compared to other steps. Replace the hardcoded credential with a GitHub secret reference (e.g. `${{ secrets.POSTGRES_PASSWORD }}`) and verify the correct service name/project identifier is used consistently.  

```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

214-214: got unexpected character '"' while lexing expression, expecting 'a'..'z', 'A'..'Z', '_', '0'..'9', ''', '}', '(', ')', '[', ']', '.', '!', '<', '>', '=', '&', '|', '*', ',', ' '. do you mean string literals? only single quotes are available for string delimiter

(expression)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`75-84`: **Improve Custom Environment Variable Script**  
The custom environment variable setup correctly extracts and normalizes the branch name. For further robustness, consider quoting `${{ github.ref_name }}` in the `sed` command to avoid potential word splitting issues. This helps ensure reliability if branch names contain unexpected characters.

---

`182-186`: **Update Docker Actions Versions**  
The workflow currently uses `docker/setup-buildx-action@v2` and `docker/login-action@v3`. Consider upgrading these actions to their latest versions (for example, Buildx v3 if available) to improve performance and security.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

182-182: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>
<details>
<summary>.github/docker-compose.yml (1)</summary><blockquote>

`1-2`: **Optional: Specify Compose File Version**  
Consider adding a `version` key (e.g. `version: '3.8'`) at the top of the file. While recent Docker Compose specifications allow omitting the version, adding it can improve clarity and ensure compatibility with different Docker Compose versions.  
  
*Proposed change:*  
```diff
+version: '3.8'
 name: webknossos-ci
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between b51ceeca01492f22027e17b225233663f1dc40bc and 83e6348f9ecc9907aab257a2c25cdeffff6ecb93.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

31-31: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

67-67: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

119-119: "uses" is required to run action in step

(syntax-check)

---

132-132: got unexpected character '"' while lexing expression, expecting 'a'..'z', 'A'..'Z', '_', '0'..'9', ''', '}', '(', ')', '[', ']', '.', '!', '<', '>', '=', '&', '|', '*', ',', ' '. do you mean string literals? only single quotes are available for string delimiter

(expression)

---

134-134: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

164-164: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

182-182: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

214-214: got unexpected character '"' while lexing expression, expecting 'a'..'z', 'A'..'Z', '_', '0'..'9', ''', '}', '(', ')', '[', ']', '.', '!', '<', '>', '=', '&', '|', '*', ',', ' '. do you mean string literals? only single quotes are available for string delimiter

(expression)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (7)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`105-110`: **Verify Database Host Consistency in SBT Build**  
The "Build webknossos (sbt)" step sets `POSTGRES_URL` to `jdbc:postgresql://localhost:5432/webknosos`. Given that the Postgres service is defined with host `postgres`, please verify that this difference (localhost vs. postgres) is intended for your build context.

---

`219-220`: **Double-Check Service Identifier Consistency**  
There appears to be a minor inconsistency in naming: the Postgres service is defined as `postgres` in the service configuration, but later the connection string in e2e tests uses `localhost` or even `"webknosos"` elsewhere. Verify that these references are correct and intended, as inconsistent naming could prevent proper service communication.

</details>
<details>
<summary>.github/docker-compose.yml (5)</summary>

`4-29`: **Webknossos Service Configuration Looks Solid**  
The configuration for the `webknossos` service is well defined with proper image reference, port mapping, command arguments, volumes, environment variables, and dependency health checks. Just ensure that the environment variable `CERTIFICATE` is provided in the CI environment if it is expected to have a concrete value.

---

`30-47`: **Webknossos-Datastore Service Configuration Verified**  
The configuration for the `webknossos-datastore` service is clear with the correct image, port settings, volume mount, command configuration, and dependency on `redis`.

---

`48-66`: **Webknossos-Tracingstore Service Settings are Consistent**  
The `webknossos-tracingstore` service is correctly configured with appropriate command options and dependencies on `redis` and `fossildb`. All applied settings appear to cater to the service’s requirements.

---

`67-76`: **Fossildb Service Configuration is Clear and Robust**  
The configuration for the `fossildb` service properly sets the image, command, and volume mounts for persistent data. No issues noted.

---

`93-105`: **Redis Service Configuration Meets Expectations**  
The `redis` service is properly configured with an image, command, and a detailed healthcheck using a TCP connection test.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T14:35:26Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 5**

<details>
<summary>♻️ Duplicate comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`67-69`: _🛠️ Refactor suggestion_

**Outdated Checkout Action in Build Job**  
The build job also uses `actions/checkout@v3` (line 67). Please update this to `actions/checkout@v4` for consistency and to align with the latest recommendations.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

67-67: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`30-32`: _💡 Verification agent_

_🛠️ Refactor suggestion_

<details>
<summary>🧩 Analysis chain</summary>

**Outdated Checkout Action Version in Frontend Job**  
The static frontend job uses `actions/checkout@v3` (line 31). Since static analysis and best practices now recommend using a newer version, please upgrade to `actions/checkout@v4` for enhanced performance, security, and features.

---

Below is a shell script to verify which version of the checkout action is used in the GitHub workflows. This script searches for any usage of the checkout action in files within the `.github/workflows` directory:



Once you run this script, if it confirms that `.github/workflows/build_test_deploy.yml` still uses `actions/checkout@v3`, then the review comment is valid and the recommendation remains to upgrade to version v4.

---

**Update Checkout Action to v4**  
Based on the verification, the checkout step in the static frontend job currently uses `actions/checkout@v3`. For improved performance, security, and feature support, please update it as follows:

- **File:** `.github/workflows/build_test_deploy.yml` (specifically, lines 30–32)
- **Required change:**
  ```diff
      - name: Checkout code
  -   uses: actions/checkout@v3
  +   uses: actions/checkout@v4
      with:
  ```

---

🏁 Script executed:

```shell

#!/bin/bash
echo "Searching for checkout action version references..."
rg "actions/checkout@" .github/workflows/
```

Length of output: 848

---



</details>

**Upgrade Checkout Action to v4**

The static frontend job in `.github/workflows/build_test_deploy.yml` still uses `actions/checkout@v3` (as confirmed by the script output). To align with current best practices for improved performance, security, and feature enhancements, please update it to use `actions/checkout@v4`.

- **Affected File:** `.github/workflows/build_test_deploy.yml` (lines 30–32)
- **Required Change:**
  ```diff
      - name: Checkout code
  -   uses: actions/checkout@v3
  +   uses: actions/checkout@v4
      with:
  ```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

31-31: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`3-17`: **Workflow Triggers & Debug Input Configuration**  
The triggers for push (on branch `master`), pull_request (on all branches), and workflow_dispatch (with a `debug_enabled` input) are clearly defined, which is great for flexibility. However, enabling debug sessions via `workflow_dispatch` without explicit permission restrictions can be a security risk. Consider adding a top‑level `permissions` field to restrict debug operations and prevent inadvertent exposure of sensitive information.

---

`73-80`: **Quoting in Custom Environment Variables Setup**  
Within the custom environment variables step, line 77 uses:  
```bash
NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
```  
To prevent word splitting or globbing issues, please wrap `${{ github.ref_name }}` in double quotes as in:  
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```  
This ensures reliable substitution and handling of branch names containing special characters.

---

`182-182`: **Upgrade Docker Setup Buildx Action Version**  
The workflow currently uses `docker/setup-buildx-action@v2` (line 182). Consider upgrading to a more recent version (for example, v3) to benefit from performance improvements and new features.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

182-182: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`249-456`: **Commented-Out Legacy Code Cleanup**  
The later portion of the file (lines 249–456) consists of commented-out sections from previous configurations. If these sections are no longer needed, consider cleaning them up to improve readability and maintainability. If they are kept for reference, add comments clarifying their purpose.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 83e6348f9ecc9907aab257a2c25cdeffff6ecb93 and 252c647021b6925d8a205a2271dd83574b778777.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

31-31: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

67-67: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

119-119: "uses" is required to run action in step

(syntax-check)

---

132-132: got unexpected character '"' while lexing expression, expecting 'a'..'z', 'A'..'Z', '_', '0'..'9', ''', '}', '(', ')', '[', ']', '.', '!', '<', '>', '=', '&', '|', '*', ',', ' '. do you mean string literals? only single quotes are available for string delimiter

(expression)

---

134-134: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

164-164: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

182-182: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

214-214: got unexpected character '"' while lexing expression, expecting 'a'..'z', 'A'..'Z', '_', '0'..'9', ''', '}', '(', ')', '[', ']', '.', '!', '<', '>', '=', '&', '|', '*', ',', ' '. do you mean string literals? only single quotes are available for string delimiter

(expression)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`111-114`: **PostgreSQL Hostname Consistency Check**  
There is an inconsistency between the PostgreSQL service (using the host `postgres` in its URL on line 52) and the build step’s environment variables (using `localhost` on line 112). Please verify whether this discrepancy is intentional. If not, adjust the hostname to ensure consistency across services.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T14:50:05Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 5**

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`76-84`: **Custom Environment Variables – Quote Expansions**  
The script in the “Custom environment variables” step builds `NORMALIZED_BRANCH` using a command like:  
```bash
NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
```  
For robustness against potential word splitting or globbing issues, consider quoting the variable expansion (e.g., `echo "${{ github.ref_name }}" | sed ...`).

---

`182-182`: **Update Setup-Buildx Action Version**  
The workflow uses `docker/setup-buildx-action@v2` (line 182). Static analysis recommends updating this action to a more recent version, if available, to take advantage of performance improvements and bug fixes.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

182-182: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 252c647021b6925d8a205a2271dd83574b778777 and 387016a5bbdc073a021335b8d2f62e56f1dbe719.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

31-31: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

67-67: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

134-134: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

164-164: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

182-182: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary>

`30-33`: **Upgrade Checkout Action Version**  
The static frontend job uses `actions/checkout@v3`, which is flagged as outdated by static analysis. Upgrading to `actions/checkout@v4` will ensure you benefit from the latest features and security improvements.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

31-31: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`134-136`: **Update Checkout Action in Test-Backend Job**  
The test-backend job again uses `actions/checkout@v3`. To maintain consistency and leverage updated functionality and security fixes, please upgrade this step to `actions/checkout@v4`.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

134-134: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`164-166`: **Upgrade Checkout Action in Docker E2E Tests Job**  
The docker-build-and-e2e-tests job still uses `actions/checkout@v3`. It’s advisable to update this to `actions/checkout@v4` to keep the workflow consistent and secure.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

164-164: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T15:02:04Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>♻️ Duplicate comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`218-220`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Issue: Hardcoded POSTGRES_PASSWORD in Docker Instance Start**

In the "Start Docker Instance" step, the environment still sets `POSTGRES_PASSWORD` to the literal value `secret_password`. For security purposes, replace this hardcoded value with a GitHub secret reference.

```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`19-24`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Issue: Insecure Environment Configuration**

The environment block sets `USER_NAME` to `root` and hardcodes `POSTGRES_PASSWORD` as `"secret_password"`. Running jobs as the root user and exposing plaintext credentials pose serious security risks. Please change `USER_NAME` to a non‑root user (for example, `webknossos`) and replace the hardcoded password with a GitHub secret reference.

```diff
-  USER_NAME: root
+  USER_NAME: webknossos

-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`67-69`: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Update Checkout Action in Build Job**

This step also uses `actions/checkout@v3`. Please update it to `actions/checkout@v4` for consistency and better security.

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

---

Below is a shell script to verify the usage of the checkout action in the workflow file:



Once executed, this script should confirm that the file still contains the following lines:

```
      - uses: actions/checkout@v3
        with:
          fetch-depth: 5
```

Based on that verification, here is the rewritten review comment:

**Action Required: Update Checkout Action Version in Workflow**

It looks like the workflow at `.github/workflows/build_test_deploy.yml` still uses `actions/checkout@v3` (lines 67–69). For consistency and better security, please update this step to `actions/checkout@v4`.

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

---

🏁 Script executed:

```shell

#!/bin/bash
rg "actions/checkout@v3" .github/workflows/build_test_deploy.yml
```

Length of output: 357

---



</details>

**Action Required: Update Checkout Action Versions in Workflow**

We verified that multiple instances of `actions/checkout@v3` are present in the `.github/workflows/build_test_deploy.yml` file (including active steps on lines similar to 67–69). For better security and consistency, please update all active occurrences of this checkout action to `actions/checkout@v4`.

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

- Confirm that all active (uncommented) usages of the checkout action are updated.
- Review any commented instances to ensure they do not reintroduce the older version if reactivated.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

67-67: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`74-84`: **Improve Variable Quoting in Custom Environment Configuration**

In the custom environment setup, the branch name is processed without quotes. To prevent any potential word splitting or globbing issues, consider quoting `${{ github.ref_name }}` in the `sed` command.

```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`182-182`: **Action Update: Upgrade Docker Setup Buildx Action**

The workflow currently uses `docker/setup-buildx-action@v2`, which has been flagged as out-of-date by static analysis. Upgrading to a more recent version (e.g. `@v3`) is recommended for improved performance and new features.

```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

182-182: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 387016a5bbdc073a021335b8d2f62e56f1dbe719 and 740044502be56819fed7f6acd3f3186186351b03.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

31-31: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

67-67: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

134-134: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

164-164: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

182-182: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: docker-build-and-e2e-tests
* GitHub Check: test-backend
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary>

`112-114`: **Review POSTGRES_URL Consistency**

In the webknossos (sbt) build step, the environment sets `POSTGRES_URL` as `jdbc:postgresql://localhost:5432/webknossos`. However, the PostgreSQL service is configured with `jdbc:postgresql://postgres/webknossos` (line 52). Please verify if this discrepancy is intentional; aligning the URLs may prevent connectivity issues.

---

`164-166`: <details>
<summary>✅ Verification successful</summary>

**Update Checkout Action in Docker Build & E2E Tests Job**

This step is also using the outdated `actions/checkout@v3`. Please change it to `actions/checkout@v4` to ensure consistency across the workflow.

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

---



</details>

**Checkout Action Version Update for Docker Build & E2E Tests Job**

The analysis confirms that the workflow file (.github/workflows/build_test_deploy.yml) still references the outdated checkout action (`actions/checkout@v3`). To keep the workflow consistent and leverage improvements in v4, please update the checkout step as follows:

- **File:** .github/workflows/build_test_deploy.yml  
- **Lines:** 164-166  
- **Change:**
  ```diff
  -      - uses: actions/checkout@v3
  +      - uses: actions/checkout@v4
  ```

This update ensures consistency across the workflow and adheres to the latest best practices.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

164-164: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`30-33`: <details>
<summary>✅ Verification successful</summary>

**Update Checkout Action Version**

The checkout step here uses `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will provide improved features and security enhancements.

```diff
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
```

---



</details>

**Update Checkout Action Version to v4**

In the file `.github/workflows/build_test_deploy.yml` (lines 30–33), the checkout step currently uses `actions/checkout@v3`. Since the latest version, `actions/checkout@v4`, offers improved features and enhanced security, please update it as follows:

```diff
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

31-31: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T15:10:20Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>♻️ Duplicate comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`82-83`: _🛠️ Refactor suggestion_

**Refactor: Update Checkout Action Version (Build Job)**  
Similarly, the build job’s checkout step at line 82 should be upgraded from `actions/checkout@v3` to `actions/checkout@v4`.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

82-82: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`45-48`: _🛠️ Refactor suggestion_

**Refactor: Update Checkout Action Version (Static Frontend Checks)**  
The checkout step uses `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will provide enhanced performance and security.  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`189-191`: _🛠️ Refactor suggestion_

**Refactor: Update Checkout Action Version (Docker Build & E2E Tests Job)**  
The checkout step in this job also uses `actions/checkout@v3`. Upgrade it to `actions/checkout@v4` to keep the workflow up-to-date.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

189-189: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`154-156`: _🛠️ Refactor suggestion_

**Refactor: Update Checkout Action Version (Test-backend Job)**  
The test-backend job is also using the outdated `actions/checkout@v3`. Please update it to `actions/checkout@v4` for consistency and improved security.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

154-154: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`242-249`: _⚠️ Potential issue_

**Security: Secure Docker Service Credentials**  
In the "Start Docker Instance" step, the `POSTGRES_PASSWORD` is still hardcoded as `secret_password`, which is insecure. Replace the hardcoded value with a reference to a GitHub Secret.  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`33-40`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security: Insecure Environment Variable Configuration**  
The environment block currently sets `USER_NAME: root` and hardcodes `POSTGRES_PASSWORD: "secret_password"`, which poses security risks. It is recommended to run the CI jobs as a non‑root user (e.g., `"webknossos"`) and to source sensitive credentials from GitHub Secrets.  
```diff
-  USER_NAME: root
-  POSTGRES_PASSWORD: "secret_password"
+  USER_NAME: webknossos
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`90-99`: **Nitpick: Quote Variables in Custom Environment Setup**  
In the custom environment variables step, the branch name is used without quotes. Quoting `${{ github.ref_name }}` will help avoid issues with word splitting and globbing.  
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`118-120`: **Security: Debug Session Setup**  
A tmate debugging session is conditionally enabled here. Since debug sessions can expose sensitive information, consider adding explicit permissions and timeout settings to restrict access during on‑demand debug runs.

---

`211-211`: **Good-to-Have: Upgrade Docker Buildx Action Version**  
The workflow uses `docker/setup-buildx-action@v2`. Consider upgrading to a more recent version (e.g., v3) if available, to benefit from the latest features and performance improvements.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

211-211: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 740044502be56819fed7f6acd3f3186186351b03 and e7fc3e2dd3ccaf08abecb0a342727fb8e4001254.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

82-82: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

154-154: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

189-189: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

211-211: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary>

`132-134`: **Verification: PostgreSQL Connection URL Consistency**  
The build job’s environment sets `POSTGRES_URL` as `jdbc:postgresql://localhost:5432/webknossos`, while the postgres service uses `jdbc:postgresql://postgres/webknosos`. Please verify whether this discrepancy is intentional. If you intend to use the container hostname, update the URL accordingly.  
```diff
-          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
```

---

`167-170`: **Security: Debug Session in Test-backend Job**  
The tmate session in the test-backend job is conditionally enabled. Ensure that appropriate restrictions (such as permissions or timeouts) are implemented to prevent unintended debug access.

---

`198-200`: **Security: Debug Session in Docker Build & E2E Tests Job**  
A tmate session is conditionally started in this job as well. As with other debug steps, verify that debugging is adequately secured with proper restrictions to avoid exposing sensitive data.

---

`242-249`: **Verification: PostgreSQL Host Consistency Check**  
There is a potential inconsistency between the database URL used in the build job and the one used during E2E tests. In the build job, you may consider using the container hostname (i.e. `postgres`) instead of `localhost` if the tests run inside the Docker network. Please verify and adjust accordingly.  



Also applies to: 278-280

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T15:24:05Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>♻️ Duplicate comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`307-312`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security: Secure End-to-End Test Credentials**  
The e2e test step continues to use a hardcoded `POSTGRES_PASSWORD: secret_password`. For enhanced security, update this to reference a GitHub secret instead.  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`211-213`: _⚠️ Potential issue_

**Upgrade Checkout Action in Docker Build Job**  
In the `docker-build-and-e2e-tests` job, the checkout step also uses `actions/checkout@v3`. Upgrade it to version 4 for improved security and reliability.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

211-211: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`231-231`: **Consider Updating Docker Setup Buildx Action**  
The workflow currently uses `docker/setup-buildx-action@v2`. Consider upgrading to a newer version (such as v3) to benefit from performance enhancements and additional features.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

231-231: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`143-153`: **Verify Database Connection URL Consistency**  
The "Build webknossos (sbt)" step sets the environment variable `POSTGRES_URL` to `jdbc:postgresql://localhost:5432/webknossos`, which differs from the Postgres service configuration (`jdbc:postgresql://postgres/webknossos`). Please verify that this discrepancy is intentional. Aligning these values may help avoid future connection issues.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between e7fc3e2dd3ccaf08abecb0a342727fb8e4001254 and 9863e91a29d078e6b1fb30464e624594d1957f9f.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

89-89: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

173-173: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

211-211: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

231-231: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`45-48`: **Upgrade Checkout Action Version**  
The checkout step here uses `actions/checkout@v3`, which is outdated and flagged by static analysis. Upgrading to `actions/checkout@v4` will improve both security and compatibility with the latest GitHub Actions features.  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`89-91`: **Upgrade Checkout Action in Build Job**  
The build job’s checkout step also relies on `actions/checkout@v3`. Please update this to `actions/checkout@v4` for consistency and improved performance.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

89-89: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T16:01:12Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`173-175`: _🛠️ Refactor suggestion_

**Update Checkout Action in Backend Tests**  
In the `test-backend` job, the checkout step at line 173 uses `actions/checkout@v3`.  
> **Action:** Upgrade to `actions/checkout@v4` for consistency, better performance, and security enhancements.
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

173-173: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`212-214`: _🛠️ Refactor suggestion_

**Update Checkout Action in Docker Build and E2E Tests**  
The `docker-build-and-e2e-tests` job also uses `actions/checkout@v3` (line 212).  
> **Action:** Update this step to use `actions/checkout@v4` to align with the latest best practices.
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

212-212: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`45-48`: _🛠️ Refactor suggestion_

**Update Checkout Action Version in Frontend Checks**  
The "static_frontend_code_checks" job uses `actions/checkout@v3` (line 46), which is flagged by static analysis as outdated.  
> **Recommended Change:** Upgrade to `actions/checkout@v4` to benefit from current security and performance improvements.
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security: Avoid Hardcoded Credentials and Running as Root**  
The global environment sets:  
- `USER_NAME: root`  
- `POSTGRES_PASSWORD: "secret_password"`  
These settings pose significant security risks.  
> **Recommended Change:**  
> - Change `USER_NAME` to a non-root user (e.g., `webknossos`).  
> - Replace the hardcoded `POSTGRES_PASSWORD` with a reference to a GitHub Secret (e.g., `${{ secrets.POSTGRES_PASSWORD }}`).  
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
…
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`311-313`: _⚠️ Potential issue_

**Security: Hardcoded Credentials in E2E Tests**  
The e2e test step sets the database password as a literal `"secret_password"` in its environment.  
> **Action Required:** Update the POSTGRES_PASSWORD in the e2e tests to reference a secure GitHub Secret.
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`4-31`: **Workflow Triggers and Debug Inputs Configuration**  
The new triggers for push (on master), pull_request (all branches), and the workflow_dispatch block with multiple debug-related inputs are well defined.  
> **Recommendation:** Ensure that any debug-related inputs (like `debug_enabled`, `tmate_debug_docker_build`, etc.) are secured by additional permission restrictions (for example by adding a `permissions` field) to prevent unauthorized or inadvertent debugging.

---

`96-107`: **Custom Environment Variables Setup**  
The custom configuration step computes `NORMALIZED_BRANCH` and `DOCKER_TAG`.  
> **Suggestion:** In line 100, the command  
> ```bash
> NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
> ```  
> could be made more robust by quoting the `${{ github.ref_name }}` variable to prevent word splitting. For example:  
> ```diff
> - NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
> + NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
> ```

---

`232-233`: **Update Docker Buildx Action Version**  
The workflow uses `docker/setup-buildx-action@v2` (line 232), which static analysis flags as outdated.  
> **Suggestion:** Consider upgrading to a newer version (e.g., `@v3`) for improved features and performance.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

232-232: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`136-138`: **Debug Session Security Consideration (tmate Sessions)**  
The workflow conditionally sets up tmate debugging sessions in several steps (e.g., lines 136–138 and later in other jobs).  
> **Suggestion:** Ensure that these debug sessions are secured by adding appropriate timeouts and restricting access. Consider incorporating explicit permissions or additional logging to monitor debug session access.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 9863e91a29d078e6b1fb30464e624594d1957f9f and ddb1c2d9538032259dcffc3e93496dc840723baf.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

89-89: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

173-173: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

212-212: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

232-232: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`1-322`: **Overall Feedback and Recommendations**  
The CI pipeline along with associated jobs has been significantly revamped to support GitHub Actions. Key highlights include:  
- Consolidation of triggers and the introduction of debug inputs.  
- Usage of caching (for node modules and sbt) and improved build steps across jobs.  
- Integration of Docker build and deployment steps with multi-tag support.

**Action Items:**  
- Upgrade all occurrences of `actions/checkout@v3` to `@v4`.  
- Replace hardcoded credentials (especially `POSTGRES_PASSWORD` and any similar sensitive values) with GitHub Secret references.  
- Revisit the discrepancy between database connection URLs (using `localhost` vs. `postgres`) to ensure intended connectivity.  
- Secure debugging sessions by adding proper access restrictions.  

Overall, the changes are moving in the right direction; please address the security concerns and version upgrades as suggested.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

89-89: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

173-173: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

212-212: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

232-232: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`143-153`: <details>
<summary>❓ Verification inconclusive</summary>

**SBT Build Step and Database Connection Discrepancy**  
The "Build webknossos (sbt)" step conditionally executes sbt commands. Note that the environment variables for this step are set as follows:  
- `POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos`  
- `POSTGRES_USER: webknossos_user`  
- `POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}`  
> **Observation:** The POSTGRES_URL here uses `localhost` while the PostgreSQL service is configured with the host `postgres` (line 74). Please verify that this discrepancy is intentional. Additionally, relying on the insecure global `POSTGRES_PASSWORD` remains a concern; switching this to a secret reference would improve security.

---



</details>

**SBT Build Step and Database Connection Discrepancy – Please Verify**

- In the build step (lines 143–153 of `.github/workflows/build_test_deploy.yml`), the `POSTGRES_URL` is set to use `localhost`, yet elsewhere (around line 74) the PostgreSQL service appears to be configured with the host `postgres`. Please confirm if this discrepancy is intentional—if not, update the URL to ensure connectivity aligns with the service configuration.
- The step currently relies on a globally defined `POSTGRES_PASSWORD` (via `${{ env.POSTGRES_PASSWORD }}`). For improved security, it’s recommended to reference a secret instead.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T16:10:38Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 8**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/docker-compose.yml (1)</summary><blockquote>

`78-83`: _⚠️ Potential issue_

**Postgres Service Environment Variable Typo**

There is a typo in the environment variable for the PostgreSQL user on line 82. The variable is currently spelled as `${POSTRGRES_USER}` which does not match the correctly spelled `${POSTGRES_USER}` used elsewhere (e.g., in the healthcheck command on line 89).  
Please update line 82 as follows:

```diff
-      - POSTGRES_USER=${POSTRGRES_USER}
+      - POSTGRES_USER=${POSTGRES_USER}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`99-107`: **Branch Normalization Script: Quote Variables**  
The branch normalization logic computes `NORMALIZED_BRANCH` using unquoted variable expansions (line 100). To avoid potential word splitting or globbing issues, consider quoting the variable (e.g. `"${{ github.ref_name }}"`).

---

`232-232`: **Update Docker Buildx Action Version**  
The workflow uses `docker/setup-buildx-action@v2` (line 232). It is recommended to upgrade to a newer version (e.g. v3) to ensure access to the latest features and fixes.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

232-232: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>
<details>
<summary>.github/docker-compose.yml (2)</summary><blockquote>

`3-30`: **WebKnossos Service Configuration**

The configuration for the main `webknossos` service is clear with proper image reference, port mapping, command arguments, volumes, and dependency conditions. One minor nitpick: the environment variable `CERTIFICATE` is listed without an explicit value. Ensure this is intentional and that the deployment environment injects the required value.

---

`49-67`: **WebKnossos-Tracingstore HTTP URI Verification**

The tracingstore service's configuration is largely consistent; however, note that the `-Dhttp.uri` parameter is set to `http://webknossos-datastore:9050`. Given that the datastore service is configured to expose port 9090, please verify that this is intentional. If tracingstore is expected to communicate with a service on a different port, clarifying inline or via documentation would help avoid confusion.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between ddb1c2d9538032259dcffc3e93496dc840723baf and bf61fe6d60778b5e3d5577a38980b0aac2bf93b4.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

89-89: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

173-173: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

212-212: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

232-232: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`3-32`: **Workflow Triggers and Inputs Configuration**  
The new trigger configuration for push, pull_request, and workflow_dispatch with multiple boolean inputs is well defined. This provides flexible control for debugging (with tmate) and branch handling.

---

`143-153`: <details>
<summary>❓ Verification inconclusive</summary>

**Database Connection URL Discrepancy and Credential Handling**  
In the "Build webknossos (sbt)" step, the environment sets `POSTGRES_URL` with `localhost` (line 151) while the Postgres service is configured with the host `postgres` (line 74). Please verify that this discrepancy is intentional. Also note that the build uses `${{ env.POSTGRES_PASSWORD }}` which still points to the insecure hardcoded value; updating this to use a secret is advised.

---



</details>

**Action Required: Verify Database Connection Settings and Credential Handling**

- In the "Build webknossos (sbt)" step (file: `.github/workflows/build_test_deploy.yml`, lines 143–153), the workflow sets `POSTGRES_URL` to `jdbc:postgresql://localhost:5432/webknossos` (line 151). However, elsewhere (line 74) the Postgres service appears to be configured with the host `postgres`. Please verify whether this apparent mismatch is intentional.
- Additionally, the build uses `${{ env.POSTGRES_PASSWORD }}`, which seems to refer to a non-secret value. It is recommended to update this to use secrets for improved security.

</details>
<details>
<summary>.github/docker-compose.yml (4)</summary>

`1-2`: **General File Metadata & Naming Check**

The file header and declared project name ("webknossos-ci") appear appropriate for this new Docker Compose configuration file.

---

`31-48`: **WebKnossos-Datastore Service Setup**

The datastore service is configured correctly with proper image tagging, port mapping, volume mount, command parameters, and a dependency on `redis`. No issues were detected here.

---

`68-77`: **Fossildb Service Configuration**

The FossilDB service is defined with an appropriate image, command line arguments, and volume configurations to manage persistent data and backups. Everything appears in order.

---

`94-107`: **Redis Service Healthcheck & Command**

The Redis service is configured with the correct image, command, and a robust healthcheck script that ensures its availability. No issues are observed in this section.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T08:10:17Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 5**

<details>
<summary>♻️ Duplicate comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Insecure Global Environment Variables**  
The global environment block sets `USER_NAME` to `root` and hardcodes `POSTGRES_PASSWORD` as `"secret_password"`. Running CI jobs as the root user can expose the system to unnecessary risks, and hardcoded credentials may lead to inadvertent exposure in logs.  
**Recommended changes:**  
- Set `USER_NAME` to a non‑root user (e.g. `webknossos`).  
- Replace the hardcoded `POSTGRES_PASSWORD` with a reference to a GitHub secret (for example, `${{ secrets.POSTGRES_PASSWORD }}`).  
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
…
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`166-168`: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Upgrade Checkout Action in Test-Backend Job**  
The checkout step in the `test-backend` job is still using `actions/checkout@v3`. For improved reliability and security, please update this to version v4.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

---

**Upgrade Checkout Action in Test-Backend Job**  
Our verification confirms that the `test-backend` job in `.github/workflows/build_test_deploy.yml` still uses `actions/checkout@v3`. For enhanced reliability and security, please update this to version v4 as shown below:
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

---

🏁 Script executed:

```shell

#!/bin/bash
# Search for the checkout step using v3 in the workflow file to validate the review comment.
rg "actions/checkout@v3" .github/workflows/build_test_deploy.yml
```

Length of output: 357

---



</details>

**Action Required: Upgrade Checkout Action in Test-Backend Job**

Our investigation confirms that the `test-backend` job in `.github/workflows/build_test_deploy.yml` still uses `actions/checkout@v3`. The script output shows several occurrences of this version in the file (with one line commented out), so please ensure that the checkout step in the `test-backend` job is updated to version v4 for improved reliability and security:

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

Additionally, please review the remaining instances of `actions/checkout@v3` to confirm whether they should also be updated or are intentionally left unchanged.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

166-166: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`96-107`: **Enhance Shell Command Quoting in Environment Configuration**  
Within the “Custom environment variables” step, the command that computes `NORMALIZED_BRANCH` is not quoting the input. This can lead to word splitting or globbing issues.  
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```
Consider applying similar quoting practices wherever user input is processed.

---

`1-3`: **Enhancement: Add Restrictive Permissions to Workflow Dispatch Trigger**  
The workflow now supports debugging via the `workflow_dispatch` trigger through inputs like `debug_enabled` and `tmate_debug_*`. For security reasons, consider adding a `permissions` field to restrict token scope (for example, restricting `id-token` and `contents`) so that debug sessions cannot be triggered inadvertently by unauthorized users.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between bf61fe6d60778b5e3d5577a38980b0aac2bf93b4 and aa482b218b3c99ca680a9737939d19704d0422af.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

89-89: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

166-166: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

197-197: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

217-217: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary>

`143-146`: **Verify Database Host Discrepancy in SBT Build Step**  
The “Build webknossos (sbt)” step sets the environment variable  
```yaml
POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
```  
while the PostgreSQL service is configured with  
```yaml
POSTGRES_URL: jdbc:postgresql://postgres/webknossos
```  
Please verify if this discrepancy is intentional. Consistency in the database host name is critical to avoid connection issues.

---

`45-48`: <details>
<summary>❓ Verification inconclusive</summary>

**Upgrade Checkout Action Version in Frontend Checks**  
The checkout step for the `static_frontend_code_checks` job is using `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will provide improved performance, security, and additional features.  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

---



</details>

**Action: Upgrade Checkout Action to v4 in Frontend Checks**

The static frontend code checks job in `.github/workflows/build_test_deploy.yml` (lines 45–48) is currently referencing `actions/checkout@v3`. Upgrading to `actions/checkout@v4` is recommended to take advantage of improved performance, enhanced security, and additional features. Please update the checkout step as follows and verify that this change does not impact any downstream caching or workflow behavior:

```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`217-217`: <details>
<summary>✅ Verification successful</summary>

**Update Buildx Action Version**  
The workflow uses `docker/setup-buildx-action@v2`, which is flagged as outdated. Upgrading to a newer version (for example, v3) can provide performance improvements and new features.  
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

---

I'm going to gather additional verification details before finalizing the rewritten review comment. To do this, I'll run the following commands:

**1. Verify the usage of the Buildx Action in the workflow file**




**2. Check the latest stable version of the Buildx Action and confirm if v3 is recommended over v2**




I'll evaluate the results of these queries to ensure that updating the action to v3 is appropriate before providing the final rewritten review comment.

---

🏁 Script executed:

```shell
#!/bin/bash
rg "docker/setup-buildx-action" .github/workflows/build_test_deploy.yml
```

Length of output: 160

---

🌐 Web query:

```web
What is the latest stable version for docker/setup-buildx-action on GitHub, and is version v3 recommended over v2 for performance improvements and new features?
```

💡 Result:

The latest stable version of `docker/setup-buildx-action` is **v3.10.0**, as indicated by its GitHub releases page[1]. This version includes updates like dependency bumps to `@docker/actions-toolkit` and other improvements.

**Version v3 is strongly recommended over v2** for several reasons:
- **New Features**:  
  - Support for latest BuildKit configurations like registry mirrors and max parallelism[3][9]  
  - Standalone mode execution without Docker CLI[3]  
  - Multi-platform image builds via QEMU integration[9]  
  - Pinning specific Buildx/BuildKit versions[3]
- **Performance Improvements**:  
  - Default use of `docker-container` driver for multi-arch builds[4][9]  
  - Enhanced caching mechanisms with `cache-binary` input[4]  
  - Optimized builder management with automatic cleanup[4]
- **Maintenance**:  
  - Active development with 10+ releases in the v3.x series since 2024[1][10]  
  - Official Docker documentation now references v3 usage[3][9]  
  - Security updates like dependency vulnerability fixes[1]

Key differences in configuration between versions:

| Feature               | v2                  | v3                  |
|-----------------------|---------------------|---------------------|
| BuildKit version      | Older defaults      | Pinnable to latest  |
| Platform support      | Limited             | Expanded via QEMU   |
| Security              | Basic               | Enhanced sandboxing |
| Cache handling        | Manual              | Automated cleanup   |

For new projects, use this boilerplate:
```yaml
- name: Set up Docker Buildx
  uses: docker/setup-buildx-action@v3
  with:
    version: v3.10.0  # Explicitly pin latest
    driver-opts: |
      image=moby/buildkit:v0.22.0
```

Older v2.x versions (last updated in 2024) lack support for modern BuildKit features and multi-arch build optimizations[5]. The v3 series has become the standard in GitHub Actions workflows, as shown in recent documentation[2][3][9] and community examples[2][5].

Citations:

- 1: https://github.com/docker/setup-buildx-action/releases
- 2: https://dev.to/pradumnasaraf/docker-buildx-gha-dockerhub-3h2c
- 3: https://docs.docker.com/build/ci/github-actions/configure-builder/
- 4: https://github.com/marketplace/actions/docker-setup-buildx
- 5: https://forums.docker.com/t/can-i-build-docker-image-legacy-on-github-actions/144141
- 6: https://docs.docker.com/desktop/release-notes/
- 7: https://github.com/docker/buildx/releases
- 8: https://community.fly.io/t/issue-with-docker-build-push-action-v2-fly-registry-and-caching/4932
- 9: https://docs.docker.com/build/ci/github-actions/multi-platform/
- 10: https://github.com/orgs/docker/packages/container/setup-buildx-action/versions

---



</details>

**Action Required: Upgrade to Docker Buildx Action v3**

I verified that the workflow currently references `docker/setup-buildx-action@v2` and that the latest stable version (v3.10.0) offers significant improvements such as enhanced BuildKit configurations, improved caching and performance, expanded multi-platform support, and additional security updates. Updating to v3 is strongly recommended.

Please update the affected line in `.github/workflows/build_test_deploy.yml` as shown below:

```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

217-217: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T08:31:16Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`173-175`: _🛠️ Refactor suggestion_

**Action Update: Upgrade Checkout Action in Test-Backend Job**  
The `test-backend` job checks out the code using `actions/checkout@v3` (line 173). For consistency and improved security, please update this to `actions/checkout@v4`.  

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

173-173: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`310-312`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Hardcoded POSTGRES_PASSWORD in E2E Tests**  
In the environment for the "Run e2e tests" step (lines 310–312), `POSTGRES_PASSWORD` is again hardcoded as `secret_password`. This should be replaced with a GitHub secret reference to protect sensitive credentials.  

```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`270-278`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Replace Hardcoded POSTGRES_PASSWORD in Docker Instance**  
In the "Start Docker Instance" step (lines 270–278), `POSTGRES_PASSWORD` is set to `secret_password` (line 277). Hardcoding credentials here is a security risk. Please replace it with a reference to a GitHub secret (e.g., `${{ secrets.POSTGRES_PASSWORD }}`).  

```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`45-48`: _🛠️ Refactor suggestion_

**Action Update: Upgrade Checkout Action**  
The checkout step in the `static_frontend_code_checks` job currently uses `actions/checkout@v3` (line 46). As this version is outdated and flagged by static analysis, please upgrade to `actions/checkout@v4` to benefit from the latest security improvements and features.  

```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`204-206`: _🛠️ Refactor suggestion_

**Action Update: Upgrade Checkout Action in Docker Build Job**  
In the `docker-build-and-e2e-tests` job, the checkout step (line 204) still uses `actions/checkout@v3`. Please upgrade this to `actions/checkout@v4` for consistency.  

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

204-204: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Avoid Running as Root and Hardcoded Credentials**  
The global environment block sets `USER_NAME: root` (line 34) and hardcodes `POSTGRES_PASSWORD` as `"secret_password"` (line 39). Running CI jobs as root can introduce security risks, and hardcoded credentials may inadvertently expose sensitive information.  
Consider updating `USER_NAME` to a non‑root user (e.g., `webknossos`) and replacing the hardcoded `POSTGRES_PASSWORD` with a reference to a GitHub secret, for example:  

```diff
-  USER_NAME: root
+  USER_NAME: webknossos
...
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`227-227`: **Action Update: Upgrade Docker Setup Buildx Action**  
The workflow uses `docker/setup-buildx-action@v2` (line 227), which is considered outdated by static analysis. Consider upgrading to a more recent version (e.g., v3) to take advantage of improved performance and features.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

227-227: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between aa482b218b3c99ca680a9737939d19704d0422af and ba2db9ce17f013f44247b32b56bd7a7c3438b593.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

93-93: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

173-173: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

204-204: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

227-227: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`100-112`: **LGTM: Custom Branch Normalization**  
The script for generating the normalized branch name and Docker tag is clear and correctly uses proper quoting with `$GITHUB_OUTPUT`. Just ensure that the branch naming convention meets the overall requirements of your deployment process.

---

`143-153`: **Configuration Discrepancy: PostgreSQL URL and Credential Handling**  
In the "Build webknossos (sbt)" step, the environment variable `POSTGRES_URL` is set to `jdbc:postgresql://localhost:5432/webknossos` (line 151) whereas the PostgreSQL service uses `jdbc:postgresql://postgres/webknossos` (line 78). Please verify that this discrepancy is intentional. Additionally, instead of using the hardcoded global `POSTGRES_PASSWORD` (inherited from line 39), it is more secure to reference a GitHub secret directly within this step.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T09:16:34Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>♻️ Duplicate comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`279-287`: _⚠️ Potential issue_

**Secure Docker Start Instance Configuration**  
In the "Start Docker Instance" step, the environment variable `POSTGRES_PASSWORD` is hardcoded as `secret_password`, which is insecure. Replace this with a GitHub Secret reference to ensure credentials are protected.  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical Security Update: Environment Variables**  
The global environment sets `USER_NAME: root` and hardcodes `POSTGRES_PASSWORD` as `"secret_password"`. Running CI jobs as the root user and exposing sensitive credentials in plaintext introduces significant risks. Update `USER_NAME` to a non‑root user (e.g., `webknossos`) and source `POSTGRES_PASSWORD` from GitHub Secrets.  
```diff
-  USER_NAME: root
+  USER_NAME: webknosos  # or "webknossos" (non-root)
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`312-321`: _⚠️ Potential issue_

**Secure E2E Test Credentials**  
The e2e tests step specifies `POSTGRES_PASSWORD` as `secret_password`. To secure your CI pipeline, replace this hardcoded value with one sourced from GitHub Secrets.  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`3-32`: **Enhance Debug Workflow Security and Triggers**  
The workflow triggers for `push`, `pull_request`, and especially the `workflow_dispatch` inputs (e.g. `debug_enabled`) are well defined. However, to protect against inadvertent or unauthorized debug sessions, consider adding an explicit `permissions` field (or another access control mechanism) to restrict who can trigger these debug options.

---

`102-104`: **Improve Shell Quoting for Environment Variables**  
In the "Custom environment variables" step, the branch name normalization uses an unquoted variable, which may lead to word-splitting issues. Quote the expansion for safety.  
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`236-236`: **Update Docker Buildx Action Version**  
The workflow currently references `docker/setup-buildx-action@v2` (line 236). Consider upgrading to a more recent version (e.g., v3) for improved performance and additional features.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

236-236: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>
<details>
<summary>.github/docker-compose.yml (2)</summary><blockquote>

`1-2`: **Docker Compose Metadata and Versioning**  
The file begins with a descriptive name ("webknossos-ci"). Consider whether you want to specify an explicit Docker Compose version (e.g. `version: "3.8"`) to ensure backward compatibility with older Docker Compose releases or to document that you’re using the latest Compose Specification.

---

`94-107`: **Redis Service – Healthcheck Shell Dependencies**  
The Redis service is well-configured overall, but the healthcheck command relies on Bash (lines 100–103). Verify that the `redis:5.0` image includes Bash. If Bash is not available, you might consider rewriting the healthcheck command to use a shell that’s guaranteed to exist (e.g., `/bin/sh`) or an alternative approach using `redis-cli`.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between ba2db9ce17f013f44247b32b56bd7a7c3438b593 and 8a8f1fb948dacb18a7fc5741e8b14cf291780542.

</details>

<details>
<summary>📒 Files selected for processing (3)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)
* `Dockerfile` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* Dockerfile

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

92-92: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

182-182: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

213-213: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

236-236: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (10)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary>

`45-48`: **Update Checkout Action Version**  
The `static_frontend_code_checks` job uses `actions/checkout@v3` (line 46). Upgrading to `actions/checkout@v4` will leverage better security, performance, and newer features.  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`92-94`: **Update Checkout Action in Build Job**  
The build job’s checkout step also relies on `actions/checkout@v3` (lines 92–94). Please update this to `actions/checkout@v4` to maintain consistency and improve security.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

92-92: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`182-184`: **Update Checkout Action in Test-Backend Job**  
The test-backend job uses `actions/checkout@v3` (line 182). Upgrading this step to `actions/checkout@v4` is recommended for consistency across the workflow.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

182-182: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`213-215`: **Upgrade Checkout Action in Docker Build and E2E Tests Job**  
The docker-build-and-e2e-tests job uses `actions/checkout@v3` (line 213). Please update this to `actions/checkout@v4` to adhere to current best practices.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

213-213: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`152-162`: **Verify Database Connection String Consistency**  
The sbt build step sets `POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos`, whereas the PostgreSQL service is defined with the image running under its service name. Please verify that using `localhost` here (instead of, for example, `postgres`) is intentional and works with your network configuration in GitHub Actions.

</details>
<details>
<summary>.github/docker-compose.yml (5)</summary>

`3-30`: **WebKnossos Service – JDBC URL Verification**  
The configuration for the `webknossos` service is complete and the dependency ordering is clear. However, note that the environment variable `POSTGRES_URL` is set as:  
```
POSTGRES_URL=jdbc:postgres://postgres/webknossos
```  
Typically, PostgreSQL JDBC URLs use the syntax `jdbc:postgresql://...`. Please verify that this format is intentional. If not, you might consider updating it as shown below:  

```diff
-      - POSTGRES_URL=jdbc:postgres://postgres/webknossos
+      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
```

---

`31-48`: **WebKnossos-Datastore Service Configuration**  
The `webknossos-datastore` service is clearly defined with appropriate port mappings, volume mounts, and command-line options for specifying memory settings and configuration files. No issues are evident in this segment.

---

`49-67`: **WebKnossos-Tracingstore Service – HTTP URI Check**  
The service configuration for `webknossos-tracingstore` is generally consistent; however, review the `-Dhttp.uri` parameter on line 58:  
```
- -Dhttp.uri=http://webknossos-datastore:9050
```  
It appears unexpected that the tracing store’s HTTP URI points to the datastore service. If this is a copy-paste error and it should refer to the tracing store service itself, consider revising it as follows:  

```diff
-      - -Dhttp.uri=http://webknossos-datastore:9050
+      - -Dhttp.uri=http://webknossos-tracingstore:9050
```  

Please verify the intended service discovery behavior.

---

`68-77`: **FossilDB Service Setup**  
The `fossildb` service is configured with the correct image, command parameters, and volume mounts. Make sure that the relative paths used for the volumes (`./fossildb/data` and `./fossildb/backup`) resolve correctly in your project’s directory structure.

---

`78-93`: **Postgres Service – Healthcheck and Environment**  
The Postgres service is defined with appropriate environment variables, volume mapping, and a healthcheck that uses `pg_isready`. Confirm that using the `${POSTGRES_USER}` substitution in the healthcheck command behaves as intended in your CI environment. Additionally, ensure that the chosen image tag (`postgres:17-bookworm`) is correct and supported by your setup.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T10:11:42Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`316-318`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Insecure Environment in E2E Tests**  
Within the "Run e2e tests" step, the environment block again hardcodes `POSTGRES_PASSWORD` as `"secret_password"`. This should be replaced by a secure GitHub secret reference to protect sensitive information.  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`179-181`: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Upgrade Checkout Action Version in Test-Backend Job**  
The checkout at line 179 again uses `actions/checkout@v3`. For uniformity and improved security, please update it to `actions/checkout@v4`.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

---



</details>

**Action Required: Upgrade Checkout Action Version in Test-Backend Job**

After verifying the relevant file, we confirmed that `.github/workflows/build_test_deploy.yml` currently uses `actions/checkout@v3` at lines 179–181. To maintain consistency across workflows and benefit from the latest security improvements, please update it to `actions/checkout@v4` as shown below:

- **File:** `.github/workflows/build_test_deploy.yml` (lines 179–181)
  ```diff
  -      - uses: actions/checkout@v3
  +      - uses: actions/checkout@v4
  ```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

179-179: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`95-97`: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Upgrade Checkout Action Version in Build Job**  
Similar to the static frontend job, the checkout step at line 95 uses `actions/checkout@v3`. Please update to version v4 for consistency and to benefit from the latest improvements.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

---

**Upgrade Checkout Action Version in Build Job**

We've verified that the file `.github/workflows/build_test_deploy.yml` still uses `actions/checkout@v3` at line 95. For consistency with the static frontend workflow and to take advantage of the latest improvements, please update the checkout action to version v4 as shown below:
  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

---

🏁 Script executed:

```shell
#!/bin/bash
# Verify the checkout action version used in the build workflow file.
echo "Scanning .github/workflows/build_test_deploy.yml for checkout action usage..."
grep "actions/checkout@" .github/workflows/build_test_deploy.yml || echo "No checkout action found."
```

Length of output: 400

---



</details>

**Upgrade Checkout Action Version in Build Job**

We've confirmed that `.github/workflows/build_test_deploy.yml` contains several instances of `actions/checkout@v3` (including active and commented lines). For consistency with the static frontend job and to take advantage of improvements in the latest release, please update all active checkout steps to use `actions/checkout@v4`. For example:

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

If the commented checkout line is still in use or might be reactivated, consider updating it as well.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Insecure Global Environment Configuration**  
The global environment variables currently set `USER_NAME: root` and hardcode `POSTGRES_PASSWORD` as `"secret_password"`. Running CI jobs as root and exposing plaintext credentials are critical security risks. It is recommended to use a non‑root user (for example, `webknossos`) and source sensitive credentials directly from GitHub Secrets.  
For example, update as follows:  
```diff
-  USER_NAME: root
+  USER_NAME: webknosos
...
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`10-31`: **Add Debug Inputs with Optional tmate Debugging**  
You’ve introduced several debug-related inputs (e.g. `tmate_debug_docker_build`, `tmate_debug_test_backend`, `tmate_debug_build`, `debug_enabled`) which are great for on‑demand troubleshooting. To further secure this functionality, consider adding an explicit `permissions` field or other access-control measures on the `workflow_dispatch` trigger so that debug sessions can only be initiated by authorized users.

---

`102-113`: **Custom Environment Variables – Branch and Tag Calculation**  
The custom environment variables logic for normalizing branch names and setting the Docker tag is well implemented. One minor suggestion is to ensure that any variable interpolations (e.g. `${{ github.ref_name }}`) remain safely quoted in shell commands. This will help prevent word-splitting or globbing issues.

---

`233-233`: **Upgrade Docker Setup Buildx Action**  
The action `docker/setup-buildx-action@v2` is used at line 233. Consider upgrading to a more recent version (if available) to take advantage of improvements and better integration with GitHub Actions.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

233-233: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 8a8f1fb948dacb18a7fc5741e8b14cf291780542 and 080f47c113aa89f091e9a9b9f7548ef8469c6330.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

179-179: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

210-210: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

233-233: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: test-backend
* GitHub Check: docker-build-and-e2e-tests
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary>

`91-94`: **Review Database URL Configuration Consistency**  
In the `build` job’s environment block, `POSTGRES_URL` is set to `jdbc:postgresql://localhost:5432/webknossos`. Note that the PostgreSQL service is defined to map port 5432 from the container. Please verify that connecting via `localhost` is intentional and consistent with how the service hostname is resolved inside your CI network.

---

`45-48`: <details>
<summary>✅ Verification successful</summary>

**Update Checkout Action Version in Static Frontend Checks**  
The step at line 45 is using `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will provide better performance, security, and bug fixes.  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

---



</details>

```web
Is GitHub Actions Checkout version 4 (actions/checkout@v4) stable and recommended for production workflows, and does it offer measurable performance, security, or bug fix improvements over version 3?
``` 

**Action Required: Upgrade Checkout Action Version**  
Please update the checkout step in `.github/workflows/build_test_deploy.yml` from `actions/checkout@v3` to `actions/checkout@v4` to leverage the latest performance and security improvements. Ensure that this update aligns with the most recent GitHub best practices.  
- **File:** `.github/workflows/build_test_deploy.yml`  
- **Diff Snippet:**  
  ```diff
  -        uses: actions/checkout@v3
  +        uses: actions/checkout@v4
  ```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`210-212`: <details>
<summary>✅ Verification successful</summary>

**Upgrade Checkout Action Version in Docker Build and E2E Tests Job**  
The checkout action used at line 210 is still at v3. Please update this step to `actions/checkout@v4` to resolve static analysis warnings and harness the newer action capabilities.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

---

Please run the above script to verify that the checkout action is currently set to `actions/checkout@v3`. Once confirmed, the review comment suggesting an upgrade to `actions/checkout@v4` is valid and should be implemented. 



---

🏁 Script executed:

```shell

#!/bin/bash
echo "Inspecting checkout action version in .github/workflows/build_test_deploy.yml..."
grep -n "actions/checkout@" .github/workflows/build_test_deploy.yml
```

Length of output: 549

---



</details>

**Action: Upgrade Checkout Action in Docker Build and E2E Tests Job**

The checkout step in the Docker Build and E2E Tests job (line 210) is still using `actions/checkout@v3`. Please update it to `actions/checkout@v4` to resolve static analysis warnings and leverage the newer capabilities. For clarity, see the suggested diff below:

```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

Additionally, please review the other occurrences of `actions/checkout@v3` (e.g., lines 46, 95, and 179) to confirm whether they should also be upgraded for consistency.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

210-210: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T11:36:55Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`95-97`: _🛠️ Refactor suggestion_

**Checkout Action Version in Build Job**  
Similar to the previous comment, the build job’s checkout step still uses `actions/checkout@v3`. Please update this to `actions/checkout@v4` for consistency across jobs.  

  
*Proposed diff:*
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`179-181`: _🛠️ Refactor suggestion_

**Checkout Action Version in Test-Backend Job**  
The test-backend job also uses the outdated checkout action (`actions/checkout@v3`). Upgrading this to version v4 will ensure better consistency and security throughout the workflow.  

  
*Proposed diff:*
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

179-179: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`213-215`: _🛠️ Refactor suggestion_

**Checkout Action Version in Docker Build and E2E Tests Job**  
Again, the docker-build-and-e2e-tests job is using `actions/checkout@v3`; please update it to `actions/checkout@v4` for uniformity and to benefit from the latest improvements.  

  
*Proposed diff:*
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

213-213: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`45-48`: _🛠️ Refactor suggestion_

**Checkout Action Version in Static Frontend Checks**  
The step using `actions/checkout@v3` is outdated. It is advisable to upgrade to `actions/checkout@v4` for improved performance, features, and security.  

  
*Proposed diff:*
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Global Environment Variables – Security Concerns**  
The environment block sets sensitive values:
- `USER_NAME` is set to `root`, which is not recommended from a security standpoint.  
- `POSTGRES_PASSWORD` is hardcoded as `"secret_password"`.  
**Action Required:**  
1. Change `USER_NAME` to a non‑root user (e.g. `"webknossos"`).  
2. Replace the hardcoded PostgreSQL password with a reference to a GitHub secret (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).  
These changes will help secure the CI environment and protect sensitive credentials.  

  
*Proposed diff:*
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
...
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (12)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`3-10`: **Workflow Triggers & Debug Inputs Configuration**  
The new workflow triggers for pushes, pull requests, and the addition of several optional inputs (e.g. `tmate_debug_docker_build`, `tmate_debug_test_backend`, `tmate_debug_build`, and `debug_enabled`) are well structured. These inputs will allow on‑demand debugging.  
**Recommendation:** Consider adding an explicit `permissions` field on the `workflow_dispatch` trigger to limit who can invoke debug sessions. This will enhance security by preventing unauthorized or accidental debugging.

---

`105-113`: **Custom Environment Variables – Shell Quoting**  
In the "Custom environment variables" step, the branch name is obtained using:  
```bash
NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
```  
For improved robustness against word splitting and globbing, consider quoting the interpolated variable.  

  
*Proposed diff:*
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`236-236`: **Update Docker Setup Buildx Action**  
The workflow uses `docker/setup-buildx-action@v2`, which static analysis flags as outdated. Consider updating this action to a newer version (if available, e.g. v3) to leverage improved performance and features.  

  
*Suggested improvement (verify the latest version):*
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

236-236: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>
<details>
<summary>webknossos-tracingstore/Dockerfile (1)</summary><blockquote>

`18-20`: **Broadening Execute Permissions**

The change from `chmod go+x bin/webknossos-tracingstore` to `chmod +x bin/webknosos-tracingstore` now grants execute permission to the owner, group, and others rather than only group and others. This adjustment makes the binary executable by all classes and appears intended to align with the changes made in related Dockerfiles.

</blockquote></details>
<details>
<summary>webknossos-datastore/Dockerfile (1)</summary><blockquote>

`17-19`: **Consistent Permission Update**

The update to use `chmod +x bin/webknosos-datastore` now uniformly grants execute permissions to all users, mirroring the approach taken in the tracing store Dockerfile. Verify that this broader permission aligns with your security policies and container runtime expectations.

</blockquote></details>
<details>
<summary>.github/docker-compose.yml (7)</summary><blockquote>

`1-2`: **Compose File Identification**

The file begins with a clear name (`webknosos-ci`) for the Docker Compose setup. Ensure that this name accurately represents the environment for local or CI integration testing and that all team members are aware of its purpose.

---

`3-29`: **Main Service Configuration – Webknosos**

The configuration for the `webknosos` service is well-defined with its image, ports, and command arguments. A couple of points to consider:
- Ensure that environment variables like `CERTIFICATE` and `POSTGRES_URL` are correctly populated at runtime.
- Confirm that the volume mapping (`./binaryData:/webknosos/binaryData`) meets your persistency requirements.

Overall, the settings appear appropriate for integration testing.

---

`30-47`: **Datastore Service Configuration**

The `webknosos-datastore` service is configured consistently. The command flag `-Dhttp.uri=http://webknosos-datastore:9090` suggests a self-referencing endpoint, which is standard practice. Just ensure that the volume mapping (`./binaryData:/webknosos-datastore/binaryData`) and memory settings work as expected across different environments.

---

`67-76`: **FossilDB Service Setup**

The FossilDB service is set up with a clear image reference, command, and volume mounts. Confirm that the command arguments (which list multiple configuration items) accurately reflect the operational needs of FossilDB and that the local directories (`./fossildb/data` and `./fossildb/backup`) are correctly mounted in your CI or local testing environment.

---

`77-92`: **Postgres Service Health and Environment**

The Postgres service configuration appears robust, with environment variables for database configuration and a healthcheck that uses `pg_isready`. Make sure that the secrets (`POSTGRES_USER` and `POSTGRES_PASSWORD`) are managed securely within GitHub Actions (for example, via encrypted secrets).

---

`93-105`: **Redis Service Configuration**

The Redis service is configured with a custom healthcheck. The command used for the healthcheck is a bit complex; consider verifying it yields consistent results in varied environments. If possible, testing under CI conditions could validate that the service reliably reports healthy status.

---

`1-106`: **Overall Docker Compose Configuration**

This newly added Docker Compose file comprehensively defines the multi-service environment for the `webknosos` application, including dependencies on Postgres, FossilDB, and Redis. Ensure that:
- All environment variables are correctly injected during runtime.
- Port mappings do not conflict with other services running on shared environments.
- The integration with GitHub Actions properly leverages this configuration for build and test jobs.

Review these aspects as you further integrate the configuration into your CI pipeline.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 080f47c113aa89f091e9a9b9f7548ef8469c6330 and d8b0db94c06aba14338a27965a7466dfca8e56f9.

</details>

<details>
<summary>📒 Files selected for processing (5)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)
* `Dockerfile` (1 hunks)
* `webknossos-datastore/Dockerfile` (1 hunks)
* `webknossos-tracingstore/Dockerfile` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* Dockerfile

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

179-179: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

213-213: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

236-236: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`92-94`: **Database URL Consistency Check**  
The build job sets the environment variable:  
```yaml
POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
```
Even though within the service configuration the PostgreSQL container is reachable via its exposed port, please verify that using `localhost` here is intentional. In some configurations, using the service name (e.g. `postgres`) might be preferred for internal networking consistency.

</details>
<details>
<summary>.github/docker-compose.yml (1)</summary>

`48-66`: <details>
<summary>❓ Verification inconclusive</summary>

**Tracingstore Service Endpoint Verification**

There is a potential misconfiguration in the tracing store’s command arguments. The flag:
```
-Dhttp.uri=http://webknosos-datastore:9050
```
appears to reference the datastore service rather than the tracing store itself. Verify if this is intentional (for example, if the tracing store needs to proxy or interact with the datastore) or if it should instead be:
```
-Dhttp.uri=http://webknosos-tracingstore:9050
```
to correctly reference its own network identity.

---

Below is a shell script you can run to verify the endpoint configuration in the docker-compose file. This script searches for the usage of the `-Dhttp.uri` flag and checks for both “datastore” and “tracingstore” references in the file. Running it will help confirm whether the tracing store’s command arguments are intentionally pointing to the datastore or if an update is required.

**Please run the script and review its output.**



After reviewing the script’s output, please verify whether the current configuration (i.e. `-Dhttp.uri=http://webknossos-datastore:9050`) is intentional or if it should be updated to reference the tracing store (for example, `http://webknossos-tracingstore:9050`).  


---

🏁 Script executed:

```shell

#!/bin/bash
# Check the -Dhttp.uri setting in the .github/docker-compose.yml file.
rg "-Dhttp.uri=" .github/docker-compose.yml

# Confirm if 'webknossos-datastore' is used elsewhere in the file.
rg "webknossos-datastore" .github/docker-compose.yml

# Also check for occurrences of the tracingstore service definition.
rg "webknossos-tracingstore" .github/docker-compose.yml
```

Length of output: 1011

---



</details>

**Tracingstore Service Endpoint Verification**

The command argument `-Dhttp.uri=http://webknosos-datastore:9050` in the tracingstore service appears inconsistent with the service names defined in the compose file. Notably, the datastore service is defined as `webknossos-datastore` (with an extra "s"), suggesting a potential typo or misconfiguration.

- **Verify whether:**  
  - The tracingstore service is intentionally configured to reference the datastore for certain operations, in which case the hostname should be corrected to match the datastore service name (i.e., `webknossos-datastore`), or  
  - It should reference its own service endpoint (i.e., `http://webknossos-tracingstore:9050`) if self-referencing is intended.

Please review the intended behavior and update the configuration accordingly.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T12:01:56Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 7**

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`105-107`: **Enhance Variable Quoting in Custom Environment Setup**  
Within the custom environment variables script in the build job, line 106 uses `echo ${{ github.ref_name }}` without enclosing it in quotes. To prevent potential word-splitting issues, please quote this variable (e.g. using `"${{ github.ref_name }}"`).  


_Proposed diff:_
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`237-237`: **Upgrade Docker Setup Buildx Action Version**  
The workflow uses `docker/setup-buildx-action@v2` (line 237) which is now considered outdated. Upgrading to a more recent version (for example, v3 if available) may bring performance and feature benefits.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

237-237: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>
<details>
<summary>.github/docker-compose.yml (3)</summary><blockquote>

`1-10`: **Docker Compose Configuration for Webknossos Service**  
The newly introduced `webknossos` service is well organized. The environment variables and dependency conditions (e.g. on `postgres`, `fossildb`, and `redis`) are clearly set up. In production, please ensure that sensitive information (such as `POSTGRES_USER` and `POSTGRES_PASSWORD`) is injected securely (for example via environment variables or secret management) rather than left for manual assignment.

---

`67-76`: **FossilDB Service Volumes and Permissions**  
The `fossildb` service mounts host directories for data and backup (lines 73–75). Verify that on the host system these directories are secured with proper permissions and ownership to prevent unauthorized access or data corruption.

---

`77-92`: **Postgres Service Environment Variables**  
The Postgres service (lines 77–92) relies on the external values for `${POSTGRES_USER}` and `${POSTGRES_PASSWORD}`. Ensure these values are supplied securely at runtime and that they are consistent with your overall security practices in production.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between d8b0db94c06aba14338a27965a7466dfca8e56f9 and d5f69dffade039131c6a2741dffd57f8faecd582.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

179-179: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

214-214: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

237-237: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T13:51:32Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`33-40`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Secure CI Environment Variables**

The environment block sets sensitive values in plaintext:
- `USER_NAME` is set to `root`, which poses risks when running processes with elevated privileges.
- `POSTGRES_PASSWORD` is hardcoded as `"secret_password"`, which could lead to accidental exposure.

It is recommended to run CI jobs as a non‑root user (for example, `webknossos`) and to source sensitive credentials from GitHub Secrets. For example:

```diff
-  USER_NAME: root
+  USER_NAME: webknossos
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`237-237`: **Update Docker Setup Buildx Action Version**

The job uses `docker/setup-buildx-action@v2` (line 237), which is now outdated. Consider upgrading to a later version (such as v3) to leverage new features and improve compatibility.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

237-237: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`102-114`: **Review Custom Environment Variables Script**

The custom script for calculating `normalized_branch` and `docker_tag` (lines 102–114) is functionally sound. As a nitpick, consider ensuring that variables like `${{ github.ref_name }}` are wrapped in quotes within shell expressions (e.g. in the `echo` commands) to avoid any potential word splitting issues if branch names contain spaces or special characters.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between d5f69dffade039131c6a2741dffd57f8faecd582 and b2bdc47f8e12b8d91ccbc23fd6369c45a873c6e7.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

179-179: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

214-214: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

237-237: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: test-backend
* GitHub Check: docker-build-and-e2e-tests
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`46-48`: **Upgrade GitHub Checkout Action Version**

Multiple jobs (in the static frontend, build, test-backend, and docker-build-and-e2e-tests sections) use `actions/checkout@v3`. Since version 3 is now outdated, please update these steps to use `actions/checkout@v4` to take advantage of performance improvements and enhanced security.

 


Also applies to: 95-97, 179-181, 214-216

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>
<details>
<summary>.github/docker-compose.yml (1)</summary>

`1-106`: **Docker-Compose Configuration Review**

The new Docker Compose file defines the multi-service architecture required for the `webknossos` application. It correctly sets up services for `webknossos`, `webknossos-datastore`, `webknossos-tracingstore`, `fossildb`, `postgres`, and `redis` complete with port mappings, health checks, and dependencies.

Minor suggestions:
- Verify that the placeholder environment variable references (e.g. `${POSTGRES_USER}` and `${POSTGRES_PASSWORD}`) are populated appropriately from your deployment environment or CI/CD secrets.
- Confirm that the relative volume paths (e.g. `../fossildb/data` and `../pg/db`) resolve correctly in your container environment.

Overall, the configuration is well structured and aligns with the new CI/CD improvements.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T15:00:18Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/docker-compose.yml (4)</summary><blockquote>

`1-2`: **Ensure Compose Spec Compatibility**

The file starts with a `name` field but does not specify a Compose file version. If you intend to use the new Compose specification (v2), this is acceptable. Otherwise, consider adding a version field (e.g. `version: "3.8"`) to ensure compatibility with environments that require it.

---

`3-29`: **Review of the webknossos Service Configuration**

The configuration for the `webknossos` service appears well structured. A couple of points to verify:  
- The volume path `../binaryData` is relative to the CI environment; please confirm that the repository structure guarantees the correct mount.  
- The environment variable `CERTIFICATE` is listed without a default value—ensure that it is intentionally passed from the CI environment.

---

`30-47`: **webknossos-datastore Service Review**

The `webknossos-datastore` service is configured correctly with explicit JVM memory settings and necessary volume mounts. For additional flexibility in different environments, consider making memory limits configurable via environment variables.

---

`93-106`: **Redis Service Configuration and Update Suggestion**

The Redis service is correctly set up with a healthcheck that leverages a Bash command to ensure availability. As a good-to-have, consider evaluating whether a more recent version of Redis might offer performance or security benefits.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between b2bdc47f8e12b8d91ccbc23fd6369c45a873c6e7 and b902f58685466b55aa18b523a21b22539ddcaf9c.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/docker-compose.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/docker-compose.yml (1)</summary>

`77-92`: **Postgres Service Configuration Looks Good**

The `postgres` service is configured with a modern image tag and robust healthcheck using `pg_isready`. Just ensure that using `127.0.0.1` within the container context is appropriate for your networking setup.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T15:46:32Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Issue: Insecure Global Environment Configuration**  
The global environment block currently sets:  
- `USER_NAME: root`  
- `POSTGRES_PASSWORD: "secret_password"` (a hardcoded credential)  
Running jobs as root and exposing plaintext passwords can lead to security vulnerabilities. Please change the user to a non‑root account (e.g. `webknossos`) and source the PostgreSQL password from GitHub Secrets (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).  
 
  
*Proposed diff:*
```diff
-  USER_NAME: root
-  POSTGRES_PASSWORD: "secret_password"
+  USER_NAME: webknossos
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`104-109`: **Reliability Improvement: Quote Variable Expansions in Shell Script**  
Within the "Custom environment variables" step (lines 104–109), the command  
```bash
NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
```  
can be more robust if the variable is quoted to prevent word splitting. Consider updating it as follows:
  
*Example diff:*
```diff
-          NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+          NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`333-532`: **Cleanup Suggestion: Remove Obsolete Commented-Out Code**  
There is a large block of commented-out configuration (lines 333–532) that appears to be legacy. If these lines are no longer necessary, deleting them can help reduce clutter and improve maintainability. Otherwise, please add a comment explaining why this code is retained for future reference.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between b902f58685466b55aa18b523a21b22539ddcaf9c and 2994f0d8cb51a77b5e9d191fbea024cddfcab82b.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

179-179: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

210-210: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

233-233: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

282-282: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`92-94`: **Verification Needed: Consistency of PostgreSQL Connection URL**  
The build job’s environment (lines 92–94) sets `POSTGRES_URL` to `jdbc:postgresql://localhost:5432/webknossos`. Verify that using `localhost` (instead of a service name like `postgres`) is intentional for your CI environment. Consistency in how the database is referenced across jobs is essential for reliability.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T08:02:10Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 6**

<details>
<summary>♻️ Duplicate comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`45-48`: _🛠️ Refactor suggestion_

**Action Needed: Update Checkout Action Version**  
The checkout step in the `static_frontend_code_checks` job uses `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will provide improved performance and enhanced security.  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`233-233`: _🛠️ Refactor suggestion_

**Action Needed: Upgrade Docker Setup Buildx Action**  
The workflow currently uses `docker/setup-buildx-action@v2`, which is flagged as outdated. Upgrading to version `v3` will likely provide performance improvements and enhanced capabilities.  
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

233-233: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical Security Issue: Environment Variables**  
The global environment block sets `USER_NAME` to `root` and hardcodes `POSTGRES_PASSWORD` as `"secret_password"`. Running jobs as the root user increases the attack surface, and hardcoded credentials can be inadvertently exposed in logs.  
Please update `USER_NAME` to a non‑root user (such as `webknossos`) and source the PostgreSQL password from GitHub Secrets. For example:  
```diff
-  USER_NAME: root
-  POSTGRES_PASSWORD: "secret_password"
+  USER_NAME: webknossos
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`102-113`: **Nitpick: Quote Variable in Sed Command**  
In the custom environment variables step, the branch name is processed with a `sed` command without quoting the variable. To prevent potential word splitting or globbing issues, consider quoting the input. For example:  
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`138-141`: **Security & Debug: Tmate Session in Build Job**  
The build job conditionally sets up a tmate session (line 138) for debugging if the `tmate_debug_build` input is true. Debug sessions can reveal sensitive information if left unsecured.  
Consider reinforcing this step with additional permission checks or a timeout to limit exposure.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 2994f0d8cb51a77b5e9d191fbea024cddfcab82b and 1ee2e863144f9dcd3b61d1baf14d03dd43564117.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

179-179: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

210-210: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

233-233: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

282-282: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`92-93`: **Verification: PostgreSQL URL Configuration**  
The build job sets `POSTGRES_URL` to `jdbc:postgresql://localhost:5432/webknossos`. Typically, within Docker-based services the hostname corresponding to the service (e.g. `postgres`) is used rather than `localhost`. Please verify that this configuration is intentional and works as expected in your Docker network.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T08:32:02Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 5**

<details>
<summary>♻️ Duplicate comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`45-48`: _🛠️ Refactor suggestion_

**Action Improvement: Upgrade Checkout Action Version**  
The checkout step in the `static_frontend_code_checks` job uses `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will improve performance and security.  


*Suggested diff:*
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical Security Concern: Insecure Global Environment Variables**  
The global environment sets `USER_NAME: root` and hardcodes `POSTGRES_PASSWORD` as `"secret_password"`. Running jobs as root increases risk, and hardcoded credentials can be exposed in logs. Please change `USER_NAME` to a non‑root user (e.g. `webknossos`) and replace the hardcoded `POSTGRES_PASSWORD` with a reference to a GitHub Secret (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).  


*Suggested diff:*
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`95-97`: _🛠️ Refactor suggestion_

**Action Improvement: Upgrade Checkout Action in Build Job**  
Similarly, the checkout step inside the `build` job still uses `actions/checkout@v3`. Please update it to `actions/checkout@v4` for consistency with current best practices.  


*Suggested diff:*
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`102-113`: **Code Quality: Quote Variable Expansions in Custom Env Setup**  
In the custom environment variables step, the branch name is interpolated without quotes (e.g. in line 106). To safeguard against word splitting or globbing issues, consider quoting the variable expansion.  


*Suggested diff:*
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 1ee2e863144f9dcd3b61d1baf14d03dd43564117 and 3774608eb8355ff423a9f1d8dbbe76516d5dc40e.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

171-171: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

181-181: property "build" is not defined in object type {}

(expression)

---

189-189: property "build" is not defined in object type {}

(expression)

---

197-197: property "build" is not defined in object type {}

(expression)

---

214-214: property "build" is not defined in object type {}

(expression)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T08:58:14Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 5**

<details>
<summary>♻️ Duplicate comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`45-48`: _🛠️ Refactor suggestion_

**General Recommendation: Update All Checkout Actions**  
Multiple jobs use `actions/checkout@v3` (e.g., lines 45–48 and 95–97). Upgrading all these steps to `actions/checkout@v4` will keep your workflow up-to-date with the latest security and performance improvements.  



Also applies to: 95-97

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`95-97`: _🛠️ Refactor suggestion_

**Update Checkout Action in Build Job**  
Similarly, the `build` job checks out the code with `actions/checkout@v3` (line 95). Please upgrade to version v4.  
_Example diff:_  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`45-48`: _🛠️ Refactor suggestion_

**Update Checkout Action in Frontend Job**  
The `static_frontend_code_checks` job uses `actions/checkout@v3`. It is recommended to update to `actions/checkout@v4` for better performance and security.  
_Example diff:_  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`171-171`: _🛠️ Refactor suggestion_

**Upgrade Docker Buildx Action Version**  
The Docker Buildx setup action is using version v2. For improved features and performance, consider upgrading to v3.  
_Example diff:_  
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

171-171: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`4-9`: **Review of Workflow Triggers**  
The push trigger restricts pushes to the “master” branch and the pull_request trigger applies to all branches (“*”). This setup seems intentional; please verify that using a single branch for pushes meets your team’s workflow requirements.

---

`104-113`: **Shell Command Quoting in “Custom Environment Variables” Step**  
In the “Custom environment variables” step, the command that normalizes the branch name could be made more robust by quoting the variable. For example, using:  
```bash
NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```  
This minimizes potential word-splitting issues.

---

`1-32`: **Additional Security Enhancement for Debug Sessions**  
While the debug inputs in the `workflow_dispatch` section are useful, no explicit permissions are specified at the workflow level. For enhanced security, consider adding a `permissions` field (e.g., restricting token scope to content read only) to limit who can trigger debug sessions.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 2315d8f52a0f4367cd151feeba9239640abd4031 and 147129f561824f126ebef1ffad4e3f214545fef3.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

171-171: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

214-214: property "build" is not defined in object type {}

(expression)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T09:27:57Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 6**

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`1-31`: **New Workflow Triggers and Debug Inputs**  
The workflow now triggers on pushes to the _master_ branch, pull requests for all branches, and supports on‑demand debugging via the workflow_dispatch input block (lines 10–31). This flexible design enables tmate debugging for various steps.

---

`102-113`: **Docker Tag & Branch Normalization Logic**  
The custom environment variables step (lines 102–113) normalizes the branch name and constructs the docker tag. The logic is correct; however, to avoid word splitting issues, consider quoting the `${{ github.ref_name }}` when passing it to `sed`.

---

`129-131`: **Conditional Debugging via tmate**  
The tmate session for debugging (lines 129–131) is conditionally enabled only when the appropriate debug input is true. This is a valuable addition for troubleshooting; however, consider enforcing additional access controls (e.g., using a `permissions` field on workflow_dispatch) to restrict who can trigger debug sessions.

---

`140-141`: **TODO: Build Documentation**  
A TODO comment for building documentation (line 140) indicates pending work. Please ensure that documentation builds are incorporated before final merge.

---

`177-184`: **Building the Webknossos Docker Image**  
The docker/build-push-action@v6 step (lines 177–184) builds and pushes the main webknosos image using tags from step outputs. To guard against potential issues with branch names (such as spaces or unexpected characters), consider additional sanitization if necessary.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 147129f561824f126ebef1ffad4e3f214545fef3 and 69b5e4a3f6e4a3da6df4897e900a092145ca01fa.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

171-171: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (18)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (18)</summary>

`54-61`: **Node Modules Caching Configuration**  
The caching step (lines 53–61) properly caches multiple `node_modules` directories based on a hash of `yarn.lock`. This setup appears appropriate.

---

`65-70`: **Frontend Code Checks**  
Linting, type checking, and cyclic dependency checks (lines 65–70) are implemented consistently. These steps ensure that code quality is maintained.

---

`88-94`: **Build Job Environment and Outputs**  
The _build_ job sets outputs (`normalized_branch` and `docker_tag`) based on the configure step (lines 89–90) and defines its own environment (lines 92–94). Also, the `POSTGRES_URL` is set to use `localhost` while the PostgreSQL service is defined under the service name; please verify that the intended DB host reference is correct.

---

`115-120`: **Java and SBT Setup**  
The steps setting up Java (lines 115–119) and configuring sbt (line 120) are correctly implemented using the latest actions.

---

`122-124`: **Installing Frontend Dependencies**  
The steps to run `corepack enable` and install dependencies (lines 122–124) using Yarn are straightforward and effective.

---

`126-128`: **OS Dependencies Installation**  
The command to install OS libraries (line 127–128) via apt-get is correctly implemented. Ensure that only necessary packages are installed to optimize build times.

---

`133-138`: **Database Schema Validations**  
The steps asserting unique evolution numbers and schema consistency (lines 133–138) help ensure database integrity. This addition strengthens the CI pipeline’s robustness.

---

`142-144`: **Webpack Build Step**  
The webpack build step (lines 142–144) is correctly configured to run `yarn build` for the web frontend.

---

`145-151`: **SBT Build for Webknossos**  
The sbt build step (lines 145–151) differentiates between the master branch and other branches to handle warnings appropriately. This conditional implementation is well executed.

---

`152-156`: **SBT Build for Additional Projects**  
Separate sbt build steps for _webknossos-datastore_ and _webknossos-tracingstore_ (lines 152–156) are defined, allowing independent compilation and staging of these components.

---

`157-163`: **Backend Code Linting and Tests**  
The linting (line 157–159) and backend test steps (lines 160–163) ensure that the backend code quality and functionality are verified.

---

`164-167`: **Application Directory Checksum**  
The checksum computation (lines 164–167) for application directories is a thoughtful addition for integrity verification.

---

`172-175`: **Docker Login Action**  
The docker login step (lines 172–175) uses `docker/login-action@v3` appropriately with secure credentials.

---

`185-192`: **Building the Datastore Docker Image**  
The docker build step for the datastore image (lines 185–192) aligns with the main image tagging scheme and is implemented correctly.

---

`193-199`: **Building the Tracingstore Docker Image**  
Similar to the previous docker build steps, the tracingstore image build (lines 193–199) is correctly set up with appropriate tagging.

---

`210-215`: **Starting the Docker Instance**  
The step to start the Docker instance (lines 210–215) uses the compose file with the project name "webknossos" and sets the `DOCKER_TAG` from the configure step output. The conditional execution (if not on master) is appropriate.

---

`216-227`: **Smoke Test Steps**  
Smoke tests for webknossos, its datastore, and tracingstore (lines 216–227) are executed using a custom URL health check action. The URLs appear to be correctly configured for local testing.

---

`229-232`: **End-to-End Tests Execution**  
The final step (lines 229–232) runs the e2e tests via a Yarn command. This is clear and consistent with the testing strategy.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T09:36:20Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`45-48`: _🛠️ Refactor suggestion_

**Update Checkout Action Version**  
In the `static_frontend_code_checks` job, the checkout step uses `actions/checkout@v3`, which is flagged as outdated by static analysis. Please upgrade to `actions/checkout@v4` to leverage improvements and better security.  
_Proposed diff:_  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`171-171`: _🛠️ Refactor suggestion_

**Update Docker BuildX Action Version**  
The workflow currently uses `docker/setup-buildx-action@v2` (line 171), which is outdated according to static analysis. Please upgrade to version v3 to benefit from improved features and performance.  
_Proposed diff:_  
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

171-171: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical Security: Avoid Running as Root and Exposing Hardcoded Credentials**  
The global environment block sets `USER_NAME: root` and hard‑codes `POSTGRES_PASSWORD: "secret_password"`. Running CI jobs as root and exposing sensitive credentials can lead to major security issues. Please update these values—for example, use a non‑root user like `webknossos` and source the database password from GitHub Secrets.  
_Proposed diff:_  
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`95-97`: _🛠️ Refactor suggestion_

**Update Checkout Action in Build Job**  
The checkout step in the `build` job still uses `actions/checkout@v3` (lines 95–97). For consistency and improved security, please upgrade this step to use `actions/checkout@v4`.  
_Proposed diff:_  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`102-113`: **Enhance Shell Safety in Environment Variable Setup**  
In the "Custom environment variables" step (lines 102–113), the script retrieves and processes `${{ github.ref_name }}` without quoting the expansion. To prevent potential word splitting or globbing issues, consider wrapping variable references in double quotes. For example:  
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`129-132`: **Review Tmate Session Setup and Debug Controls**  
The tmate session for debugging is conditionally enabled in the build job (lines 129–132), which is useful for troubleshooting. Keep in mind, however, that on‑demand debugging can expose sensitive runtime information. Please consider adding stricter permission restrictions or timeout settings to mitigate potential risks.  
 [security]

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 69b5e4a3f6e4a3da6df4897e900a092145ca01fa and 4a4677a02c281618365c42c3421c219c0ac72018.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

171-171: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

218-218: property "configure" is not defined in object type {}

(expression)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T09:47:48Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>♻️ Duplicate comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`171-171`: _🛠️ Refactor suggestion_

**Update Docker Buildx Action Version**  
The workflow uses `docker/setup-buildx-action@v2`, which is flagged as outdated by static analysis. Upgrading to version v3 is recommended to leverage improved functionality.  

_Proposed diff:_  
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

171-171: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`45-48`: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Upgrade Checkout Action Version in Frontend Checks**  
The `static_frontend_code_checks` job uses `actions/checkout@v3`, which is outdated. Upgrading to version v4 will improve performance and security.  

_Proposed diff:_  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

---



</details>

Based on the snippet provided, the workflow in the `static_frontend_code_checks` job is still using `actions/checkout@v3`, which means it isn’t taking advantage of the performance and security improvements in version v4. The review comment is correct in recommending the update. Here’s the revised review comment:

**Action Required: Upgrade Checkout Action in Frontend Checks**  
The `static_frontend_code_checks` job in `.github/workflows/build_test_deploy.yml` currently uses `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will offer improved performance and security.  
- **File:** `.github/workflows/build_test_deploy.yml` (Lines 45-48)  
- **Proposed diff:**
  ```diff
  -        uses: actions/checkout@v3
  +        uses: actions/checkout@v4
  ```

Please update the workflow file accordingly.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`75-80`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Secure PostgreSQL Service Credentials in Build Job**  
In the `build` job’s service definition for PostgreSQL, the password is taken from the global environment (`${{ env.POSTGRES_PASSWORD }}`). To avoid propagating insecure credentials, use a GitHub secret instead.  

_Proposed diff:_  
```diff
-          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Issue: Insecure Global Environment Variables**  
The environment block currently sets `USER_NAME: root` and hardcodes `POSTGRES_PASSWORD` as `"secret_password"`. Running CI jobs as root can introduce security risks, and hardcoded credentials may be accidentally exposed.  
  
**Recommendation:**  
- Change `USER_NAME` from `root` to a non‑root user (for example, `webknossos`).  
- Replace the hardcoded password with a GitHub secret reference (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).  

_Proposed diff:_  
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
…
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`105-113`: **Shell Quoting Improvement in Environment Setup**  
In the "Custom environment variables" step, the GitHub variable `${{ github.ref_name }}` is currently not quoted. This may lead to issues with word splitting if the branch name contains spaces or special characters.  

_Proposed diff (line 106):_  
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 4a4677a02c281618365c42c3421c219c0ac72018 and 3caacd64783d23a8b234c565e058b99be0815f6b.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

171-171: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`92-94`: **Verify Database Connection URL Consistency**  
In the `build` job’s environment, `POSTGRES_URL` is set to `jdbc:postgresql://localhost:5432/webknossos` while the PostgreSQL service is configured on port 5432 with hostname defined in its service block. Please verify that using `localhost` (instead of the service name, e.g. `postgres`) for the connection URL is intentional.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T09:57:26Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`33-39`: _⚠️ Potential issue_

**Security Improvement: Avoid Running as Root and Using Hardcoded Credentials**

The global environment block currently sets:
- `USER_NAME: root` which implies the jobs run as the root user, and
- `POSTGRES_PASSWORD: "secret_password"` as a hardcoded value.

Both practices expose security risks. It is recommended to run jobs as a non‑root user (e.g. `webknossos`) and to source sensitive credentials from GitHub Secrets.

*Proposed diff:*
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
…
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`95-97`: _🛠️ Refactor suggestion_

**Update Checkout Action Version in the Build Job**

The build job’s checkout step still uses `actions/checkout@v3`. Please upgrade this to `actions/checkout@v4` to ensure consistency and leverage recent improvements.

*Proposed diff:*
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`217-219`: _🛠️ Refactor suggestion_

**Update Checkout Action Version in e2e-Tests Job**

The e2e-tests job uses `actions/checkout@v3` (lines 217–219). Please upgrade this to `actions/checkout@v4`.

*Proposed diff:*
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

217-217: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`197-199`: _🛠️ Refactor suggestion_

**Update Checkout Action Version in Backend Test Job**

The backend-test job’s checkout step uses `actions/checkout@v3`. Upgrading to `actions/checkout@v4` is recommended for improved security and performance.

*Proposed diff:*
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

197-197: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`129-132`: **Secure Tmate Debug Session Setup**

The tmate session step is conditionally enabled for debugging purposes. Debug sessions can expose sensitive runtime details if not properly secured. Consider enhancing this step with additional safeguards (such as explicit timeouts or further restricting its activation) to mitigate potential risks.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 3caacd64783d23a8b234c565e058b99be0815f6b and 187e115aebd8117375a2d465a23266ff59471234.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

164-164: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

197-197: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

217-217: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T10:19:58Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>♻️ Duplicate comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`45-48`: _🛠️ Refactor suggestion_

**General Note on Checkout Action Versions**  
Multiple jobs in this workflow (static_frontend_code_checks, build, backend-test, and e2e-tests) are using `actions/checkout@v3` in various locations. For consistency and improved security, please update all instances of the checkout action to `actions/checkout@v4`.  
 


Also applies to: 95-97, 197-199, 224-224

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`95-97`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Upgrade Checkout Action in Build Job**  
The checkout step in the `build` job again uses `actions/checkout@v3`. Please update it to v4.  
> **Proposed Diff:**  
> ```diff
> -      - uses: actions/checkout@v3
> +      - uses: actions/checkout@v4
> ```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`45-48`: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Update Checkout Action Version in Frontend Checks Job**  
The checkout step in the `static_frontend_code_checks` job uses `actions/checkout@v3`, which is outdated. Please upgrade to version v4 to ensure you benefit from the latest security fixes and improvements.  
> **Proposed Diff:**  
> ```diff
> -        uses: actions/checkout@v3
> +        uses: actions/checkout@v4
> ```

---



</details>

**Action Required: Update Checkout Action Version in Frontend Checks Job**

The checkout step in the `static_frontend_code_checks` job currently uses `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will ensure that the latest security fixes and improvements are applied.

- **File:** `.github/workflows/build_test_deploy.yml` (Lines 45-48)
- **Proposed Diff:**
  ```diff
  -        uses: actions/checkout@v3
  +        uses: actions/checkout@v4
  ```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`33-39`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Environment Variables – Security Enhancements Needed**  
The global environment defines sensitive variables:  
- **USER_NAME** is set to `root` which is a security risk. It is recommended to use a non‑root user (e.g. `webknossos`).  
- **POSTGRES_PASSWORD** is hardcoded as `"secret_password"`, which can expose credentials. It is best practice to source such secrets from GitHub Secrets.  
> **Suggested Diff:**  
> ```diff
> -  USER_NAME: root
> +  USER_NAME: webknossos
> …
> -  POSTGRES_PASSWORD: "secret_password"
> +  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
> ```

---

`227-234`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Tighten Filesystem Permissions in e2e Test Preparation Step**  
The "Prepare e2e test" step currently sets overly permissive permissions using `chmod -R "0777"` for both the unzipped dataset directory and the fossildb folders. This can expose the system to unnecessary risks.  
> **Recommended Changes:**  
> - For the dataset directory:  
> ```diff
> -          sudo chmod -R "0777" binaryData/Organization_X
> +          sudo chmod -R "0755" binaryData/Organization_X
> ```  
> - For the fossildb directories:  
> ```diff
> -          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
> -          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
> +          mkdir -p fossildb/data fossildb/backup
> +          sudo chown -R 999:999 fossildb/data fossildb/backup
> +          sudo chmod -R "0755" fossildb/data fossildb/backup
> ```

---

`164-164`: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Update Docker Setup Buildx Action Version**  
The workflow currently uses `docker/setup-buildx-action@v2`, which is flagged as outdated. Please upgrade to version v3 for enhanced features and improvements.  
> **Proposed Diff:**  
> ```diff
> -      - uses: docker/setup-buildx-action@v2
> +      - uses: docker/setup-buildx-action@v3
> ```

---



</details>

**Update Docker Setup Buildx Action Version**  
The workflow currently uses `docker/setup-buildx-action@v2`, which is now outdated. Updating to `docker/setup-buildx-action@v3` ensures that you benefit from the latest features, improvements, and stability fixes.

> **Proposed Diff:**  
> ```diff
> -      - uses: docker/setup-buildx-action@v2
> +      - uses: docker/setup-buildx-action@v3
> ```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

164-164: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`1-32`: **CI Pipeline Triggers and Debug Inputs Setup**  
The workflow triggers for `push` (on master) and `pull_request` (on all branches) are clearly defined, and the new `workflow_dispatch` inputs for various debug modes (e.g. `tmate_debug_build`, `tmate_debug_e2e_tests`, `tmate_debug_backend_tests`, and `debug_enabled`) provide flexibility for on‑demand debugging.  
> **Suggestion:** Consider adding a top‑level `permissions` field to restrict who can trigger the debug sessions via `workflow_dispatch`, for example:  
> ```yaml
> permissions:
>   contents: read
> ```  
This will help prevent unauthorized or inadvertent activation of debugging features.

---

`102-113`: **Custom Environment Variables Calculation – Verify Quoting**  
The step that computes `NORMALIZED_BRANCH` and `DOCKER_TAG` in the `build` job appears logically sound. However, to safeguard against unwanted word splitting, consider quoting the interpolation of `github.ref_name`.  
> **Suggested Refinement:**  
> ```diff
> -            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
> +            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
> ```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 187e115aebd8117375a2d465a23266ff59471234 and 9547c29d02578fa9e2fb761726d33f0eba9b0abd.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

164-164: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

197-197: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

224-224: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: e2e-tests
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`240-246`: **Start Docker Instance – Correct Job Output Reference**  
In the "Start Docker Instance" step, the environment variable for `DOCKER_TAG` is correctly being sourced from the build job’s outputs via `${{ needs.build.outputs.docker_tag }}`.  
> **Note:** This is the appropriate usage when consuming outputs from a dependent job.

---

`247-263`: **Smoke Tests and e2e Test Execution**  
The subsequent steps running smoke tests and end-to-end tests appear to be set up correctly. No changes are needed here.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T10:29:31Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>♻️ Duplicate comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`90-92`: _🛠️ Refactor suggestion_

**Update Checkout Action Version in Build Job**  
Similarly, the build job’s checkout step (lines 90-92) uses `actions/checkout@v3`. Please update it to `actions/checkout@v4`.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

90-90: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`40-43`: _🛠️ Refactor suggestion_

**Update Checkout Action Version in Frontend Checks**  
The checkout step in the `static_frontend_code_checks` job uses `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will provide improved performance and security.  
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

41-41: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`203-205`: _🛠️ Refactor suggestion_

**Update Checkout Action Version in e2e-tests Job**  
The checkout step in the `e2e-tests` job also uses `actions/checkout@v3`. Please update it to `actions/checkout@v4` to align with current best practices.  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

203-203: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`214-221`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Restrict Overly Permissive File Permissions in e2e Test Preparation**  
The "Prepare e2e test" step creates directories and applies `sudo chmod -R "0777"`, which is overly permissive and may expose the system to security risks. It is recommended to use more restrictive permissions (such as `0755`) and adjust ownership if necessary. For example:  
```diff
-          sudo chmod -R "0777" binaryData/Organization_X
+          sudo chmod -R "0755" binaryData/Organization_X
-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```

---

`28-34`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Issue: Insecure Global Environment Variables**  
The environment block sets `USER_NAME` to `"root"` and hardcodes `POSTGRES_PASSWORD` as `"secret_password"`. Running CI jobs as root creates security risks, and hardcoded credentials may be exposed in logs.  
Consider updating these lines as follows:  
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`97-108`: **Improve Shell Quoting in Custom Environment Variables**  
In the "Custom environment variables" step, the command that extracts `NORMALIZED_BRANCH` uses:  
```
NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
```  
To prevent potential word splitting or globbing issues, consider wrapping `${{ github.ref_name }}` in double quotes. For example:  
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 9547c29d02578fa9e2fb761726d33f0eba9b0abd and a3d85d79473208d5ce7b8f7cc12a114e2f4f51dc.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

41-41: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

90-90: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

203-203: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`227-233`: **Review: Docker Instance Startup**  
The "Start Docker Instance" step correctly uses the job output for `DOCKER_TAG` (referenced as `${{ needs.build.outputs.docker_tag }}`), ensuring that the Docker images are tagged appropriately. No changes are necessary here.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T11:47:11Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 5**

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`97-109`: **Code Quality: Improve Shell Quoting in Custom Environment Variables**

In the "Custom environment variables" step (the `configure` step), the script extracts the normalized branch name using the GitHub reference. To avoid potential word splitting issues, please wrap the reference in quotes. For example:

```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`166-166`: **Upgrade Action Version: Update Docker Buildx Setup**

The workflow uses `docker/setup-buildx-action@v2` at line 166. Upgrading to version v3 is advisable to benefit from recent improvements in performance and features:

```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between a3d85d79473208d5ce7b8f7cc12a114e2f4f51dc and bc30b7cae822c9690bac24376b9f63d8269a47dd.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: build
* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary>

`171-194`: **Consistency Check: Docker Build Tag References**

The Docker build steps tag images using  
```
${{ steps.configure.outputs.docker_tag }} 
```
and  
```
${{ steps.configure.outputs.normalized_branch }}
```  
Make sure these references are consistently propagated throughout the workflow. For instance, the `e2e-tests` job uses the outputs via `needs.build.outputs`; ensure that the build job correctly sets its outputs and that both the Docker build steps and downstream jobs refer to the same source. If needed, adjust these to maintain consistency across jobs.

---

`231-236`: **Verification: Docker Tag Output Reference in Start Docker Instance**

In the "Start Docker Instance" step, the Docker tag is referenced via  
```
DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
```  
This is correct provided that the `build` job properly defines and exports its outputs. Please verify that the `build` job’s outputs (set in the `configure` step) are correctly propagated to ensure that the Docker instance uses the intended tag.

---

`238-254`: **CI Flow: Smoke and End-to-End Tests**

The smoke tests and the end-to-end test execution steps (using the URL health-check actions and running `yarn run test-e2e`) are clearly defined and well organized. No issues were detected in these sections.

---

`1-452`: **Overall: CI Pipeline Configuration Looks Promising**

The migration from CircleCI to GitHub Actions is implemented effectively. The workflow defines separate jobs for frontend static checks, builds (with proper service provisioning and output management), and end-to-end tests. With attention to the security concerns and code quality improvements noted above—such as securing environment variables, tightening file permissions, and upgrading action versions—the overall configuration will provide a robust and secure CI/CD pipeline.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T12:08:09Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`29-34`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Improvement: Avoid Using Root and Hardcoded Credentials**  
The global environment block currently sets `USER_NAME` to `root` and hardcodes the PostgreSQL password as `"secret_password"`. Running jobs as the root user increases security risks, and hardcoded credentials can be accidentally exposed. It is recommended to change `USER_NAME` to a non‑root user (e.g., `webknossos`) and source `POSTGRES_PASSWORD` from GitHub Secrets.  
_Proposed diff:_  
```diff
-  USER_NAME: root
+  USER_NAME: webknossos
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`97-108`: **Custom Environment Variables Setup**  
The script for setting `normalized_branch` and `docker_tag` (lines 97–108) is well structured. For extra safety, consider quoting the GitHub variable expansion in the `sed` command to avoid any unforeseen word-splitting issues. For example:  
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`166-166`: **Upgrade Docker Buildx Action Version**  
The workflow currently uses `docker/setup-buildx-action@v2` (line 166). It is advisable to upgrade to version v3 for access to improved features and performance enhancements.  
_Proposed diff:_  
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`196-199`: **Avoid Redundant Tmate Debugging Sessions**  
There are two tmate debugging session steps (lines 196–199 and 211–213) with the same condition (`if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_e2e_tests }}`). To reduce redundancy and potential confusion during debugging, consider consolidating these into a single step.  



Also applies to: 211-213

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between bc30b7cae822c9690bac24376b9f63d8269a47dd and 39d64ce159586d6dc3e789729ebec151cc36bd10.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

220-220: property "build" is not defined in object type {}

(expression)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (8)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (8)</summary>

`70-75`: **Review PostgreSQL Service Configuration**  
The PostgreSQL service (lines 70–75) pulls its password using `${{ env.POSTGRES_PASSWORD }}`. Ensure that the global environment variable is updated to source the password securely from GitHub Secrets. Otherwise, consider replacing it here directly with `${{ secrets.POSTGRES_PASSWORD }}` for improved security.

---

`171-194`: **Docker Image Build Steps**  
The Docker image build steps (lines 171–194) use the `docker/build-push-action@v6` with tags derived from the outputs of the `configure` step. This approach appears consistent; just ensure that the same variables are used downstream throughout the workflow.

---

`200-200`: **Set PostgreSQL URL for e2e Tests**  
The "Update ENV for end-to-end tests" step (line 200) sets `POSTGRES_URL` to `jdbc:postgresql://localhost:5432/webknossos`. Verify that using port 5432 here is intentional, as the build job’s PostgreSQL service runs on port 5434.

---

`215-221`: **Verify Docker Tag Output Dependency**  
The "Start Docker Instance" step (lines 215–221) sets the `DOCKER_TAG` environment variable using `${{ needs.build.outputs.docker_tag }}`. Ensure that the current job declares a dependency on the `build` job (using `needs: build`) so that these outputs are available at runtime.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

220-220: property "build" is not defined in object type {}

(expression)

</details>

</details>

---

`222-226`: **Smoke Test for Webknossos**  
The smoke test step (lines 222–226) correctly uses the URL health check action. Please verify that the endpoint (`http://localhost:9000/api/health`) is correct and reachable in the deployed environment.

---

`227-229`: **Smoke Test for Datastore**  
The smoke test for webknossos-datastore (lines 227–229) is configured as expected. Make sure that the endpoint (`http://localhost:9090/data/health`) matches the service's configuration.

---

`230-232`: **Smoke Test for Tracingstore**  
The health check for webknossos-tracingstore (lines 230–232) appears correct. Confirm that the endpoint (`http://localhost:9050/tracings/health`) accurately reflects the tracingstore’s deployment.

---

`236-238`: **Execute End-to-End Tests**  
The final step (lines 236–238) runs the end-to-end test suite using `yarn run test-e2e`. Ensure that this test command fully covers the required user flows and that any active debugging options do not interfere with test isolation.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T13:27:55Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`166-166`: _🛠️ Refactor suggestion_

**Action Version Update: Upgrade docker/setup-buildx-action**  
The build step uses `docker/setup-buildx-action@v2` (line 166), which is flagged as outdated by static analysis. Consider updating to v3 as shown below:
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`3-27`: **Suggestion: Secure Workflow Dispatch Triggers**  
The new workflow triggers and debug inputs (lines 3–27) are well defined and enhance the pipeline’s flexibility. However, to prevent unauthorized or inadvertent activation of debug sessions (e.g. via tmate), please consider adding a top‑level `permissions` field (for example, `permissions: { contents: read }`) to restrict who can run workflows with debugging enabled.

---

`97-102`: **Suggestion: Quote GitHub Ref Name in Shell Commands**  
In the "Custom environment variables" step (lines 100–102), `${{ github.ref_name }}` is used without quotes when piping to `sed`. To prevent word splitting or globbing issues, consider quoting it as follows:  
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`124-127`: **Reminder: Validate Tmate Debug Session Security**  
The tmate session in the build job is conditionally enabled (line 124–127). Ensure that proper timeouts and access controls are configured to avoid unintended exposure during debugging.

---

`135-136`: **Reminder: Implement Documentation Build**  
A TODO marker for building docs is present (line 135–136). Please address this by adding documentation build steps or updating the workflow once documentation changes are ready.

---

`196-199`: **Reminder: Conditional Debugging for e2e Tests**  
A tmate debugging session is conditionally enabled for e2e tests (lines 196–199). Please ensure that debugging features are adequately secured with timeouts and access restrictions.

---

`215-221`: **Review: Docker Tag Output Reference**  
The "Start Docker Instance" step (lines 215–221) sets `DOCKER_TAG` using `${{ steps.configure.outputs.docker_tag }}`. Please confirm that referencing the output directly from the `configure` step (within the same job) is intended rather than using a job output.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 39d64ce159586d6dc3e789729ebec151cc36bd10 and caf0153c506d0b24fd75fde81f543f655e657835.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary>

`37-66`: **LGTM: Static Frontend Code Checks**  
The steps for checking out code, caching dependencies, and running lint/typecheck tasks are well implemented using up-to-date actions.

---

`200-202`: **Review: Database URL Consistency**  
The "Update ENV for end-to-end tests" step (line 200–202) sets `POSTGRES_URL` to use port 5432, although the PostgreSQL service in this job maps port 5434. Please verify that the intended endpoint is correct for your tests.

---

`211-213`: **Duplicate Debugging Session?**  
There are two tmate debugging session steps for e2e tests (lines 196–199 and 211–213) with the same condition. Consider consolidating these into a single step to reduce redundancy.

---

`222-232`: **LGTM: Smoke Tests**  
The smoke test steps for webknossos, datastore, and tracingstore (lines 222–232) correctly use the custom URL health-check action.

---

`235-238`: **LGTM: End-to-End Tests**  
The e2e test step (lines 235–238) is straightforward and uses yarn to run tests. Ensure that test failures are properly reported by your test command.

---

`202-209`: **(Reiterated)** Please note that overly permissive file permissions in the "Prepare e2e test" step should be tightened, as described above.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T13:39:29Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 8**

<details>
<summary>🧹 Nitpick comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`67-91`: **Custom Environment Variables Setup: Robustness and Quoting**  
The `Custom environment variables` step (id: `configure`) correctly computes and exports `NORMALIZED_BRANCH` and `DOCKER_TAG`. To avoid potential issues with word splitting in shell commands, consider wrapping variable references (such as `${{ github.ref_name }}`) in quotes inside the `sed` command. For example:  
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```  
This minor refinement can prevent unexpected behavior if the branch name contains special characters.

---

`112-115`: **Documentation Build Step: Legacy Variable References**  
The "Build frontend documentation" step sets the project version using:  
```bash
WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
```  
Since this workflow is now running under GitHub Actions, legacy CircleCI environment variables (`CIRCLE_TAG` and `CIRCLE_BUILD_NUM`) may not be available. Consider updating this fallback chain to use GitHub Actions–specific variables (for example, using `github.run_number` or similar) to ensure accurate versioning.

---

`139-145`: **Use of Legacy CircleCI Scripts for Frontend Checks**  
Several steps (e.g. "Lint frontend code and check formatting", "Check for cyclic dependencies in front-end") invoke scripts from the `.circleci/` directory. As you transition away from CircleCI, consider migrating these scripts or commands to use GitHub Actions–native implementations to reduce dependency on legacy infrastructure.

---

`156-160`: **End-to-End Tests: Retry Loop Robustness**  
The retry loop for running end-to-end tests initializes and uses the exit status variable `s` via:  
```bash
for i in {1..3}; do ... && s=0 && break || s=$?; done
(exit $s)
```  
Ensure that the variable `s` is properly initialized before the loop to avoid potential undefined value issues, and consider enhancing the reporting or error handling if all retry attempts fail.

---

`165-166`: **Inconsistent Docker Command Usage**  
In the "Start webknosos, datastore and tracingstore" step, there is an inconsistency between using `docker compose` and `docker-compose` (note the hyphen in the latter). For consistency and to reduce potential confusion, standardize on one command format (preferably `docker compose`, which is the newer CLI syntax).

---

`222-223`: **Reporting Coverage and Slack Notification**  
The final steps for reporting coverage and sending a Slack notification use constructs such as:  
```bash
.run: .circleci/not-on-master.sh docker compose run base yarn coverage || true
```  
Using `|| true` at the end of the coverage command may hide regressions or failures in test coverage. Consider enforcing a minimum coverage threshold or allowing the step to fail if coverage issues arise. Double-check that the Slack notification script runs only when appropriate (e.g., on the master branch) to avoid spurious alerts.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between caf0153c506d0b24fd75fde81f543f655e657835 and 8e9c0e79d746769dafdbcb1cce63f66e522509a4.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`129-129`: **Checksum Calculation**  
The checksum step for application directories is implemented correctly and appears efficient. No changes required here.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T14:15:33Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 9**

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`76-91`: **Custom Environment Variables Configuration: Enhance Robustness**  
The `configure` step correctly computes `NORMALIZED_BRANCH` and `DOCKER_TAG` and writes them to both `$GITHUB_OUTPUT` and `$GITHUB_ENV`. As a nitpick, consider wrapping the GitHub variable `${{ github.ref_name }}` in quotes within the `sed` command to guard against potential word splitting issues (e.g. use `sed 's/[\/-]/_/g'` on a quoted value).

---

`105-109`: **Postgres Readiness: Replace Static Sleep with Health Check Loop**  
Using a fixed `sleep 3` to wait for Postgres can be unreliable. Instead, consider replacing it with a loop that checks Postgres readiness (e.g. using `pg_isready` in a retry loop) so that the next step only runs once the database is truly available.

---

`131-135`: **Docker Image Build: Silencing Pull Failures**  
The `Build webknosos docker image` step uses a pull command that appends `|| true`, which may hide underlying pull errors. Consider handling failure cases explicitly to ensure that any issues during image retrieval are caught and addressed.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 8e9c0e79d746769dafdbcb1cce63f66e522509a4 and b679297a505c65060c8804f23099cc2aa7d37215.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`37-66`: **Static Frontend Code Checks: Looks Good**  
The `static_frontend_code_checks` job is now running on Ubuntu 24.04, and the steps (checkout with actions/checkout@v4, Node.js setup, caching, and lint/typecheck commands) are implemented properly.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T14:44:13Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 6**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`28-35`: _⚠️ Potential issue_

**Sensitive Global Environment Variables**  
The environment block still sets `USER_NAME: root` and hardcodes `POSTGRES_PASSWORD: "secret_password"`. Running the job as root is a security risk, and hardcoded credentials may be inadvertently exposed. Please update these to use a non‑root user (e.g. `webknosos` or a dedicated service account) and source the PostgreSQL password from GitHub Secrets. For example:  
```diff
-  USER_NAME: root
+  USER_NAME: webknosos
…
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`76-91`: **Custom Environment Variables – Configuration Step**  
The custom environment variables step (ID: configure) sets `NORMALIZED_BRANCH` and `DOCKER_TAG` based on the branch type. To guard against any edge cases (e.g. branch names with special characters), consider wrapping variable expansions in double quotes. For example:  
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```  
This is a minor nitpick that can help ensure robustness.

---

`95-98`: **Docker Pull for Dev Image**  
The step pulling the webknosos-dev docker image uses `|| true`, which can mask pull errors. If the image absence is expected sometimes, this is acceptable; otherwise, consider handling errors explicitly so that you’re alerted to unexpected pull failures.

---

`105-109`: **Schema Validation Step using sleep**  
In the "Assert schema.sql and evolutions are equal" step, the command uses a fixed `sleep 3` after starting the Postgres service. This approach might be unreliable. Consider replacing it with a loop that checks the database readiness (e.g. using `pg_isready`) to ensure that Postgres is fully operational before proceeding.

---

`221-224`: **Coverage Reporting Error Suppression**  
The final coverage reporting step uses `|| true` to ignore errors:  
```bash
docker compose run base yarn coverage || true
```  
While this may be intentional to avoid breaking the build on coverage issues, consider whether you want to suppress potential regressions in test coverage. Removing the error suppression or enforcing a minimum coverage threshold might be more robust.

---

`224-227`: **Slack Notification Step**  
The final step runs a Slack notification script located at `.circleci/slack-notification.sh`. Ensure that this script is updated and compatible with the GitHub Actions environment, especially now that you are transitioning away from CircleCI.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between b679297a505c65060c8804f23099cc2aa7d37215 and e40c112f39aaa2165fe55da6ba4f1ac0fcc4373d.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`37-66`: **Static Frontend Code Checks Job**  
The `static_frontend_code_checks` job is well configured on ubuntu-24.04 with proper checkout, Node.js setup, caching, and frontend linting/type checking steps. The changes are clear and adhere to best practices.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T14:57:14Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 6**

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`110-113`: **[Suggestion] Docker Pull Error Masking**

The "Build webknosos-dev docker image" step runs the command:  
```bash
docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH || true
```  
Using `|| true` masks pull failures which might hide underlying issues. Consider replacing this with proper error handling or a retry mechanism that reports failures if the pull fails.

 

*Example diff:*
```diff
-          docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH || true
+          docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH
```

---

`122-126`: **[Suggestion] Robust PostgreSQL Readiness Check**

The schema assertion step uses a fixed `sleep 3` after starting the PostgreSQL service. Relying on a fixed delay is not always robust. Consider replacing the sleep with a loop that waits until the database is ready, for example, using `pg_isready`.



*Example diff:*
```diff
-          sleep 3
+          until docker compose exec -T postgres pg_isready; do
+            echo "Waiting for postgres to be ready..."
+            sleep 1
+          done
```

---

`148-151`: **[Suggestion] Docker Image Build Error Masking**

Similar to the earlier Docker pull step, the "Build webknosos docker image" step uses:
```bash
docker pull scalableminds/webknosos:$NORMALIZED_BRANCH || true
```
Removing `|| true` (or implementing a proper retry mechanism) would help surface any errors during the pull stage.



*Proposed diff:*
```diff
-          docker pull scalableminds/webknosos:$NORMALIZED_BRANCH || true
+          docker pull scalableminds/webknosos:$NORMALIZED_BRANCH
```

---

`207-238`: **[Suggestion] Docker Images Push – Quoting and Consistency**

The "Push docker images" block defines a `retry` function and uses several docker commands. Consider the following improvements:
- Quote variable expansions in docker tag and push commands to avoid potential word splitting issues.  
- Verify that all condition checks use GitHub Actions variables appropriately (e.g. replacing legacy or ambiguous checks).

For example, update tagging commands as follows:
  
*Proposed diff:*
```diff
-            docker tag \
-              scalableminds/webknosos:${DOCKER_TAG} \
-              scalableminds/webknosos:${NORMALIZED_BRANCH}
+            docker tag "scalableminds/webknosos:${DOCKER_TAG}" "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```
Apply similar quoting to other docker tag commands in this block.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between e40c112f39aaa2165fe55da6ba4f1ac0fcc4373d and cfc6bf24ab36cf21ba17aa631b077edacd9892e9.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`37-66`: **[Approval] Static Frontend Code Checks Job**

The `static_frontend_code_checks` job (running on Ubuntu 24.04) is well defined with checkout, Node.js setup, caching, and various frontend validation steps. The use of actions/checkout@v4 and the dependency caching strategy helps optimize performance.

---

`91-106`: **[Approval] Custom Environment Variables Setup**

The custom environment variable step efficiently computes a normalized branch name and a Docker tag based on the branch context. The use of `$GITHUB_OUTPUT` and `$GITHUB_ENV` is appropriate for propagating these values.  
  
  
  
*Note:* If branch names could contain unexpected characters, consider additional quoting or sanitization.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T15:40:55Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>♻️ Duplicate comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`239-241`: _⚠️ Potential issue_

**Do Not Suppress Coverage Failures Silently**  
The final coverage reporting step uses `|| true` (line 241), which may hide regressions or defects in test coverage. It is important to let the job fail if coverage drops unexpectedly.  

**Suggestion:**  
Remove the `|| true` suffix so that coverage failures are surfaced.

```diff
-        run: docker compose run base yarn coverage || true
+        run: docker compose run base yarn coverage
```

---

`1-11`: _🛠️ Refactor suggestion_

**Secure Workflow Dispatch and Debug-Related Inputs**  
While the workflow sets up useful triggers (push, pull_request, and workflow_dispatch with debug-related inputs), there is no top‑level `permissions` field to restrict sensitive operations (such as enabling tmate debugging). This could potentially allow unauthorized debug sessions which may expose sensitive details.

**Recommendation:**  
Add a `permissions` field at the top of the file to restrict access. For example:

```diff
+permissions:
+  contents: read
```

This will help ensure that only authorized users can trigger workflows with debug capabilities.

---

`28-34`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Avoid Hardcoded and Insecure Global Environment Values**  
The global environment block is setting `USER_NAME: root` and hardcoding the PostgreSQL password as `"secret_password"`. Running CI jobs as root and embedding sensitive credentials in plaintext expose the system to security risks.  
  
**Recommendations:**  
- Change `USER_NAME` to a non‑root user (e.g. `"webknosos"` or another dedicated service account).  
- Replace the hardcoded `POSTGRES_PASSWORD` with a secret reference (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).  

```diff
-  USER_NAME: root
+  USER_NAME: webknosos
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

---

`172-174`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Tighten Filesystem Permissions in End-to-End Test Preparation**  
The “Run end-to-end tests” step creates the directory `binaryData/Organization_X` and sets its permissions to `777` (line 174), which is overly permissive and can introduce security risks.  

**Recommendation:**  
Use a more restrictive permission mode, such as `755`.

```diff
-          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

---

`207-238`: _🛠️ Refactor suggestion_

**Enhance Docker Image Push Logic and Quoting**  
The “Push docker images” block defines a custom retry function for logging in and pushing images. However, there are a couple of points to address:
  
1. **Branch Condition Check:**  
   The condition `if [ -n "${{ github.ref_name }}" ]; then` (line 220) is always true since `github.ref_name` is non-empty. Consider checking the branch type explicitly (e.g. using `${{ github.ref_type }}` or comparing against `'master'`).

2. **Quoting Variables:**  
   In the docker tag commands, variable expansions (e.g. `${DOCKER_TAG}` and `${NORMALIZED_BRANCH}`) are unquoted. This could lead to word splitting if the values contain spaces. It is best practice to wrap these in double quotes.

**Suggestion Example for One Tag Command:**

```diff
-              scalableminds/webknosos:${DOCKER_TAG} \
+              scalableminds/webknosos:"${DOCKER_TAG}" \
```

Apply similar quoting for other docker tag and push commands.

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`91-106`: **Improve Robustness in Custom Environment Variables Definition**  
The custom environment variables step calculates `NORMALIZED_BRANCH` and `DOCKER_TAG` using the unquoted `${{ github.ref_name }}` value. Although the current implementation functions, it is best practice to ensure all external variables are properly quoted to avoid word splitting or unexpected behavior.

**Suggestion:**  
Wrap variable references in quotes where applicable. For example:

```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between e40c112f39aaa2165fe55da6ba4f1ac0fcc4373d and cfc6bf24ab36cf21ba17aa631b077edacd9892e9.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: build_test_deploy

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T15:46:03Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 8**

<details>
<summary>🧹 Nitpick comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`94-109`: **Custom Environment Variables Setup**  
The `configure` step effectively normalizes branch names and constructs the `DOCKER_TAG` dynamically. The use of `sed` is appropriate; however, please verify that branch names with unusual characters are handled correctly. Also, double-check that appending values to both `$GITHUB_OUTPUT` and `$GITHUB_ENV` meets your intentions for later steps.

---

`110-112`: **Tmate Session Integration for Debugging**  
The conditional tmate session step using `mxschmitt/action-tmate@v3` is a helpful tool for on‑demand debugging. To improve security, consider adding explicit restrictions (e.g. via a top‑level `permissions` field) to limit who can enable such debug sessions.

---

`124-130`: **Database Schema Validation: Waiting for Postgres**  
The steps asserting unique evolution numbers and schema consistency are critical. However, relying on a simple `sleep 3` (line 128) to wait for PostgreSQL readiness may be unreliable. Consider using a loop (e.g. a `pg_isready` check) to robustly wait for the database to be ready before proceeding.

---

`187-193`: **Webknosos Smoke Test: Retry Mechanism**  
The smoke test step for webknosos uses a retry loop with `curl` and appears robust. The fixed maximum of 20 attempts should be evaluated based on expected startup times, but overall the implementation is sound.

---

`211-218`: **Custom Retry Function: Docker Push Resilience**  
The defined `retry` function is a useful mechanism for handling transient errors during Docker operations. For added robustness, consider quoting the command arguments (e.g. using `"${@}"`) and ensuring that the exit status is propagated accurately.

---

`219-240`: **Docker Tagging and Pushing: Variable Quoting and Condition Check**  
The block for tagging and pushing Docker images is comprehensive and employs the custom retry function. However, variable expansions (e.g., `${DOCKER_TAG}` and `${NORMALIZED_BRANCH}`) should be wrapped in quotes to prevent word splitting issues. Additionally, the condition `if [ -n "${{ github.ref_name }}" ]; then` could be revisited since `github.ref_name` is always set in this context.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between cfc6bf24ab36cf21ba17aa631b077edacd9892e9 and 86c670fb622fe071a58968f70ea30d29f1688e7b.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)
* `docker-compose.yml` (2 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* docker-compose.yml

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`37-66`: **Static Frontend Code Checks: Configuration Review**  
The `static_frontend_code_checks` job is configured on Ubuntu 24.04 with updated Node.js (v18) and uses caching (via actions/cache) for dependency folders. The steps for linting, typechecking, and cyclic dependency checks are neatly organized.

---

`137-144`: **SBT Build Command: Branch-Based Logic**  
The conditional in the "Build webknosos (sbt)" step correctly leverages `${{ github.ref_name }}` to determine if the build should be run with additional warning flags. This approach is clear and appropriate.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T16:07:14Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 6**

<details>
<summary>🧹 Nitpick comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`3-10`: **[Security & Best Practice] Restrict Workflow Dispatch Debug Options**  
The workflow triggers include a manual dispatch with several debug-related inputs (e.g. `tmate_debug_build`, `tmate_debug_e2e_tests`, `debug_enabled`). For improved security, consider adding a top‑level `permissions` field (for example, `permissions: { contents: read }`) to restrict which users can trigger a debug session.

---

`102-102`: **[Tooling] Update Docker Buildx Action Version**  
The workflow currently uses `docker/setup-buildx-action@v2` (line 102). Consider upgrading to version v3 for enhanced features and performance improvements.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

102-102: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`118-133`: **[Code Style] Branch Normalization Script**  
The custom environment variable step sets `NORMALIZED_BRANCH` and `DOCKER_TAG` based on `${{ github.ref_name }}` (lines 121–128). For improved robustness and to avoid issues with word splitting, consider quoting the variable expansion (e.g. use `echo "$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')"`).

---

`134-136`: **[Security & Clarity] tmate Debug Session Configuration**  
The tmate session step is conditionally enabled for debugging (lines 134–136). While useful for on‑demand sessions, it is recommended to further secure these sessions (for example, by enforcing a timeout or restricting debug activation via a permissions field).

---

`149-153`: **[Robustness Improvement] Postgres Schema Validation Step**  
In the “Assert schema.sql and evolutions are equal” step (lines 149–153), the script uses a fixed `sleep 3` after starting the Postgres container. It would be more robust to replace this with a loop that checks the database’s readiness (for example, using `pg_isready` in a retry loop) so that the script proceeds only when the database is fully up.

---

`240-268`: **[Code Quality] Docker Image Tagging and Push Commands**  
Within the "Push docker images" block (lines 240–268), the docker tag commands interpolate variables (e.g. `${DOCKER_TAG}` and `${NORMALIZED_BRANCH}`) without quotes. To prevent potential word splitting or globbing issues, wrap these variable references in double quotes. For example:  
```diff
- docker tag scalableminds/webknosos:${DOCKER_TAG} scalableminds/webknosos:${NORMALIZED_BRANCH}
+ docker tag "scalableminds/webknosos:${DOCKER_TAG}" "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```  
Apply similar quoting for other tag and push commands.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 86c670fb622fe071a58968f70ea30d29f1688e7b and 300cca40c197cb08930f7b8a4ef3631e83aa7eb4.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)
* `docker-compose.yml` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* docker-compose.yml

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

102-102: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`93-97`: **[Verification] Database URL Consistency**  
The job-level environment sets `POSTGRES_URL` to `"jdbc:postgresql://localhost:5432/webknossos"`, while the Postgres service was configured with the default hostname via Docker. Please verify that using `localhost` here is intentional and consistent with your networking setup; sometimes the service hostname (e.g. “postgres”) is used instead.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-03T16:41:33Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 5**

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`70-92`: **Service Definitions for PostgreSQL & Redis**  
The services for Postgres and Redis are configured with health-check options and proper port mappings. However, note that the PostgreSQL credentials are derived from the global env where the password is hardcoded. Once the global variable is secured (see above), consider also binding the Postgres port more restrictively (e.g. to localhost) if external access isn’t required.

---

`147-150`: **Database Schema Assertions**  
The steps asserting unique evolution numbers and schema consistency are clear. However, the “Assert schema.sql and evolutions are equal” step uses a fixed `sleep 3` to wait for Postgres readiness. Consider replacing this with a loop that checks Postgres health (e.g. using `pg_isready`) to make the process more robust against variable startup times.

---

`173-178`: **Checksum & Main Docker Image Build**  
The checksum generation step is a useful quality check. In the “Build webknosos docker image” step, again the image pull uses `|| true`. As noted earlier, suppressing errors here might hide pull issues. Consider using explicit error handling.

---

`243-272`: **Docker Image Push & Tagging**  
The script defines a `retry()` function to attempt Docker image pushes. Several points to note:  
• The function loops correctly, but ensure that variable expansions in the docker tag commands are quoted to avoid word splitting issues.  
• The condition in the if‑statement (`if [ -n "${{ github.ref_name }}" ]; then`) should be reviewed to see if it aligns with the intended branch/tag logic.  
• Overall, consider revisiting error handling so that any persistent failure (after all retries) is surfaced.  
_For example, quoting the image tags:_  
```diff
-              scalableminds/webknosos:${DOCKER_TAG}
+              "scalableminds/webknosos:${DOCKER_TAG}"
```

---

`273-276`: **Coverage Reporting Step – Error Suppression**  
The coverage reporting step uses `continue-on-error: true`, which may hide coverage regressions. While this might be acceptable in a WIP context, consider failing the job if coverage drops below a defined threshold in the future.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 300cca40c197cb08930f7b8a4ef3631e83aa7eb4 and 31f229fa979c31ccbc8e7a3acf5db3b15c32074d.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

102-102: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (19)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (19)</summary>

`38-67`: **Static Frontend Code Checks Job – LGTM**  
The static_frontend_code_checks job is well structured: it checks out code with an up‑to‑date checkout action, sets up Node.js, leverages caching for dependencies, and then runs linting, type checking, and cyclic dependency checks. Great job keeping this modular and efficient.

---

`93-97`: **Job-specific Environment Variables**  
The build_test_deploy job sets `POSTGRES_URL` to `"jdbc:postgresql://localhost:5432/webknossos"`. Verify that the intended Postgres host is indeed localhost rather than the service alias (which is “postgres” in the service definition). Consistency in the DB connection URL is essential for reliability.

---

`98-100`: **Checkout Code Step**  
The checkout step in the build_test_deploy job uses `actions/checkout@v4` with a proper fetch depth. This step is implemented correctly.

---

`104-112`: **Setup of Node.js, Java & SBT**  
These steps (lines 104–112) correctly set up Node.js, Java (using Temurin for Java 21), and SBT. This setup looks solid and aligns with best practices.

---

`115-116`: **OS Dependencies Installation**  
The command installs system dependencies using `apt-get update` and installs the required libraries. This step is clear and concise.

---

`118-133`: **Custom Environment Variable Setup**  
The “Custom environment variables” step (id: configure) calculates and exports `NORMALIZED_BRANCH` and `DOCKER_TAG` appropriately using GitHub Actions context variables. This approach is effective in propagating these values to both the job outputs and the environment.

---

`141-147`: **Dependency Folders & Frontend Installation**  
The steps for preparing dependency folders and installing frontend dependencies (with yarn) are straightforward and look good. The environment variable to skip Chromium download for Puppeteer is a nice touch.

---

`156-160`: **Frontend Documentation and Build Steps**  
The documentation build, webpack build, and subsequent sbt build steps are implemented with appropriate conditions (differentiating master from other branches). The use of `${{ github.run_number }}` for versioning in documentation is appropriate.

---

`161-168`: **sbt Build Commands**  
The conditional execution of sbt commands (clean compile stage on master vs. fail on warning for others) is clear and correct. This ensures builds have stricter requirements on non-master branches.

---

`169-172`: **Docker Image Build for Datastore and Tracingstore**  
These steps use `docker compose build --pull` to rebuild the docker images for the datastore and tracingstore. They are straightforward and in line with previous steps.

---

`179-182`: **Docker Image Build for Datastore & Tracingstore**  
The subsequent image build steps for the datastore and tracingstore docker images are clear and follow best practices.

---

`183-191`: **Frontend & Backend Testing Steps**  
The linting, test execution, and cyclic dependency checks for both frontend and backend (using sbt and yarn) are conditionally run on non-master branches. This conditional testing approach helps speed up the pipeline on master while ensuring thorough checks on other branches.

---

`210-212`: **Frontend Type Validation**  
The frontend type check step runs `yarn typecheck` conditioned on non-master branches and is clear and concise.

---

`213-220`: **Services Startup & Smoke Tests**  
The steps for starting the application’s docker services and running iterative smoke tests (with curl and retry loops) are well implemented. The use of retry loops provides additional robustness in checking service health.

---

`222-228`: **Datastore & Tracingstore Smoke Tests**  
Similar retry loops are correctly implemented for datastore and tracingstore smoke tests.

---

`229-235`: **Tracingstore Smoke Test**  
The smoke test loop for the tracingstore is implemented with appropriate retries.

---

`236-238`: **Application Shutdown Step**  
The step to bring down docker-compose with the `--volumes --remove-orphans` flags is a good cleanup practice.

---

`239-242`: **Docker Login for Image Push**  
The docker/login-action step uses v3 and correctly authenticates using secrets. This is implemented securely.

---

`102-103`: <details>
<summary>❓ Verification inconclusive</summary>

**Docker Buildx Setup Action Version**  
The workflow uses `docker/setup-buildx-action@v2` (line 102). Static analysis suggests upgrading to v3 for improved performance and features.  
_For example:_  
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

---



</details>

**Upgrade Docker Buildx Action to v3**  
After reviewing the code and considering the static analysis recommendation, it’s advised to update the Docker Buildx setup from v2 to v3 to take advantage of enhanced performance and new features. Please update the workflow file as follows:

- **File:** `.github/workflows/build_test_deploy.yml` (line 102)  
  ```diff
  -      - uses: docker/setup-buildx-action@v2
  +      - uses: docker/setup-buildx-action@v3
  ```

Be sure to run your CI/CD tests after updating to verify that the new action version integrates smoothly with your pipeline.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

102-102: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T10:13:28Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 5**

<details>
<summary>♻️ Duplicate comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`102-102`: _🛠️ Refactor suggestion_

**Update Buildx Action Version**

The workflow uses `docker/setup-buildx-action@v2` (line 102), which is outdated per static analysis hints. Upgrading to version v3 will improve compatibility and bring new features.

```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

102-102: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`28-35`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Avoid Running as Root and Hardcoded Credentials**

The global environment block sets:
- `USER_NAME: root` (line 29), which poses a security risk in CI jobs.
- Hardcoded `POSTGRES_PASSWORD: "secret_password"` (line 35) is insecure.

Consider switching to a non‑root user (for example, `"webknosos"`) and sourcing sensitive credentials from GitHub Secrets. For instance, update the entries as follows:

```diff
-  USER_NAME: root
+  USER_NAME: webknosos
...
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`118-133`: **Environment Variable Configuration: Consider Quoting Variables**

The "Custom environment variables" block (lines 118–133) correctly sets `normalized_branch` and `docker_tag`. For extra robustness against word splitting, consider quoting the interpolated variables (e.g. `${{ github.ref_name }}`) when passing them to commands like `sed`.

---

`134-136`: **Debug Session Permissions: Restrict Debug Access**

The tmate debugging step (lines 134–136) is conditionally enabled based on debug inputs. Debug sessions can expose sensitive runtime data. It is recommended to add a top‑level permissions block in the workflow (for example, `permissions: { contents: read }`) to restrict who can trigger these debug sessions.

---

`149-153`: **Database Schema Check: Improve Wait for PostgreSQL Readiness**

The schema check step (lines 149–153) currently uses a fixed `sleep 3` after starting PostgreSQL. This approach may be unreliable. It might be preferable to wait in a loop (for example, using `pg_isready`) until the PostgreSQL service is confirmed ready before running the schema check.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 31f229fa979c31ccbc8e7a3acf5db3b15c32074d and 58431d16461340e70bcf4bc3d77626d088551458.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)
* `webknossos-jni/src/bucketScanner.cpp` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* webknossos-jni/src/bucketScanner.cpp

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

77-77: context "env" is not allowed here. available contexts are "github", "inputs", "matrix", "needs", "strategy", "vars". see https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability for more details

(expression)

---

102-102: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T11:37:04Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`28-35`: _⚠️ Potential issue_

**[Security Concern] Insecure Global Environment Variables**  
The global `env:` block sets `USER_NAME: root` and hardcodes `POSTGRES_PASSWORD: "secret_password"`. Running jobs as root increases vulnerability and hardcoded credentials may become exposed. Consider changing to a non‑root user (e.g. `"webknosos"`) and sourcing the PostgreSQL password from GitHub Secrets. For example:  
```diff
-  USER_NAME: root
+  USER_NAME: webknosos
…
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```  
 [security]

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`1-10`: **[Security & Configuration] Consider Explicit Permissions for Workflow Dispatch**  
The workflow trigger section (lines 3–10) defines debug inputs (e.g. `tmate_debug_build`, `tmate_debug_e2e_tests`, and `debug_enabled`) for on‑demand debugging. For enhanced security, explicitly adding a top‑level `permissions` block (for example, `permissions: { contents: read }`) would help restrict who can trigger these debug sessions.  
 [security]

---

`102-102`: **[Tooling Improvement] Update Buildx Action Version**  
The step using `docker/setup-buildx-action@v2` (line 102) is flagged by static analysis. Upgrading to version v3 will bring enhanced features and performance improvements.  
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

102-102: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`121-123`: **[Refactoring Suggestion] Quote Variables in Environment Setup**  
In the "Custom environment variables" step, the script computes `NORMALIZED_BRANCH` with a sed command using the unquoted `${{ github.ref_name }}`. To prevent potential word splitting, wrap the variable in quotes. For example:  
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`151-153`: **[Robustness] Replace Fixed Sleep with a Health Check Loop**  
The schema assertion step currently uses `sleep 3` (lines 151–153) after starting Postgres. A fixed sleep may not reliably ensure database readiness. Consider replacing it with a loop that waits for Postgres to become responsive (e.g. using `pg_isready`).

---

`256-259`: **[Robustness & Security] Quote Variables in Docker Tag Commands**  
Within the "Push docker images" block (lines 256–259), the docker tag commands interpolate variables without quotes. This can lead to word splitting issues if the variables contain unexpected characters. Consider quoting the variables. For example:  
```diff
-            docker tag \
-              scalableminds/webknosos:${DOCKER_TAG} \
-              scalableminds/webknosos:${NORMALIZED_BRANCH}
+            docker tag \
+              "scalableminds/webknosos:${DOCKER_TAG}" \
+              "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```  
 [security]

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 58431d16461340e70bcf4bc3d77626d088551458 and 60e0f13b932ecaef58a2ff111c5ed9c1b3c3b2f8.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

102-102: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T11:46:28Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/docker-compose.yml (1)</summary><blockquote>

`67-76`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Typo in FossilDB Command Arguments**

The FossilDB command on line 72 has an apparent concatenation error:
```
... volumeSegmentIndex,editableMappingsInfomeditableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate, ...
```
It seems that `editableMappingsInfomeditableMappingsAgglomerateToGraph` should be split into two separate parameters (e.g. `editableMappingsInfo` and `editableMappingsAgglomerateToGraph`). Consider applying the following diff:
```diff
-      - skeletons,volumes,volumeData,volumeSegmentIndex,editableMappingsInfomeditableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate,annotations,annotationUpdates
+      - skeletons,volumes,volumeData,volumeSegmentIndex,editableMappingsInfo,editableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate,annotations,annotationUpdates
```
This correction will ensure that each parameter is parsed correctly.

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (9)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`113-115`: **Conditional tmate Debug Session**

The tmate session step is conditionally triggered based on the workflow dispatch input `tmate_debug_build`. This is useful for on‑demand debugging. For added security, consider enforcing access restrictions (for example, via top‑level permissions).

---

`116-119`: **Docker Pull Error Suppression in Dev Image Build**

The "Build webknosos-dev docker image" step uses a docker pull command ending with `|| true`, which may mask critical pull failures. It is advisable to handle errors explicitly (or implement a retry mechanism) rather than silently suppressing errors.

---

`128-132`: **Robustness in Schema Assertion Step**

The "Assert schema.sql and evolutions are equal" step uses a fixed `sleep 3` after starting the postgres service. Replacing this with an active health-check (e.g. using `pg_isready`) would make the process more robust.

---

`154-157`: **Handle Docker Pull Errors for Webknosos Image**

Similar to the dev image pull, the "Build webknosos docker image" step uses `docker pull scalableminds/webknosos:$NORMALIZED_BRANCH || true`. Consider handling pull errors explicitly rather than suppressing them with `|| true`.

---

`222-251`: **Improve Docker Image Tagging and Push Commands**

The push block defines a custom `retry` function and uses docker tag commands without quoting the variables. To prevent word splitting or unexpected issues, please wrap variable expansions in double quotes.  
_Proposed diff example:_
```diff
-            docker tag \
-              scalableminds/webknosos:${DOCKER_TAG} \
-              scalableminds/webknosos:${NORMALIZED_BRANCH}
+            docker tag \
+              "scalableminds/webknosos:${DOCKER_TAG}" \
+              "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```
This applies similarly to the subsequent docker tag and push commands.

---

`79-80`: **Upgrade Docker Buildx Action Version**

Static analysis indicates that `docker/setup-buildx-action@v2` (used at line 79) is outdated. Upgrading to version v3 is recommended for improved performance and new features.
_Proposed diff:_
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</blockquote></details>
<details>
<summary>.github/docker-compose.yml (3)</summary><blockquote>

`1-2`: **Clarify Project Name and Compose Version**

The project is named `webknossos-ci`, which is clear; however, consider specifying a Compose file version (e.g. `version: '3.8'`) if you’re not fully relying on the latest Compose specification. This can enhance readability and ensure compatibility in environments that expect an explicit version.

---

`30-47`: **Validation of the "webknossos-datastore" Service Settings**

This service’s configuration looks solid with its defined memory options (`-J-Xmx20G` and `-J-Xms1G`), port exposure, and volume mapping. Please verify that the allocated memory values are appropriate for your CI environment’s resources.

---

`93-106`: **Reviewing the Redis Service Healthcheck**

The Redis service is using a custom healthcheck that opens a TCP connection and expects a "PONG" response. While this method works, consider if a simpler approach (e.g. using `redis-cli ping` if available) might be more straightforward. If the current method is proven effective in your environment, it is acceptable as is.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 60e0f13b932ecaef58a2ff111c5ed9c1b3c3b2f8 and 9f71353c2f33eed54c53076f92493e47e1e5222b.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary>

`38-67`: **Static Frontend Code Checks Job Looks Good**

The `static_frontend_code_checks` job is well configured—using ubuntu-24.04, checkout@v4, and appropriate caching for Node modules. The linting, type checking, and cyclic dependency checks are clearly defined.

---

`97-112`: **Custom Environment Variables Setup is Clear**

The step with `id: configure` correctly normalizes the branch name and sets the Docker tag based on the branch and run number. The use of GITHUB_OUTPUT and GITHUB_ENV is appropriate.

---

`141-147`: **sbt Build Step Verification**

The condition in the "Build webknosos (sbt)" step properly distinguishes between the master and non‑master cases. The use of `${{ github.ref_name }}` is appropriate, and the build commands appear correct.

</details>
<details>
<summary>.github/docker-compose.yml (3)</summary>

`4-29`: **Review of the "webknossos" Service Configuration**

The configuration for the `webknossos` service is well-organized with the expected image, port mapping, command-line arguments, and dependency health checks. A couple of points to consider:
- Verify that the relative volume path `../binaryData:/webknossos/binaryData` correctly resolves from the file’s location.
- The environment variable `CERTIFICATE` is listed without an assignment; ensure this is intentional (e.g., if it is being injected externally).
Overall, the settings align with the service requirements.

---

`77-92`: **Postgres Service Configuration Check**

The `postgres` service is configured with the necessary environment variables and a health check command that uses `pg_isready`. Ensure that the injected variables (`${POSTGRES_USER}` and `${POSTGRES_PASSWORD}`) are defined in the CI/CD environment. The overall configuration appears sound.

---

`48-66`: <details>
<summary>❓ Verification inconclusive</summary>

**Potential Misconfiguration in "webknossos-tracingstore"**

In the tracingstore service, line 57 sets:
```
- -Dhttp.uri=http://webknossos-datastore:9050
```
Typically, a service should reference its own hostname (e.g. `webknossos-tracingstore`) for internal URI settings unless there is a specific proxying or routing requirement. Please verify whether this configuration is intentional or if it should be updated to reflect the correct service name.

---

Once we confirm that "webknosos-datastore" is used only in the configuration within the "webknosos-tracingstore" service—and no corresponding service is defined elsewhere—it would suggest that the hostname might be misconfigured. Please verify if this reference is intentional (for example, if it points to an external proxy or if there's a specific network routing requirement) or whether it should instead reference the "webknosos-tracingstore" service or another valid service name.

---

**Action Required: Confirm Service Name in `webknosos-tracingstore` Configuration**

The configuration in `.github/docker-compose.yml` (lines 48-66) for the `webknosos-tracingstore` service includes the command parameter:
```
- -Dhttp.uri=http://webknosos-datastore:9050
```
This hostname (`webknosos-datastore`) does not match any defined service in the docker-compose file. If this is intentional (e.g., for external routing or proxying), please clarify its purpose in the documentation. Otherwise, update this reference to use the correct internal service name.


```

---

🏁 Script executed:

```shell

#!/bin/bash
# Search for any occurrences of "webknosos-datastore" in the repository
rg -n "webknosos-datastore" .
```

Length of output: 151

---



</details>

**Attention: Validate the Hostname in the Tracingstore Service**

In the `.github/docker-compose.yml` file (lines 48-66) for the `webknosos-tracingstore` service, the configuration includes:

```
- -Dhttp.uri=http://webknosos-datastore:9050
```

However, a search in the repository did not reveal any definition or usage of a service named `webknosos-datastore`. This suggests that the hostname may be misconfigured. Please verify whether this reference is intentional (for example, if it points to an external dependent service or proxy) or if it should be corrected—potentially to use the service's own hostname or another valid internal name.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T12:08:16Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 8**

<details>
<summary>🧹 Nitpick comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`79-80`: **Update Docker Buildx Action Version**  
The job is currently using `docker/setup-buildx-action@v2`. Upgrading to a newer version (e.g. v3) may yield improved performance and features.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`97-112`: **Suggestion: Improve Quoting in Environment Variable Derivation**  
In the “Custom environment variables” step, the line  
```bash
NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
```  
would be more robust if the value were quoted (e.g., `echo "${{ github.ref_name }}" …`). This prevents potential issues arising from word splitting.

---

`156-164`: **Suggestion: Quote Docker Tag Variables**  
When specifying tags in the docker/build-push-action step, the tag values (e.g. `${{ env.NORMALIZED_BRANCH }}` and `${{ env.DOCKER_TAG }}`) are not quoted. Quoting these (e.g., `"${{ env.NORMALIZED_BRANCH }}"`) can prevent potential issues with word splitting if unexpected characters appear.

---

`165-171`: **Suggestion: Consistent Tag Quoting in Docker Builds**  
Please ensure that all tag values in docker build steps (for datastore, for example) are quoted consistently to help prevent variable expansion issues.

---

`172-179`: **Suggestion: Quote Docker Tag Variables for Tracingstore**  
As with the previous docker image steps, quoting references to environment variables in the tagging process can improve robustness.

---

`258-264`: **Suggestion: Quote Variables in Docker Tag Commands**  
Within the Docker push step (lines 258–264), the docker tag commands use unquoted variables (e.g., `${DOCKER_TAG}`). Quoting these variables (e.g., `"${DOCKER_TAG}"`) can help prevent word splitting and ensure the commands run reliably.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 9f71353c2f33eed54c53076f92493e47e1e5222b and 115666e53e310443b87a7a5dfb0cf27964cdd1b6.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (8)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary>

`38-67`: **LGTM: Frontend Code Checks Job**  
The static frontend-code checks job is well configured with proper checkout, node setup, caching, and dependency installation.

---

`70-74`: **Verification: Confirm PostgreSQL Host Reference**  
The build job sets  
```yaml
POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
```  
while the docker-compose file later uses `postgres` as the host. Please verify that using `localhost` here is intentional and consistent with your service configuration.

---

`257-257`: **Verification: Conditional Check on github.ref_name**  
The conditional statement  
```bash
if [ -n "${{ github.ref_name }}" ]; then
```  
will likely always be true in this context. Please verify that this condition truly reflects your intent (for example, if you only want to tag and push on certain branch types, consider checking a more specific condition).

</details>
<details>
<summary>.github/docker-compose.yml (5)</summary>

`4-9`: **LGTM: webknossos Service Definition**  
The `webknossos` service is defined with the expected image (using `${DOCKER_TAG}`), port mapping, Java options, and environment variables (including the POSTGRES connection details).

---

`30-47`: **LGTM: webknossos-datastore Service Configuration**  
The datastore service is configured correctly with port 9090, proper volume mounting, and command arguments that set the HTTP URI and other properties.

---

`48-66`: **Verification: Check URI Setting in Tracingstore**  
The `webknossos-tracingstore` service sets its HTTP URI as  
```yaml
-Dhttp.uri=http://webknossos-datastore:9050
```  
This may be a misconfiguration because—given that this service is the tracingstore—it might be more appropriate for the URI to reference itself (for example, `http://webknossos-tracingstore:9050`). Please verify whether this reference is intentional.

---

`79-94`: **LGTM: Postgres Service Configuration**  
The Postgres service sets the database name, user, and password (using environment variable interpolation) and includes a healthcheck. Please ensure that the credentials (provided via `${POSTGRES_USER}` and `${POSTGRES_PASSWORD}`) are supplied securely from your environment.

---

`95-107`: **LGTM: Redis Service Configuration**  
The Redis service is properly configured with an image and a healthcheck. The healthcheck uses a TCP connection test that looks appropriate.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T12:25:48Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`28-35`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Avoid Running as Root and Hardcoded Credentials**

The global environment block sets:
- `USER_NAME: root`
- `POSTGRES_PASSWORD: "secret_password"`

Running the CI job as root increases the attack surface, and hardcoding sensitive credentials is insecure. I recommend using a non‑root user (for example, `webknossos`) and sourcing the PostgreSQL password from GitHub Secrets.

```diff
-  USER_NAME: root
-  POSTGRES_PASSWORD: "secret_password"
+  USER_NAME: webknossos
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>
<details>
<summary>.github/docker-compose.yml (2)</summary><blockquote>

`48-66`: _⚠️ Potential issue_

**Potential Misconfiguration in 'webknossos-tracingstore':**  
The command on line 57 sets `-Dhttp.uri` to `http://webknossos-datastore:9050`, which looks like it might be a copy–paste error. It’s likely that the tracingstore service should reference itself (e.g., `http://webknossos-tracingstore:9050`) since it listens on port 9050. Please verify and correct if necessary.

---

`67-78`: _⚠️ Potential issue_

**Fix Concatenation Error in FossilDB Command:**  
On line 72, the command argument contains `editableMappingsInfomeditableMappingsAgglomerateToGraph`, which appears to be a concatenation error. It likely should be separated into two parameters (for example: `editableMappingsInfo,editableMappingsAgglomerateToGraph`).  

  
*Proposed diff:*
```diff
-      - skeletons,skeletonTreeBodies,volumes,volumeData,volumeSegmentIndex,editableMappingsInfomeditableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate,annotations,annotationUpdates
+      - skeletons,skeletonTreeBodies,volumes,volumeData,volumeSegmentIndex,editableMappingsInfo,editableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate,annotations,annotationUpdates
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`116-119`: **Notice: Use of '|| true' in Docker Pull Command**

In the "Build webknossos-dev docker image" step, the command

  `docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH || true`

suppresses any pull errors. This may hide critical issues if the image pull fails. Please verify that error suppression is intentional. If not, consider removing `|| true` or implementing a proper retry mechanism.

```diff
-          docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH || true
+          docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH
```

---

`254-271`: **Docker Tagging: Quote Variable Expansions and Verify Conditional Check**

In the "Push docker images" block, the docker tag commands use unquoted variable expansions. This can lead to issues if the variables contain spaces or special characters. For example, change:

```diff
-            docker tag \
-              scalableminds/webknosos:${DOCKER_TAG} \
-              scalableminds/webknosos:${NORMALIZED_BRANCH}
+            docker tag \
+              "scalableminds/webknosos:${DOCKER_TAG}" \
+              "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```

Also, double‐check the conditional `if [ -n "${{ github.ref_name }}" ]; then` to ensure it properly identifies the branch context when tagging images.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 115666e53e310443b87a7a5dfb0cf27964cdd1b6 and 7caaf90e2c832a01765882959a8afac452bdb86d.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`79-79`: <details>
<summary>✅ Verification successful</summary>

**Update Docker Buildx Action Version**

The job uses `docker/setup-buildx-action@v2` on line 79. To take advantage of newer features and improvements, please update to version v3:

```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

---



</details>

**Action: Update Docker Buildx Action Version**

After verifying available information on the Docker Buildx Action releases, it's confirmed that updating from v2 to v3 is recommended to leverage the latest features and improvements. Please update the workflow step in `.github/workflows/build_test_deploy.yml` as follows:

- **File:** `.github/workflows/build_test_deploy.yml`  
- **Line:** 79

```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>
<details>
<summary>.github/docker-compose.yml (5)</summary>

`1-3`: **General Structure & Naming Convention:**  
The file starts with a clear naming definition (`webknossos-ci`) and a proper `services:` declaration. The overall structure is clear and aligns well with our multi-service CI environment architecture.

---

`4-29`: **Service 'webknossos' Configuration:**  
The configuration for the `webknossos` service looks solid—with clearly defined image, ports, volumes, and dependency conditions. One minor point: the environment variable `CERTIFICATE` is listed without an explicit value. Please verify that this is intentional and that a default value or external assignment is provided during runtime.

---

`30-47`: **Service 'webknossos-datastore' Configuration:**  
This service is configured appropriately with memory settings, HTTP URI, volume mapping, and the proper dependency on `redis`. The parameters and formatting appear correct.

---

`79-94`: **Postgres Service Configuration Verification:**  
The `postgres` service uses the `postgres:17-bookworm` image and is properly configured with environment variables, volume mapping, and a robust healthcheck. Verify that this version meets the current security and performance requirements.

---

`95-108`: **Redis Service Healthcheck Review:**  
The Redis service is configured with the correct image, command, and a well-constructed healthcheck leveraging a TCP connection test. This looks good for ensuring service availability.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T13:31:21Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 6**

<details>
<summary>🧹 Nitpick comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`68-78`: **LGTM: Build Job Setup**  
The checkout and service–startup steps in the build_test_deploy job are well configured. One note: static analysis recommends upgrading the Buildx action (currently using `docker/setup-buildx-action@v2` on line 79) to v3 for improved features and security.

---

`79-80`: **Action Update Recommendation**  
Static analysis suggests upgrading `docker/setup-buildx-action@v2` to a newer version (e.g. v3). This change can improve performance and security.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`80-82`: **Suggestion: Validate Service Readiness**  
After starting Docker services with  
```bash
docker compose --file .github/docker-compose.yml up -d postgres redis
```  
it would be beneficial to add a readiness check (or a short wait loop) to ensure that both `postgres` and `redis` are healthy before proceeding.

---

`114-116`: **Debug Session: Consider Access Controls**  
The tmate session is conditionally enabled based on the `tmate_debug_build` input. For additional security, consider adding explicit timeout settings and/or permission restrictions so that debug sessions cannot be inadvertently or maliciously enabled.

---

`242-271`: **Docker Push Improvement: Quote Variable Expansions**  
Within the "Push docker images" block, the docker tag commands (e.g., lines 255–258) use unquoted variable expansions such as `${DOCKER_TAG}` and `${NORMALIZED_BRANCH}`. To avoid potential word splitting issues, enclose these variables in double quotes (for example, `"scalableminds/webknossos:${DOCKER_TAG}"`).

---

`244-250`: **Retry Function: Verify Error Handling**  
The custom retry function reattempts docker commands up to 5 times. Please verify that error codes are handled consistently—especially if a command continues to fail—and that this mechanism aligns with your overall reliability strategy.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 7caaf90e2c832a01765882959a8afac452bdb86d and 5901353de21a4b228788449384d74023d0df80a4.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (21)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (16)</summary>

`38-67`: **LGTM: Static Frontend Code Checks**  
The frontend job correctly checks out code, configures Node.js (with caching), and runs linting, typechecking, and cyclic dependency checks.

---

`97-112`: **Clarification: Custom Environment Variables Setup**  
The “Custom environment variables” step calculates `NORMALIZED_BRANCH` and `DOCKER_TAG` based on the branch type. Please double‑check that downstream steps correctly reference these outputs (via `$GITHUB_ENV` and `$GITHUB_OUTPUT`).

---

`132-136`: **LGTM: Frontend Documentation Build**  
The documentation build step uses the GitHub run number as the version. This appears acceptable provided that your versioning strategy is aligned.

---

`138-144`: **LGTM: SBT Build for webknossos**  
The conditional build step correctly distinguishes between the master branch and other branches using `${{ github.ref_name }}`.

---

`145-148`: **LGTM: SBT Build for Datastore and Tracingstore**  
The SBT build steps for the additional projects are structured properly.

---

`152-159`: **LGTM: Docker Image Build for webknossos**  
The Docker build uses the build-push action (v6) with multiple tags. Just ensure that the environment variables `NORMALIZED_BRANCH` and `DOCKER_TAG` (set in the configure step) are correctly propagated.

---

`160-167`: **LGTM: Docker Image Build for Datastore**  
The datastore image build configuration is solid and uses the proper tagging.

---

`168-175`: **LGTM: Docker Image Build for Tracingstore**  
The tracingstore image is built with appropriate tags. Keep an eye on consistency with other image builds.

---

`181-182`: **LGTM: Docker Build for Datastore via Compose**  
The docker compose build step for the datastore image is straightforward.

---

`183-184`: **LGTM: Docker Build for Tracingstore via Compose**  
The docker compose build command for the tracingstore image is well configured.

---

`186-200`: **LGTM: Testing and Linting Steps**  
The conditional steps for linting (frontend and backend) and tests (frontend tests, backend tests) are correctly gated to run only on non‑master branches. Please ensure this condition meets your testing strategy.

---

`214-216`: **LGTM: Frontend Type Validation**  
The frontend type-checking step is properly conditioned and executed.

---

`217-223`: **LGTM: Starting Application Services**  
The commands to start the webknossos, datastore, and tracingstore services via docker compose are clearly defined.

---

`224-234`: **LGTM: Service Smoke Tests**  
The smoke tests for webknossos and its dependent services are configured to check the health endpoints. This should provide a fast feedback loop for service readiness.

---

`235-237`: **LGTM: Stopping Application Services**  
The stop command ensures cleanup of volumes and orphaned containers.

---

`238-241`: **LGTM: Docker Hub Login**  
The login step for Docker Hub correctly uses secrets for authentication.

</details>
<details>
<summary>.github/docker-compose.yml (5)</summary>

`1-29`: **LGTM: Service Definition for webknosos**  
The `webknossos` service is properly defined with the correct image, port mapping, environment variables (including database connection details), and dependencies. Ensure that the environment variables (`POSTGRES_USER`, `POSTGRES_PASSWORD`) are provided securely during deployment.

---

`30-47`: **LGTM: webknossos-datastore Configuration**  
The datastore service has the expected image, port, volume mount, and command settings. The declared HTTP URI and memory settings are consistent.

---

`48-57`: **Service Configuration: Verify HTTP URI for Tracingstore**  
The `webknossos-tracingstore` service sets its HTTP URI with:  
```yaml
-Dhttp.uri=http://webknossos-datastore:9050
```  
This appears inconsistent since tracingstore typically would advertise its own endpoint. Please verify if this reference is intentional; if it is a mistake, update it to the correct service (for example, `http://webknossos-tracingstore:9050`).

---

`79-94`: **LGTM: Postgres Service Configuration**  
The Postgres service uses the `postgres:17-bookworm` image with the proper environment variables and a healthcheck. Ensure that the `${POSTGRES_USER}` and `${POSTGRES_PASSWORD}` values are securely provided.

---

`95-110`: **LGTM: Redis Service Configuration**  
The Redis service is configured with its image, command, port mapping, and a healthcheck that uses a TCP-based test. This configuration appears sound.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T13:48:32Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`28-35`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Avoid Hardcoded Credentials and Running as Root**  
The global environment sets `USER_NAME: root` and hardcodes `POSTGRES_PASSWORD: "secret_password"`. Running CI jobs as root and exposing sensitive credentials are both major security risks. It is recommended to change the user to a non‑root account (for example, `webknosos`) and source the PostgreSQL password from GitHub Secrets. For example:
```diff
-  USER_NAME: root
+  USER_NAME: webknosos
…
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`1-27`: **Enhance Workflow Triggers & Debug Inputs**  
The workflow trigger section now includes push, pull_request, and workflow_dispatch with debug inputs (`tmate_debug_build`, `tmate_debug_e2e_tests`, and `debug_enabled`). To further secure on‑demand debugging, please consider adding a top‑level `permissions` field (e.g. `permissions: { contents: read }`). This ensures that only authorized users can trigger debug sessions.
[security]

---

`79-79`: **Upgrade Docker Buildx Action Version**  
The job uses `docker/setup-buildx-action@v2`, but static analysis recommends updating this to `v3` for improved features and performance.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

---

`97-112`: **Improve Branch Normalization in Environment Configuration**  
In the "Custom environment variables" step, the branch name is normalized using `${{ github.ref_name }}`. For extra safety against word splitting issues, consider quoting the variable during processing. For example, change:
```diff
-            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`114-116`: **Secure TMate Debug Session Access**  
The tmate session step is conditionally executed based on debug inputs. To further minimize the risk of unauthorized debug access, consider enforcing explicit workflow permissions at the top level so that only trusted users can trigger these debug sessions.
[security]

---

`261-264`: **Review Coverage Reporting Error Handling**  
The "Report coverage" step is marked with `continue-on-error: true`, which may inadvertently hide coverage regressions. Consider removing this flag or implementing a coverage threshold so that any significant drop in coverage fails the job.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 5901353de21a4b228788449384d74023d0df80a4 and 4068888300e957b727965ba8b9f44a06d38b4159.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`38-67`: **Static Frontend Code Checks Job Looks Good**  
The `static_frontend_code_checks` job is well configured with appropriate steps for installing dependencies, linting, typechecking, and checking for cyclic dependencies.

---

`68-74`: **Verify Database URL Configuration**  
The `build_test_deploy` job sets `POSTGRES_URL` to `"jdbc:postgresql://localhost:5432/webknossos"`. Please verify that using `localhost` is intentional in your Docker network context—often, the service name (e.g. `postgres`) is used.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T14:07:29Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`28-35`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Global Environment Variables**  
The global environment block sets:
- `USER_NAME: root`  
- `POSTGRES_PASSWORD: "secret_password"`  
Running CI jobs as root and hardcoding sensitive credentials can introduce security risks. Please consider using a dedicated non‑root user (for example, `webknosos`) and sourcing sensitive credentials (like `POSTGRES_PASSWORD`) from GitHub Secrets.  
For example:
```diff
-  USER_NAME: root
+  USER_NAME: webknosos
…
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`3-10`: **Workflow Triggers and Debug Inputs**  
The workflow now triggers on pushes (to master), pull requests (all branches), and also supports manual dispatch with debug-related inputs (`tmate_debug_build`, `tmate_debug_e2e_tests`, and `debug_enabled`). This design provides flexibility for on‑demand debugging.  
However, to tighten security, consider adding an explicit top‑level `permissions` field (for example, `permissions: { contents: read }`) so that only authorized users can trigger these debug sessions.

---

`114-116`: **tmate Session for Debugging**  
The tmate session step is conditionally enabled when the workflow is manually dispatched with `tmate_debug_build` set to true. This is a useful mechanism for on‑demand debugging.  
For additional security, you might consider adding explicit access restrictions (for example via a top‑level `permissions` field) so that only authorized users can initialize debug sessions.

---

`240-275`: **Docker Image Build and Push Steps**  
The Docker image build steps correctly tag images using environment variables set earlier. The subsequent push steps use the retry action to add robustness, which is effective.  
A couple of suggestions:  
1. In the commented-out block (lines 276–285), consider removing legacy code if it’s no longer needed.  
2. Ensure that when referencing variables (e.g. `${{ env.DOCKER_TAG }}` and `${{ env.NORMALIZED_BRANCH }}`) in commands like `docker push`, the variable expansions are quoted to prevent word splitting issues (the current implementation appears acceptable but keep an eye on potential edge cases).

</blockquote></details>
<details>
<summary>.github/actions/retry/action.yml (2)</summary><blockquote>

`1-12`: **Action Metadata and Input Definitions are Clear**

The metadata section and input definitions are well-organized. The required inputs (`run` and `retries`) and the default value for `retry_delay_seconds` are clearly specified.  
Consider adding a note in the descriptions that `retries` and `retry_delay_seconds` should be numeric values to avoid any misconfiguration.

---

`16-22`: **Loop Construction with Brace Expansion May Be Fragile**

The loop on line 18 uses brace expansion:
```bash
for i in {1..${{ inputs.retries }}}; do
```
While GitHub Actions will interpolate `${{ inputs.retries }}` at parse time (turning it into a literal number), brace expansion in Bash does not support variable evaluation at runtime in a robust way. If for any reason the substitution does not produce a proper numeric literal, the loop may fail.  
For improved clarity and robustness, consider using an arithmetic loop. For example:
```diff
-        for i in {1..${{ inputs.retries }}}; do
+        for (( i=1; i<=${{ inputs.retries }}; i++ )); do
```
This change ensures that the loop behaves correctly under all circumstances.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 4068888300e957b727965ba8b9f44a06d38b4159 and 0595cac72bdf6c4b725b691f802c4154756376ac.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/actions/retry/action.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

199-199: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

203-203: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (10)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (9)</summary>

`38-67`: **Static Frontend Code Checks Job**  
The `static_frontend_code_checks` job uses updated actions (e.g. `actions/checkout@v4`) and includes caching, dependency installation, linting, type checking, and cyclic dependency checks. The implementation is clear and follows best practices.

---

`70-74`: **Build Job Environment Setup**  
The job-level environment for `build_test_deploy` sets variables such as `USER_UID`, `USER_GID`, and a `POSTGRES_URL` pointing to `localhost`. This is acceptable if your Docker Compose and service configurations expect the database at localhost. Just verify that this is consistent with other service configurations.

---

`97-112`: **Custom Environment Variables Configuration**  
This step (lines 97–112) dynamically sets `NORMALIZED_BRANCH` and `DOCKER_TAG` based on whether the reference is a branch or not. The use of `$GITHUB_OUTPUT` and `$GITHUB_ENV` is correct and clear.  
One minor suggestion: verify that using `sed 's/[\/-]/_/g'` fully meets your normalization requirements for branch names.

---

`118-124`: **Dependency Folder Preparation and Frontend Dependencies Installation**  
These steps create necessary folders and install frontend dependencies with caching. They are implemented cleanly and help ensure reproducible builds.

---

`125-131`: **Assertion and Migration Checks**  
The steps asserting unique evolution numbers, verifying schema consistency, and checking for complete migrations are clear and add robustness to your database evolution process.

---

`132-136`: **Frontend Documentation Build**  
Building the frontend documentation using the GitHub run number as the project version (via `WK_VERSION`) is a practical solution in the absence of release tags.

---

`138-144`: **SBT Build for Webknossos**  
The conditional SBT build step correctly distinguishes between the `master` branch and others using `${{ github.ref_name }}`. This update from legacy CircleCI variables is spot on.

---

`214-225`: **Smoke Test Steps**  
The steps running smoke tests for webknosos, datastore, and tracingstore use the custom Shell Retry action with appropriate retry counts and delays. These steps look solid.

---

`235-238`: **Docker Login Action**  
The workflow uses `docker/login-action@v3` with credentials sourced from secrets, which is correct and secure.

</details>
<details>
<summary>.github/actions/retry/action.yml (1)</summary>

`23-24`: **Appropriate Use of Environment Variable for Command Execution**

The action sets the `INPUT_COMMAND` environment variable to `${{ inputs.run }}` (line 24) and then uses it within the retry loop. This decouples the input handling from the runtime command execution neatly.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T14:50:37Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`250-254`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Typo: Incorrect input key in retry action**  
In the “Run end-to-end tests” step the retry action is passed an input named `reties` (line 254), which is a typo. Please change this to `retries` so the action receives the correct parameter.  
*Example diff:*
```diff
-          reties: 3
+          retries: 3
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

250-250: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

254-254: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`143-148`: **Style: Quote variable input in shell command**  
In the ‘Custom environment variables’ step the script uses:  
```bash
NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
```  
It is safer to wrap the variable in quotes to avoid word splitting or globbing issues.  
*Suggestion:*
```diff
-  NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+  NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```

---

`247-247`: **Security: Overly permissive folder permissions**  
The command on line 247 uses `chmod 777` for the binaryData folder. This is excessively permissive. Please tighten the permissions (e.g. to `755`) to reduce exposure.  
*Example diff:*
```diff
-        mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+        mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

---

`346-349`: **Consideration: Handling coverage errors**  
The final “Report coverage” step uses `continue-on-error: true`, which might mask critical regression signals in test coverage. Consider either failing the job on coverage errors or implementing a minimum threshold check.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 0595cac72bdf6c4b725b691f802c4154756376ac and ec411a8f38342b0158f2a7125d2fd434cd75d5d6.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

125-125: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

250-250: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

254-254: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary>

`119-119`: **Discrepancy: POSTGRES_URL configuration**  
In this job the POSTGRES_URL is set to `"jdbc:postgresql://localhost:5432/webknossos"`, yet in your Docker Compose file the Postgres service is reached by the hostname `postgres`. Please verify and align these values to avoid connection issues.

---

`260-264`: **Note: Docker image build and service startup sequence**  
The steps starting at line 260 (starting webknossos, datastore, and tracingstore) use a simple `docker compose up -d` sequence. Ensure that these commands work reliably in your environment (and that any required delays or health-check logic is in place).

---

`286-290`: **Approval: Docker login action usage**  
The Docker login step uses `docker/login-action@v3` with credentials from secrets. This approach looks correct for securing your Docker Hub operations.

</details>
<details>
<summary>.github/docker-compose.yml (2)</summary>

`56-60`: **Verification: Check tracingstore HTTP URI**  
In the `webknossos-tracingstore` service, the command at line 60 sets:  
```
-Dhttp.uri=http://webknossos-datastore:9050
```  
Since this is the tracingstore service, please verify that referencing `webknossos-datastore` is intentional. If it should refer to the tracingstore itself (or another correct endpoint), please update accordingly.

---

`20-22`: **Note: Environment variable interpolation**  
The `webknossos` service sets `POSTGRES_USER` and `POSTGRES_PASSWORD` using the syntax `${POSTGRES_USER}` and `${POSTGRES_PASSWORD}`. Ensure that these variables are provided by your external environment or secrets so that the proper values are injected at runtime.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T15:14:35Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>🧹 Nitpick comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary><blockquote>

`3-10`: **Workflow Triggers & Dispatch Inputs – Add Explicit Permissions**  
The “on:” block defines push (to master), pull_request (all branches), and workflow_dispatch with several debug inputs. For improved security—especially when optional debug flags (e.g. `tmate_debug_build`, `tmate_debug_e2e_tests`, `debug_enabled`) can enable sensitive tmate sessions—you should add a top‐level permissions block (e.g. allowing only minimal access such as `contents: read`).  
_A suggested diff:_
```diff
+permissions:
+  contents: read
```

---

`112-116`: **tmate Session for Build Debugging – Consider Additional Access Controls**  
The tmate session step (lines 112–116) is conditionally enabled when the workflow is manually dispatched with `tmate_debug_build`. This is a useful debugging feature; however, debug sessions can expose sensitive runtime details. Consider adding extra security (for example, via the top-level permissions suggested earlier) to restrict who may trigger these sessions.

---

`175-178`: **tmate Session for Later Stage Debugging – Security Consideration**  
Similarly, the tmate session at lines 175–178 is conditionally run when `debug_enabled` is true. As with the previous tmate step, adding explicit restrictions (e.g. through the workflow’s permissions) is recommended to limit debug access.

---

`298-300`: **Coverage Reporting – Avoid Silently Ignoring Failures**  
The “Report coverage” step (lines 298–300) uses `continue-on-error: true` when running the coverage command. Silencing failures here may hide significant regressions. Consider either removing this directive or enforcing a minimum coverage threshold.

---

`243-278`: **Docker Push Steps – Quote Variable Expansions**  
The docker push commands (lines 243–278) reference environment variables without surrounding quotes. Quoting these variables can help prevent word splitting or unexpected behavior if the variables ever contain spaces or special characters.  
_Example diff for one push step:_
```diff
-          run: docker push scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          run: docker push "scalableminds/webknosos:${{ env.DOCKER_TAG }}"
```
[ask_verification]

---

`1-3`: **Overall Workflow Security – Consider Explicit Permissions**  
In addition to the per-step recommendations, we strongly recommend adding an explicit top-level permissions block right after the workflow name (or before the “on:” block) in order to restrict manual dispatch (workflow_dispatch) and debug triggers. This extra layer of control helps ensure that only authorized users can run workflows that might expose sensitive information.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between ec411a8f38342b0158f2a7125d2fd434cd75d5d6 and 3556814d6c562efefa44ed3bd74e0d640aa92d50.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

77-77: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

202-202: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

206-206: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary>

`95-110`: **Custom Environment Variables – Correctly Setting Branch & Docker Tag**  
The “Custom environment variables” step (lines 95–110) correctly determines a normalized branch and a Docker tag based on the GitHub context. The use of GITHUB_OUTPUT and GITHUB_ENV is appropriate.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T15:23:17Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`28-33`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Avoid Running as Root and Hardcoded Credentials**  
The global environment sets `USER_NAME: root` and hardcodes `POSTGRES_PASSWORD` to `"secret_password"`. Running jobs as root and using hardcoded credentials pose significant security risks. Consider modifying these as follows:
```diff
-  USER_NAME: root
+  USER_NAME: webknosos
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`114-116`: **Conditional tmate Debug Session for Build Job**  
The first tmate session step is conditionally triggered based on the `tmate_debug_build` input. This addition is useful for on‑demand debugging; however, please ensure that access to such sessions is properly restricted.

---

`183-186`: **Conditional tmate Debug Session for Post-Build Phase**  
A second tmate session is conditionally enabled via the `debug_enabled` input. As these sessions can expose sensitive runtime information, please review and consider additional access control (e.g. via a top‑level permissions block) for enhanced security.

---

`209-214`: **Correct Retry Input and Error Handling in End-to-End Tests**  
The end-to-end tests step leverages a custom retry action, but the input key is misspelled as `reties` instead of `retries`. Additionally, the inline command combining `&& s=0 && break || s=$?` should be reviewed to ensure proper error propagation.  
```diff
-          reties: 3
+          retries: 3
```

---

`152-162`: **Typo in Docker Build Steps: 'outpus' Field**  
In the Docker build steps for the webknosos, datastore, and tracingstore images, the field `outpus` is used instead of `outputs`. Correcting this typo ensures proper operation of the build action.  
```diff
-          outpus: |
+          outputs: |
```  



Also applies to: 163-172, 173-182

---

`251-286`: **Enhance Docker Push Commands**  
When pushing Docker images, unquoted variable expansions may lead to word splitting issues. It is advisable to quote the variables consistently. For example, update:  
```diff
- docker push scalableminds/webknosos:${{ env.DOCKER_TAG }}
+ docker push "scalableminds/webknosos:${{ env.DOCKER_TAG }}"
```  
Please review similar adjustments in the push steps for the normalized images, datastore, and tracingstore variants.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 3556814d6c562efefa44ed3bd74e0d640aa92d50 and 0f5cb1e34a416e32cfbaba5423ed8f5cf60ace69.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

77-77: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

202-202: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

206-206: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: frontend-tests
* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`36-67`: **Frontend Tests Job Verification**  
The `frontend-tests` job is configured to run on non‑master branches and performs tasks such as installation, linting, type checking, and testing. Please verify that conditionally excluding master (using `if: ${{ github.ref_name != 'master' }}`) aligns with your intended CI strategy.

---

`68-112`: **Custom Environment Variable Configuration**  
In the `build_test_deploy` job, job-level environment variables (e.g. overriding `USER_UID`, `USER_GID`, and setting `POSTGRES_URL`) are defined, and custom variables are computed via the `configure` step. Ensure that using `"jdbc:postgresql://localhost:5432/webknossos"` is intentional (as opposed to a Docker service hostname) and that the normalization logic for branch names meets your requirements.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

77-77: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T08:20:26Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>♻️ Duplicate comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`224-230`: _⚠️ Potential issue_

**Correct Typographical Error in Retry Action Input**

There is a typo in the retry action’s input key: `reties: 3` should be corrected to `retries: 3`. This misspelling may disable the intended retry mechanism. Additionally, please verify that the error-handling logic in the shell command (using constructs like `&& s=0 && break || s=$?`) correctly propagates errors.
```diff
-          reties: 3
+          retries: 3
```

---

`221-222`: _⚠️ Potential issue_

**Tighten Filesystem Permissions for Dependency Folders**

The command in the "Prepare binaryData folder" step uses `chmod 777`, which makes the directory world‑writable. This is excessively permissive and can expose the system to security vulnerabilities. It is recommended that you use a more restrictive mode, such as 755. For example:
```diff
- mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+ mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`3-10`: **Add Top‑Level Permissions for Workflow Security**

The trigger configuration (push to master, pull_request on all branches) does not include a top‑level `permissions` field. Specifying explicit permissions (for example, `permissions: { contents: read }`) would help restrict who can trigger the workflow—particularly important given the debug inputs enabled via workflow_dispatch.

---

`11-27`: **Review Workflow Dispatch Debug Inputs**

The workflow_dispatch block now introduces optional debug inputs (`tmate_debug_build`, `tmate_debug_e2e_tests`, and `debug_enabled`). While these options enhance debugging flexibility, consider enforcing additional restrictions (such as via a top‑level permissions block) to ensure that debug sessions are only activated by authorized users.

---

`121-136`: **Enhance Variable Handling in Custom Environment Setup**

The "Custom environment variables" step correctly constructs `NORMALIZED_BRANCH` and `DOCKER_TAG`. For extra safety against word splitting issues, consider quoting the expansion of `${{ github.ref_name }}` when piping it to `sed`. For example:
```diff
- NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+ NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
```
This ensures that unexpected whitespace or special characters are handled robustly.

---

`176-186`: **Fix Typo in Docker Build Action Configuration**

In the "Build webknosos docker image" step, the key `outpus:` is misspelled; it should be `outputs:`. Correcting this ensures that any intended outputs from the docker build action are correctly processed.
```diff
-          outpus: |
+          outputs: |
```

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 0f5cb1e34a416e32cfbaba5423ed8f5cf60ace69 and 7a1300cdf55c564c0a6a8a0f522e82866398fde0.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

77-77: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

---

202-202: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

206-206: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T08:35:24Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`120-135`: **Enhancement: Quote Environment Variable Expansions**  
In the custom environment variables step, variables like `${{ github.ref_name }}` are passed to commands (using `sed` for instance) without extra quoting. Although branch names typically lack spaces, it is good practice to wrap such expansions in double quotes to handle any unexpected characters robustly.

---

`320-323`: **Review: Coverage Reporting Behavior**  
The "Report coverage" step uses `continue-on-error: true`, which may mask significant issues by allowing the build to pass even if coverage regressions occur. Consider removing the error suppression or implementing a threshold-based fail condition so that any substantial drop in test coverage is reported.

---

`265-300`: **Refactor: Quote Variables in Docker Push Commands**  
In the Docker push steps (e.g. pushing images with tags based on `${{ env.DOCKER_TAG }}` or `${{ env.NORMALIZED_BRANCH }}`), the variable expansions are not quoted. Unquoted expansions can lead to word splitting issues if the variables ever contain unexpected characters. It is advisable to wrap these in double quotes (e.g., `"scalableminds/webknosmos:${{ env.DOCKER_TAG }}"`).

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 7a1300cdf55c564c0a6a8a0f522e82866398fde0 and bf3c1ab19689aa8fab645114e64a65038aba965d.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

184-184: input "outpus" is not defined in action "docker/build-push-action@v6". available inputs are "add-hosts", "allow", "annotations", "attests", "build-args", "build-contexts", "builder", "cache-from", "cache-to", "cgroup-parent", "context", "file", "github-token", "labels", "load", "network", "no-cache", "no-cache-filters", "outputs", "platforms", "provenance", "pull", "push", "sbom", "secret-envs", "secret-files", "secrets", "shm-size", "ssh", "tags", "target", "ulimit"

(action)

---

194-194: input "outpus" is not defined in action "docker/build-push-action@v6". available inputs are "add-hosts", "allow", "annotations", "attests", "build-args", "build-contexts", "builder", "cache-from", "cache-to", "cgroup-parent", "context", "file", "github-token", "labels", "load", "network", "no-cache", "no-cache-filters", "outputs", "platforms", "provenance", "pull", "push", "sbom", "secret-envs", "secret-files", "secrets", "shm-size", "ssh", "tags", "target", "ulimit"

(action)

---

204-204: input "outpus" is not defined in action "docker/build-push-action@v6". available inputs are "add-hosts", "allow", "annotations", "attests", "build-args", "build-contexts", "builder", "cache-from", "cache-to", "cgroup-parent", "context", "file", "github-token", "labels", "load", "network", "no-cache", "no-cache-filters", "outputs", "platforms", "provenance", "pull", "push", "sbom", "secret-envs", "secret-files", "secrets", "shm-size", "ssh", "tags", "target", "ulimit"

(action)

---

225-225: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

229-229: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (4)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: backend_tests
* GitHub Check: frontend-tests
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary>

`36-67`: **Frontend Tests Job – LGTM**  
The `frontend-tests` job is cleanly defined with correct checkout, caching, dependency installation, and testing steps.

---

`68-93`: **Backend Tests Job – LGTM**  
The `backend_tests` job properly sets up the Java environment, installs system dependencies, and runs the linting and backend tests.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T08:55:14Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`1-27`: **Workflow Triggers & Debug Inputs: Consider Adding Explicit Permissions**

The trigger configuration (push on master, pull_request on all branches, and workflow_dispatch with several debug-related boolean inputs) is correctly defined. However, enabling on‑demand debug sessions (via inputs such as `tmate_debug_build`, `tmate_debug_e2e_tests`, and `debug_enabled`) may open up the possibility of unauthorized or inadvertent activation. For enhanced security, please consider adding a top‑level `permissions` block (for example:  
```yaml
permissions:
  contents: read
```
) to explicitly restrict which users can trigger the workflow.

---

`139-141`: **tmate Session for Build Job: Debugging with Caution**

The tmate session step (conditional on `inputs.tmate_debug_build`) is a useful addition for interactive debugging. However, as with other debug-related features, ensure that access to debug sessions is controlled (for example, via the aforementioned top‑level permissions) so that sensitive runtime details are not inadvertently exposed.

---

`267-302`: **Docker Push Steps: Quote Environment Variable Expansions**

The Docker push commands (for webknosos, datastore, and tracingstore images) reference environment variables such as `${{ env.DOCKER_TAG }}` and `${{ env.NORMALIZED_BRANCH }}` without quoting. To prevent potential word‐splitting issues if these variables contain unexpected characters, it is advisable to quote these variables. For example:
```diff
- docker push scalableminds/webknosos:${{ env.DOCKER_TAG }}
+ docker push "scalableminds/webknosos:${{ env.DOCKER_TAG }}"
```
Please review and apply similar quoting to all docker tag/push commands in this block.

---

`326-327`: **Slack Notification TODO: Add Integration Before Merging**

A TODO comment indicates that Slack notifications are planned. Given that integration with Slack was one of the objectives mentioned in the PR, please ensure that the Slack notification step (or a reusable action for notifications) is implemented and tested before merging.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between bf3c1ab19689aa8fab645114e64a65038aba965d and fba9780c83e2bee992305adab6c5caf74e61de83.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

226-226: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

230-230: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: build_test_deploy
* GitHub Check: frontend-tests
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary>

`36-67`: **Frontend Tests Job: Implementation Looks Solid**

The `frontend-tests` job is well structured with checkout, node setup, caching, installation, linting, type checking, and running tests. The usage of `actions/checkout@v4` and caching via `actions/cache@v4` is appropriate. No immediate issues are detected here.

---

`68-93`: **Backend Tests Job: Verify Conditional Execution on Master**

The `backend_tests` job is set up with Java, sbt, and docker-based Postgres startup. Note that both linting and test steps are conditioned with:
```yaml
if: ${{ github.ref_name != 'master' }}
```
Please verify that the decision to skip these steps on the master branch is intentional.

---

`122-137`: **Custom Environment Variables: Good Variable Normalization Logic**

The block under “Custom environment variables” (id: configure) correctly computes a normalized branch name and a Docker tag based on the GitHub context. The use of `sed` for replacement and updating both `$GITHUB_OUTPUT` and `$GITHUB_ENV` is well done.  
If possible, double‐check that the quoting is sufficient for any branch names with special characters, although this appears acceptable.

---

`322-325`: **Coverage Reporting: Avoid Silently Ignoring Failures**

The “Report coverage” step is configured with `continue-on-error: true`. While this allows the workflow to proceed even if coverage tasks fail, it may inadvertently mask a significant drop in test coverage or other issues. Consider either removing the error suppression or implementing a minimum coverage threshold to catch regressions.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T09:01:41Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`28-33`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Secure Environment Variables**

The `POSTGRES_PASSWORD` is currently hardcoded as `"secret_password"`. For improved security, replace it with a GitHub secret reference. For example:

```diff
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

This change will help prevent sensitive credentials from being exposed in the repository.

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary><blockquote>

`1-27`: **Enhance Workflow Security with Explicit Permissions**

Consider adding a top-level `permissions` field to restrict who can manually trigger the workflow via `workflow_dispatch`—especially since debug inputs (like `tmate_debug_build`, `tmate_debug_e2e_tests`, and `debug_enabled`) are exposed. For example, you might add:

```yaml
permissions:
  contents: read
```

This extra layer of control helps prevent inadvertent or unauthorized debug sessions.

---

`155-157`: **tmate Session (Build Job Debug): Security Consideration**

The tmate session step is conditionally executed for debug scenarios using the input `tmate_debug_build`. In addition to this conditional activation, ensure that overall workflow permissions (see the top-level suggestion) further restrict debug session activation to authorized users only.

---

`224-227`: **tmate Session for Post-Build Debugging**

A second tmate session is provided later in the job when the `debug_enabled` input is true. As before, please ensure that adequate permissions restrict who can enable this session.

---

`319-337`: **Remove Unneeded Commented-Out Code**

The block of code for pushing docker images (lines 319–337) is commented out. If it’s no longer needed, please remove it to keep the workflow file clean and maintainable.

---

`342-342`: **Reminder: Slack Notification**

A TODO note indicates that Slack notifications should be added. Ensure that you follow up on this reminder once the current CI pipeline is stable.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between fba9780c83e2bee992305adab6c5caf74e61de83 and b2e7ab02d2c96c827eed283a25468c82039eda66.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

<details>
<summary>.github/workflows/build_test_deploy.yml</summary>

242-242: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

246-246: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (1)</summary>

* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (8)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (8)</summary>

`35-68`: **Frontend Tests: Implementation Looks Good**

The `frontend-tests` job is well structured with proper checkout, caching, dependency installation, linting, type checking, and test execution.

---

`69-109`: **Backend Tests: Verify Dependency Installation**

The `backend-tests` job sets up Node.js and installs dependencies via yarn—even though it’s named “backend-tests” and also sets up Java and sbt. Please verify that installing frontend dependencies in this job is intentional. If these steps aren’t required for backend testing, consider removing them.

---

`138-153`: **Custom Environment Variables: Good Implementation**

The normalization logic for branch names and the assignment of `DOCKER_TAG` appear robust. It uses `sed` to replace problematic characters and then writes the values to both the job’s outputs and environment for later use.

---

`166-172`: **Migration Assertions: Looks Good**

The steps asserting unique evolution numbers, schema consistency, and complete migrations are clear and valuable for maintaining database integrity.

---

`173-177`: **Build Frontend Documentation**

Using the GitHub run number as the project version (`WK_VERSION: ${{ github.run_number }}`) is a valid temporary solution. Confirm that this versioning aligns with your documentation release strategy over time.

---

`178-185`: **Build Webknossos (sbt) Conditional Logic**

The conditional branching for builds—running a full clean compile on master versus using a warning flag on other branches—is implemented correctly. Verify that this behavior meets your deployment requirements.

---

`193-203`: **Build Webknossos Docker Image**

The Docker image is built with two tags based on the normalized branch and Docker tag. This tagging strategy is sound as long as the values from the custom environment variables are reliable.

---

`228-232`: **Backend Linting and Testing: Conditional Execution**

The linting and test steps for the backend run only when `github.ref_name != 'master'`. Confirm that skipping these on the master branch is intentional since it might be desirable to run full checks on the main branch.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T09:12:18Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 4**

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`1-10`: **Workflow Triggers Configuration**  
The pipeline is triggered on pushes to the master branch and all pull requests, which is clear. One suggestion is to add a top‑level `permissions` field (e.g. `permissions: { contents: read }`) to restrict manual (workflow_dispatch) activations and safeguard against inadvertent debug sessions.

---

`138-153`: **Custom Environment Variables and Docker Tag Generation**  
The shell block sets up branch normalization and Docker tag generation. The use of `sed` to replace slashes and hyphens is appropriate. One suggestion: in the else branch, verify that using `"master"` as the Docker tag and `github.ref_name` for NORMALIZED_BRANCH meets your versioning intent. Additionally, consider quoting variable substitutions in the command for extra safety.

---

`251-257`: **Starting Application Services**  
Services (webknossos, datastore, tracingstore) are started sequentially via docker compose. Although this works, you might consider parallelizing these steps for efficiency if startup time becomes an issue.

---

`342-343`: **Slack Notification Placeholder**  
A TODO for Slack Notification is present. Once the integration is finalized, be sure to add a step for sending notifications about build results.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between b2e7ab02d2c96c827eed283a25468c82039eda66 and 4292d4e61098ba97aaaafbb89243d6f3b49c4e2f.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: backend-tests
* GitHub Check: build_test_deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (30)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (30)</summary>

`11-27`: **Manual Dispatch Inputs Defined**  
The workflow_dispatch inputs for `tmate_debug_build`, `tmate_debug_e2e_tests`, and `debug_enabled` are clearly defined with descriptions, types, and defaults. Consider adding further documentation if these options require extra context for maintainability.

---

`36-68`: **Frontend Tests Job Setup**  
The `frontend-tests` job is well configured on ubuntu-24.04. Checkout, Node setup, caching, dependency installation, linting, typechecking, and test execution steps are clearly laid out. The conditional to run only on non‑master branches is acceptable if intentional.

---

`69-92`: **Backend Tests Job Setup**  
The `backend-tests` job uses similar best practices: checking out the code, setting up Node.js, caching dependencies, and then setting up Java and SBT. The inclusion of system dependency installation and starting PostgreSQL is appropriate.

---

`112-133`: **Initial Setup in Build-Test-Deploy Job**  
Steps including code checkout, Docker Buildx (upgraded to v3), Node and Java setups, and SBT configuration follow current best practices. The installation of system dependencies with apt-get is clear.

---

`155-157`: **Debug Session for Build Job**  
The tmate session for the build job is conditionally enabled based on the `workflow_dispatch` event and `tmate_debug_build` input. This is implemented correctly.

---

`159-165`: **Dependency Folders and Frontend Dependencies Installation**  
Creating required folders for dependencies and installing frontend dependencies with yarn are standard practices. No issues noted here.

---

`166-172`: **Database Assertions for Migrations**  
The steps to assert unique evolution numbers, check the schema versus evolutions, and verify migration completeness are a strong quality safeguard. Ensure these commands exit with nonzero status on failure to correctly fail the job if there is an issue.

---

`173-177`: **Frontend Documentation Build**  
The documentation build step uses an environment variable `WK_VERSION` set from `${{ github.run_number }}`. This is a practical approach; just ensure it meets your versioning strategy requirements.

---

`178-189`: **SBT Build Steps for Application Components**  
The sbt build steps for webknossos (both webpack and sbt builds), datastore, and tracingstore are conditionally executed based on whether the branch is master. The logic appears sound and helps enforce stricter build parameters on non-master branches.

---

`190-190`: **Checksum Generation for App Directories**  
Generating an MD5 checksum for app directories is a useful method to detect unintended changes.

---

`193-203`: **Building Webknossos Docker Image**  
The docker image build step uses `docker/build-push-action@v6` with two tags based on `${{ env.NORMALIZED_BRANCH }}` and `${{ env.DOCKER_TAG }}`. Verify that these env variables are set as expected from the earlier configuration.

---

`203-213`: **Building Datastore Docker Image**  
The datastore image is built similarly with appropriate context and tagging. This consistency is beneficial.

---

`214-222`: **Building Tracingstore Docker Image**  
The tracingstore docker image build configuration mirrors the other image builds and is well configured.

---

`224-227`: **Optional Debug Session in Build-Test-Deploy Job**  
A second tmate session is conditionally enabled if `debug_enabled` is true. This mirrors the earlier debug setup and appears correct.

---

`228-230`: **Backend Code Linting Step**  
The linting step for backend code uses sbt commands and is conditionally executed for non‑master branches. This helps catch formatting issues during PRs.

---

`231-232`: **Running Backend Tests**  
The backend tests step, executed conditionally, invokes sbt tests. Ensure that any test failures cause the job to fail as expected.

---

`235-237`: **Starting Fossildb Service**  
The step to start Fossildb via docker compose is straightforward; just verify that the referenced docker-compose file (`.github/docker-compose.yml`) contains the correct configuration for Fossildb.

---

`247-250`: **Frontend Type Validation**  
The yarn typecheck step for frontend types is simple and effective. No changes are needed if it meets your requirements.

---

`258-263`: **Webknossos Smoke Test**  
The smoke test for the webknossos API uses a curl command within a retry action with 20 retries and a 5‑second delay. This robust retry configuration is a good practice to ensure service readiness.

---

`264-268`: **Datastore Smoke Test**  
Similarly, the datastore health check is appropriately configured using the retry action with the same parameters.

---

`269-274`: **Tracingstore Smoke Test**  
The tracingstore smoke test is also properly defined with sufficient retries and delay, ensuring that the service is healthy before proceeding.

---

`275-277`: **Stopping Application Services**  
The step to stop services using docker compose down (with options to remove volumes and orphans) is correctly implemented which helps clean up resources after tests are complete.

---

`278-281`: **Docker Hub Login Step**  
The login step using `docker/login-action@v3` with credentials sourced from GitHub Secrets is secure and correct.

---

`283-288`: **Pushing Webknosos Image**  
The push step for the webknosos image uses a retry mechanism with 5 attempts and a 10‑second delay. Confirm that the environment variable `${{ env.DOCKER_TAG }}` is correctly set by the earlier configuration step.

---

`289-294`: **Pushing Normalized Webknosos Image**  
The normalized image is pushed using the branch‑derived tag. This step appears consistent with your tagging strategy.

---

`295-300`: **Pushing Datastore Image**  
The datastore image push steps (using both DOCKER_TAG and NORMALIZED_BRANCH) mirror the webknosos image push logic and are correctly set up.

---

`301-306`: **Pushing Normalized Datastore Image**  
This step pushes the datastore image tagged with the normalized branch name. The retry parameters are appropriate.

---

`307-312`: **Pushing Tracingstore Image**  
The retry-based push for the tracingstore image using the DOCKER_TAG is set up correctly.

---

`313-318`: **Pushing Normalized Tracingstore Image**  
The corresponding push for the tracingstore image using the normalized branch name is configured in the same robust manner.

---

`319-337`: **Legacy Docker Push Block (Commented Out)**  
There is a commented-out block of legacy Docker push commands. Since this code is not active and you have replaced it with the new retry-based steps, it should be removed if no longer needed.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T09:17:00Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 6**

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`60-91`: **Backend Tests Job – Dependency Installation:**  
In the `backend-tests` job, while checking out code and setting up Java and sbt, there’s also a step to install frontend dependencies (lines 72–74). Please confirm whether installing frontend dependencies is required in this backend testing context, or if this is an oversight that could be eliminated to streamline the job.

---

`120-131`: **Custom Environment Variables Setup:**  
The step with id `configure` uses a shell condition  
```bash
if [[ ${{ github.ref_type }} == "branch" ]]; then
```
to determine how the `NORMALIZED_BRANCH` and `DOCKER_TAG` are defined. Although the logic appears sound, please verify that the interpolation of `${{ github.ref_type }}` in the shell script context behaves as expected. In some cases, you might consider first assigning it to a variable to avoid any ambiguity.

</blockquote></details>
<details>
<summary>.github/slack-notifiaction.sh (2)</summary><blockquote>

`5-14`: **Author Mapping for Slack Notifications**  
Mapping GitHub actor usernames to their Slack mentions via parameter substitution is clear and effective. Consider adding inline documentation explaining the rationale behind each mapping for future maintainability.

---

`27-35`: **Slack API Notification Request**  
The `curl` command is well-structured and uses multiple `-d` options to build the POST request payload. Consider adding an explicit timeout (using `--max-time`) to the request to avoid hanging if Slack’s API is slow to respond.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 4292d4e61098ba97aaaafbb89243d6f3b49c4e2f and ebd45aa717b4c053287a9cc5c8fff33016f1366d.

</details>

<details>
<summary>📒 Files selected for processing (5)</summary>

* `.github/Dockerfile.datastore` (1 hunks)
* `.github/Dockerfile.tracingstsore` (1 hunks)
* `.github/Dockerfile.webknossos` (1 hunks)
* `.github/slack-notifiaction.sh` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 Gitleaks (8.21.2)</summary>

<details>
<summary>.github/Dockerfile.webknossos</summary>

33-33: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.

(jwt)

</details>

</details>
<details>
<summary>🪛 Shellcheck (0.10.0)</summary>

<details>
<summary>.github/slack-notifiaction.sh</summary>

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

---

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: backend-tests
* GitHub Check: build-test-e2e-deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (30)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary>

`36-59`: **Frontend Tests Job – Conditional Execution:**  
The job `frontend-tests` is configured to run only when the branch is not master (`if: ${{ github.ref_name != 'master' }}`). Please verify that this condition is intentional (i.e. tests are not run on master). If the intent is to run tests on all branches or to handle master differently, adjust the condition accordingly.

---

`206-213`: **End-to-End Tests – Retry Configuration:**  
The end-to-end tests step utilizes a custom retry action with `retries: 3`. Please verify that this number of retries is sufficient under variable load conditions. Additionally, ensure that the retry action propagates errors correctly if the test command continues to fail.

---

`285-288`: <details>
<summary>❓ Verification inconclusive</summary>

**Slack Notification Condition:**  
The Slack Notification step is gated with  
```yaml
if: ${{ github.ref_name != 'master' }}  # TODO: Invert !=
```  
The inline comment suggests that the condition might need inversion. Please review whether notifications should be sent on master (or only on non-master branches) and update the condition accordingly.

---



</details>

**Action Required: Clarify Slack Notification Trigger on Master Branch**

The Slack Notification step currently uses:
```yaml
if: ${{ github.ref_name != 'master' }}  # TODO: Invert !=
```
This means that the notification runs on all branches except master. The inline comment indicates that you might have intended the opposite behavior. Please verify if the desired behavior is to trigger Slack notifications only on the master branch. If so, update the condition to:
```yaml
if: ${{ github.ref_name == 'master' }}
```
Otherwise, if notifications should remain only for non-master branches, remove the inline comment to avoid confusion.

</details>
<details>
<summary>.github/slack-notifiaction.sh (4)</summary>

`1-4`: **Strict Error Handling Implementation**  
The use of `set -Eeuo pipefail` ensures robust script execution by failing early on errors. This is a best practice in Bash scripting.

---

`16-21`: **Commit Message Formatting**  
The loop that reformats the commit message to include GitHub issue links is a smart enhancement. Ensure that all commit messages follow the pattern expected by the regex to avoid unexpected results.

---

`36-38`: **Error Handling on Slack Notification**  
The check on the response from Slack using `jq` is a good way to verify success. If maintaining SLAs is critical, you might want to log additional details or trigger an alert.

---

`39-40`: **Informational Logging**  
Logging an informational message after sending the notification helps track successful operations.

</details>
<details>
<summary>.github/Dockerfile.webknossos (7)</summary>

`1-3`: **Base Image and Node Version Argument**  
The Dockerfile selects a recent Eclipse Temurin 21-jammy base image and defines a build argument for Node.js, which is a solid foundation for the container.

---

`4-6`: **Installation of Dependencies and Cleanup**  
Using a chained `RUN` command to install dependencies (Node.js, required libraries, etc.) and cleaning up with `rm -rf /var/lib/apt/lists/*` minimizes the image size. This is a commendable practice.

---

`8-12`: **Working Directory and Build Artifacts**  
The creation of the `/webknossos` directory, followed by setting the working directory and copying the build artifacts, is correctly implemented.

---

`14-20`: **User and Permissions Configuration**  
The Dockerfile properly sets up a dedicated user and group (`webknossos`), adjusts directory permissions, and grants execution rights where needed. This enhances container security and encapsulation.

---

`22-23`: **Entrypoint Script Setup**  
Creating a custom entrypoint script that sets the umask and then executes the application is clearly laid out and correctly implemented.

---

`25-27`: **Healthcheck Configuration**  
The healthcheck uses `curl` to verify the container’s service availability by checking the `/api/buildinfo` endpoint. Ensure that this endpoint reliably indicates service readiness.

---

`35-36`: **Entrypoint and Final Configurations**  
The ENTRYPOINT is set to use the custom entrypoint script, which consolidates startup logic. This configuration is clean and straightforward.

</details>
<details>
<summary>.github/Dockerfile.datastore (9)</summary>

`1-2`: **Base Image Consistency**  
Using the same Eclipse Temurin 21-jammy base image ensures consistency across containers.

---

`3-5`: **Dependency Installation and Cleanup**  
The apt-get commands install only the necessary libraries and clean up afterwards, keeping the image lean.

---

`7-9`: **Datastore Directory and User Setup**  
The creation of the `/webknossos-datastore` directory along with the group and user setup is implemented effectively, ensuring proper access controls.

---

`11-15`: **Working Directory and Build Artifacts**  
Defining the working directory and copying the build outputs from the earlier stage is correctly handled.

---

`17-19`: **File Permission Adjustments**  
The chown and chmod commands correctly set file ownership and permissions, ensuring that executables run with the correct privileges.

---

`21-22`: **Entrypoint Script for Datastore**  
The entrypoint script is created to set a proper umask and execute the datastore binary. This method is clear and effective.

---

`24-25`: **User Context for Execution**  
Switching to the `webknossos` user prior to running the application is a good security measure that limits container privileges.

---

`26-29`: **Healthcheck Configuration**  
The healthcheck is set up to periodically check the datastore’s health via the `/data/health` endpoint. This is a valuable monitoring step to ensure the service remains responsive.

---

`30-33`: **Final Entrypoint and Command Settings**  
The ENTRYPOINT and CMD instructions clearly define the container’s runtime behavior, including JVM options and configuration files, ensuring predictable startup.

</details>
<details>
<summary>.github/Dockerfile.tracingstsore (7)</summary>

`1-2`: **Base Image and Setup**  
The Dockerfile consistently uses Eclipse Temurin 21-jammy and correctly installs the necessary library dependencies.

---

`3-5`: **Dependency Installation and Cleanup**  
The use of apt-get to install dependencies followed by cleanup is well executed, keeping the image size optimized.

---

`7-10`: **Directory Structure and User Configuration**  
The Dockerfile creates the `/webknossos-tracingstore` directory, sets up the `webknossos` user/group, and creates the `tracingData` directory for persistent storage. This structure is clear and appropriate.

---

`12-16`: **Working Directory and Build Artifacts**  
Setting the working directory and copying build artifacts from a previous stage is straightforward and typical for multi-stage builds.

---

`18-20`: **Setting Proper Permissions**  
Adjusting file ownership and permissions ensures the application binary is executable and the necessary directories are writable.

---

`22-23`: **Entrypoint Script Setup**  
Creating an entrypoint script to configure the umask and execute the tracing store binary is well executed.

---

`27-29`: **Healthcheck Configuration**  
The healthcheck is designed to monitor the `/tracings/health` endpoint at port 9050, which helps ensure ongoing service availability.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T10:08:22Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 3**

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`103-114`: **Review: Custom Environment Variables Setup**  
The “Custom environment variables” step (lines 103–114) correctly computes and writes `NORMALIZED_BRANCH` and `DOCKER_TAG` to the GitHub environment. As a suggestion, review whether using `github.run_id` for the `DOCKER_TAG` meets your requirements or if `github.run_number` (or another identifier) would provide a more meaningful tag.

---

`187-188`: **Suggestion: Tighten File Permissions**  
The “Prepare binaryData folder” step on lines 187–188 uses `chmod 777`, which is very permissive and could expose your system to unintended modifications. Consider using a more restrictive permission mode such as `chmod 755` (and adjust ownership if required) to improve security.

---

`232-267`: **Enhancement: Quote Variables in Docker Push Commands**  
In the Docker push steps (lines 232–267), environment variables like `${{ env.DOCKER_TAG }}` and `${{ env.NORMALIZED_BRANCH }}` are interpolated without quotes. Although this may work under normal circumstances, it is safer to enclose these variable expansions in double quotes (for example, `"scalableminds/webknossos:${{ env.DOCKER_TAG }}"`). This helps prevent potential word splitting issues if the variables ever contain unexpected characters.

</blockquote></details>
<details>
<summary>.github/docker-compose.yml (1)</summary><blockquote>

`70-81`: **FossilDB Service Configuration and Command Parameters**

The FossilDB service is configured with its image and detailed startup command. The comma-separated list of command parameters is clear and appears well structured. It is recommended to double-check that the application interprets these parameters as intended.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between ebd45aa717b4c053287a9cc5c8fff33016f1366d and 425bb07ae6c52c7332910b990ef1139f88c238e0.

</details>

<details>
<summary>📒 Files selected for processing (3)</summary>

* `.github/Dockerfile.tracingstore` (1 hunks)
* `.github/docker-compose.yml` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (4)</summary>

* GitHub Check: frontend-tests
* GitHub Check: build-test-e2e-deploy
* GitHub Check: backend-tests
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (17)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary>

`19-42`: **Clarification: Frontend Tests Execution Condition**  
The `frontend-tests` job (lines 19–42) has an `if` condition (`github.ref_name != 'master'`), meaning these tests will be skipped on the master branch. Please confirm that you intend for frontend tests to run only on non‑master branches, or adjust the condition as needed to ensure critical tests run in your desired pipelines.

---

`43-74`: **Clarification: Backend Tests Execution Condition**  
Similarly, the `backend-tests` job (lines 43–74) is conditioned to run only when the branch is not master. Verify whether skipping backend tests on the master branch is intentional; if not, consider modifying or removing this condition to avoid missing critical feedback on your mainline code.

---

`189-196`: **Review: End-to-End Tests Configuration**  
The “Run end-to-end tests” step (lines 189–196) runs a command via a custom retry action. Please verify that the usage of localhost for service addresses (e.g. `-Dtracingstore.fossildb.address=localhost`) correctly reflects your Docker Compose network setup. Ensuring these addresses match the configuration defined in your docker-compose file is important for reliable integration tests.

---

`268-271`: **Action Required: Invert Notification Condition**  
The “Slack Notification” step (lines 268–271) currently runs only if `github.ref_name != 'master'` (as denoted by the inline comment “# TODO: Invert !=”). Please verify whether notifications are meant to be sent for non‑master builds only or if they should be inverted to trigger on master builds—update the condition accordingly.

---

`19-74`: **Consistency Check: Execution Conditions Across Branches**  
Multiple jobs and steps (including those in the `frontend-tests`, `backend-tests`, and several steps in `build-test-e2e-deploy`) are using the condition `github.ref_name != 'master'`. Please confirm that you intentionally want to skip tests (and even some notifications) on the master branch. Consistent handling of the master branch is critical to ensure that your production code is thoroughly tested and validated.  



Also applies to: 187-271

</details>
<details>
<summary>.github/Dockerfile.tracingstore (7)</summary>

`1-5`: **Base Image and Package Installation**

The usage of `eclipse-temurin:21-jammy` is appropriate, and installing the necessary libraries (libblosc1, libbrotli1, libdraco4) followed by cleaning the apt cache helps reduce the final image size.

---

`7-10`: **User and Directory Setup**

The creation of the `/webknossos-tracingstore` directory along with setting up a dedicated group and user (with UID/GID 1000) is well implemented. This ensures proper file ownership and isolation.

---

`12-14`: **Working Directory and Volume Declaration**

Setting the working directory to `/webknossos-tracingstore` and declaring the necessary volumes for persistent storage (tracing data and temporary files) are correctly configured.

---

`16-20`: **Copy and Permission Adjustments**

Copying the application artifacts from `target/universal/stage` and adjusting ownership and permissions (including adding execute permission on the binary) appear to be correctly handled.

---

`22-23`: **Entrypoint Script Creation**

An entrypoint script is generated inline that sets the appropriate umask before executing the binary. Please verify that the inline usage of `"$@"` behaves as intended during runtime—though this is a common pattern, a quick runtime check is recommended.

---

`25-25`: **User Switch**

Switching to the non-root `webknossos` user enhances container security by reducing privileges.

---

`27-29`: **HEALTHCHECK Logic**

The healthcheck uses a curl command targeting `http://localhost:9050/tracings/health` to validate service health. Please confirm that the application indeed serves a health endpoint at `/tracings/health` on the expected port.

</details>
<details>
<summary>.github/docker-compose.yml (5)</summary>

`4-30`: **WebKnossos Service Configuration**

The `webknossos` service is configured with the appropriate image, port mapping (`9000:9000`), command arguments, and dependencies. Ensure that the environment variables (e.g., `CERTIFICATE`, `POSTGRES_USER`) are correctly set in the deployment environment.

---

`31-49`: **WebKnossos-Datastore Service Settings**

The datastore service is well defined with its port mapping (`9090:9090`), volume binding, and command configuration (including the `-Dhttp.uri=http://webknossos-datastore:9090` setting). Its dependency on Redis is clearly stated.

---

`82-97`: **Postgres Service Setup**

The Postgres service is set up with the correct image, environment variables, volume mapping, and a precise healthcheck using `pg_isready`. This configuration aligns with best practices for containerized database services.

---

`98-112`: **Redis Service Configuration**

The Redis service is configured with standard settings, including a simple command to launch the server and a custom healthcheck that verifies connectivity via TCP. This should work reliably in the defined environment.

---

`1-113`: **Overall Docker Compose File Review**

The multi-service Docker Compose configuration effectively organizes the WebKnossos application and its dependencies. Attention should be given to ensuring inter-service communication is correctly configured—particularly, verify that the intended URIs (such as the one for the tracingstore service) match the actual service endpoints.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T11:15:48Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`11-16`: _⚠️ Potential issue_

**Hardcoded Environment Credentials**  
The global environment variables set on lines 11–16 include a hardcoded PostgreSQL password (`POSTGRES_PASSWORD: "secret_password"`). Hardcoding sensitive credentials poses a security risk. Please switch to sourcing such values from GitHub Secrets. For example, you might change:  

```diff
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```  

This change will help protect your credentials during builds.

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`3-10`: **Trigger Configuration Verification**  
The workflow is now triggered on pushes to the master branch and pull requests on all branches. Please confirm that limiting push triggers to only the master branch is intentional and that this behavior aligns with your CI/CD strategy (e.g. running tests on PRs and doing deploys only on master).

---

`43-74`: **Backend Tests Job Verification**  
The `backend-tests` job also runs on Ubuntu 24.04 and sets up Node.js, installs dependencies (interestingly, it installs frontend dependencies as well), sets up Java and sbt, installs system dependencies, brings up PostgreSQL via Docker Compose, and runs backend tests.  
- **Note:** Verify that installing frontend dependencies in the backend testing job is intentional or required for your backend test suite.

</blockquote></details>
<details>
<summary>.github/slack-notification.sh (2)</summary><blockquote>

`24-24`: **Fix Unicode Quotes in Notification Message**

The notification message (line 24) currently uses Unicode curly quotes around the commit message, which may lead to unexpected behavior in some shells. Consider replacing them with standard ASCII quotes.


```diff
-mesg="${author} WEBKNOSSOS docker image \`master__${GITHUB_RUN_ID}\` for “${commitmsg}” is ${buildlink}."
+mesg="${author} WEBKNOSSOS docker image \`master__${GITHUB_RUN_ID}\` for \"${commitmsg}\" is ${buildlink}."
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 Shellcheck (0.10.0)</summary>

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

---

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

</details>

</details>

---

`26-27`: **Validate Slack Token Presence**

Before making the API call to Slack, it would be beneficial to verify that the `SLACK_NOTIFY_TOKEN` environment variable is set. This can prevent unnecessary API calls and provide an early, clear error.


```diff
+if [[ -z "${SLACK_NOTIFY_TOKEN:-}" ]]; then
+  echo "[ERROR] SLACK_NOTIFY_TOKEN is not set. Aborting Slack notification."
+  exit 1
+fi
```

</blockquote></details>
<details>
<summary>.github/docker-compose.yml (2)</summary><blockquote>

`3-30`: **`webknossos` Service Configuration**

The configuration for the main `webknossos` service is comprehensive. The image, port mapping, environment variables, and dependencies are clearly defined.  
Consider adding a healthcheck for this service to further improve reliability during deployment.

---

`70-81`: **`fossildb` Service Command Clarity**

The FossilDB service’s command includes several comma-separated parameters. While the current single-line string is valid, consider splitting or commenting the parts if they represent distinct configuration items for improved readability and maintainability.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 425bb07ae6c52c7332910b990ef1139f88c238e0 and c43c9e5a9dd3951bcb943e9e831a272c7182193c.

</details>

<details>
<summary>📒 Files selected for processing (4)</summary>

* `.github/Dockerfile.tracingstore` (1 hunks)
* `.github/docker-compose.yml` (1 hunks)
* `.github/slack-notification.sh` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* .github/Dockerfile.tracingstore

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 Shellcheck (0.10.0)</summary>

<details>
<summary>.github/slack-notification.sh</summary>

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

---

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (4)</summary>

* GitHub Check: frontend-tests
* GitHub Check: build-test-e2e-deploy
* GitHub Check: backend-tests
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (17)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (7)</summary>

`19-42`: **Frontend Tests Job Review**  
The `frontend-tests` job running on Ubuntu 24.04 checks out the code (using the updated checkout action), installs dependencies, lints, typechecks, and runs tests. Note that the job is conditional (it runs only when the branch is not master, as per the condition on line 21). Please verify that skipping frontend tests on the master branch is intentional.

---

`103-115`: **Custom Environment Variable Setup**  
In the "Custom environment variables" step, the script uses the GitHub context to normalize the branch name and to compute a unique Docker tag (using `${{ github.run_id }}`). The logic is clear and the resulting values are stored to `$GITHUB_ENV`. Ensure that using the run ID for tagging meets your versioning needs.

---

`189-196`: **End-to-End Tests Execution**  
The "Run end-to-end tests" step uses a custom retry action to run the e2e test command via sbt with several system property overrides pointing to `localhost`. Please verify that the use of `localhost` for addresses (instead of the service names defined in Docker Compose) is correct within your testing network context.

---

`268-270`: **Slack Notification Condition Check**  
The Slack Notification step (lines 268–270) runs only when `${{ github.ref_name != 'master' }}`. However, the inline comment (“# TODO: Invert !=") suggests that the condition might need to be reversed. Please review whether Slack notifications should be sent only for non‑master branches or if the condition needs to be inverted.

---

`227-231`: **Docker Login Configuration**  
The Docker login step uses `docker/login-action@v3` with credentials drawn securely from GitHub Secrets. This is configured correctly; just ensure that the secret names used here (i.e. `DOCKER_USER` and `DOCKER_PASS`) match your repository secret definitions.

---

`232-267`: **Docker Image Push Steps Consistency**  
The push steps for the webknosos, datastore, and tracingstore images use a retry action and properly quote variable expansions (e.g. `"scalableminds/webknosos:${{ env.DOCKER_TAG }}"`). This structure is clear and robust. Confirm that the image names and tag formats (using both `${{ env.DOCKER_TAG }}` and `${{ env.NORMALIZED_BRANCH }}`) meet your deployment requirements.

---

`268-270`: **(Reiteration) Slack Notification Condition**  
Note that the notification step is conditionally executed only on non‑master branches. As mentioned earlier, please double-check this logic to ensure that notifications are sent as intended (e.g. if debug notifications should also occur on master or not).

</details>
<details>
<summary>.github/slack-notification.sh (5)</summary>

`1-4`: **Shebang and Strict Mode Initialization**

The shebang and strict error handling options (`set -Eeuo pipefail`) are correctly set to ensure robust execution.

---

`5-14`: **Mapping GitHub Actors to Slack Mentions**

The series of parameter expansions correctly maps GitHub usernames to Slack mentions. The approach is straightforward and readable.

---

`16-21`: **Commit Message Formatting Loop**

The logic to transform pull request references within the commit message into clickable links is implemented clearly. The while‑loop using the regex is a neat touch to ensure all occurrences are handled.

---

`27-35`: **cURL Command for Slack Notification**

The use of `curl` to post the message to Slack is well structured. The passing of multiple `-d` parameters makes the intent clear. Ensure that the provided URL and parameters always match your Slack app configuration.

---

`36-39`: **Handling Slack API Response**

The script appropriately checks the response from the Slack API using `jq` and logs a warning if an error occurs. This error handling is useful for debugging purposes.

</details>
<details>
<summary>.github/docker-compose.yml (5)</summary>

`1-2`: **Compose File Header**

The header defining the name of the compose project (`name: webknossos-ci`) is clear. Ensure that this name is consistent with your CI/CD pipeline naming conventions.

---

`31-49`: **`webknossos-datastore` Service**

The datastore service is properly configured with its image, ports, volumes, command flags, and dependency on Redis. The use of the dynamic tag (`${DOCKER_TAG}`) ensures flexibility.

---

`50-69`: **`webknossos-tracingstore` Service**

The tracingstore service now correctly sets the HTTP URI to reference itself (`http://webknossos-tracingstore:9050`). All command flags and dependencies are configured correctly.

---

`82-97`: **`postgres` Service Configuration**

The Postgres service is configured with the appropriate image, environment variables, port mapping, volume, and a healthcheck using `pg_isready`. This service should reliably support the database backend.

---

`98-112`: **`redis` Service Setup**

The Redis service definition includes the essential image, command, port exposure, and a detailed healthcheck command that validates connectivity. This robust configuration helps ensure the service is ready when required.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T11:48:53Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>🔭 Outside diff range comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`1-273`: _🛠️ Refactor suggestion_

**Overall Workflow and Security Enhancement**  
The overall structure of the CI pipeline is comprehensive, covering frontend, backend, end-to-end testing, image building, and deployment steps. In addition to the detailed comments above, consider these overarching improvements:  
• Secure sensitive credentials by removing hardcoded values and using GitHub Secrets.  
• Tighten file system permissions (e.g. replacing `chmod 777` with `chmod 755`).  
• Verify that workflow trigger conditions (especially for debug and notification steps) match your intended behavior.  
• Consider adding a top‑level `permissions` field (e.g. `permissions: { contents: read }`) to restrict who may manually trigger workflows—this is especially important when debug features (like tmate sessions) are enabled.  
These adjustments will help increase the security and maintainability of your GitHub Actions pipeline.

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`43-74`: **Clarification on Dependency Installation in Backend-Tests Job**  
Within the `backend-tests` job, there’s a step titled “Install frontend dependencies” (line 55). If these dependencies are indeed shared between the frontend and backend tests, then the naming might be acceptable; otherwise, consider renaming the step (or verifying that the correct dependencies are installed) to avoid any confusion.

---

`130-134`: **Documentation Versioning Consideration**  
The “Build frontend documentation” step uses the environment variable `WK_VERSION` set to `${{ github.run_id }}`. While this provides a unique identifier, consider whether a more meaningful version tag (e.g. a commit hash, release tag, or semantic version) might better serve your documentation needs.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between c43c9e5a9dd3951bcb943e9e831a272c7182193c and 85f152828d616bb63b20f15dc54516ffa756c45f.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (4)</summary>

* GitHub Check: backend-tests
* GitHub Check: frontend-tests
* GitHub Check: build-test-e2e-deploy
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary>

`19-42`: **Clarification on Frontend-Tests Job Trigger Condition**  
The `frontend-tests` job is configured with the condition `if: ${{ github.ref_name != 'master' }}`, meaning it will not run for the master branch. Please confirm that this behavior is intentional—for example, if you prefer to run frontend tests only on feature branches.

---

`103-114`: **Review of Custom Environment Variables Setup**  
The script block under “Custom environment variables” correctly computes `NORMALIZED_BRANCH` and `DOCKER_TAG` based on the branch type using `${{ github.ref_name }}` and `${{ github.run_id }}`. Confirm that using `${{ github.run_id }}` meets your project’s tagging/versioning requirements for Docker images.

---

`189-196`: **Validation of End-to-End Test Retry Mechanism**  
The “Run end-to-end tests” step employs a custom retry action with 3 retries. Verify that this retry count and its associated delay timing suit the network or startup variability for your end-to-end tests; adjustments may be needed to ensure test robustness.

---

`150-182`: **Docker Image Build Steps Verification**  
The steps for building Docker images for webknosos, webknosos-datastore, and webknosos-tracingstore use `docker/build-push-action@v6` with tags derived from the environment variables `NORMALIZED_BRANCH` and `DOCKER_TAG`. Ensure that these variables are correctly computed in the earlier “Custom environment variables” step and propagate as expected for downstream operations.

---

`232-267`: **Docker Image Push Steps: Consistent Tagging and Quoting**  
The Docker push steps use a retry action to push images with commands that correctly quote environment variables (e.g. `"scalableminds/webknosos:${{ env.DOCKER_TAG }}"`). This helps prevent word splitting issues. Please double-check that all image tags and retry configurations remain consistent across the different image pushes.

---

`268-272`: **Slack Notification Condition Review**  
The Slack notification step (lines 268–272) is currently conditioned on `${{ github.ref_name != 'master' }}` and includes a comment `# TODO: Invert !=`. Please verify whether notifications should trigger on master or only on non‑master branches, and then update the condition accordingly.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T11:55:09Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 0**

<details>
<summary>♻️ Duplicate comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`190-191`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Tighten Filesystem Permissions for BinaryData Folder**  
The step "Prepare binaryData folder" (line 190) uses `chmod 777`, which is overly permissive and can expose the directory to unintended modifications. It is recommended to use more restrictive permissions, for example:  
```diff
- run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+ run: mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

---

`11-19`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical: Secure Global Environment Variables**  
The global environment block hardcodes sensitive information – notably, `POSTGRES_PASSWORD` is set to `"secret_password"`. This poses a security risk since credentials are exposed in plaintext. Please update it to source the value from GitHub Secrets, for example:  
```diff
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary><blockquote>

`1-10`: **Review Workflow Triggers**  
The workflow is currently triggered on push events only for the master branch and on pull_request events for all branches. Please verify that you intend for pushes on non‑master branches not to trigger the CI pipeline.

---

`105-116`: **Review Custom Environment Variables Calculation**  
The "Custom environment variables" step (lines 105–116) computes `NORMALIZED_BRANCH` and `DOCKER_TAG` based on the GitHub context. The use of `${{ github.run_id }}` for the Docker tag is acceptable if the intention is to incorporate a unique build identifier; however, consider whether a more semantic version or tag might be more meaningful for image management.

---

`132-136`: **Documentation Versioning**  
In the "Build frontend documentation" step (lines 132–136), the documentation is built with `WK_VERSION` assigned from `${{ github.run_id }}`. While this ensures uniqueness, consider whether a semantic version (e.g. from release tags or an incremental build number) might be more appropriate for versioned documentation.

---

`270-272`: **Clarify Slack Notification Condition**  
The "Slack Notification" step (lines 270–272) runs only if `github.ref_name != 'master'` and includes a comment `# TODO: Invert !=`. Please clarify whether Slack notifications should be sent for master builds or for non‑master builds, and update the condition accordingly.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 85f152828d616bb63b20f15dc54516ffa756c45f and 9b5b19f32689336a643d9a2472afdad30b07833f.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (4)</summary>

* GitHub Check: build-test-e2e-deploy
* GitHub Check: backend-tests
* GitHub Check: frontend-tests
* GitHub Check: circleci_build

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T12:04:39Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`45-76`: **Backend Tests Job – Dependency Installation Step Naming**  
Within the `backend-tests` job, the step on line 57 is labeled "Install frontend dependencies" even though this job is meant for backend tests. If these dependencies are shared, it might be clearer to rename the step to a more generic title like "Install dependencies."

---

`192-198`: **End-to-End Tests Step – Retry Action Usage**  
The e2e test step uses a custom retry action with 3 retries. While the retry logic is helpful, you might also consider adding stronger error handling (for example, using `set -euo pipefail` within multi-line shell scripts) to ensure that any unexpected errors terminate the step promptly.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 9b5b19f32689336a643d9a2472afdad30b07833f and 062afc6479af9a3fdd30873dd37b0b8ada451a72.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: build-test-e2e-deploy
* GitHub Check: backend-tests
* GitHub Check: circleci_build

</details>

<details>
<summary>🔇 Additional comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary>

`3-9`: **Workflow Trigger Configuration**  
The new trigger block looks good: it now triggers on push events only for the master branch and on pull requests for all branches. This change aligns with the PR objective of consolidating CI under GitHub Actions.

---

`21-44`: **Frontend Tests Job – Conditional Execution**  
The `frontend-tests` job is configured to run only when `github.ref_name != 'master'`. If this is intentional (i.e. to skip running tests on master), it’s fine. Otherwise, ensure that skipping master branch testing is supported by your release strategy. Otherwise, consider revising the condition.

---

`105-116`: **Custom Environment Variables – Docker Tag and Branch Normalization**  
The shell snippet correctly checks the GitHub ref type and normalizes the branch name using sed. Appending `DOCKER_TAG` and `NORMALIZED_BRANCH` to `$GITHUB_ENV` is a good practice. Verify that using `github.run_id` for the tag is intentional.

---

`270-275`: **Slack Notification Condition Clarification**  
The Slack notification step is conditional on `github.ref_name != 'master'` with a comment “# TODO: Invert !=”. Please clarify whether notifications should be sent only on non‑master branches or on master as well. Adjust the condition accordingly to ensure that critical notifications are not inadvertently suppressed.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T12:08:50Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>🔭 Outside diff range comments (1)</summary><blockquote>

<details>
<summary>docker-compose.yml (1)</summary><blockquote>

`1-2`: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Mismatch in New Docker Compose File Location**

The comment instructs users to use `tools/hosting/docker-compose.yml`, but the PR documentation and related changes indicate that the new Docker Compose file is located at `.github/docker-compose.yml`. Please verify and update the comment to point to the correct file location.

---

Below is a shell script to help verify which Docker Compose file actually exists in the repository:



**Action Required: Update Docker Compose File Reference**

- The note in `docker-compose.yml` currently instructs users to use `tools/hosting/docker-compose.yml`.
- Verification based on the current PR documentation shows that the new Docker Compose file is located at `.github/docker-compose.yml`.
- Please update the comment in `docker-compose.yml` (lines 1-2) to reference the correct file location: `.github/docker-compose.yml`.

---

🏁 Script executed:

```shell

#!/bin/bash
# Check for the new Docker Compose file location
if [ -f ".github/docker-compose.yml" ]; then
  echo "New docker-compose file exists at .github/docker-compose.yml"
else
  echo "New docker-compose file NOT found at .github/docker-compose.yml"
fi

# Check for the old Docker Compose file location mentioned in the comment
if [ -f "tools/hosting/docker-compose.yml" ]; then
  echo "Old docker-compose file exists at tools/hosting/docker-compose.yml"
else
  echo "Old docker-compose file NOT found at tools/hosting/docker-compose.yml"
fi
```

Length of output: 481

---



</details>

**Update Docker Compose Reference to Reflect New File Location**

- In **docker-compose.yml** (lines 1-2), the comment currently directs users to use `tools/hosting/docker-compose.yml`.
- Verification shows that the new Docker Compose file is located at `.github/docker-compose.yml`.
- **Action:** Update the comment in **docker-compose.yml** to instruct users to use `.github/docker-compose.yml` instead.

```diff
- # NOTE: This file is no longer used. Please, use `tools/hosting/docker-compose.yml` instead.
+ # NOTE: This file is no longer used. Please, use `.github/docker-compose.yml` instead.
```

</blockquote></details>

</blockquote></details>

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`189-190`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Restrict Filesystem Permissions for binaryData Folder**  
The command to prepare the binaryData folder uses `chmod 777`, which is overly permissive and may expose the folder to unintended write access. It is advisable to use a more restricted permission mode, such as `755`.  
```diff
-        mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+        mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`105-116`: **Custom Environment Variables: Verify DOCKER_TAG Generation Logic**  
The custom environment variables block correctly normalizes the branch name and constructs a `DOCKER_TAG` using `${{ github.run_id }}`. Consider verifying that using `github.run_id` (a unique run identifier) meets your sequential build numbering requirements. In some cases, you might prefer `${{ github.run_number }}` for a simpler sequential build number.

---

`139-144`: **SBT Build Step: Verify Branch-Dependent Commands**  
The SBT build step conditionally runs a clean compile and stage on master versus a warning-sensitive compile on other branches. Please verify that using  
```bash
if [ "${{ github.ref_name }}" == 'master' ]; then
  sbt clean compile stage
else
  sbt -DfailOnWarning compile stage
fi
```  
meets your intended CI strategy for production versus development builds.

---

`1-1`: **Overall Workflow Configuration**  
The revised GitHub Actions configuration demonstrates a significant improvement over the previous CircleCI setup. The jobs are logically segmented for frontend tests, backend tests, and build–test–e2e–deploy. In addition to the comments above, consider reviewing the following optional improvements:  
- **Caching:** You might add caching for Node.js dependencies (e.g. using `actions/cache@v3`) to further improve build performance.  
- **Permissions:** Although the workflow currently triggers only on push and pull_request (which is secure), if you plan to add manual triggers (workflow_dispatch) in the future, consider a top‑level `permissions` block to limit who can trigger debug sessions.  
Overall, excellent progress on integrating GitHub Actions into your CI/CD pipeline.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 062afc6479af9a3fdd30873dd37b0b8ada451a72 and 5c7e64ec67cbeb2804affdfc0ddecb758f90ef79.

</details>

<details>
<summary>📒 Files selected for processing (7)</summary>

* `.circleci/config.yml` (0 hunks)
* `.circleci/not-on-master.sh` (0 hunks)
* `.circleci/slack-notification.sh` (0 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)
* `Dockerfile.dev` (0 hunks)
* `docker-compose.yml` (1 hunks)
* `start-docker.sh` (0 hunks)

</details>

<details>
<summary>💤 Files with no reviewable changes (5)</summary>

* .circleci/not-on-master.sh
* Dockerfile.dev
* start-docker.sh
* .circleci/config.yml
* .circleci/slack-notification.sh

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (2)</summary>

* GitHub Check: backend-tests
* GitHub Check: build-test-e2e-deploy

</details>

<details>
<summary>🔇 Additional comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (5)</summary>

`21-24`: **Verify Branch Filter for Frontend Tests Job**  
The frontend-tests job is conditioned to run only when the branch is not master (`if: ${{ github.ref_name != 'master' }}`). Please confirm that you intend to skip frontend tests on the master branch.

---

`45-47`: **Confirm Backend Tests Branch Condition**  
Similarly, the backend-tests job is gated with `if: ${{ github.ref_name != 'master' }}`. Verify that backend tests are not intended to run on master—or update the condition if tests should be run for every commit regardless of branch.

---

`153-184`: **Docker Images Build Steps Look Good**  
The docker build steps for webknossos, datastore, and tracingstore correctly use `docker/build-push-action@v6` with proper context and tagging (using both `${{ env.NORMALIZED_BRANCH }}` and `${{ env.DOCKER_TAG }}`). No immediate issues were observed here.

---

`234-269`: **Docker Push Commands Explicitly Quote Variables**  
The steps pushing docker images (for the three services) already use explicit quoting (e.g. `"scalableminds/webknosos:${{ env.DOCKER_TAG }}"`). This is a good practice that helps prevent word‐splitting issues.

---

`270-275`: **Slack Notification Step for Master Branch**  
The Slack Notification step is conditioned to run only when the branch is master. This is appropriate for production notifications. Just ensure that the Slack secret has the proper access restrictions.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T12:41:50Z
user: login: normanrz
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-09T12:48:19Z
user: login: robert-oleynik
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T12:56:14Z
user: login: robert-oleynik
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T12:57:39Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/docker-compose.yml (1)</summary><blockquote>

`1-3`: **CI Identification and Naming**  
The header comment and the name declaration (`name: webknossos-ci`) clearly indicate that this configuration is dedicated to CI. This naming follows the suggestion provided in previous reviews.

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (5)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`45-76`: **Backend Tests Job Setup**  
The `backend-tests` job appears to be correctly configured with steps to check out code, set up Node.js, install dependencies, and even install Java and system packages. One minor note: the step title “Install frontend dependencies” (line 57) in the backend job might be a misnomer if these are actually backend or shared dependencies. Please confirm that the naming is intentional.

---

`105-115`: **Custom Environment Variables Script**  
In the “Custom environment variables” step, you set up `NORMALIZED_BRANCH` and `DOCKER_TAG` based on the value of `${{ github.ref_type }}`. The logic is clean and uses `sed` to normalize branch names. One point to verify: for non‑branch events (e.g. when the ref is a tag), the script defaults `DOCKER_TAG` to “master” and sets `NORMALIZED_BRANCH` to `${{ github.ref_name }}`. Please confirm that this is the intended behavior for your deployment pipeline.

</blockquote></details>
<details>
<summary>.github/slack-notification.sh (2)</summary><blockquote>

`5-14`: **Mapping GitHub Actor to Slack Mentions**  
The series of parameter substitutions mapping the GitHub actor to a Slack username is clear and works as expected. For maintainability and scalability, you might consider storing these mappings in an associative array (if Bash version ≥ 4) instead of hardcoding each substitution. This refactor could simplify future updates if additional mappings are needed.

---

`23-24`: **Slack Message Formatting – Replace Unicode Quotes**  
Line 24 uses Unicode “curly quotes” around the commit message. These can sometimes cause issues in shells or when parsing logs. It is recommended to replace them with standard ASCII quotes.  
```diff
- mesg="${author} WEBKNOSSOS docker image \`master__${GITHUB_RUN_ID}\` for “${commitmsg}” is ${buildlink}."
+ mesg="${author} WEBKNOSSOS docker image \`master__${GITHUB_RUN_ID}\` for \"${commitmsg}\" is ${buildlink}."
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 Shellcheck (0.10.0)</summary>

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

---

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

</details>

</details>

</blockquote></details>
<details>
<summary>.github/docker-compose.yml (1)</summary><blockquote>

`4-113`: **Overall Docker Compose Configuration Consistency**  
All service definitions properly use environment variable expansion, volume mappings, and dependency conditions. A small note: the use of the non-standard field `pull_policy: never` in multiple services should be verified against your compose file version or any custom tooling in your CI/CD pipeline. If this field is a custom extension, ensure that its behavior is well-documented for future maintainers.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 5c7e64ec67cbeb2804affdfc0ddecb758f90ef79 and e6e608c90fb8f76b40e66f8bff1fd18b4dbb8c00.

</details>

<details>
<summary>📒 Files selected for processing (4)</summary>

* `.github/docker-compose.yml` (1 hunks)
* `.github/slack-notification.sh` (1 hunks)
* `.github/workflows/build_test_deploy.yml` (1 hunks)
* `webknossos-jni/src/bucketScanner.cpp` (1 hunks)

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (1)</summary>

* webknossos-jni/src/bucketScanner.cpp

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 Shellcheck (0.10.0)</summary>

<details>
<summary>.github/slack-notification.sh</summary>

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

---

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: frontend-tests
* GitHub Check: build-test-e2e-deploy
* GitHub Check: backend-tests

</details>

<details>
<summary>🔇 Additional comments (16)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary>

`3-10`: **Workflow Trigger Configuration**  
The workflow now triggers on push events to the master branch and on all pull requests (branches: '*'). This configuration is clear and focused. Please double‑check that you intentionally want tests (or builds) to run only on master for push events and on every pull request.

---

`21-44`: **Frontend Tests Job Setup**  
The `frontend-tests` job is well configured on Ubuntu 24.04. Using checkout@v4 and setup-node@v4 is great; note its condition (`if: ${{ github.ref_name != 'master' }}`) restricts this job to non‑master branches. Please verify that you indeed want to skip these frontend tests on master (perhaps because master may use a different deployment strategy).

---

`190-197`: **End-to-End Tests Execution**  
The e2e test step uses your custom retry action to run the sbt command with specific `-D` flags targeting local endpoints. This approach is helpful for robustness. Please verify that using `localhost` for all service addresses (9000, 9090, 9050) correctly reflects your test environment.

---

`229-232`: **Docker Login Action**  
Using the docker/login-action@v3 with credentials retrieved from GitHub Secrets is implemented correctly here.

---

`234-269`: **Docker Push Commands with Retry Mechanism**  
The push steps for webknosos, datastore, and tracingstore images are wrapped within your retry action and all variable interpolations are correctly quoted. This approach enhances robustness and prevents word‐splitting issues.

---

`270-274`: **Slack Notification Step**  
The Slack notification step is conditioned to run only on the master branch and uses a dedicated script with the Slack token supplied via secrets. This integration looks good and aligns with the overall move to GitHub Actions.

</details>
<details>
<summary>.github/slack-notification.sh (4)</summary>

`1-4`: **Script Header and Strict Mode Settings**  
The shebang and strict error-handling options (`set -Eeuo pipefail`) are set correctly, ensuring the script fails fast on errors.

---

`16-21`: **Commit Message Processing and PR Link Conversion**  
The extraction of the latest commit message and its transformation (by replacing pull request references with clickable links) is implemented correctly using the while-loop and regex. Just ensure that the modified commit message does not unintentionally match the regex again, which could lead to an infinite loop for commit messages with multiple PR references.

---

`27-35`: **Sending the Slack Notification via cURL**  
The cURL command to post the message to Slack is well-formed, and the use of a multi-line command with appropriate data fields makes it readable. The retrieval of the Slack token from an environment variable (with a default empty value) is acceptable given that the CI environment should supply it.

---

`36-40`: **Response Handling and Logging**  
The script correctly processes the Slack API response using `jq` and logs a warning if the message was not sent successfully. The final informational log confirms successful notification.

</details>
<details>
<summary>.github/docker-compose.yml (6)</summary>

`4-31`: **`webknossos` Service Configuration**  
The configuration for the `webknossos` service is well-defined:  
- The service image uses a dynamic tag via `${DOCKER_TAG}`.  
- Port mapping, command options, and volume mounts are clear and appropriately set.  
- Environment variables for database connectivity (e.g., `POSTGRES_URL`, `POSTGRES_USER`, and `POSTGRES_PASSWORD`) are correctly injected.  
- The `depends_on` condition ensuring dependent services are healthy adds robustness.  
Overall, this segment aligns well with CI requirements.

---

`32-50`: **`webknossos-datastore` Service Setup**  
The datastore service configuration is consistent:  
- The service is tagged with `${DOCKER_TAG}` and exposes port 9090.  
- The commands correctly set memory parameters and HTTP configurations.  
- The URL settings (for example, `-Dhttp.uri=http://webknossos-datastore:9090`) appear valid within the internal network context.  
This segment is clear and follows the intended design.

---

`51-70`: **`webknossos-tracingstore` Service Adjustments**  
The tracing service now correctly sets its `http.uri` to reference itself (`http://webknossos-tracingstore:9050`), which resolves previous inconsistencies. This change ensures that notifications related to tracing use the correct endpoint.

---

`71-82`: **`fossildb` Service Command and Mounts**  
The FossilDB service is configured with a specific image version (`master__510`) and a command that passes a comma-separated list of configuration parameters. The resolved concatenation (with commas between each entry) is now correct. Volume mappings for data and backup directories are clearly defined.

---

`83-98`: **`postgres` Service with Healthcheck**  
The Postgres service is pinned to a specific image tag (`postgres:17-bookworm`) with environment variables provided via the shell environment. The healthcheck that uses `pg_isready` is well-configured to delay service startup until the DB is ready.

---

`99-113`: **`redis` Service Healthcheck and Configuration**  
The Redis service uses a recent version (`redis:7.4`) and includes a robust healthcheck using a TCP connection test. The command and healthcheck configuration are clear.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T13:03:08Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`191-192`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Overly Permissive File Permissions**

The “Prepare binaryData folder” step uses `chmod 777` on the `binaryData/Organization_X` directory. Using mode 777 is overly permissive and can expose your system to modification risks. It is recommended to use a more restrictive permission (for example, `chmod 755`) to enhance security.  
```diff
- mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+ mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`3-10`: **Workflow Triggers Configuration**

The workflow is now triggered on push to the master branch and pull requests on all branches. This setup is clear and meets the PR’s objective of migrating from CircleCI.  
*Note:* Consider adding a manual trigger (workflow_dispatch) if you want on‑demand debugging or ad hoc runs in the future.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between e6e608c90fb8f76b40e66f8bff1fd18b4dbb8c00 and a05c25384bc38449f20ff710783b2c86f1c99c05.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: build-test-e2e-deploy
* GitHub Check: frontend-tests
* GitHub Check: backend-tests

</details>

<details>
<summary>🔇 Additional comments (6)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (6)</summary>

`21-24`: **Frontend Tests Job Condition**

The `frontend-tests` job is conditioned with `if: github.ref != 'refs/heads/master'`, which means it does not run on the master branch. Please verify if this is the intended behavior. In many CI pipelines, you may want to run tests on master too to catch regressions.

---

`45-48`: **Backend Tests Job Condition**

Similarly, the `backend-tests` job is also skipped on master via the condition `if: github.ref != 'refs/heads/master'`. Please double-check that you want to exclude master from running these tests, or adjust the condition if tests should run on master as well.

---

`105-118`: **Custom Environment Variables Calculation**

The custom environment script correctly computes the branch-based variables (`NORMALIZED_BRANCH` and `DOCKER_TAG`) and exports them to the GitHub Actions environment. The implementation is clear and the use of parameter expansion (to replace slashes and hyphens) is appropriate.

---

`193-199`: **End-to-End Tests with Retry**

The end-to-end tests step uses a custom retry action with `retries: 3` which is a good approach to mitigate transient failures. Ensure that the test command correctly propagates errors if a failure occurs beyond the allowed retries.

---

`237-272`: **Docker Image Push Commands**

The Docker push steps correctly use retry actions and the image tags are appropriately quoted (e.g. `"scalableminds/webknosos:${{ env.DOCKER_TAG }}"`). This minimizes issues due to word splitting in shell commands. The consistent use of retries and delays improves robustness.

---

`273-278`: **Slack Notification Step**

The Slack notification step is configured to run only when not on the master branch, and it uses a secret for `SLACK_NOTIFY_TOKEN`. Ensure that the referenced script `.github/slack-notification.sh` implements proper error handling. Overall, this step is well integrated.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T13:27:31Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`11-16`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical Security Issue: Hardcoded Sensitive Credentials**  
The global environment block currently hardcodes sensitive values (e.g., POSTGRES_URL, POSTGRES_USER, and POSTGRES_PASSWORD). Hardcoding credentials is a major security risk. It is strongly recommended to source these values from GitHub Secrets. For example, update the declarations as follows:  
```diff
-  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
-  POSTGRES_USER: "webknossos_user"
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+  POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (2)</summary><blockquote>

`119-121`: **Debug Session Setup: Consider Restricting Debug Access**  
The workflow sets up a tmate session via `mxschmitt/action-tmate@v3` which can be very useful for on‑demand debugging. However, because debug sessions may expose sensitive runtime information, consider adding a top‑level permissions field (e.g. `permissions: { contents: read }`) or other access restrictions to limit who can trigger these sessions.

---

`1-3`: **Consider Adding Workflow-Level Permissions**  
Although not tied to a specific change segment, note that the workflow currently does not specify a top‑level `permissions` field. Adding explicit permissions (e.g. `permissions: { contents: read }`) can help restrict who may trigger manual dispatch events (especially with debug inputs enabled). This is a recommended security enhancement for the overall CI pipeline.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between a05c25384bc38449f20ff710783b2c86f1c99c05 and fd199b64c583c8584af32d9a64fd376e5f58fc94.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: frontend-tests
* GitHub Check: backend-tests
* GitHub Check: build-test-e2e-deploy

</details>

<details>
<summary>🔇 Additional comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (4)</summary>

`21-44`: **Frontend Tests Job – Looks Good**  
The “frontend-tests” job is well configured: it checks out the code with actions/checkout@v4, sets up Node.js correctly, installs dependencies, performs linting, type checking, and runs tests.

---

`45-76`: **Backend Tests Job – Implementation Appears Correct**  
The “backend-tests” job follows best practices with updated actions for checkout, Node.js, Java, and SBT. The steps such as installing system dependencies, starting PostgreSQL via Docker Compose, linting, and running tests are logically organized.

---

`105-118`: **Custom Environment Variables – Clear but Verify Conditional Logic**  
The custom environment variables step uses a bash snippet to set DOCKER_TAG and NORMALIZED_BRANCH based on the branch type. The use of bash parameter expansion is correct. Just ensure that the condition based on `${{ github.ref_type }}` fits all your cases.

---

`275-280`: **Slack Notification Step – Looks Good**  
The Slack notification step is correctly set up with a conditional run (skipping on master) and securely references the SLACK_NOTIFY_TOKEN from secrets.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T13:32:37Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 1**

<details>
<summary>🔭 Outside diff range comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`1-277`: _🛠️ Refactor suggestion_

**Overall Workflow Security Enhancement: Add Explicit Permissions**  
The workflow does not define a top‑level `permissions` block. Adding explicit permissions (for example:  
```yaml
permissions:
  contents: read
```
) can help restrict who can trigger manual (`workflow_dispatch`) runs—especially given that debug-related inputs are available. This is an important security best practice for CI/CD pipelines.

</blockquote></details>

</blockquote></details>

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (1)</summary><blockquote>

`190-192`: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Filesystem Permissions: Overly Permissive Directory Mode**  
The "Prepare binaryData folder" step creates the directory `binaryData/Organization_X` with permissions set via `chmod 777`, which is overly permissive and can expose your system to security risks. It is recommended to use more restrictive permissions (for example, `755`) as follows:  
```diff
-        mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+        mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`105-117`: **Custom Environment Variable Setup**  
The "Custom environment variables" step builds `NORMALIZED_BRANCH` and `DOCKER_TAG` based on the branch name. The approach using bash substitution (e.g. `"${GITHUB_HEAD_REF//[\/-]/_}"`) is effective; however, note that for non–pull-request events, `GITHUB_HEAD_REF` may be empty. Please verify that the current logic correctly handles all scenarios (push vs. pull_request).

---

`210-216`: **Webknossos Smoke Test Timing**  
The smoke test for webknossos uses curl with 20 retries and a 5‑second delay. These parameters appear robust but consider whether they align with the typical startup time of your service. Adjust if necessary to avoid false negatives.

---

`217-227`: **Datastore & Tracingstore Smoke Tests**  
The subsequent smoke tests for the datastore and tracingstore endpoints follow a similar retry strategy. Ensure that their endpoints (`http://localhost:9090/data/health` and `http://localhost:9050/tracings/health`) are correct and that the retry settings are optimal for your container startup times.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between fd199b64c583c8584af32d9a64fd376e5f58fc94 and e908be4527439a7c679b4ca72fec03950b67a725.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: build-test-e2e-deploy
* GitHub Check: frontend-tests
* GitHub Check: backend-tests

</details>

<details>
<summary>🔇 Additional comments (9)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (9)</summary>

`3-10`: **CI Trigger Configuration Verification**  
The workflow is now triggered by a push to the master branch and by all pull_request events. Please confirm that limiting pushes to only the master branch is intentional and that these trigger settings align with your deployment and testing strategy.

---

`21-44`: **Clarification on Frontend Test Execution**  
The `frontend-tests` job is set to run only when the reference is not master (`if: github.ref != 'refs/heads/master'`). Confirm that you intend to skip these tests on the master branch (e.g. if master represents a production build where tests have already been run) or if they should run on all branches.

---

`45-77`: **Clarification on Backend Test Execution**  
Similarly, the `backend-tests` job condition (`if: github.ref != 'refs/heads/master'`) excludes the master branch from test execution. Please verify that this conditional is intentional so that branch-specific tests run only on pull requests or feature branches.

---

`192-199`: **End-to-End Tests with Retry Logic**  
The e2e tests are executed via a custom retry action that runs an sbt command with specific system properties. Please verify that a retry count of 3 is sufficient for your environment and that any failures from your e2e suite are correctly propagated.

---

`203-209`: **Service Startup Verification**  
The step that starts the webknossos, datastore, and tracingstore services uses docker compose with a set of service names. Please confirm that the service names in the compose file match these references and that no additional environment-specific configuration is required at startup.

---

`236-242`: **Docker Image Push for Webknossos**  
The workflow pushes two tags for the webknossos image – one using `${{ env.DOCKER_TAG }}` and another using `${{ env.NORMALIZED_BRANCH }}`. Please verify that the repository name is spelled correctly and that the tagging strategy meets your deployment and rollback requirements. The use of quotes in the push commands is appropriate.

---

`248-254`: **Docker Image Push for Datastore**  
The push steps for the webknossos-datastore image are consistent with those for the main image. Confirm that both tag variants are intentional and that your downstream deployment processes correctly pull the required tag.

---

`260-266`: **Docker Image Push for Tracingstore**  
Similarly, the push steps for the webknossos-tracingstore image use the same retry parameters and tagging scheme. Ensure that these tags are being set correctly during the build phase and that the push commands run without errors.

---

`272-276`: **Slack Notification Step Verification**  
The final step sends a Slack notification via an external script. Please ensure that `.github/slack-notification.sh` exists, is executable, and securely handles any sensitive output. Also, note that this step runs only if the branch isn’t master—confirm that this conditional is intentional for your notification workflow.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T13:48:16Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 2**

<details>
<summary>🧹 Nitpick comments (4)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary><blockquote>

`45-76`: **Optional: Wait for Postgres Readiness in Backend Tests**  
In the `backend-tests` job you start Postgres with a Docker Compose command but do not explicitly wait for it to become ready before running tests. It’s advisable to add a health‐check loop (or use a dedicated action) to ensure the database is accepting connections. For example:

```diff
-      - name: "Start postgres"
-        run: docker compose --file .github/docker-compose.yml up -d postgres
+      - name: "Start postgres"
+        run: |
+          docker compose --file .github/docker-compose.yml up -d postgres
+          until docker compose --file .github/docker-compose.yml exec postgres pg_isready; do
+            echo "Waiting for Postgres to be ready..."
+            sleep 2
+          done
```

---

`105-117`: **Review: Custom Environment Variables Script**  
The custom script correctly sets `DOCKER_TAG` and `NORMALIZED_BRANCH` using the GitHub context. Please verify that for non‑branch refs (e.g. tags) the values are as intended. You might also consider adding a check or comment explaining the rationale if tags aren’t expected.

---

`231-242`: **Docker Image Push: Proper Quoting and Consistency Check**  
The push steps correctly use quotes around variable interpolations (e.g. `"scalableminds/webknossos:${{ env.DOCKER_TAG }}"`), which prevents issues with word splitting. Verify that the repository name is consistent with what’s defined earlier in the Docker build steps.

</blockquote></details>
<details>
<summary>CHANGELOG.unreleased.md (1)</summary><blockquote>

`22-25`: **Clarity Improvement: Reword Docker Image Numbering Entry**  
The changelog entry under "Changed" on line 24 is ambiguous:  
> `- Numbered docker image no use different and larger numbers. [#8147](...)`

Consider rephrasing it to more clearly communicate the change. For example:  
> **Revised:** "Docker image tags are now generated using a normalized and larger number scheme for improved versioning consistency. [#8147](...)"

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between e908be4527439a7c679b4ca72fec03950b67a725 and 6c455a30cdf0feb08128917a0512c81463ecdb13.

</details>

<details>
<summary>📒 Files selected for processing (2)</summary>

* `.github/workflows/build_test_deploy.yml` (1 hunks)
* `CHANGELOG.unreleased.md` (2 hunks)

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: backend-tests
* GitHub Check: frontend-tests
* GitHub Check: build-test-e2e-deploy

</details>

<details>
<summary>🔇 Additional comments (3)</summary><blockquote>

<details>
<summary>.github/workflows/build_test_deploy.yml (3)</summary>

`21-44`: **Double‑Check Branch Testing Conditions for Frontend Tests**  
The `frontend-tests` job runs only if the ref is not master (`if: github.ref != 'refs/heads/master'`). Confirm that this exclusion is intentional—if you want all branches (including master) to run these tests, the condition may need adjustment.

---

`192-199`: **Good Use of Retry for End-to-End Tests**  
The e2e tests step leverages a custom retry action with a configured retry count. Ensure that the service addresses (e.g. `localhost` for redis and fossildb) match your Docker network configuration. Overall, this approach improves robustness.

---

`272-277`: **Slack Notification Step Looks Correct**  
The Slack notification step uses a separate script with the token pulled from secrets. This is a good practice for exposing notifications only on non‑master branches.

</details>

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-09T14:21:35Z
user: login: normanrz
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-04-10T11:37:28Z
user: login: normanrz
state: APPROVED
author_association: MEMBER
submitted_at: 2025-04-10T11:38:12Z
user: login: coderabbitai[bot]
body: **Actionable comments posted: 0**

<details>
<summary>♻️ Duplicate comments (1)</summary><blockquote>

<details>
<summary>CHANGELOG.unreleased.md (1)</summary><blockquote>

`27-28`: **Grammar Note: Pluralize "docker image" to "docker images".**

The current entry reads:  
`Numbered docker image now use different and larger numbers.`  
Since the verb “use” is plural, it should refer to “docker images”. Please update this to maintain correct subject–verb agreement.  


```diff
- Numbered docker image now use different and larger numbers.
+ Numbered docker images now use different and larger numbers.
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 LanguageTool</summary>

[uncategorized] ~27-~27: The grammatical number of this noun doesn’t look right. Consider replacing it.
Context: ...ebknossos/pull/8106)  - Numbered docker image now use different and larger numbers. [...

(AI_EN_LECTOR_REPLACEMENT_NOUN_NUMBER)

---

[grammar] ~27-~27: Possible subject-verb agreement error.
Context: ...pull/8106)  - Numbered docker image now use different and larger numbers. [#8147](h...

(SINGULAR_NOUN_ADV_AGREEMENT)

</details>

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (1)</summary><blockquote>

<details>
<summary>CHANGELOG.unreleased.md (1)</summary><blockquote>

`47-48`: **Breaking Change Documentation: Confirm Related Updates.**

The breaking change entry clearly documents that `docker-compose.yml` has been removed in favor of `tools/hosting/docker-compose.yml`. Please verify that all associated documentation (e.g., migration guides, internal references) has been updated to reflect this change.

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Pro**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 41e2cf2edea348d870289181d6f7b87a6490a0f3 and 82ebc72738018f480abe314a358fb733a6a7202f.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `CHANGELOG.unreleased.md` (2 hunks)

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 LanguageTool</summary>

<details>
<summary>CHANGELOG.unreleased.md</summary>

[uncategorized] ~27-~27: The grammatical number of this noun doesn’t look right. Consider replacing it.
Context: ...ebknossos/pull/8106)  - Numbered docker image now use different and larger numbers. [...

(AI_EN_LECTOR_REPLACEMENT_NOUN_NUMBER)

---

[grammar] ~27-~27: Possible subject-verb agreement error.
Context: ...pull/8106)  - Numbered docker image now use different and larger numbers. [#8147](h...

(SINGULAR_NOUN_ADV_AGREEMENT)

</details>

</details>

</details>

<details>
<summary>⏰ Context from checks skipped due to timeout of 90000ms (3)</summary>

* GitHub Check: frontend-tests
* GitHub Check: build-test-e2e-deploy
* GitHub Check: backend-tests

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-10T11:40:25Z

Review comments:
diff_hunk: @@ -1,13 +1,208 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: circleci
+  USER_UID: 1000
+  USER_GID: 1000
+  TZ: Europe/Berlin
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontent_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+          node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+
+      - name: Prepare dependency folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Run frontend tests
+        run: .github/not-on-master.sh docker compose run base yarn test-verbose
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
+      - name: Validate frontend types
+        run: .github/not-on-master.sh docker compose run base yarn typecheck
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9000/api/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Run webknossos-datastore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9090/data/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Run webknossos-tracingstore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9050/tracings/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Refactor duplicated health check logic**

The health check implementation is duplicated across three services. Consider extracting this into a reusable composite action:

1. Create `.github/actions/health-check/action.yml`:
```yaml
name: 'Health Check'
description: 'Performs health check with retries'
inputs:
  url:
    description: 'Health check URL'
    required: true
runs:
  using: 'composite'
  steps:
    - shell: bash
      run: |
        for i in {1..20}; do
          curl --fail -v "${{ inputs.url }}" && exit 0
          sleep 5
        done
        exit 1
```

2. Use it in the workflow:
```yaml
- uses: ./.github/actions/health-check
  with:
    url: http://localhost:9000/api/health
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint</summary><blockquote>

153-153: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

153-153: shellcheck reported issue in this script: SC2086:info:5:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

161-161: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

161-161: shellcheck reported issue in this script: SC2086:info:5:7: Double quote to prevent globbing and word splitting

(shellcheck)

---

169-169: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

169-169: shellcheck reported issue in this script: SC2086:info:5:7: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-10-24T14:08:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,208 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: circleci
+  USER_UID: 1000
+  USER_GID: 1000
+  TZ: Europe/Berlin
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontent_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+          node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+
+      - name: Prepare dependency folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Run frontend tests
+        run: .github/not-on-master.sh docker compose run base yarn test-verbose
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
+      - name: Validate frontend types
+        run: .github/not-on-master.sh docker compose run base yarn typecheck
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9000/api/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Run webknossos-datastore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9090/data/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Run webknossos-tracingstore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9050/tracings/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry docker login -u $DOCKER_USER -p $DOCKER_PASS
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
+          docker logout
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Consolidate Docker push retry logic**

The Docker push steps have complex retry logic. Consider:
1. Using GitHub's built-in retry functionality
2. Creating a reusable function for Docker operations

```yaml
- name: Login to Docker Hub
  uses: docker/login-action@v2
  with:
    username: ${{ env.DOCKER_USER }}
    password: ${{ env.DOCKER_PASS }}

- name: Push images
  uses: nick-invision/retry@v2
  with:
    timeout_minutes: 10
    max_attempts: 3
    command: |
      docker compose push webknossos
      docker compose push webknossos-datastore
      docker compose push webknossos-tracingstore
      if [[ ${{ github.ref_type }} == "branch" ]]; then
        # ... tag and push branch images
      fi
```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint</summary><blockquote>

180-180: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</details>

<!-- This is an auto-generated reply by CodeRabbit -->
created_at: 2024-10-24T14:08:09Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,208 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: circleci
+  USER_UID: 1000
+  USER_GID: 1000
+  TZ: Europe/Berlin
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontent_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+          node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Fix shell script quoting issues**

The branch normalization script has potential issues with word splitting. Apply proper quoting:

```diff
  if [[ ${{ github.ref_type }} == "branch" ]]; then
-   NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+   NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
-   echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+   echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
-   DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+   DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
-   echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+   echo "DOCKER_TAG=${DOCKER_TAG}" >> "${GITHUB_ENV}"
```


<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: "Custom environment variables"
        run: |
          if [[ ${{ github.ref_type }} == "branch" ]]; then
            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
            echo "NORMALIZED_BRANCH=${NORMALIZED_BRANCH}" >> "${GITHUB_ENV}"
            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
            echo "DOCKER_TAG=${DOCKER_TAG}" >> "${GITHUB_ENV}"
          else
            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
          fi
`````

</details>
<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint</summary><blockquote>

57-57: shellcheck reported issue in this script: SC2086:info:3:50: Double quote to prevent globbing and word splitting

(shellcheck)

---

57-57: shellcheck reported issue in this script: SC2086:info:5:36: Double quote to prevent globbing and word splitting

(shellcheck)

---

57-57: shellcheck reported issue in this script: SC2086:info:7:38: Double quote to prevent globbing and word splitting

(shellcheck)

---

57-57: shellcheck reported issue in this script: SC2086:info:8:47: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-10-24T14:08:09Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,208 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: circleci
+  USER_UID: 1000
+  USER_GID: 1000
+  TZ: Europe/Berlin
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontent_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+          node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+
+      - name: Prepare dependency folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Run frontend tests
+        run: .github/not-on-master.sh docker compose run base yarn test-verbose
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
+      - name: Validate frontend types
+        run: .github/not-on-master.sh docker compose run base yarn typecheck
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9000/api/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Run webknossos-datastore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9090/data/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Run webknossos-tracingstore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9050/tracings/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry docker login -u $DOCKER_USER -p $DOCKER_PASS
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
+          docker logout
+
path: .github/workflows/build_test_deploy.yml
user: login: hotzenklotz
body: That sound great. Please do it!
created_at: 2024-10-24T15:27:39Z
author_association: MEMBER
diff_hunk: @@ -1,13 +1,208 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: circleci
+  USER_UID: 1000
+  USER_GID: 1000
+  TZ: Europe/Berlin
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontent_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+          node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+
+      - name: Prepare dependency folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Run frontend tests
+        run: .github/not-on-master.sh docker compose run base yarn test-verbose
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
+      - name: Validate frontend types
+        run: .github/not-on-master.sh docker compose run base yarn typecheck
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9000/api/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Run webknossos-datastore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9090/data/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Run webknossos-tracingstore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9050/tracings/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry docker login -u $DOCKER_USER -p $DOCKER_PASS
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
+          docker logout
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: @hotzenklotz, glad you like the suggestion! Here's the updated workflow with the consolidated Docker push retry logic:

```yaml
name: CI Pipeline

on:
  push:
    branches:
      - '*'
  pull_request:
    branches:
      - '*'
  workflow_dispatch:

env:
  USER_NAME: circleci
  USER_UID: 1000
  USER_GID: 1000
  TZ: Europe/Berlin
  DOCKER_USER: ${{ secrets.DOCKER_USER }}
  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}

jobs:
  static_frontent_code_checks:
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          fetch-depth: 5

      - uses: actions/setup-node@v4
        with:
          node-version: 18

      - name: Install frontend dependencies
        run: corepack enable && yarn install --immutable

      - name: Lint frontend code and check formatting
        run: yarn run check-frontend

      - name: Typecheck frontend code
        run: yarn typecheck

      - name: Check for cyclic dependencies in frontend
        run: yarn check-cyclic-dependencies

  build_test_deploy:
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          fetch-depth: 5

      - name: "Custom environment variables"
        run: |
          if [[ ${{ github.ref_type }} == "branch" ]]; then
            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
          else
            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
          fi

      - name: Set up Docker
        uses: docker/setup-buildx-action@v2

      # ... other build and test steps ...

      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ env.DOCKER_USER }}
          password: ${{ env.DOCKER_PASS }}

      - name: Push docker images
        uses: nick-invision/retry@v2
        with:
          timeout_minutes: 10
          max_attempts: 3
          command: |
            docker compose push webknossos
            docker compose push webknossos-datastore
            docker compose push webknossos-tracingstore
            if [[ ${{ github.ref_type }} == "branch" ]]; then
              docker tag scalableminds/webknossos:${{ env.DOCKER_TAG }} scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
              docker push scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
              docker tag scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }} scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
              docker push scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
              docker tag scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }} scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
              docker push scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
              docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${{ env.NORMALIZED_BRANCH }}
              docker push scalableminds/webknossos-dev:${{ env.NORMALIZED_BRANCH }}
            fi

      - name: Logout from Docker Hub
        run: docker logout

      # ... remaining steps ...

```

This update simplifies the retry logic by utilizing the [`nick-invision/retry@v2`](https://github.com/nick-invision/retry) action and the [`docker/login-action@v2`](https://github.com/docker/login-action) for authentication with Docker Hub.

Let me know if you have any questions or need further assistance!

(\^‿^)/

<!-- This is an auto-generated reply by CodeRabbit -->
created_at: 2024-10-24T15:28:43Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,16 @@
+name: 'URL Health Check'
+description: 'Performs URL health check with retries'
+inputs:
+  url:
+    description: 'Health check URL'
+    required: true
+runs:
+  using: 'composite'
+  steps:
+    - shell: bash
+      run: |
+        for i in {1..20}; do
+          curl --fail -v "${{ inputs.url }}" && exit 0
+          sleep 5
+        done
+        exit 1
path: .github/actions/health_check_action.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Enhance security and reliability of the health check implementation.**

Consider the following improvements:
1. Add timeout to prevent hanging requests
2. Validate the URL input
3. Remove verbose flag to prevent potential sensitive information exposure
4. Make retry count and delay configurable

Apply this diff to implement the suggested improvements:

```diff
+inputs:
+  url:
+    description: 'Health check URL'
+    required: true
+  max_attempts:
+    description: 'Maximum number of retry attempts'
+    required: false
+    default: '20'
+  retry_delay:
+    description: 'Delay between retries in seconds'
+    required: false
+    default: '5'
 runs:
   using: 'composite'
   steps:
     - shell: bash
       run: |
-        for i in {1..20}; do
-          curl --fail -v "${{ inputs.url }}" && exit 0
-          sleep 5
+        # Validate URL format
+        if ! [[ "${{ inputs.url }}" =~ ^https?:// ]]; then
+          echo "Error: Invalid URL format. Must start with http:// or https://"
+          exit 1
+        fi
+        
+        for i in $(seq 1 ${{ inputs.max_attempts }}); do
+          echo "Attempt $i of ${{ inputs.max_attempts }}"
+          # Add timeout and remove verbose flag
+          if curl --fail --max-time 30 "${{ inputs.url }}"; then
+            echo "Health check succeeded"
+            exit 0
+          fi
+          echo "Attempt failed, retrying in ${{ inputs.retry_delay }} seconds..."
+          sleep ${{ inputs.retry_delay }}
         done
+        echo "Health check failed after ${{ inputs.max_attempts }} attempts"
         exit 1
```


> Committable suggestion was skipped due to low confidence.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint</summary><blockquote>

[error] 16-16: no new line character at the end of file

(new-line-at-end-of-file)

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-10-28T07:39:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,199 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontend_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+          node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+
+      - name: Prepare dependency folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Run frontend tests
+        run: .github/not-on-master.sh docker compose run base yarn test-verbose
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
+      - name: Validate frontend types
+        run: .github/not-on-master.sh docker compose run base yarn typecheck
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Remove duplicate type checking**

The frontend type checking is already performed in the `static_frontend_code_checks` job (line 38-39).

Consider removing this duplicate step to improve pipeline performance.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-10-28T07:39:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,199 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontend_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+          node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+
+      - name: Prepare dependency folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Run frontend tests
+        run: .github/not-on-master.sh docker compose run base yarn test-verbose
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
+      - name: Validate frontend types
+        run: .github/not-on-master.sh docker compose run base yarn typecheck
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9000/api/health
+          
+
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9050/tracings/health
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry docker login -u $DOCKER_USER -p $DOCKER_PASS
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
+          docker logout
+
+      - name: Report coverage
+        run: .github/not-on-master.sh docker compose run base yarn coverage || true
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Don't silently ignore coverage failures**

The coverage command ignores failures with `|| true`, which could hide important coverage regressions.

Consider:
1. Setting a minimum coverage threshold
2. Making the job fail if coverage drops below the threshold
3. Using a coverage reporting action to track trends

```diff
-        run: .github/not-on-master.sh docker compose run base yarn coverage || true
+        run: |
+          .github/not-on-master.sh docker compose run base yarn coverage
+        continue-on-error: true
```


> Committable suggestion was skipped due to low confidence.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-10-28T07:39:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,199 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontend_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+          node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+
+      - name: Prepare dependency folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Replace sleep with proper postgres readiness check**

Using `sleep` is not reliable for ensuring postgres is ready. Consider using a proper health check.

```diff
-          sleep 3
+          until docker compose exec -T postgres pg_isready; do
+            echo "Waiting for postgres..."
+            sleep 1
+          done
```


<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Assert schema.sql and evolutions are equal
        run: |
          docker compose up -d postgres
          until docker compose exec -T postgres pg_isready; do
            echo "Waiting for postgres..."
            sleep 1
          done
          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
`````

</details>
<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2024-10-28T07:39:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -105,8 +105,8 @@ services:
       - POSTGRES_USER=webknossos_user
       - POSTGRES_PASSWORD=secret_password
       - HOME=/root
-      - CIRCLE_TAG=${CIRCLE_TAG}
-      - CIRCLE_BUILD_NUM=${CIRCLE_BUILD_NUM}
+      - CI_TAG=${GITHUB_REF}
+      - CI_BUILD_NUM=${GITHUB_JOB}
path: docker-compose.yml
user: login: coderabbitai[bot]
body: _:bulb: Codebase verification_

_:warning: Potential issue_

**Environment variables need adjustment for GitHub Actions**

Based on the usage in `project/BuildInfoSettings.scala`, these variables are used to populate build information. The current mappings need to be corrected:

1. `CI_TAG=${GITHUB_REF}` - This will include the full ref path, making `ciTag` contain unwanted prefixes like "refs/tags/" or "refs/heads/"
2. `CI_BUILD_NUM=${GITHUB_JOB}` - This will store the job name instead of a build number in `ciBuild`, which differs from the previous behavior

Suggested fix:
```diff
-      - CI_TAG=${GITHUB_REF}
-      - CI_BUILD_NUM=${GITHUB_JOB}
+      - CI_TAG=${GITHUB_REF_NAME}
+      - CI_BUILD_NUM=${GITHUB_RUN_NUMBER}
```

- `GITHUB_REF_NAME` provides just the branch/tag name without the "refs/*/" prefix
- `GITHUB_RUN_NUMBER` provides a sequential number for the workflow runs, similar to the previous CI build number



<details>
<summary>🔗 Analysis chain</summary>

**Review environment variable mappings for GitHub Actions.**

The current mappings might not provide equivalent values:
1. `GITHUB_REF` includes the full reference path (e.g., 'refs/heads/main', 'refs/tags/v1.0.0') unlike `CIRCLE_TAG` which only contained the tag name.
2. `GITHUB_JOB` provides the job name, not a sequential build number like `CIRCLE_BUILD_NUM`.


Consider these alternatives:
```diff
-      - CI_TAG=${GITHUB_REF}
-      - CI_BUILD_NUM=${GITHUB_JOB}
+      - CI_TAG=${GITHUB_REF#refs/tags/}
+      - CI_BUILD_NUM=${GITHUB_RUN_NUMBER}
```

Let's verify the usage of these variables:

---

Let me gather more context about how these variables might be used in the application code.

</details>

<details>
<summary>🏁 Scripts executed</summary>

The following scripts were executed for the analysis:

Script:

```shell
#!/bin/bash
# Search for CI_TAG and CI_BUILD_NUM usage in the codebase
rg "CI_(TAG|BUILD_NUM)" --type-add 'config:*.{yml,yaml,json,conf,properties}' -t config

```

Length of output: 191

---

Script:

```shell
#!/bin/bash
# Search for CI_TAG and CI_BUILD_NUM usage in all files
rg "CI_(TAG|BUILD_NUM)" -A 3 -B 3

# Also check for any shell scripts that might use these variables
fd ".sh$" --exec grep -l "CI_TAG\|CI_BUILD_NUM" {} \;

```

Length of output: 1350

</details>

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-10-28T07:39:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,199 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: webknossos
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontend_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+          node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+
+      - name: Prepare dependency folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable && yarn cache clean
+
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Consider parallelizing build steps**

The build steps for webknossos, datastore, and tracingstore are running sequentially. Consider using GitHub Actions' job parallelization to speed up the pipeline:

1. Split the builds into separate jobs
2. Use job outputs to share build artifacts
3. Use job dependencies to maintain the correct order


Example structure:
```yaml
jobs:
  build-webknossos:
    # ... build webknossos
    outputs:
      checksum: ${{ steps.checksum.outputs.value }}

  build-datastore:
    needs: build-webknossos
    # ... build datastore

  build-tracingstore:
    needs: build-webknossos
    # ... build tracingstore

  tests:
    needs: [build-webknossos, build-datastore, build-tracingstore]
    # ... run tests
```

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2024-10-28T08:05:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,199 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  # USER_NAME: root
+  # USER_UID: 1000
+  # USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontend_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+          node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+
+      - name: Prepare dependency folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable && yarn cache clean
+
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Run frontend tests
+        run: .github/not-on-master.sh docker compose run base yarn test-verbose
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
+      - name: Validate frontend types
+        run: .github/not-on-master.sh docker compose run base yarn typecheck
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9000/api/health
+          
+
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9050/tracings/health
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Consider using GitHub Actions' built-in retry functionality**

Instead of implementing a custom retry function, consider using GitHub Actions' built-in retry functionality with the `nick-invision/retry@v2` action:

```yaml
- uses: nick-invision/retry@v2
  with:
    timeout_minutes: 10
    max_attempts: 5
    command: docker login -u "${DOCKER_USER}" -p "${DOCKER_PASS}"
```

This approach provides better logging and integration with GitHub Actions.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2024-10-28T08:12:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -8,6 +8,7 @@ RUN curl -sL "https://deb.nodesource.com/setup_${VERSION_NODE}" | bash - \
 RUN mkdir -p /webknossos
 WORKDIR /webknossos
 
+# Copy compiled Scala output from a previous build step, e.g. output of the Docker-dev image
 COPY target/universal/stage .
path: Dockerfile
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Consider validating the copied Scala artifacts.**

While the COPY command is correct, consider adding validation to ensure the required Scala artifacts are present and complete.

Consider adding a validation step:

```diff
 # Copy compiled Scala output from a previous build step, e.g. output of the Docker-dev image
 COPY target/universal/stage .
+RUN test -f bin/webknossos && \
+    test -d lib || \
+    (echo "Error: Required Scala artifacts are missing" && exit 1)
```


<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
# Copy compiled Scala output from a previous build step, e.g. output of the Docker-dev image
COPY target/universal/stage .
RUN test -f bin/webknossos && \
    test -d lib || \
    (echo "Error: Required Scala artifacts are missing" && exit 1)
`````

</details>
<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-10-28T12:59:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,217 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontend_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java / SBT
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      
+      - name: Install dependencies
+        run: apt-get update \
+          && apt-get install -y \
+          findutils \
+          libdraco-dev \
+          libblosc1
+
+                    # build-essential \
+          # cmake \
+      # - name: Set up Docker
+      #   uses: docker/setup-buildx-action@v2
+
+      # - name: Build webknossos-dev docker image
+      #   run: |
+      #     docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+      #     DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Install frontend dependencies
+      #   run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable && yarn cache clean
+
+      # - name: Assert unique evolution numbers
+      #   run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Run frontend tests
+        run: .github/not-on-master.sh docker compose run base yarn test-verbose
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9000/api/health
+          
+
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9050/tracings/health
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry docker login -u $DOCKER_USER -p $DOCKER_PASS
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
+          docker logout
+
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          yarn run docs --project-version $WK_VERSION
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Add error handling to documentation build**

The documentation build step should fail the workflow if there are any errors.

```diff
      - name: Build frontend documentation
        run: |
+         set -eo pipefail
          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
-         yarn run docs --project-version $WK_VERSION
+         yarn run docs --project-version "${WK_VERSION}"
```


<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Build frontend documentation
        run: |
          set -eo pipefail
          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
          yarn run docs --project-version "${WK_VERSION}"

`````

</details>
<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2024-10-28T12:59:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,217 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontend_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java / SBT
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      
+      - name: Install dependencies
+        run: apt-get update \
+          && apt-get install -y \
+          findutils \
+          libdraco-dev \
+          libblosc1
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Optimize apt-get commands**

The apt-get installation can be optimized to reduce the image size and improve build time.

```diff
-      - name: Install dependencies
-        run: apt-get update \
-          && apt-get install -y \
-          findutils \
-          libdraco-dev \
-          libblosc1
+      - name: Install dependencies
+        run: |
+          apt-get update && apt-get install -y --no-install-recommends \
+            findutils \
+            libdraco-dev \
+            libblosc1 \
+          && rm -rf /var/lib/apt/lists/*
```


<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Install dependencies
        run: |
          apt-get update && apt-get install -y --no-install-recommends \
            findutils \
            libdraco-dev \
            libblosc1 \
          && rm -rf /var/lib/apt/lists/*
`````

</details>
<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2024-10-28T12:59:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,217 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
+  static_frontend_code_checks:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Add yarn cache to improve CI performance**

Consider using GitHub's cache action for yarn dependencies to speed up the CI pipeline.

```diff
    - uses: actions/setup-node@v4
      with:
        node-version: 18
+       cache: 'yarn'
+
+   - name: Get yarn cache directory path
+     id: yarn-cache-dir-path
+     run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
+
+   - uses: actions/cache@v3
+     id: yarn-cache
+     with:
+       path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+       key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+       restore-keys: |
+         ${{ runner.os }}-yarn-

    - name: Install frontend dependencies
      run: corepack enable && yarn install --immutable
```


<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
    - uses: actions/setup-node@v4
      with:
        node-version: 18
        cache: 'yarn'

    - name: Get yarn cache directory path
      id: yarn-cache-dir-path
      run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT

    - uses: actions/cache@v3
      id: yarn-cache
      with:
        path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
        restore-keys: |
          ${{ runner.os }}-yarn-

    - name: Install frontend dependencies
      run: corepack enable && yarn install --immutable
`````

</details>
<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 48d4736
created_at: 2024-10-28T12:59:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,223 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Align Ubuntu versions across jobs**

The `static_frontend_code_checks` job uses `ubuntu-24.04` while `build_test_deploy` uses `ubuntu-20.04`. This inconsistency could lead to environment differences. Consider using the same Ubuntu version for both jobs.



Also applies to: 46-46

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 252c647
created_at: 2024-10-28T13:34:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,223 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      POSTGRES_HOST: localhost
+      POSTGRES_PORT: 5432
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_DB: webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Use secrets for database credentials**

Database credentials are currently hardcoded in the workflow file. Consider using GitHub secrets:
```diff
-            POSTGRES_DB: webknossos
-            POSTGRES_USER: webknossos_user
-            POSTGRES_PASSWORD: secret_password
+            POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
+            POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+            POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```



<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
            POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
            POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
            POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
`````

</details>
<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-10-28T13:34:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,223 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      POSTGRES_HOST: localhost
+      POSTGRES_PORT: 5432
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_DB: webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java / SBT
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y \
+          libdraco-dev \
+          libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9000/api/health
+          
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9050/tracings/health
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry docker login -u $DOCKER_USER -p $DOCKER_PASS
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
+          docker logout
+
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          yarn run docs --project-version $WK_VERSION
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Improve documentation version handling**

The current version fallback chain could be more explicit:
```diff
-          WK_VERSION=${{ github.event.release.tag_name || github.run_number || 'dev' }}
+          WK_VERSION=$(
+            if [ -n "${{ github.event.release.tag_name }}" ]; then
+              echo "${{ github.event.release.tag_name }}"
+            elif [ "${{ github.ref }}" = "refs/heads/master" ]; then
+              echo "${{ github.run_number }}"
+            else
+              echo "dev"
+            fi
+          )
```



<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Build frontend documentation
        run: |
          WK_VERSION=$(
            if [ -n "${{ github.event.release.tag_name }}" ]; then
              echo "${{ github.event.release.tag_name }}"
            elif [ "${{ github.ref }}" = "refs/heads/master" ]; then
              echo "${{ github.run_number }}"
            else
              echo "dev"
            fi
          )
          yarn run docs --project-version $WK_VERSION
`````

</details>
<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-10-28T13:34:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,223 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      POSTGRES_HOST: localhost
+      POSTGRES_PORT: 5432
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_DB: webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java / SBT
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y \
+          libdraco-dev \
+          libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Optimize Docker builds with layer caching**

Consider using BuildKit's cache features to speed up builds:
```diff
-        run: docker compose build --pull webknossos-datastore
+        run: |
+          DOCKER_BUILDKIT=1 docker compose build \
+            --pull \
+            --build-arg BUILDKIT_INLINE_CACHE=1 \
+            webknossos-datastore
```



<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Build webknossos docker image
        run: |
          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos

      - name: Build webknossos-datastore docker image
        run: |
          DOCKER_BUILDKIT=1 docker compose build \
            --pull \
            --build-arg BUILDKIT_INLINE_CACHE=1 \
            webknossos-datastore

      - name: Build webknossos-tracingstore docker image
        run: docker compose build --pull webknossos-tracingstore
`````

</details>
<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint</summary><blockquote>

141-141: shellcheck reported issue in this script: SC2086:info:1:38: Double quote to prevent globbing and word splitting

(shellcheck)

</blockquote></details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2024-10-28T13:34:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,223 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
 
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      POSTGRES_HOST: localhost
+      POSTGRES_PORT: 5432
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_DB: webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java / SBT
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y \
+          libdraco-dev \
+          libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:bulb: Codebase verification_

**These database validation steps should be uncommented and fixed**

The commented-out steps are critical database schema validation checks that:
1. Ensure evolution numbers are unique (`assert-unique-evolution-numbers`)
2. Verify schema.sql matches the evolutions (`check-evolutions-schema`)

These checks are important as evidenced by:
- The `dbtool.js` script contains active implementations of these commands
- The script is actively used in other parts of the codebase for database validation
- No alternative validation steps exist in the workflow file



<details>
<summary>🔗 Analysis chain</summary>

**Clean up commented code blocks**

Several steps are commented out but seem important for database schema validation. Either:
1. Remove these comments if they're no longer needed
2. Uncomment and fix them if they're still required

---

Let me check how these database tools are actually used to determine if the commented steps are still needed.

---

Let me check if these database validation steps are replaced by other mechanisms in the workflow.

</details>

<details>
<summary>🏁 Scripts executed</summary>

The following scripts were executed for the analysis:

Script:

```shell
#!/bin/bash
# Check if these database tools are used elsewhere
rg -l "dbtool.js"

```

Length of output: 217

---

Script:

```shell
#!/bin/bash
# Check the content of files that use dbtool.js
rg "dbtool\.js" -C 3

# Also check if there are any other similar database schema validation tasks
rg "schema" .github/workflows/ -C 3

```

Length of output: 6445

---

Script:

```shell
#!/bin/bash
# Check the entire workflow file for other database validation steps
cat .github/workflows/build_test_deploy.yml

# Also check if dbtool.js exists and what commands it supports
cat tools/postgres/dbtool.js 2>/dev/null || echo "File not found"

```

Length of output: 21423

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 1dc8f7c
created_at: 2024-10-28T13:34:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,234 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_DB: webknossos
+            POSTGRES_USER: postgres
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Optimize SBT build configuration**

The SBT build could be optimized:
1. Use `.sbtopts` file for common options
2. Enable parallel execution
3. Configure memory settings

```diff
    - name: Build webknossos (sbt)
      run: |
+       echo "-J-Xmx4G" > .sbtopts
+       echo "-J-Xms2G" >> .sbtopts
+       echo "-Dsbt.parallel=true" >> .sbtopts
        if [ "${{ github.ref }}" == "refs/heads/master" ]; then
-         sbt -no-colors clean compile stage
+         sbt clean compile stage
        else
-         sbt -no-colors -DfailOnWarning compile stage
+         sbt -DfailOnWarning compile stage
        fi
```



<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Build webknossos (sbt)
        run: |
          echo "-J-Xmx4G" > .sbtopts
          echo "-J-Xms2G" >> .sbtopts
          echo "-Dsbt.parallel=true" >> .sbtopts
          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
            sbt clean compile stage
          else
            sbt -DfailOnWarning compile stage
          fi
`````

</details>
<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2024-10-28T14:06:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,245 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Security: Avoid running as root user**

Running containers as root user is a security risk. Consider using a non-root user with minimal required permissions.

```diff
-  USER_NAME: root
+  USER_NAME: webknossos
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
  USER_NAME: webknossos
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2024-11-11T15:48:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,245 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Add error handling to frontend checks**

The frontend check commands should fail fast if any check fails. Add proper error handling:

```diff
    - name: Lint frontend code and check formatting
      run: |
+       set -euo pipefail
        yarn run check-frontend

    - name: Typecheck frontend code
      run: |
+       set -euo pipefail
        yarn typecheck

    - name: Check for cyclic dependencies in frontend
      run: |
+       set -euo pipefail
        yarn check-cyclic-dependencies
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
    - name: Lint frontend code and check formatting
      run: |
        set -euo pipefail
        yarn run check-frontend

    - name: Typecheck frontend code
      run: |
        set -euo pipefail
        yarn typecheck

    - name: Check for cyclic dependencies in frontend
      run: |
        set -euo pipefail
        yarn check-cyclic-dependencies
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2024-11-11T15:48:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,245 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://webknossos_user:secret_password@localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://webknossos_user@localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          PGUSER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+          PGPASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Fix shell script quoting in retry logic**

The retry logic needs proper quoting and error handling:

```diff
  run: |
+   set -euo pipefail
    for i in {1..3}; do # retry
-     .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+     if .github/not-on-master.sh docker compose run e2e-tests; then
+       s=0
+       break
+     else
+       s=$?
+     fi
    done
-   (exit $s)
+   (exit "${s}")
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
        run: |
          set -euo pipefail
          for i in {1..3}; do # retry
            if .github/not-on-master.sh docker compose run e2e-tests; then
              s=0
              break
            else
              s=$?
            fi
          done
          (exit "${s}")
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint</summary>

180-180: shellcheck reported issue in this script: SC2034:warning:1:1: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

180-180: shellcheck reported issue in this script: SC2086:info:4:7: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-11-11T15:48:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,245 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Security: Use secrets for database credentials**

Database credentials should not be hardcoded in the workflow file.


```diff
 env:
-  POSTGRES_URL: jdbc:postgresql://postgres/webknossos
-  POSTGRES_USER: webknossos_user
-  POSTGRES_PASSWORD: secret_password
+  POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+  POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
            POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
            POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
            POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 0ba0ad5 to e7fc3e2
created_at: 2024-11-11T16:24:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,245 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Uncomment and fix database validation steps**

The commented-out database validation steps are critical for ensuring schema integrity.


```diff
-# - name: Assert unique evolution numbers
-#   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+- name: Assert unique evolution numbers
+  run: node tools/postgres/dbtool.js assert-unique-evolution-numbers

-# - name: Assert schema.sql and evolutions are equal
-#   run: |
-#     docker compose up -d postgres
-#     sleep 3
-#     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+- name: Assert schema.sql and evolutions are equal
+  run: |
+    docker compose up -d postgres
+    until docker compose exec -T postgres pg_isready; do
+      echo "Waiting for postgres..."
+      sleep 1
+    done
+    docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Assert unique evolution numbers
        run: node tools/postgres/dbtool.js assert-unique-evolution-numbers

      - name: Assert schema.sql and evolutions are equal
        run: |
          docker compose up -d postgres
          until docker compose exec -T postgres pg_isready; do
            echo "Waiting for postgres..."
            sleep 1
          done
          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2024-11-11T16:24:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,245 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      
+      
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref }}" == "refs/heads/master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh docker compose run backend-lint-format
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh docker compose run backend-tests
+
+      - name: Run end-to-end tests
+        run: |
+          for i in {1..3}; do # retry
+            .github/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9000/api/health
+          
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9050/tracings/health
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry docker login -u $DOCKER_USER -p $DOCKER_PASS
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
+          docker logout
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Fix shell script issues in Docker operations**

The Docker operations script has multiple quoting and error handling issues.


```diff
 function retry() {
+  local cmd=("$@")
   for i in {1..5}; do
-    "$@" && s=0 && break || s=$?
+    if "${cmd[@]}"; then
+      return 0
+    fi
     sleep 10
   done
-  return $s
+  return 1
 }
-retry docker login -u $DOCKER_USER -p $DOCKER_PASS
+retry docker login -u "${DOCKER_USER}" -p "${DOCKER_PASS}"
 retry docker compose push webknossos
 retry docker compose push webknossos-datastore
 retry docker compose push webknossos-tracingstore
 if [[ ${{ github.ref_type }} == "branch" ]]; then
-  docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+  docker tag "scalableminds/webknossos:${DOCKER_TAG}" "scalableminds/webknossos:${NORMALIZED_BRANCH}"
   # Similar fixes for other docker commands
 fi
```


> Committable suggestion skipped: line range outside the PR's diff.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint</summary>

211-211: shellcheck reported issue in this script: SC2034:warning:2:3: i appears unused. Verify use (or export if used externally)

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:6:10: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:8:23: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:8:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:13:39: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:13:78: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:14:46: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:15:49: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:15:98: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:16:56: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:17:52: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:17:104: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:18:59: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:19:72: Double quote to prevent globbing and word splitting

(shellcheck)

---

211-211: shellcheck reported issue in this script: SC2086:info:20:50: Double quote to prevent globbing and word splitting

(shellcheck)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-11-11T16:24:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,236 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      
+      
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+      
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9000/api/health
+          
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9050/tracings/health
+      
+      - name: Run end-to-end tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: .github/not-on-master.sh yarn run test-e2e
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: |
+            docker compose push webknossos
+            docker compose push webknossos-datastore
+            docker compose push webknossos-tracingstore
+            
+            if [[ ${{ github.ref_type }} == "branch" ]]; then
+              docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            fi
+            docker logout
+
+      - name: Report coverage
+        run: .github/not-on-master.sh yarn coverage || true
+
+      # - name: Send Slack notification (master only)
+      #   run: .circleci/slack-notification.sh
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Consider implementing GitHub Actions native Slack integration.**

Instead of using the CircleCI script, implement Slack notifications using GitHub Actions:

```yaml
- name: Notify Slack
  if: github.ref == 'refs/heads/master'
  uses: slackapi/slack-github-action@v1.24.0
  with:
    channel-id: 'CHANNEL_ID'
    slack-message: "GitHub Action build result: ${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}"
  env:
    SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
```

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-11-12T12:42:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,236 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      
+      
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+      
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
path: .github/workflows/build_test_deploy.yml
user: login: robert-oleynik
body: ```suggestion
        run: |
          mkdir fossildb && chmod 999:999 fossildb
```
created_at: 2024-12-04T08:48:09Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,237 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      
+      
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+      
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          mkdir fossildb && chmod 999:999 fossildb
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Fix permissions for fossildb directory**

The `chmod 999:999` command is incorrect. Use `chown` for ownership changes.

```diff
-  mkdir fossildb && chmod 999:999 fossildb
+  mkdir fossildb && chown 999:999 fossildb
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
        run: |
          mkdir fossildb && chown 999:999 fossildb
          docker compose up -d webknossos
          docker compose up -d webknossos-datastore
          docker compose up -d webknossos-tracingstore
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-12-04T08:52:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,237 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      
+      
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+      
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          mkdir fossildb && chmod 999:999 fossildb
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9000/api/health
+          
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/health_check_action
+        with: 
+          url: http://localhost:9050/tracings/health
+      
+      - name: Run end-to-end tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: .github/not-on-master.sh yarn run test-e2e
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: |
+            docker compose push webknossos
+            docker compose push webknossos-datastore
+            docker compose push webknossos-tracingstore
+            
+            if [[ ${{ github.ref_type }} == "branch" ]]; then
+              docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            fi
+            docker logout
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Improve Docker push retry logic**

The Docker push steps could be optimized:
1. Use GitHub's retry action consistently
2. Add proper error handling
3. Use proper quoting in shell commands

```diff
 command: |
+  set -euo pipefail
   docker compose push webknossos
   docker compose push webknossos-datastore
   docker compose push webknossos-tracingstore
   
   if [[ ${{ github.ref_type }} == "branch" ]]; then
-    docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+    docker tag "scalableminds/webknossos:${DOCKER_TAG}" "scalableminds/webknossos:${NORMALIZED_BRANCH}"
     # Similar fixes for other docker commands
   fi
```


> Committable suggestion skipped: line range outside the PR's diff.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 yamllint (1.35.1)</summary>

[error] 220-220: trailing spaces

(trailing-spaces)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-12-04T08:52:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,237 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:bulb: Codebase verification_

**Restrict debug access and protect sensitive data**

The workflow contains several security concerns that need to be addressed:

1. The `workflow_dispatch` trigger has no permission restrictions, allowing any user with repository access to enable debugging
2. The tmate debugging session has no timeout configured
3. The workflow exposes sensitive environment variables and credentials:
   - Database credentials (POSTGRES_PASSWORD)
   - Docker credentials (DOCKER_USER, DOCKER_PASS)
   - These are visible in logs and to anyone with debug access

Recommendations:
- Add `permissions` field to restrict who can trigger workflow_dispatch
- Configure tmate timeout using `timeout-minutes`
- Move sensitive values to GitHub Actions secrets
- Use secret masking for all credential environment variables
- Add job-level timeout to limit maximum debug session duration



<details>
<summary>🔗 Analysis chain</summary>

**Review debug access controls**

The tmate debugging option could potentially expose sensitive information. Consider:
1. Limiting the `workflow_dispatch` trigger to specific user roles
2. Adding a timeout for debug sessions
3. Documenting security implications in the workflow

---

Based on the search results, there are numerous files containing sensitive information like passwords, tokens, secrets, and credentials. Let me analyze the workflow file further to provide specific recommendations.

</details>

<details>
<summary>🏁 Scripts executed</summary>

The following scripts were executed for the analysis:

Script:

```shell
#!/bin/bash
# Check if there are any sensitive files that might be exposed during debug
rg -g '!.git' -l '(?i)(password|secret|key|token|credential)' || echo "No sensitive files found"

```

Length of output: 36548

---

Script:

```shell
#!/bin/bash
# Check if there are any environment variables or secrets used in the workflow
rg -g '.github/workflows/build_test_deploy.yml' '(?i)(secret|token|password|credential|key)'

# Check if there are any security controls on the workflow_dispatch trigger
cat .github/workflows/build_test_deploy.yml

```

Length of output: 8697

</details>

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2024-12-04T08:52:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,237 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      
+      
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+      
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          mkdir fossildb && chown 999:999 fossildb
path: .github/workflows/build_test_deploy.yml
user: login: robert-oleynik
body: ```suggestion
          mkdir -p fossildb/data && chown -R 999:999 fossildb/data
          mkdir -p fossildb/backup && chown -R 999:999 fossildb/backup
```
created_at: 2024-12-04T09:07:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,238 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Update checkout action version**

The `actions/checkout@v3` action is outdated.


```diff
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: 5
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
  static_frontend_code_checks:
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 5

`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>
<details>
<summary>🪛 yamllint (1.35.1)</summary>

[warning] 29-29: wrong indentation: expected 6 but found 4

(indentation)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 48d4736
created_at: 2024-12-04T09:24:39Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,238 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+      
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      
+      
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+      
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          mkdir -p fossildb/data && chown -R 999:999 fossildb/data
path: .github/workflows/build_test_deploy.yml
user: login: robert-oleynik
body: ```suggestion
          id -u
          ls -al fossildb
          mkdir -p fossildb/data && chown -R 999:999 fossildb/data
```
created_at: 2024-12-04T10:58:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,238 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:hammer_and_wrench: Refactor suggestion_

**Update checkout action version.**

The `actions/checkout@v3` action is outdated.

```diff
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: 5
```


Also applies to: 76-78

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-01-10T13:56:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,238 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Fix permissions for fossildb directories.**

The permissions are too open (0777). Use more restrictive permissions and proper ownership.

```diff
-         mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-         mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+         mkdir -p fossildb/{data,backup}
+         sudo chown -R 999:999 fossildb/{data,backup}
+         sudo chmod -R "0755" fossildb/{data,backup}
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
        run: |
          mkdir -p fossildb/{data,backup}
          sudo chown -R 999:999 fossildb/{data,backup}
          sudo chmod -R "0755" fossildb/{data,backup}
          docker compose up -d webknossos
          docker compose up -d webknossos-datastore
          docker compose up -d webknossos-tracingstore
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-01-10T13:56:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,242 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _:warning: Potential issue_

**Security: Critical configuration issues.**

Several security concerns need to be addressed:
1. Running as root user is a security risk
2. Consider using GitHub's OIDC for Docker Hub authentication instead of storing credentials

```diff
 env:
-  USER_NAME: root
+  USER_NAME: webknossos
   USER_UID: 1000
   USER_GID: 1000
-  DOCKER_USER: ${{ secrets.DOCKER_USER }}
-  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
```

Add OIDC configuration:
```yaml
permissions:
  id-token: write
  contents: read

jobs:
  build:
    steps:
      - uses: docker/login-action@v2
        with:
          registry: docker.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
```

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-01-10T14:12:11Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,242 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      - name: Run end-to-end tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: .github/not-on-master.sh yarn run test-e2e
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
path: .github/workflows/build_test_deploy.yml
user: login: robert-oleynik
body: ```suggestion
          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
```

Use `localhost` instead of `postgres` seems to work in previous stages:
- https://github.com/scalableminds/webknossos/pull/8147/files#diff-42cd3ec5ae996683429b45af319635fed477b47a31407e40192426d5f00b3704R159-R166

created_at: 2025-03-17T10:40:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,242 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Action Update: Upgrade Checkout Action Version**  
The workflow uses `actions/checkout@v3`. Given the static analysis feedback, please upgrade to `actions/checkout@v4` to leverage the latest features and improvements.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-03-17T12:02:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,242 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Adjust fossildb Directory Permissions**  
The commands to create and set permissions for the fossildb directories use `sudo chmod -R "0777"`, which is overly permissive. It is recommended to use more restrictive permissions (for example, `0755`) and change ownership with `chown` instead.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-03-17T12:02:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,242 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Workflow Triggers and Dispatch Inputs Security**  
The workflow now defines triggers for pushes, pull requests, and a `workflow_dispatch` input (`debug_enabled`) for on‑demand debugging. While this flexible design is useful, consider adding a `permissions` field or additional restrictions on the `workflow_dispatch` trigger to prevent unauthorized or inadvertent debug sessions.

---



</details>

**Security Improvement: Add Explicit Permissions for Debug Sessions**

The current CI workflow file triggers debugging via `workflow_dispatch` without explicit permission restrictions. To mitigate potential security risks (such as unauthorized or inadvertent debug sessions), please add a `permissions` field or otherwise restrict the debug trigger.

- **File:** `.github/workflows/build_test_deploy.yml` (Lines are around the trigger definitions)
- **Recommended Action:** Insert a `permissions` field (with a restrictive scope) to govern token access during workflow runs, especially when using the debug mode.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-03-17T12:02:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,242 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5433
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5433:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5433/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5433/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security & Permissions: Restrict fossildb Directory Permissions**  
Using `sudo chmod -R "0777"` is overly permissive. It is recommended to create the directories, adjust ownership, and set more restrictive permissions (e.g. 0755).  
```diff
-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```  
 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Start webknossos, datastore, and tracingstore
        run: |
          mkdir -p fossildb/data fossildb/backup
          sudo chown -R 999:999 fossildb/data fossildb/backup
          sudo chmod -R "0755" fossildb/data fossildb/backup
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 4fbf0d2
created_at: 2025-03-26T12:49:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,242 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Upgrade the Checkout Action Version**  
The static frontend job is using `actions/checkout@v3`. Upgrading to `actions/checkout@v4` is recommended for improved performance, security, and compatibility with newer GitHub Actions features.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-03-26T13:06:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,242 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5433
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5433:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5433/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Secure SBT Build Environment Variables**  
The SBT build step’s environment includes hardcoded credentials (`POSTGRES_PASSWORD: secret_password`). Replace these values with secure references from GitHub Secrets to avoid exposing sensitive information.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-03-26T13:06:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,242 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5433
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5433:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5433/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5433/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Avoid Hardcoded Credentials in Docker Build Environment**  
The step building the webknossos docker image sets environment variables (e.g., `POSTGRES_PASSWORD: secret_password`) with hardcoded values. Replace these with references to GitHub Secrets to improve security.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-03-26T13:06:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,242 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5433
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5433:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5433/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5433/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      - name: Run end-to-end tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: sh -c "docker ps && .github/not-on-master.sh yarn run test-e2e"
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: |
+            docker compose push webknossos
+            docker compose push webknossos-datastore
+            docker compose push webknossos-tracingstore
+
+            if [[ ${{ github.ref_type }} == "branch" ]]; then
+              docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            fi
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Improve Docker Tag Command Quoting**  
Within the Docker image push step, ensure that all variable interpolations are wrapped in double quotes to prevent issues with word splitting. For example:  
```diff
- docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+ docker tag "scalableminds/webknossos:${DOCKER_TAG}" "scalableminds/webknossos:${NORMALIZED_BRANCH}"
```  
Apply similar quoting to other docker tag commands in this block.  



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
            if [[ ${{ github.ref_type }} == "branch" ]]; then
-              docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
-              retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
-              docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
-              retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
-              docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
-              retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
-              docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
-              retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+              docker tag "scalableminds/webknossos:${DOCKER_TAG}" "scalableminds/webknossos:${NORMALIZED_BRANCH}"
+              retry docker push "scalableminds/webknossos:${NORMALIZED_BRANCH}"
+              docker tag "scalableminds/webknossos-datastore:${DOCKER_TAG}" "scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}"
+              retry docker push "scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}"
+              docker tag "scalableminds/webknossos-tracingstore:${DOCKER_TAG}" "scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}"
+              retry docker push "scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}"
+              docker tag "scalableminds/webknossos-dev" "scalableminds/webknossos-dev:${NORMALIZED_BRANCH}"
+              retry docker push "scalableminds/webknossos-dev:${NORMALIZED_BRANCH}"
            fi
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-03-26T13:06:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,244 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Update Checkout Action Version**  
The checkout step uses `actions/checkout@v3`, which is considered outdated. Please upgrade to `actions/checkout@v4` to take advantage of the latest improvements and security fixes.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-03-26T14:26:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,244 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Security Concern: Hardcoded PostgreSQL Credentials**  
The PostgreSQL service’s environment variables include hardcoded credentials (`POSTGRES_USER` and `POSTGRES_PASSWORD: secret_password`). Please use GitHub Secrets (e.g. `${{ secrets.POSTGRES_USER }}` and `${{ secrets.POSTGRES_PASSWORD }}`) to safeguard these sensitive values.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-03-26T14:26:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,244 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Security Enhancement: Restrict PostgreSQL Port Exposure**  
The PostgreSQL container exposes port `5432` on all interfaces (`5432:5432`). For improved security, consider binding the port to localhost (e.g. `127.0.0.1:5432:5432`) to limit external access.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-03-26T14:26:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,244 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Update Checkout Action Version:**  
The static frontend job uses `actions/checkout@v3`. Upgrading to `actions/checkout@v4` can improve performance and security.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-03-27T10:25:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,244 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          set -xeo pipefail
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Restrict Fossildb Directory Permissions:**  
Using `sudo chmod -R "0777"` on the fossildb directories is overly permissive and can expose the system to security risks. It is recommended to create the directories, adjust ownership with `chown`, and set more restrictive permissions (for example, `0755`).

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-03-27T10:25:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,244 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          set -xeo pipefail
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      - name: Run end-to-end tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: sh -c "mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X && .github/not-on-master.sh yarn run test-e2e"
+        env:
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Secure End-to-End Test Setup:**  
- The command for end-to-end tests uses `chmod 777` for the `binaryData/Organization_X` directory, which is too permissive.  
- Moreover, the environment variables for the E2E tests still contain hardcoded credentials (`secret_password`).  
Please tighten the file permissions and migrate these credentials to GitHub Secrets.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-03-27T10:25:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,244 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Secure SBT Build Credentials:**  
The environment variables for the sbt build step include hardcoded credentials (`POSTGRES_PASSWORD: secret_password`). To avoid security risks, please replace these with credentials sourced from GitHub Secrets.

---



</details>

**Critical Security Update: Replace Hardcoded SBT Build Credentials**

The build workflow in `.github/workflows/build_test_deploy.yml` (lines 129-139) currently exposes sensitive credentials by hardcoding values (e.g., `POSTGRES_PASSWORD: secret_password`). To maintain security best practices, please update the workflow to source these credentials from GitHub Secrets. For example:

```diff
       env:
-        POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
-        POSTGRES_USER: webknossos_user
-        POSTGRES_PASSWORD: secret_password
+        POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+        POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+        POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

This change will help ensure that sensitive information is not exposed and adheres to secure CI/CD practices.



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Build webknossos (sbt)
        run: |
          if [ "${{ github.ref_name }}" == "master" ]; then
            sbt -no-colors clean compile stage
          else
            sbt -no-colors -DfailOnWarning compile stage
          fi
        env:
          POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-03-27T10:25:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,247 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Avoid Running as Root in CI Environment**  
The environment sets `USER_NAME: root`, which can introduce security risks during CI/CD execution. It is advisable to use a non‑root user (e.g. `webknossos`) to minimize vulnerabilities.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-03-27T13:30:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,247 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Avoid Masking Errors in Docker Pull**  
The command `docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true` suppresses failures, which might hide critical issues. It is better to remove the `|| true` or handle the error explicitly so that any pull failures can be addressed promptly.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-03-27T13:30:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,247 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          set -xeo pipefail
+
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+
+          mkdir -p binaryData/Organization_X && sudo chmod -R "0777" binaryData/Organization_X
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Restrict Overly Permissive Directory Permissions**  
The commands setting permissions with `sudo chmod -R "0777"` on directories (for both `binaryData/Organization_X` and fossildb folders) are too permissive. It is recommended to use tighter permissions (e.g. `0755`) and adjust ownership via `chown` instead. For example:  
```diff
-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```
 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/

          mkdir -p binaryData/Organization_X && sudo chmod -R "0777" binaryData/Organization_X
          mkdir -p fossildb/data fossildb/backup
          sudo chown -R 999:999 fossildb/data fossildb/backup
          sudo chmod -R "0755" fossildb/data fossildb/backup
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-03-27T13:30:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,282 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Get yarn cache directory path
+      id: yarn-cache-dir
+      run: |
+        corepack enable
+        echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+    - uses: actions/cache@v4
+      id: yarn-cache
+      with:
+        path: ${{ steps.yarn-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+        restore-keys:
+          ${{ runner.os }}-yarn-
+
+    - name: Install frontend dependencies
+      run: yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Replace Hardcoded Database Credentials in Service Configuration**  
The job-level environment and PostgreSQL service configuration still include hardcoded credentials (e.g. `secret_password`). For enhanced security, replace these values with references to GitHub Secrets. For example:  
```diff
-      PGPASSWORD: secret_password
+      PGPASSWORD: ${{ secrets.PGPASSWORD }}
```
and in the service environment:
```diff
-            POSTGRES_URL: jdbc:postgresql://postgres/webknosos
-            POSTGRES_USER: webknosos_user
-            POSTGRES_PASSWORD: secret_password
+            POSTGRES_URL: ${{ secrets.POSTGRES_URL }}
+            POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+            POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```  



Also applies to: 75-77

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T10:07:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,282 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Get yarn cache directory path
+      id: yarn-cache-dir
+      run: |
+        corepack enable
+        echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+    - uses: actions/cache@v4
+      id: yarn-cache
+      with:
+        path: ${{ steps.yarn-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+        restore-keys:
+          ${{ runner.os }}-yarn-
+
+    - name: Install frontend dependencies
+      run: yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir
+        run: |
+          corepack enable
+          echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@v4
+        id: yarn-cache
+        with:
+          path: ${{ steps.yarn-cache-dir.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys:
+            ${{ runner.os }}-yarn-
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('**/*.sbt', '**/Dependencies.scala') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Secure Tmate Debug Session Configuration**  
The tmate session is enabled when `debug_enabled` is true. Debug sessions can expose sensitive information if not properly controlled. Consider adding additional security measures (such as explicit timeouts, restricted permissions, and clear documentation of risks) to ensure that debug access is used safely.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T10:07:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,282 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Get yarn cache directory path
+      id: yarn-cache-dir
+      run: |
+        corepack enable
+        echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+    - uses: actions/cache@v4
+      id: yarn-cache
+      with:
+        path: ${{ steps.yarn-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+        restore-keys:
+          ${{ runner.os }}-yarn-
+
+    - name: Install frontend dependencies
+      run: yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir
+        run: |
+          corepack enable
+          echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@v4
+        id: yarn-cache
+        with:
+          path: ${{ steps.yarn-cache-dir.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys:
+            ${{ runner.os }}-yarn-
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('**/*.sbt', '**/Dependencies.scala') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Handle Docker Pull Failures More Robustly**  
The docker pull command uses `|| true`, which can mask critical errors during image retrieval. It is recommended to remove the error suppression or handle failures explicitly. For example:  
```diff
-          docker pull scalableminds/webknosos:$NORMALIZED_BRANCH || true
+          docker pull scalableminds/webknosos:"$NORMALIZED_BRANCH"
```  



> Committable suggestion skipped: line range outside the PR's diff.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T10:07:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,282 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Get yarn cache directory path
+      id: yarn-cache-dir
+      run: |
+        corepack enable
+        echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+    - uses: actions/cache@v4
+      id: yarn-cache
+      with:
+        path: ${{ steps.yarn-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+        restore-keys:
+          ${{ runner.os }}-yarn-
+
+    - name: Install frontend dependencies
+      run: yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Replace Hardcoded Credentials with Secrets**  
Within the `build_test_deploy` job, both the job-level environment (line 70) and the PostgreSQL service configuration (lines 75–77) hardcode credentials (e.g. `secret_password`). To secure sensitive data, replace these with references to GitHub Secrets (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-04-01T11:31:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,282 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Get yarn cache directory path
+      id: yarn-cache-dir
+      run: |
+        corepack enable
+        echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+    - uses: actions/cache@v4
+      id: yarn-cache
+      with:
+        path: ${{ steps.yarn-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+        restore-keys:
+          ${{ runner.os }}-yarn-
+
+    - name: Install frontend dependencies
+      run: yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir
+        run: |
+          corepack enable
+          echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@v4
+        id: yarn-cache
+        with:
+          path: ${{ steps.yarn-cache-dir.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys:
+            ${{ runner.os }}-yarn-
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('**/build.sbt') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Secure SBT Build Environment Variables**  
The SBT build step’s environment (lines 170–174) still uses hardcoded PostgreSQL credentials. Please update these values to use GitHub Secrets so that sensitive information isn’t exposed in the workflow.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-04-01T11:31:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,282 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Get yarn cache directory path
+      id: yarn-cache-dir
+      run: |
+        corepack enable
+        echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+    - uses: actions/cache@v4
+      id: yarn-cache
+      with:
+        path: ${{ steps.yarn-cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+        restore-keys:
+          ${{ runner.os }}-yarn-
+
+    - name: Install frontend dependencies
+      run: yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir
+        run: |
+          corepack enable
+          echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
+      - uses: actions/cache@v4
+        id: yarn-cache
+        with:
+          path: ${{ steps.yarn-cache-dir.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys:
+            ${{ runner.os }}-yarn-
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('**/build.sbt') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          set -xeo pipefail
+
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      - name: Run end-to-end tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: sh -c ".github/not-on-master.sh yarn run test-e2e"
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5434/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: |
+            docker compose push webknossos
+            docker compose push webknossos-datastore
+            docker compose push webknossos-tracingstore
+
+            if [[ ${{ github.ref_type }} == "branch" ]]; then
+              docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            fi
+            docker logout
+
+      - name: Report coverage
+        run: .github/not-on-master.sh yarn coverage || true
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Avoid Silently Ignoring Coverage Failures**  
The final coverage reporting step uses `|| true`, which may hide underlying issues if test coverage drops. Removing `|| true` or enforcing a minimum coverage threshold would help ensure regressions are not missed.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 396a604
created_at: 2025-04-01T11:31:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,282 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Update Checkout Action Version**  
Both checkout steps in the jobs use `actions/checkout@v3`. Since static analysis flags this version as outdated, upgrading to `actions/checkout@v4` will leverage the latest features and security fixes.  
 


Also applies to: 88-91

---



</details>

**Action Required: Update Checkout Action Version**  
The workflow file `.github/workflows/build_test_deploy.yml` currently uses `actions/checkout@v3` (lines 29–33 and 88–91). Static analysis suggests that upgrading to `actions/checkout@v4` will provide improved features and security fixes. Please update both occurrences accordingly.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-01T11:31:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,259 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Suggestion: Enhance Security for Workflow Triggers and Debug Inputs**  
The new workflow triggers—including the `workflow_dispatch` trigger with the `debug_enabled` input used for tmate debugging—offer useful flexibility. However, to prevent unauthorized or inadvertent debug sessions, consider adding explicit permissions (e.g. a `permissions` field) or other restrictions on the `workflow_dispatch` trigger.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T11:56:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,259 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+        cache: 'yarn'
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Issue: Secure PostgreSQL Service Credentials**  
Within the `postgres` service configuration, the environment variables such as `POSTGRES_PASSWORD` are hardcoded (using `secret_password`). For enhanced security, source these credentials from GitHub Secrets. Also, review the use of `postgres:10-alpine` to ensure compatibility and security standards.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-04-01T11:56:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,259 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+        cache: 'yarn'
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Action Update: Upgrade Checkout Action in Build Job**  
The checkout step in the `build_test_deploy` job also uses `actions/checkout@v3`. Please update this to `actions/checkout@v4` for consistency and improved security.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

77-77: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-01T11:56:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,259 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+        cache: 'yarn'
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+          cache: 'yarn'
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Issue: Silencing Docker Pull Failures**  
The docker pull command uses the `|| true` construct, which can mask important errors during image retrieval. Consider handling failures explicitly to ensure that critical issues are not silently ignored.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T11:56:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,259 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+        cache: 'yarn'
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+          cache: 'yarn'
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Security Note: Debug Session Controls**  
The tmate debug session is conditionally enabled when the `debug_enabled` input is true. As debug sessions can expose sensitive data, ensure that additional security measures are configured (such as setting an explicit timeout and restricting permissions) to control access.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T11:56:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,259 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+        cache: 'yarn'
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+          cache: 'yarn'
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Security Issue: Replace Hardcoded SBT Build Credentials**  
During the sbt build step, environment variables for PostgreSQL (i.e. `POSTGRES_URL`, `POSTGRES_USER`, and `POSTGRES_PASSWORD`) are hardcoded. This exposure of sensitive information should be rectified by using GitHub Secrets instead.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-04-01T11:56:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,259 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+        cache: 'yarn'
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+          cache: 'yarn'
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          set -xeo pipefail
+
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      - name: Run end-to-end tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: sh -c ".github/not-on-master.sh yarn run test-e2e"
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5434/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: |
+            docker compose push webknossos
+            docker compose push webknossos-datastore
+            docker compose push webknossos-tracingstore
+
+            if [[ ${{ github.ref_type }} == "branch" ]]; then
+              docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            fi
+            docker logout
+
+      - name: Report coverage
+        run: .github/not-on-master.sh yarn coverage || true
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Issue: Coverage Command Silences Failures**  
The coverage reporting step uses `|| true` to ignore failures. This could mask critical issues, such as a regression in test coverage. Consider removing this construct or implementing a mechanism that fails the build when coverage drops below a defined threshold.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T11:56:24Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,257 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Added Debug Input Configuration**  
The `workflow_dispatch` trigger now includes a `debug_enabled` boolean input to conditionally enable a tmate debugging session. For improved security, consider adding explicit permission restrictions (via a `permissions` field) to limit debug session access.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T12:04:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,257 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Avoid Running as Root**  
The environment variable `USER_NAME` is set to `root`. Running CI jobs as root can expose potential security risks. It is recommended to use a non‑root user (for example, `webknossos`) for enhanced security.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T12:04:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,257 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Security Issue: Hardcoded PGPASSWORD**  
The job-level environment sets `PGPASSWORD` to a hardcoded value (`secret_password`). This practice poses a risk by exposing sensitive credentials. Replace this value with a reference to a GitHub secret (e.g. `${{ secrets.PGPASSWORD }}`).

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-04-01T12:04:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,257 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Security Issue: Hardcoded PostgreSQL Credentials**  
Within the PostgreSQL service configuration, the credentials (`POSTGRES_URL`, `POSTGRES_USER`, and `POSTGRES_PASSWORD`) are hardcoded. For improved security, source these values from GitHub Secrets.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 83e6348
created_at: 2025-04-01T12:04:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,257 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Update Checkout Action Version in Build Job**  
The checkout step in the `build_test_deploy` job still uses `actions/checkout@v3`. Consistency and enhanced security can be achieved by updating this step to `actions/checkout@v4`.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

76-76: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-01T12:04:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,257 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Update Docker Setup Buildx Action**  
The workflow currently uses `docker/setup-buildx-action@v2`. Updating to a more recent version (e.g. v3) is advised for improved performance and new features.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 7e5edeb
created_at: 2025-04-01T12:04:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,257 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Optional Debug Session: Security Consideration**  
The tmate debugging step is conditionally enabled based on the `debug_enabled` input. As debug sessions can expose sensitive information, it is recommended to add explicit timeout settings and restrict permissions for this step.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T12:04:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,257 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          set -xeo pipefail
+
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      - name: Run end-to-end tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: sh -c ".github/not-on-master.sh yarn run test-e2e"
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5434/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Security Issue: Hardcoded End-to-End Test Credentials**  
The environment variables for the end-to-end tests are hardcoded. Replace these with GitHub Secret references to protect sensitive information.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T12:04:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,257 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
+
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+
+    - name: Typecheck frontend code
+      run: yarn typecheck
+
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      # The hostname used to communicate with the PostgreSQL service container
+      # POSTGRES_HOST: localhost
+      # POSTGRES_PORT: 5432
+      PGPASSWORD: secret_password
+    services:
+        postgres:
+          image: postgres:10-alpine
+          env:
+            POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+            POSTGRES_USER: webknossos_user
+            POSTGRES_PASSWORD: secret_password
+          # Set health checks to wait until postgres has started
+          options: >-
+            --health-cmd pg_isready
+            --health-interval 2s
+            --health-timeout 5s
+            --health-retries 30
+          ports:
+            - 5432:5432
+    steps:
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - name: "Custom environment variables"
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> $GITHUB_ENV
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> $GITHUB_ENV
+          else
+            echo "NORMALIZED_BRANCH=master" >> $GITHUB_ENV
+            echo "DOCKER_TAG=${{ github.ref_name }}" >> $GITHUB_ENV
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - name: Set up sbt
+        uses: sbt/setup-sbt@v1
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+                    # build-essential \
+          # cmake \
+
+      # - name: Prepare dependency folders
+      #   run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+
+      # - name: Assert unique evolution numbers
+      #   run: node tools/postgres/dbtool.js assert-unique-evolution-numbers
+
+      # - name: Assert schema.sql and evolutions are equal
+      #   run: |
+      #     docker compose up -d postgres
+      #     sleep 3
+      #     docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: .github/not-on-master.sh sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+      - name: Run backend tests
+        run: .github/not-on-master.sh sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Set up Docker
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+        # Enable tmate debugging of manually-triggered workflows if the input option was provided
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Start webknossos, datastore, and tracingstore
+        run: |
+          set -xeo pipefail
+
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          docker compose up -d webknossos
+          docker compose up -d webknossos-datastore
+          docker compose up -d webknossos-tracingstore
+
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      - name: Run end-to-end tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: sh -c ".github/not-on-master.sh yarn run test-e2e"
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5434/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      - name: Stop webknossos, datastore, and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - name: Push docker images
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: |
+            docker compose push webknossos
+            docker compose push webknossos-datastore
+            docker compose push webknossos-tracingstore
+
+            if [[ ${{ github.ref_type }} == "branch" ]]; then
+              docker tag scalableminds/webknossos:${DOCKER_TAG} scalableminds/webknossos:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-datastore:${DOCKER_TAG} scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-tracingstore:${DOCKER_TAG} scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+              docker tag scalableminds/webknossos-dev scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+              retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            fi
+            docker logout
+
+      - name: Report coverage
+        run: .github/not-on-master.sh yarn coverage || true
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Coverage Reporting: Avoid Silencing Failures**  
The final coverage step uses `|| true`, which can suppress important errors or regressions in test coverage. It is recommended to remove `|| true` or implement a mechanism that fails the job if coverage falls below a predefined threshold.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 396a604 to 86c670f
created_at: 2025-04-01T12:04:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,257 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
+        fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Update Checkout Action Version**  
The checkout step in the `static_frontend_code_checks` job uses `actions/checkout@v3`, which is considered outdated. Please upgrade to `actions/checkout@v4` to leverage the latest features and security improvements.

---

**Please update the checkout action version from `actions/checkout@v3` to `actions/checkout@v4` in `.github/workflows/build_test_deploy.yml` (around lines 29–32).** This upgrade will ensure that you benefit from the latest features and security enhancements provided by the newer version of the action.

---

🏁 Script executed:

```shell

#!/bin/bash
# Verify the version of the checkout action used in the workflow file.
filename=".github/workflows/build_test_deploy.yml"
if [ -f "$filename" ]; then
  echo "Found file: $filename"
  grep -R "actions/checkout@" -n "$filename"
else
  echo "Error: $filename not found."
fi
```

Length of output: 481

---



</details>

**Update Checkout Action Version in Workflows**

The workflow file `.github/workflows/build_test_deploy.yml` currently references `actions/checkout@v3` in multiple locations (approximately at lines 30 and 76). Please upgrade all instances to `actions/checkout@v4` to ensure you benefit from the latest features and security improvements.

- **File:** `.github/workflows/build_test_deploy.yml`
- **Affected Lines:** ≈30 and ≈76

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-01T12:04:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,455 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Enhance Debug Session Security**  
The workflow trigger now includes a `workflow_dispatch` input (`debug_enabled`) useful for enabling tmate debugging. However, exposing debug sessions without further restrictions can be a security risk. Consider adding a `permissions` field (or additional access restrictions) to limit who can trigger debug sessions.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T14:35:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,455 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
       with:
-        fetch-depth: 5
\ No newline at end of file
+        fetch-depth: 5
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 18
+    - name: Install frontend dependencies
+      run: corepack enable && yarn install --immutable
+    - name: Lint frontend code and check formatting
+      run: yarn run check-frontend
+    - name: Typecheck frontend code
+      run: yarn typecheck
+    - name: Check for cyclic dependencies in frontend
+      run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Review Postgres Service Configuration**  
Within the `build` job, the PostgreSQL service is configured with environment variables. Note that the service uses a host of `postgres` (e.g. in `POSTGRES_URL: jdbc:postgresql://postgres/webknossos`), while later build steps use `localhost` for connecting to the database. Ensure this discrepancy is intentional. Moreover, sensitive variables such as the DB password are ultimately derived from the hardcoded value. Switching to GitHub Secrets for credentials here would enhance security.

---



</details>

Below is a revised review comment addressing the discrepancies and security suggestion:

**Postgres Service Configuration – Discrepancy & Credential Security**  
Within the `build` job, the PostgreSQL service is set up using environment variables. Note that the connection URL uses the host `postgres` (i.e. `jdbc:postgresql://postgres/webknossos`), yet later build steps appear to connect to the database via `localhost`. Please verify that this difference is intentional. Additionally, while the DB password is set using `${{ env.POSTGRES_PASSWORD }}`, it isn’t sourced from GitHub Secrets. To improve security, consider switching to GitHub Secrets for managing credentials.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 3b1e4b3
created_at: 2025-04-01T14:35:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,105 @@
+name: webknossos-ci
+
+services:
+  webknossos:
+    image: scalableminds/webknossos:${DOCKER_TAG}
+    ports:
+      - "9000:9000"
+    command:
+      - -Dconfig.file=conf/application.conf
+      - -Djava.net.preferIPv4Stack=true
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.redis.address=redis
+      - -DwebKnossos.sampleOrganization.enabled=false
+    volumes:
+      - ./binaryData:/webknossos/binaryData
+    environment:
+      - CERTIFICATE
+      - POSTGRES_URL=jdbc:postgres://postgres/webknossos
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  webknossos-datastore:
+    image: scalableminds/webknossos-datastore:${DOCKER_TAG}
+    ports:
+      - "9090:9090"
+    volumes:
+      - ./binaryData:/webknossos-datastore/binaryData
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-datastore.conf
+      - -Dhttp.port=9090
+      - -Dhttp.uri=http://webknossos-datastore:9090
+      - -Ddatastore.webKnossos.uri=webknossos:9000
+      - -Ddatastore.redis.address=redis
+    depends_on:
+      redis:
+        condition: service_healthy
+
+  webknossos-tracingstore:
+    image: scalableminds/webknossos-tracingstore:${DOCKER_TAG}
+    ports:
+      - "9050:9050"
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-tracingstore.conf
+      - -Dhttp.port=9050
+      - -Dhttp.uri=http://webknossos-datastore:9050
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.webknossos.uri=webknossos:9000
+    depends_on:
+      redis:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+
+  fossildb:
+    image: scalableminds/fossildb:master__510
+    command:
+      - fossildb
+      - -c
+      - skeletons,volumes,volumeData,volumeSegmentIndex,editableMappingsInfo,editableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate,annotations,annotationUpdates
+    volumes:
+      - "./fossildb/data:/fossildb/data"
+      - "./fossildb/backup:/fossildb/backup"
+
+  postgres:
+    image: postgres:17-bookworm
+    environment:
+      - POSTGRES_DB=webknossos
+      - POSTGRES_USER=${POSTRGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    ports:
+      - "5432:5432"
+    volumes:
+      - "./pg/db:/var/lib/postgresql/data"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d webknossos -U ${POSTGRES_USER} -h 127.0.0.1 -p 5432"]
+      interval: 2s
+      timeout: 5s
+      retries: 30
+
path: .github/docker-compose.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Typo in Postgres Environment Variable**  
There appears to be a typo on line 81: `POSTRGRES_USER` should be corrected to `POSTGRES_USER` for consistency with other service definitions and the healthcheck command.  
  
*Proposed fix:*  
```diff
-      - POSTRGRES_USER=${POSTRGRES_USER}
+      - POSTGRES_USER=${POSTGRES_USER}
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
  postgres:
    image: postgres:17-bookworm
    environment:
      - POSTGRES_DB=webknossos
-      - POSTRGRES_USER=${POSTRGRES_USER}
+      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    ports:
      - "5432:5432"
    volumes:
      - "./pg/db:/var/lib/postgresql/data"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d webknossos -U ${POSTGRES_USER} -h 127.0.0.1 -p 5432"]
      interval: 2s
      timeout: 5s
      retries: 30
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 1dc8f7c
created_at: 2025-04-01T14:35:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,455 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == "master" ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != "master" }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin' # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != "master" }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" -d
+        env:
+          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Hardcoded PostgreSQL Credentials in Docker Instance Step**  
In the "Start Docker Instance" step, the environment variable `POSTGRES_PASSWORD` is set to a literal `"secret_password"` (line 220). This hardcoded value should be replaced with a GitHub Secret (e.g. `${{ secrets.POSTGRES_PASSWORD }}`) for better security.

---



</details>

**Action Required: Replace Hardcoded PostgreSQL Password with GitHub Secret**

The workflow file currently hardcodes the PostgreSQL password (line 220 in `.github/workflows/build_test_deploy.yml`), which poses a security risk. Please update the environment variable assignment from:

```yaml
POSTGRES_PASSWORD: secret_password
```

to use a GitHub secret, for example:

```yaml
POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

This change will help secure your Docker instance by preventing sensitive credentials from being stored in plaintext.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T14:50:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,455 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**CI Trigger & Debug Input Configuration**  
The workflow’s triggers and the new `debug_enabled` input are clearly defined. However, enabling on‑demand debugging (via tmate) without additional permission restrictions could pose a security risk. Consider adding an explicit `permissions` field (or other access controls) for the `workflow_dispatch` trigger to limit who can initiate debug sessions.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T15:02:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,455 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" -d
+        env:
+          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      # Smoke Tests
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      # Run e2e-tests
+      - name: Run e2e tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: |
+            yarn run test-e2e
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Hardcoded Credentials in E2E Tests**  
The “Run e2e tests” step sets `POSTGRES_PASSWORD` again as `secret_password`. This practice can expose sensitive data and should be replaced with a GitHub Secret reference.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 7e5edeb
created_at: 2025-04-01T15:02:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,455 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: Install frontend dependencies
+        run: corepack enable && yarn install --immutable
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Database Connection Discrepancy & Credential Handling**  
In the “Build webknossos (sbt)” step, the environment sets:  
- `POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos`  
while the PostgreSQL service is configured with `POSTGRES_URL: jdbc:postgresql://postgres/webknossos`. Please verify that this discrepancy is intentional. Additionally, consider sourcing the password from secrets rather than relying on the earlier hardcoded value.

---

I'll run a shell script to search the repository for any occurrences of the `jdbc:postgresql://postgres` configuration so we can verify whether the discrepancy noted in the review comment is valid.

---

🏁 Script executed:

```shell
#!/bin/bash
# Search the entire repository for occurrences of the production PostgreSQL URL
rg "jdbc:postgresql://postgres" -n .
```

Length of output: 652

---



</details>

**Action Required: Align POSTGRES_URL Configuration & Secure Credentials**  
In the “Build webknossos (sbt)” step (lines 104-114 of `.github/workflows/build_test_deploy.yml`), the environment sets  
- `POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos`  
However, our Docker configurations (e.g., in `docker-compose.yml` and files under `tools/hosting/`) consistently use  
- `jdbc:postgresql://postgres/webknossos`  

Please verify if the discrepancy between using `localhost:5432` and `postgres` is intentional. If not, update the workflow to align with the Docker configuration. Additionally, consider sourcing `POSTGRES_PASSWORD` from secure secrets rather than an inline value for improved security.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 7e5edeb
created_at: 2025-04-01T15:02:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,455 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Security Consideration: Debug Workflow Trigger**

The `workflow_dispatch` trigger now includes a `debug_enabled` input for enabling tmate debugging. However, enabling on‑demand debug sessions without further restrictions can expose sensitive information. Consider adding explicit permissions (e.g. a `permissions` field) or other controls to limit who can trigger debug sessions.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-01T15:10:19Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,520 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: docker/setup-buildx-action@v2
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_docker_build }}
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" -d
+        env:
+          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security: Replace Hardcoded Password in Docker Instance**  
The "Start Docker Instance" step uses a hardcoded `POSTGRES_PASSWORD: secret_password`. To prevent sensitive information from being exposed, replace this with a secure reference to a GitHub secret (e.g., `${{ secrets.POSTGRES_PASSWORD }}`).  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```  
 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Start Docker Instance
        if: ${{ github.ref_name != 'master' }}
        run: |
          docker compose -f .github/docker-compose.yml -p "webknossos" -d
        env:
          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
          POSTGRES_USER: webknossos_user
          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit d8b0db9
created_at: 2025-04-01T16:01:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,521 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**PostgreSQL Service Configuration and Credential Sourcing**  
In the `build` job, the `postgres` service is configured with an image (`postgres:17-alpine`) and uses:  
- `POSTGRES_URL: jdbc:postgresql://postgres/webknossos`  
- `POSTGRES_USER: webknossos_user`  
- `POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}`  
> **Observation:** Since the global `POSTGRES_PASSWORD` is hardcoded (see lines 33–39), this propagates the security issue into the service configuration. Consider sourcing the password directly from GitHub Secrets rather than relying on a global insecure value.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 3d39b97 to 300cca4
created_at: 2025-04-01T16:10:38Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,525 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Update Checkout Action Version in Build Job**  
Within the `build` job, the checkout step (line 89) still uses `actions/checkout@v3`. Please upgrade this to `actions/checkout@v4` for consistency and improved security.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

89-89: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-02T08:10:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,525 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Cache SBT
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.ivy2/cache
+            ~/.sbt
+          key: ${{ runner.os }}-sbt-${{ hashFiles('/build.sbt') }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: docker/setup-buildx-action@v2
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_docker_build }}
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
+        env:
+          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security: Insecure Docker Instance Environment**  
In the "Start Docker Instance" step, the environment sets `POSTGRES_PASSWORD` to the hardcoded value `secret_password` (line 282). This is a critical security issue. Please replace this with a GitHub secret (e.g., `${{ secrets.POSTGRES_PASSWORD }}`) so that credentials are not exposed in the logs.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 7e5edeb to 8e9c0e7
created_at: 2025-04-02T08:10:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,502 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: docker/setup-buildx-action@v2
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_docker_build }}
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
+        env:
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Secure Docker Instance Configuration**  
In the “Start Docker Instance” step, the environment block sets:  
```yaml
POSTGRES_PASSWORD: secret_password
```  
This hardcoded value poses a security risk. Please replace it with a secure reference from GitHub Secrets.  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-02T08:31:15Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,502 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_URL: jdbc:postgresql://postgres/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: docker/setup-buildx-action@v2
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_docker_build }}
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
+        env:
+          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      # Smoke Tests
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      # Run e2e-tests
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+      - name: Run e2e tests
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Restrict Filesystem Permissions for E2E Test Preparation**  
The “Prepare e2e test” step uses overly permissive commands such as:  
```bash
sudo chmod -R "0777" binaryData/Organization_X
```
and for fossildb directories, it creates the directories and applies `chmod -R "0777"`. Overly permissive permissions can lead to security vulnerabilities.  
**Recommended changes:**  
- Use a more restrictive permission mode (e.g., `0755`).  
- Consider using `chown` to set proper ownership before applying permissions.  
```diff
-          sudo chmod -R "0777" binaryData/Organization_X
+          sudo chmod -R "0755" binaryData/Organization_X

-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 7e5edeb
created_at: 2025-04-02T08:31:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,512 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Review: Workflow Dispatch Debug Inputs**  
The new `workflow_dispatch` inputs for tmate debugging (lines 11–31) are well defined and provide useful options for on‑demand debugging. However, consider adding explicit permission restrictions (for example, via a `permissions` field) or additional access controls to ensure that debug sessions are not inadvertently or maliciously enabled.

---

I’ll run a quick check to see if the file already enforces any explicit permission restrictions. For instance, I’ll search for a “permissions:” field in the workflow file:




Once this verification confirms that no explicit permissions configuration is present, please consider revising the workflow as follows:

**Action Required: Add Explicit Permission Restrictions for Debug Inputs**

The workflow file (.github/workflows/build_test_deploy.yml; lines 11–31) defines several debug flags for on‑demand debugging. While these inputs are clear and useful, the absence of explicit permission restrictions (for example, a dedicated `permissions` field) leaves the workflow open to inadvertent or malicious activation of debugging sessions. To enhance security, please add an explicit permissions configuration or alternative access control mechanism that limits who can enable these debug options.

---

🏁 Script executed:

```shell
#!/bin/bash
rg 'permissions:' .github/workflows/build_test_deploy.yml || echo "No permissions field found in build_test_deploy.yml"
```

Length of output: 170

---



</details>

**Action Required: Enhance Debug Input Security Controls**

The workflow file (.github/workflows/build_test_deploy.yml; lines 11–31) defines several debug inputs for on‑demand debugging. However, as confirmed by our check, no explicit `permissions` field is configured in this file. This absence leaves the workflow susceptible to inadvertent or potentially malicious enablement of debugging sessions. Please add explicit permission restrictions—such as a `permissions` field or an equivalent access control mechanism—to ensure that only authorized users can activate these debug options.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-02T09:16:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,518 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: docker/setup-buildx-action@v2
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_docker_build }}
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
+        env:
+          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
+
+      # Smoke Tests
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      # Run e2e-tests
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Overly Permissive Filesystem Permissions in E2E Test Preparation**  
The commands in the "Prepare e2e test" step use `sudo chmod -R "0777"`, which is overly permissive and can introduce security vulnerabilities. It is recommended to use more restrictive permissions (such as `0755`) and adjust ownership with `chown` if needed.  
A possible diff suggestion:  
```diff
-          sudo chmod -R "0777" binaryData/Organization_X
+          sudo chmod -R "0755" binaryData/Organization_X
-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```  
 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Prepare e2e test
        run: |
          mkdir -p binaryData/Organization_X
          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
          sudo chmod -R "0755" binaryData/Organization_X

          mkdir -p fossildb/data fossildb/backup
          sudo chown -R 999:999 fossildb/data fossildb/backup
          sudo chmod -R "0755" fossildb/data fossildb/backup
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 3774608
created_at: 2025-04-02T11:36:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,518 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: docker/setup-buildx-action@v2
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_docker_build }}
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
+        env:
+          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Expose Sensitive Docker Environment Variables**  
In the "Start Docker Instance" step, the environment block sets a hardcoded `POSTGRES_PASSWORD: secret_password` (line 282–283). This insecure practice can expose credentials in logs. Please replace the hardcoded value with a GitHub secret reference.  
For example:  
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```  
 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Start Docker Instance
        if: ${{ github.ref_name != 'master' }}
        run: |
          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
        env:
          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
          POSTGRES_USER: webknossos_user
          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 7e5edeb
created_at: 2025-04-02T11:36:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,517 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    env:
+      DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: docker/setup-buildx-action@v2
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_docker_build }}
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
+
+      # Smoke Tests
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      # Run e2e-tests
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+      - name: Run e2e tests
+        uses: nick-invision/retry@v2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: |
+            yarn run test-e2e
+        env:
+          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: secret_password
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**E2E Tests – Hardcoded PostgreSQL Password**  
In the environment block for the "Run e2e tests" step, `POSTGRES_PASSWORD` is set to a hardcoded value (`secret_password`), which is a critical security risk.  
**Action Required:** Replace the hardcoded password with a reference to a GitHub secret (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).  

  
*Proposed diff:*
```diff
-          POSTGRES_PASSWORD: secret_password
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
          POSTGRES_URL: jdbc:postgresql://localhost:5432/webknosos
          POSTGRES_USER: webknosos_user
          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 7e5edeb
created_at: 2025-04-02T12:01:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,517 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    env:
+      DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: docker/setup-buildx-action@v2
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_docker_build }}
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
+
+      # Smoke Tests
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      # Run e2e-tests
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+      - name: Run e2e tests
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**E2E Test Preparation – Overly Permissive Permissions**  
The "Prepare e2e test" step uses commands that set directory permissions to `0777` (e.g., using `sudo chmod -R "0777" binaryData/Organization_X` and similar for `fossildb` directories). Overly permissive permissions can introduce security risks.  
**Recommendation:**  
- Use a more restrictive mode such as `0755` instead of `0777`.  
- Consider using `chown` to set appropriate ownership on the `fossildb` directories.  

  
*Proposed diff:*
```diff
-          sudo chmod -R "0777" binaryData/Organization_X
+          sudo chmod -R "0755" binaryData/Organization_X
...
-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Prepare e2e test
        run: |
          mkdir -p binaryData/Organization_X
          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
          sudo chmod -R "0755" binaryData/Organization_X

          mkdir -p fossildb/data fossildb/backup
          sudo chown -R 999:999 fossildb/data fossildb/backup
          sudo chmod -R "0755" fossildb/data fossildb/backup
      - name: Run e2e tests
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 2994f0d
created_at: 2025-04-02T12:01:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,514 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  docker-build-and-e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    env:
+      DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: docker/setup-buildx-action@v2
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_docker_build }}
+
+      #
+      # Build Docker Images
+      #
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
+      #
+      # Run e2e Tests
+      #
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
+
+      # Smoke Tests
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+
+      # Run e2e-tests
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Restrict Overly Permissive Filesystem Permissions**  
In the “Prepare e2e test” step (lines 302–307), the script creates directories and then applies `sudo chmod -R "0777"`, which is overly permissive and poses a security risk. It is advisable to use a more restrictive mode (e.g. 0755) and, where needed, use `chown` to assign proper ownership.  


_Proposed diff:_
```diff
-          sudo chmod -R "0777" binaryData/Organization_X
-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          sudo chmod -R "0755" binaryData/Organization_X
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
          mkdir -p binaryData/Organization_X
          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
          sudo chmod -R "0755" binaryData/Organization_X

          mkdir -p fossildb/data fossildb/backup
          sudo chown -R 999:999 fossildb/data fossildb/backup
          sudo chmod -R "0755" fossildb/data fossildb/backup
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 2994f0d
created_at: 2025-04-02T13:51:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,514 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Enhance Debug Session Security in Workflow Triggers**

The workflow triggers—including the standard push, pull_request, and the added workflow_dispatch inputs—are well defined. However, because the debug-related inputs (e.g. `tmate_debug_docker_build`, `debug_enabled`, etc.) can enable on-demand debugging, it is advisable to add an explicit `permissions` field (or an equivalent access control mechanism) to restrict who can activate these debug sessions. This will help prevent inadvertent or unauthorized exposure of sensitive runtime information.

---



</details>

**Enhance Debug Session Security: Restrict Debug Triggers**

The workflow configuration in `.github/workflows/build_test_deploy.yml` (lines 3-32) defines several debug-related inputs without any explicit access control. To safeguard against unauthorized or inadvertent activation of debug sessions—which could expose sensitive runtime details—please add an explicit `permissions` field (or a comparable access control mechanism) at the root level of the workflow. For example:

```yaml
permissions:
  contents: read
```

This ensures that only authorized users can trigger/debug these steps. Please adjust the permissions as needed to align with your security requirements.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-02T15:00:17Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,105 @@
+name: webknossos-ci
+
+services:
+  webknossos:
+    image: scalableminds/webknossos:${DOCKER_TAG}
+    ports:
+      - "9000:9000"
+    command:
+      - -Dconfig.file=conf/application.conf
+      - -Djava.net.preferIPv4Stack=true
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.redis.address=redis
+      - -DwebKnossos.sampleOrganization.enabled=false
+    volumes:
+      - ../binaryData:/webknossos/binaryData
+    environment:
+      - CERTIFICATE
+      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  webknossos-datastore:
+    image: scalableminds/webknossos-datastore:${DOCKER_TAG}
+    ports:
+      - "9090:9090"
+    volumes:
+      - ../binaryData:/webknossos-datastore/binaryData
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-datastore.conf
+      - -Dhttp.port=9090
+      - -Dhttp.uri=http://webknossos-datastore:9090
+      - -Ddatastore.webKnossos.uri=webknossos:9000
+      - -Ddatastore.redis.address=redis
+    depends_on:
+      redis:
+        condition: service_healthy
+
+  webknossos-tracingstore:
+    image: scalableminds/webknossos-tracingstore:${DOCKER_TAG}
+    ports:
+      - "9050:9050"
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-tracingstore.conf
+      - -Dhttp.port=9050
+      - -Dhttp.uri=http://webknossos-datastore:9050
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.webknossos.uri=webknossos:9000
+    depends_on:
+      redis:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+
+  fossildb:
+    image: scalableminds/fossildb:master__510
+    command:
+      - fossildb
+      - -c
+      - skeletons,volumes,volumeData,volumeSegmentIndex,editableMappingsInfomeditableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate,annotations,annotationUpdates
+    volumes:
+      - "../fossildb/data:/fossildb/data"
+      - "../fossildb/backup:/fossildb/backup"
+
path: .github/docker-compose.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Typographical Check in fossildb Command Arguments**

In the `fossildb` service, the command includes a comma‐separated list where the element:
```
editableMappingsInfomeditableMappingsAgglomerateToGraph
```
appears to be a concatenation error. Please verify if this should be split into two separate entries (for example, `editableMappingsInfo` and `editableMappingsAgglomerateToGraph`) or corrected in another way.

---



</details>

**Critical Typo in `fossildb` Command Arguments – Action Required**

In the `.github/docker-compose.yml` file (lines 67–76), the `command` for the `fossildb` service includes a comma-separated list where the segment

```
editableMappingsInfomeditableMappingsAgglomerateToGraph
```

appears to be the result of a concatenation error. Please verify whether this entry should be split into two separate parameters (e.g., `editableMappingsInfo` and `editableMappingsAgglomerateToGraph`) or otherwise corrected.

- **Location:** `.github/docker-compose.yml` (lines 67–76)
- **Issue:** Concatenated command argument likely due to a missing split
- **Action:** Update the command arguments to clearly separate the intended parameters

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits c668132 to 425bb07
created_at: 2025-04-02T15:46:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,105 @@
+name: webknossos-ci
+
+services:
+  webknossos:
+    image: scalableminds/webknossos:${DOCKER_TAG}
+    ports:
+      - "9000:9000"
+    command:
+      - -Dconfig.file=conf/application.conf
+      - -Djava.net.preferIPv4Stack=true
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.redis.address=redis
+      - -DwebKnossos.sampleOrganization.enabled=false
+    volumes:
+      - ../binaryData:/webknossos/binaryData
+    environment:
+      - CERTIFICATE
+      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  webknossos-datastore:
+    image: scalableminds/webknossos-datastore:${DOCKER_TAG}
+    ports:
+      - "9090:9090"
+    volumes:
+      - ../binaryData:/webknossos-datastore/binaryData
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-datastore.conf
+      - -Dhttp.port=9090
+      - -Dhttp.uri=http://webknossos-datastore:9090
+      - -Ddatastore.webKnossos.uri=webknossos:9000
+      - -Ddatastore.redis.address=redis
+    depends_on:
+      redis:
+        condition: service_healthy
+
+  webknossos-tracingstore:
+    image: scalableminds/webknossos-tracingstore:${DOCKER_TAG}
+    ports:
+      - "9050:9050"
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-tracingstore.conf
+      - -Dhttp.port=9050
+      - -Dhttp.uri=http://webknossos-datastore:9050
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.webknossos.uri=webknossos:9000
+    depends_on:
+      redis:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+
path: .github/docker-compose.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Potential Misconfiguration in webknossos-tracingstore**

The command list for `webknossos-tracingstore` includes:
```
- -Dhttp.uri=http://webknossos-datastore:9050
```
This URI references the datastore service while the tracingstore exposes port 9050. Please verify that this is intentional; if not, it might need to reference the correct service (likely `webknossos-tracingstore` or an appropriate proxy/endpoint).

---

I'll run a shell script to search for any occurrence of `webknossos-datastore` within the docker-compose file to determine if it's a valid service reference.

---

🏁 Script executed:

```shell
#!/bin/bash
# Search for 'webknossos-datastore' in the docker-compose file to check its definition
rg "webknossos-datastore" -n .github/docker-compose.yml
```

Length of output: 313

---

I'll run a shell script to extract the docker-compose file's content from lines 40 to 70 to see which service block these lines belong to and better understand the configuration.

---

🏁 Script executed:

```shell
#!/bin/bash
# Display lines 40 to 70 of the docker-compose file to provide service context
sed -n '40,70p' .github/docker-compose.yml
```

Length of output: 924

---



</details>

**Action Required: Check and Correct the Tracingstore URI Reference**

The `webknossos-tracingstore` service's command list sets its HTTP port to 9050 while advertising its URI as `http://webknossos-datastore:9050`. This appears inconsistent because:
  
- The datastore service uses `-Dhttp.uri=http://webknossos-datastore:9090` (and possibly another URI for a different port) to define its endpoint.
- The tracingstore container, which exposes port 9050, would more naturally reference itself (e.g. using `http://webknossos-tracingstore:9050`) if it is meant to advertise its own endpoint.
  
Please verify whether the use of `webknosos-datastore` in the tracingstore's `-Dhttp.uri` parameter is intentional. If it is a mistake, consider replacing it with the correct service name (likely `webknossos-tracingstore` or another intended proxy).

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit c43c9e5
created_at: 2025-04-02T15:46:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,531 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Update Action Versions: Upgrade Checkout Steps**  
Several jobs use `actions/checkout@v3` (e.g. lines 46, 95, 179, 210, and 282). To benefit from the latest improvements and resolve static analysis warnings, please update these steps to use `actions/checkout@v4`.  

  
*Example diff for one occurrence:*
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```


Also applies to: 95-95, 179-179, 210-210, 282-282

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-03T08:02:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,531 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  docker-build:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: docker/setup-buildx-action@v2
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Action Version Update: Upgrade Docker Buildx Setup**  
The job at line 233 uses `docker/setup-buildx-action@v2`, which is flagged by static analysis. Consider upgrading to at least v3 for enhanced features and performance improvements.  

  
*Example diff:*
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - uses: docker/setup-buildx-action@v3
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

233-233: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 7e5edeb to 8e9c0e7
created_at: 2025-04-03T08:02:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,526 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Action Needed: Update Checkout Action Version**  
In the `test-backend` job, the checkout step uses `actions/checkout@v3`. Please upgrade it to `actions/checkout@v4` to align with current best practices.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

179-179: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-03T08:32:02Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,526 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - uses: actions/upload-artifact@v4
+        with:
+          name: backend-build-artifacts
+          retention-days: 1
+          path: |
+            target/
+            util/target
+            project/**/target
+            webknossos*/target
+
+  test-backend:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/download-artifact@v4
+        with:
+          name: backend-build-artifacts
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_test_backend }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  docker-build:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Action Needed: Update Checkout Action Version**  
Within the `docker-build` job, the checkout step again uses `actions/checkout@v3`. An upgrade to `actions/checkout@v4` is recommended for consistency and improved security.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

210-210: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-03T08:32:02Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,431 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      #
+      # Build Docker Images
+      #
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ needs.build.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ needs.build.outputs.normalized_branch }}
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Functional Concern: Referencing Job Outputs Within the Same Job**  
In the Docker image build steps (lines 181–199), tags are specified using references like `${{ needs.build.outputs.docker_tag }}` and `${{ needs.build.outputs.normalized_branch }}`. Since these steps are part of the same `build` job that produces these outputs (via the `configure` step), using `needs.build` is invalid and causes undefined property references. Instead, reference the outputs directly from the step (e.g. `${{ steps.configure.outputs.docker_tag }}`) or restructure the jobs so that the Docker build steps run in a separate, later job that depends on `build`.

---



</details>

**Attention: Incorrect Job Output References in Docker Build Steps**

The Docker build steps in `.github/workflows/build_test_deploy.yml` reference job outputs using `${{ needs.build.outputs.docker_tag }}` and `${{ needs.build.outputs.normalized_branch }}`. However, since these outputs are produced within the same job (for example, via the `configure` step), referencing them with `needs.build` is invalid and results in undefined property errors. Please update the workflow to reference the outputs directly from the step (e.g., use `${{ steps.configure.outputs.docker_tag }}`) or refactor the workflow so that the Docker build steps run in a separate job that depends on the job producing these outputs.

- **File:** `.github/workflows/build_test_deploy.yml`
- **Affected Lines:** 181–199
- **Recommendation:** Replace usage of `needs.build.outputs.docker_tag` and `needs.build.outputs.normalized_branch` with the appropriate step outputs (e.g., `${{ steps.configure.outputs.docker_tag }}`), or restructure the jobs accordingly.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

181-181: property "build" is not defined in object type {}

(expression)

---

189-189: property "build" is not defined in object type {}

(expression)

---

197-197: property "build" is not defined in object type {}

(expression)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 147129f
created_at: 2025-04-03T08:58:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,431 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**New Workflow Dispatch Inputs for Debugging**  
You’ve added several optional boolean inputs (e.g. `tmate_debug_docker_build`, `tmate_debug_test_backend`, `tmate_debug_build`, and `debug_enabled`) to enable on‑demand debugging. This flexible design is useful; however, to avoid accidental or unauthorized debug session activations, consider adding explicit permission restrictions on the `workflow_dispatch` trigger (for example, by specifying a `permissions` field).

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T09:27:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,431 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      #
+      # Build Docker Images
+      #
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.normalized_branch }}
+
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
+        env:
+          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Incorrect Job Output Reference for Docker Tag**  
In the “Start Docker Instance” step, the environment variable is set as:  
```yaml
DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
```  
Since the outputs are defined within the same job (from the “Custom environment variables” step), the reference should use the step output (e.g., `${{ steps.configure.outputs.docker_tag }}`) to avoid undefined property errors.  
_Example diff:_  
```diff
-          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
+          DOCKER_TAG: ${{ steps.configure.outputs.docker_tag }}
```

---



</details>

**Action Required: Correct Docker Tag Output Reference in Workflow**

The “Start Docker Instance” step currently sets the Docker tag from a job output using:
```yaml
DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
```
However, since the Docker tag is produced by the “Custom environment variables” step (with an assumed `id: configure`) within the same job, the output should be referenced from that step. Please update the reference to:
```yaml
DOCKER_TAG: ${{ steps.configure.outputs.docker_tag }}
```

- **File:** `.github/workflows/build_test_deploy.yml` (lines 210-214)
- **Issue:** Incorrect reference to Docker tag output causing undefined property errors.
- **Resolution:** Replace `needs.build.outputs.docker_tag` with `steps.configure.outputs.docker_tag`.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

214-214: property "build" is not defined in object type {}

(expression)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 69b5e4a
created_at: 2025-04-03T09:27:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,431 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      #
+      # Build Docker Images
+      #
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.normalized_branch }}
+
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Overly Permissive Filesystem Permissions in e2e Test Preparation**  
The “Prepare e2e test” step sets directory permissions using `sudo chmod -R "0777"`, which is far too permissive and risks exposing sensitive data. It is recommended to use a more restrictive mode (such as `0755`) and adjust ownership where necessary.  
_Example diff:_  
```diff
-          sudo chmod -R "0777" binaryData/Organization_X
+          sudo chmod -R "0755" binaryData/Organization_X

-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```  



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
          mkdir -p binaryData/Organization_X
          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
          sudo chmod -R "0755" binaryData/Organization_X

          mkdir -p fossildb/data fossildb/backup
          sudo chown -R 999:999 fossildb/data fossildb/backup
          sudo chmod -R "0755" fossildb/data fossildb/backup
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 7e5edeb to 8e9c0e7
created_at: 2025-04-03T09:27:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,435 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Improvement: Use Secrets for PostgreSQL Password in Service**  
Within the `build` job’s PostgreSQL service (lines 75–80), the password is set as:
```yaml
POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
```
Using a global environment variable here is insecure. Please update this configuration to source the password from a GitHub Secret (e.g. `${{ secrets.POSTGRES_PASSWORD }}`) instead.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T09:47:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,435 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      #
+      # Build Docker Images
+      #
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.normalized_branch }}
+
+  e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+      - name: Start Docker Instance
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          docker compose -f .github/docker-compose.yml -p "webknossos" up -d
+        env:
+          DOCKER_TAG: ${{ steps.configure.outputs.docker_tag }}
+      # Smoke Tests
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Correct Docker Tag Output Reference in E2E Tests Job**  
In the "Start Docker Instance" step (lines 214–219), the environment variable is set as:  
```yaml
DOCKER_TAG: ${{ steps.configure.outputs.docker_tag }}
```  
Because the `build` job defines outputs (via the `configure` step) and passes them as job outputs, this reference should instead use the job outputs (e.g. `${{ needs.build.outputs.docker_tag }}`). This will prevent undefined property errors when running the e2e-tests job.  
_Proposed diff:_  
```diff
-          DOCKER_TAG: ${{ steps.configure.outputs.docker_tag }}
+          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
```

---

Below are the new shell scripts designed to verify the current Docker tag reference and its usage in the workflow file:





Based on expected results from these queries, it appears that the E2E tests job currently defines the Docker tag environment variable using the output from the local `configure` step:
```yaml
DOCKER_TAG: ${{ steps.configure.outputs.docker_tag }}
```
Since the build job produces `docker_tag` as a job output (via its `configure` step), the correct approach is to reference it as a dependency with:
```yaml
DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
```
This adjustment prevents runtime errors caused by undefined properties when the e2e-tests job executes.

---

**Critical: Update Docker Tag Reference in E2E Tests Job**

In the "Start Docker Instance" step of `.github/workflows/build_test_deploy.yml` (lines 214–219), please update the Docker tag reference from:
```yaml
DOCKER_TAG: ${{ steps.configure.outputs.docker_tag }}
```
to use the build job’s outputs:
```yaml
DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
```
This change ensures that the Docker tag is correctly passed and avoids undefined property errors in the e2e-tests job.

- **File:** `.github/workflows/build_test_deploy.yml` (Lines: 214–219)

---

🏁 Script executed:

```shell

#!/bin/bash
# Print the block from the workflow file where the Docker tag is referenced
sed -n '210,220p' .github/workflows/build_test_deploy.yml
```

Length of output: 638

---

🏁 Script executed:

```shell

#!/bin/bash
# Search for all occurrences of "docker_tag" to inspect its usage in the workflow file
grep -R "docker_tag" .github/workflows/build_test_deploy.yml
```

Length of output: 701

---



</details>

**Critical: Update Docker Tag Reference in E2E Tests Job**

The workflow file (.github/workflows/build_test_deploy.yml) still uses the local reference:
```yaml
DOCKER_TAG: ${{ steps.configure.outputs.docker_tag }}
```
However, since the build job exposes `docker_tag` as a job output, this reference should be updated to:
```yaml
DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
```
This change will prevent undefined property errors in the e2e-tests job during runtime.

- **File:** `.github/workflows/build_test_deploy.yml` (Lines: 214–219)
- **Proposed diff:**
  ```diff
  -          DOCKER_TAG: ${{ steps.configure.outputs.docker_tag }}
  +          DOCKER_TAG: ${{ needs.build.outputs.docker_tag }}
  ```

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

218-218: property "configure" is not defined in object type {}

(expression)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 3caacd6
created_at: 2025-04-03T09:47:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,435 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Enhance Debug Workflow Dispatch Security**  
The workflow’s `workflow_dispatch` trigger includes several optional inputs for enabling tmate debugging (e.g. `tmate_debug_docker_build`, `tmate_debug_test_backend`, etc.). However, there is no explicit permissions configuration to restrict who can trigger these debug sessions, which could potentially expose sensitive runtime details.  

**Recommendation:**  
Add a top‑level `permissions` field to restrict access (for example, setting minimal permissions such as `contents: read` or more restrictive settings as appropriate).  

_Example addition at the top of the file:_  
```yaml
permissions:
  contents: read
```

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T09:57:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,435 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      #
+      # Build Docker Images
+      #
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.normalized_branch }}
+
+  e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+      - name: Start Docker Instance
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Tighten Filesystem Permissions in E2E Test Preparation**  
The "Prepare e2e test" step uses overly permissive commands (`sudo chmod -R "0777"`) for the `binaryData/Organization_X` directory and the `fossildb` folders. Overly permissive permissions can expose your system to unintended modifications. It is recommended to use a more restrictive permission mode (for example, `0755`) and to adjust directory ownership appropriately.  

_Proposed diff:_  
```diff
-          sudo chmod -R "0777" binaryData/Organization_X
+          sudo chmod -R "0755" binaryData/Organization_X

-          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+          mkdir -p fossildb/data fossildb/backup
+          sudo chown -R 999:999 fossildb/data fossildb/backup
+          sudo chmod -R "0755" fossildb/data fossildb/backup
```  

 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Prepare e2e test
        run: |
          mkdir -p binaryData/Organization_X
          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
-         sudo chmod -R "0777" binaryData/Organization_X
+         sudo chmod -R "0755" binaryData/Organization_X

-         mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
-         mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+         mkdir -p fossildb/data fossildb/backup
+         sudo chown -R 999:999 fossildb/data fossildb/backup
+         sudo chmod -R "0755" fossildb/data fossildb/backup
      - name: Start Docker Instance
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 7e5edeb to 8e9c0e7
created_at: 2025-04-03T09:57:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,435 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Upgrade Checkout Action Version in Build Job**  
The checkout step in the `build` job (line 95) still uses `actions/checkout@v3`, which should be updated to v4 for consistency and enhanced security.  

_Proposed diff:_  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```

---



</details>

**Action Required: Update Checkout Action Version**  
The checkout step in the `build` job of `.github/workflows/build_test_deploy.yml` (lines 95-97) still uses `actions/checkout@v3`. For consistency and enhanced security, please update it to `actions/checkout@v4` as proposed.

_Proposed diff:_  
```diff
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
```



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - uses: actions/checkout@v4
        with:
          fetch-depth: 5
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

95-95: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-03T09:57:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,450 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Enhance Debug Trigger Security: Add Explicit Permissions**

The workflow’s `workflow_dispatch` trigger defines several boolean inputs for enabling tmate debugging but does not restrict who can trigger these debug sessions. It is recommended to add a top‑level `permissions` field (for example, setting `contents: read`) to limit access and reduce the risk of unauthorized debug sessions.

*Proposed addition at the top of the file (e.g. before the `on:` block):*
```diff
+permissions:
+  contents: read
```



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
permissions:
  contents: read

on:
  workflow_dispatch:
    inputs:
      tmate_debug_docker_build:
        type: boolean
        description: "Debug Docker Build and e2e Test Step"
        required: false
        default: false
      tmate_debug_test_backend:
        type: boolean
        description: "Debug Backend Tests"
        required: false
        default: false
      tmate_debug_build:
        type: boolean
        description: "Debug Build Step"
        required: false
        default: false
      debug_enabled:
        type: boolean
        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
        required: false
        default: false
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T10:19:57Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,450 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_docker_build:
+        type: boolean
+        description: "Debug Docker Build and e2e Test Step"
+        required: false
+        default: false
+      tmate_debug_test_backend:
+        type: boolean
+        description: "Debug Backend Tests"
+        required: false
+        default: false
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Step"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Update Checkout Action Version in Frontend Checks**

The checkout step in the `static_frontend_code_checks` job uses `actions/checkout@v3`, which is outdated. Upgrading to `actions/checkout@v4` will provide improved performance and security.

*Proposed diff:*
```diff
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
```



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 5
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

46-46: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-03T10:19:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,462 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      tmate_debug_backend_tests:
+        type: boolean
+        description: "Debug Tests Backend"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**PostgreSQL Service Configuration – Secure Password Handling**  
Within the `build` job, the PostgreSQL service is defined with the image `postgres:17-alpine` and uses an environment variable for the password via `${{ env.POSTGRES_PASSWORD }}`. Since the global environment variable is currently insecure (as noted earlier), ensure that the PostgreSQL service receives its password securely by sourcing it from GitHub Secrets.  
> For consistency, after updating the global environment as noted above, this line will automatically use a secure value.

---



</details>

**Action Required: Secure the PostgreSQL Password in the Build Workflow**  
In the `.github/workflows/build_test_deploy.yml` file (lines 72–80), the PostgreSQL service is configured using the image `postgres:17-alpine` with the password currently sourced from a global environment variable via `${{ env.POSTGRES_PASSWORD }}`. This approach is insecure because global environment values can be exposed. To resolve this security risk, update the configuration so that the PostgreSQL service receives its password directly from GitHub Secrets. For example, change the line:

```diff
- POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+ POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

After the global environment is updated accordingly, the service will automatically use the secure value from your secrets management.



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
  build:
    runs-on: ubuntu-24.04
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_USER: webknossos_user
          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
        # Set health checks to wait until postgres has started
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 7e5edeb
created_at: 2025-04-03T10:29:30Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,462 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      tmate_debug_backend_tests:
+        type: boolean
+        description: "Debug Tests Backend"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      #
+      # Build Docker Images
+      #
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.normalized_branch }}
+
+  backend-test:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: tmate debugging session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_backend_tests }}
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+  e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    steps:
+      - uses: actions/checkout@v3
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Upgrade Checkout Action in e2e-Tests Job**  
Similarly, the `e2e-tests` job uses `actions/checkout@v3` (line 224). Upgrade to v4 to stay in line with current best practices.  
> **Proposed Diff:**  
> ```diff
> -      - uses: actions/checkout@v3
> +      - uses: actions/checkout@v4
> ```

---

**Action Required: Upgrade Checkout Action in e2e-Tests Job**  
The `e2e-tests` job in the workflow file (`.github/workflows/build_test_deploy.yml`) currently uses `actions/checkout@v3` at line 224. To align with current best practices and to take advantage of improvements and security updates in the checkout action, please upgrade this step to use `actions/checkout@v4`.

> **Proposed Diff:**  
> ```diff
> -      - uses: actions/checkout@v3
> +      - uses: actions/checkout@v4
> ```

---

🏁 Script executed:

```shell

#!/bin/bash
# Display lines 220 to 230 from the workflow file to verify the checkout step.
sed -n '220,230p' .github/workflows/build_test_deploy.yml
```

Length of output: 488

---



</details>

**Upgrade Checkout Action in e2e-Tests Job**  
The `e2e-tests` job in `.github/workflows/build_test_deploy.yml` currently uses `actions/checkout@v3` (line 224), as confirmed by the shell script output. To align with current best practices and ensure you benefit from the latest improvements and security updates, please upgrade this step to use `actions/checkout@v4`.

> **Proposed Diff:**  
> ```diff
> -      - uses: actions/checkout@v3
> +      - uses: actions/checkout@v4
> ```



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - uses: actions/checkout@v4
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

224-224: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-03T10:29:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,462 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      tmate_debug_backend_tests:
+        type: boolean
+        description: "Debug Tests Backend"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      #
+      # Build Docker Images
+      #
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.normalized_branch }}
+
+  backend-test:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Upgrade Checkout Action in Backend-Test Job**  
The `backend-test` job’s checkout step is still using `actions/checkout@v3`. It should be updated to v4.  
> **Proposed Diff:**  
> ```diff
> -      - uses: actions/checkout@v3
> +      - uses: actions/checkout@v4
> ```

---

Below is a shell script to verify that the `backend-test` job’s checkout step in `.github/workflows/build_test_deploy.yml` is still using `actions/checkout@v3`:




Once verified, please update this step to use `actions/checkout@v4`. Here’s the rewritten review comment:

**Action Required: Upgrade Checkout Action in Backend-Test Job**  
The checkout step in the `backend-test` job is still using `actions/checkout@v3`, which should be updated to take advantage of improvements in v4. Please update the YAML file `.github/workflows/build_test_deploy.yml` at lines 197-199 accordingly.

- **Proposed Diff:**  
  ```diff
  -      - uses: actions/checkout@v3
  +      - uses: actions/checkout@v4
  ```

---

🏁 Script executed:

```shell
#!/bin/bash
rg "uses: actions/checkout@v3" .github/workflows/build_test_deploy.yml
```

Length of output: 243

---



</details>

**Action Required: Upgrade Checkout Action in Backend-Test Job**  
The checkout step in the `backend-test` job within `.github/workflows/build_test_deploy.yml` is still using `actions/checkout@v3`, while it should be updated to `actions/checkout@v4`. Please update the checkout step as shown below. Note that although multiple occurrences of `actions/checkout@v3` were found in the file, this change targets the one within the `backend-test` job as originally indicated.

- **Proposed Diff:**  
  ```diff
  -      - uses: actions/checkout@v3
  +      - uses: actions/checkout@v4
  ```



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - uses: actions/checkout@v4
        with:
          fetch-depth: 5
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

197-197: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 8a63834 to bc30b7c
created_at: 2025-04-03T10:29:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,449 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      #
+      # Build Docker Images
+      #
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.normalized_branch }}
+
+  e2e-tests:
+    runs-on: ubuntu-24.04
+    needs: [build]
+    env:
+      POSTGRES_USER: webknossos
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
+
+      - name: tmate debugging session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_e2e_tests }}
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Review: Conditional tmate Debugging in e2e-tests**  
The tmate debugging step in the e2e-tests job is conditionally enabled, which is useful for on‑demand debugging. To further strengthen security, consider adding explicit permission restrictions or additional access controls so that debug sessions cannot be activated inadvertently or maliciously.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T11:47:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,449 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      #
+      # Build Docker Images
+      #
+      - uses: docker/setup-buildx-action@v2
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Upgrade Docker Buildx Action Version**  
The workflow uses `docker/setup-buildx-action@v2` at line 166, which is flagged by static analysis. Upgrading to version v3 is advised to benefit from improved features and performance.  
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```  



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - uses: docker/setup-buildx-action@v3
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

166-166: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 7e5edeb
created_at: 2025-04-03T11:47:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,453 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Workflow Triggers and Inputs: Consider Adding Explicit Permissions**

The workflow’s triggers are configured to run on push (to master), pull requests (all branches), and via manual dispatch with several debug-related inputs (e.g. `tmate_debug_build`, `tmate_debug_e2e_tests`, and `debug_enabled`). To further safeguard against inadvertent or unauthorized manual runs—especially those that enable debugging—it is recommended to add a top‑level `permissions` field (for example, setting `permissions: { contents: read }`). This extra layer of control will help ensure that only authorized users can trigger workflows with the potential to expose sensitive runtime details.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T12:08:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,453 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5432/webknossos
+      POSTGRES_USER: webknossos_user
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Optional Debug: Secure Debug Session Activation**

The tmate debugging session in the `build` job is conditionally enabled based on the debug input. While this feature is useful, debug sessions can expose sensitive runtime details. Consider adding explicit restrictions (for example, through a permissions block in the workflow) to ensure that debug sessions can only be activated by authorized users.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T12:08:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,437 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5434:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Suggestion: Secure PostgreSQL Service Configuration**  
In the `build` job, the PostgreSQL service uses `POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}`. Since the global `POSTGRES_PASSWORD` is currently hardcoded, please update this to source the value directly from GitHub Secrets (e.g. `${{ secrets.POSTGRES_PASSWORD }}`) to enhance security.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T13:39:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,437 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5434:5432
+    outputs:
+      normalized_branch: ${{ steps.configure.outputs.normalized_branch }}
+      docker_tag: ${{ steps.configure.outputs.docker_tag }}
+    env:
+      POSTGRES_URL: jdbc:postgresql://localhost:5434/webknossos
+      POSTGRES_USER: webknossos_user
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'  # See 'Supported distributions' for available options
+          java-version: '21'
+          # cache: 'sbt'
+      - uses: sbt/setup-sbt@v1
+
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Install OS dependencies / libs
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc-dev
+
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all mirations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      # TODO: Build docs
+
+      - name: Build webknossos (webpack)
+        run: yarn build
+
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt -no-colors clean compile stage
+          else
+            sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+
+      - name: Lint backend code and check formatting
+        run: |
+          sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: |
+          sbt -v "testOnly backend.*"
+
+      - name: Checksum App Dirs
+        run: |
+          find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      #
+      # Build Docker Images
+      #
+      - uses: docker/setup-buildx-action@v2
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            scalableminds/webknossos:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-datastore
+          tags: |
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-datastore:${{ steps.configure.outputs.normalized_branch }}
+      - name: Build webknossos tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          context: webknossos-tracingstore
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.docker_tag }}
+            scalableminds/webknossos-tracingstore:${{ steps.configure.outputs.normalized_branch }}
+
+      - name: tmate debugging session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_e2e_tests }}
+
+      - name: Update ENV for end-to-end tests
+        run: echo "POSTGRES_URL=jdbc:postgresql://localhost:5432/webknossos" >> "$GITHUB_ENV"
+      - name: Prepare e2e test
+        run: |
+          mkdir -p binaryData/Organization_X
+          unzip test/dataset/test-dataset.zip -d binaryData/Organization_X/
+          sudo chmod -R "0777" binaryData/Organization_X
+
+          mkdir -p fossildb/data && sudo chmod -R "0777" fossildb/data
+          mkdir -p fossildb/backup && sudo chmod -R "0777" fossildb/backup
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Security: Overly Permissive File Permissions in e2e Test Preparation**  
The e2e test preparation (lines 202–209) uses `sudo chmod -R "0777"`, which grants full permissions and poses a security risk. Consider using a more restrictive mode (e.g., `0755`) and adjusting ownership via `chown` if necessary.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 7e5edeb to 374c4c3
created_at: 2025-04-03T13:39:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,437 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: webknossos_user
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        # Set health checks to wait until postgres has started
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security: Source PostgreSQL Password from Secrets in Service**  
Within the PostgreSQL service defined in the `build` job (lines 70–75), the password is set with `${{ env.POSTGRES_PASSWORD }}`. Given the earlier recommendation to remove hardcoded credentials, ensure that the service receives the password directly from GitHub Secrets (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T13:39:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,224 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Review Workflow Triggers and Dispatch Inputs**  
The workflow’s trigger section correctly sets up CI for pushes (specifically to the master branch), pull requests on all branches, and manual dispatch with debug-related inputs. However, to further secure on‑demand debug sessions (enabled via inputs like `tmate_debug_build` and `debug_enabled`), consider adding a top‑level `permissions` field (for example, `permissions: { contents: read }`) so that only authorized users can trigger these debug sessions.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T14:15:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,224 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1000
+      USER_GID: 1000
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.iv2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${CIRCLE_BRANCH}" == "master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Docker Image Build Steps: Error Masking Concern**  
For building the webknosos docker image and its variants, the commands use constructs such as:  
```bash
docker pull scalableminds/webknosos:$NORMALIZED_BRANCH || true
```  
Relying on `|| true` might hide image pull failures that could lead to issues later in the pipeline. It is advisable to handle errors explicitly or set up a retry mechanism that reports failures if the pull consistently fails.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 3d39b97 to 300cca4
created_at: 2025-04-03T14:15:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,224 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1000
+      USER_GID: 1000
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.iv2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${CIRCLE_BRANCH}" == "master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        run: |
+          .circleci/not-on-master.sh docker compose run base bash -c "yarn run check-frontend"
+      - name: Check for cyclic dependencies in front-end
+        run: |
+          .circleci/not-on-master.sh docker compose run base yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: |
+          .circleci/not-on-master.sh docker compose run base yarn test-verbose
+      - name: Lint backend code and check formatting
+        run: |
+          .circleci/not-on-master.sh docker compose run backend-lint-format
+      - name: Run backend tests
+        run: |
+          .circleci/not-on-master.sh docker compose run backend-tests
+      - name: Run end-to-end tests
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            .circleci/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+      - name: Validate frontend types
+        run: |
+          .circleci/not-on-master.sh docker compose run base yarn typecheck
+      - name: Start webknossos, datastore and tracingstore
+        run: docker compose up -d webknossos && docker-compose up -d webknossos-datastore && docker-compose up -d webknossos-tracingstore
+      - name: Run webknossos smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9000/api/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Run webknossos-datastore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9090/data/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Run webknossos-tracingstore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9050/tracings/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Stop webknossos, datastore and tracingstore
+        run: docker compose down --volumes --remove-orphans
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry sh -c 'echo $DOCKER_PASS | docker login -u $DOCKER_USER --password-stdin'
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [ -n "$CIRCLE_BRANCH" ]; then
+            docker tag \
+              scalableminds/webknossos:${DOCKER_TAG} \
+              scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-datastore:${DOCKER_TAG} \
+              scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-tracingstore:${DOCKER_TAG} \
+              scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-dev \
+              scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
+          docker logout
+      - name: Report coverage
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**Push Docker Images: Legacy Variables and Error Handling**  
The block responsible for pushing docker images defines a `retry` function and performs image tagging and pushing. Some points to consider:  
- The conditional check uses `[ -n "$CIRCLE_BRANCH" ]`, which relies on a legacy CircleCI variable. It should be updated to use a GitHub Actions variable (e.g. `${{ github.ref_name }}`).  
- Ensure that the tagging uses the correct and consistent environment variables (e.g., `DOCKER_TAG` and `NORMALIZED_BRANCH`) as set in the earlier configuration step.  
- The retry function works, but its error handling could be revisited to determine if swallowing errors (or returning with a non-zero exit) is the best approach in your CI pipeline context.

---



</details>

**Update Docker Image Pushing Workflow to Use GitHub Actions Variables**

- Replace the legacy CircleCI variable check (`[ -n "$CIRCLE_BRANCH" ]`) with the appropriate GitHub Actions variable (for example, using `${{ github.ref_name }}` or an equivalent environment variable set in your workflow).
- Verify that the environment variables used for image tagging (`DOCKER_TAG` and `NORMALIZED_BRANCH`) are consistently defined and correctly referenced across all `docker tag` and `docker push` commands.
- Revisit the `retry` function's error handling to determine if returning the error code after multiple failed attempts meets your CI pipeline's robustness requirements.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 3b08b3e to e40c112
created_at: 2025-04-03T14:15:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,224 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1000
+      USER_GID: 1000
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.iv2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${CIRCLE_BRANCH}" == "master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**sbt Build Steps: Update Legacy Environment Variable References**  
The sbt build step uses a condition based on:  
```bash
if [ "${CIRCLE_BRANCH}" == "master" ]; then
```
Since `CIRCLE_BRANCH` is a CircleCI variable, it should be replaced with an equivalent GitHub Actions variable (e.g. using `${{ github.ref }}` or `${{ github.ref_name }}`) to ensure the correct branch is evaluated.

---



</details>

**Update sbt Build Step to use GitHub Actions environment variables**  
In the file `.github/workflows/build_test_deploy.yml` (lines 116–124), the sbt build step currently evaluates the branch using the CircleCI variable `"CIRCLE_BRANCH"`. Since this workflow runs within GitHub Actions, please update the condition to use a GitHub Actions variable (e.g. `${{ github.ref_name }}`), so that the correct branch is detected.

- **File affected:** `.github/workflows/build_test_deploy.yml` (lines 116–124)
- **Issue:** Using `CIRCLE_BRANCH` (a CircleCI variable) instead of a GitHub Actions variable.
- **Suggested change:**
  ```yaml
      - name: Build webknossos (sbt)
        run: |
          if [ "${{ github.ref_name }}" == "master" ]; then
            docker compose run compile sbt -no-colors clean compile stage
          else
            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
          fi
  ```

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits e9d2d0c to 4656bdc
created_at: 2025-04-03T14:15:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,224 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Debug Workflow Dispatch Inputs: Consider Adding Explicit Permissions**  
You’ve added several optional inputs (e.g. `tmate_debug_build`, `tmate_debug_e2e_tests`, and `debug_enabled`) under the `workflow_dispatch` trigger. This is useful for on‑demand debugging; however, there are no explicit permission restrictions at the top level. For enhanced security, consider adding a top‑level `permissions` field (for example, `permissions: { contents: read }`) to restrict who can trigger debug sessions.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T14:44:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,224 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Docker Pull in Build Dev Image: Error Handling Consideration**  
The command  
```bash
docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH || true
```  
silently suppresses errors, which may mask critical pull failures. Consider implementing explicit error handling or a retry mechanism so that pull issues do not go unnoticed.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 3d39b97 to 93c1492
created_at: 2025-04-03T14:44:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,224 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${CIRCLE_BRANCH}" == "master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**SBT Build Step: Replace CircleCI Variable References**  
The conditional in the `Build webknosos (sbt)` step currently checks `[ "${CIRCLE_BRANCH}" == "master" ]`, but `CIRCLE_BRANCH` is a CircleCI variable. Please replace it with a GitHub Actions variable such as `${{ github.ref_name }}` to correctly detect the current branch.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 3b08b3e
created_at: 2025-04-03T14:44:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,224 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${CIRCLE_BRANCH}" == "master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        run: |
+          .circleci/not-on-master.sh docker compose run base bash -c "yarn run check-frontend"
+      - name: Check for cyclic dependencies in front-end
+        run: |
+          .circleci/not-on-master.sh docker compose run base yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: |
+          .circleci/not-on-master.sh docker compose run base yarn test-verbose
+      - name: Lint backend code and check formatting
+        run: |
+          .circleci/not-on-master.sh docker compose run backend-lint-format
+      - name: Run backend tests
+        run: |
+          .circleci/not-on-master.sh docker compose run backend-tests
+      - name: Run end-to-end tests
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            .circleci/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Filesystem Permissions in E2E Tests: Tighten Directory Mode**  
The `Run end-to-end tests` step creates the directory `binaryData/Organization_X` and sets permissions with `chmod 777`, which are overly permissive. For better security, use a more restrictive permission (e.g. `chmod 0755`) and adjust ownership with `chown` if necessary.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T14:44:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,224 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${CIRCLE_BRANCH}" == "master" ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        run: |
+          .circleci/not-on-master.sh docker compose run base bash -c "yarn run check-frontend"
+      - name: Check for cyclic dependencies in front-end
+        run: |
+          .circleci/not-on-master.sh docker compose run base yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: |
+          .circleci/not-on-master.sh docker compose run base yarn test-verbose
+      - name: Lint backend code and check formatting
+        run: |
+          .circleci/not-on-master.sh docker compose run backend-lint-format
+      - name: Run backend tests
+        run: |
+          .circleci/not-on-master.sh docker compose run backend-tests
+      - name: Run end-to-end tests
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            .circleci/not-on-master.sh docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+      - name: Validate frontend types
+        run: |
+          .circleci/not-on-master.sh docker compose run base yarn typecheck
+      - name: Start webknossos, datastore and tracingstore
+        run: docker compose up -d webknossos && docker compose up -d webknossos-datastore && docker compose up -d webknossos-tracingstore
+      - name: Run webknossos smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9000/api/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Run webknossos-datastore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9090/data/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Run webknossos-tracingstore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9050/tracings/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Stop webknossos, datastore and tracingstore
+        run: docker compose down --volumes --remove-orphans
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry sh -c 'echo $DOCKER_PASS | docker login -u $DOCKER_USER --password-stdin'
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [ -n "$CIRCLE_BRANCH" ]; then
+            docker tag \
+              scalableminds/webknossos:${DOCKER_TAG} \
+              scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-datastore:${DOCKER_TAG} \
+              scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-tracingstore:${DOCKER_TAG} \
+              scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-dev \
+              scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
+          docker logout
+      - name: Report coverage
+        run: .circleci/not-on-master.sh docker compose run base yarn coverage || true
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Coverage Reporting: Avoid Silently Ignoring Failures**  
The coverage report step ends with `|| true`, which may hide problems (such as a drop in test coverage). Consider removing this error suppression or implementing a threshold check that fails the build if coverage falls below an acceptable level.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 407ed15 to ebd45aa
created_at: 2025-04-03T14:44:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,226 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          docker compose run base yarn run docs --project-version $WK_VERSION
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Frontend Documentation Build – Legacy Environment Variables**  
The step that builds the frontend documentation uses CircleCI-specific variables:  
```bash
WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
```  
These variables are not defined in GitHub Actions. Replace them with appropriate GitHub Actions variables, such as using `${{ github.run_number }}` or a custom versioning scheme.  
Example diff:  
```diff
- WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+ WK_VERSION=${{ github.run_number }}
```  
This is a critical update to ensure the documentation build works as expected.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 3d39b97 to 93c1492
created_at: 2025-04-03T14:57:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,226 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${CIRCLE_BRANCH}" == 'master' ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run base bash -c "yarn run check-frontend"
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run base yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run base yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run backend-lint-format
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run backend-tests
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**End-to-End Tests – Overly Permissive Permission**  
The end-to-end tests step creates the directory `binaryData/Organization_X` and sets its permissions to `777`, which is excessively permissive. For increased security, consider using more restrictive permissions (e.g. `755`).  
Example diff:  
```diff
- mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+ mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```  



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Run end-to-end tests
        if: ${{ github.ref_name != 'master' }}
        run: |
          mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits e9d2d0c to cfc6bf2
created_at: 2025-04-03T14:57:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,226 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${CIRCLE_BRANCH}" == 'master' ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: docker compose run base sbt -no-colors -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run base bash -c "yarn run check-frontend"
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run base yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run base yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run backend-lint-format
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run backend-tests
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+      - name: Validate frontend types
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run base yarn typecheck
+      - name: Start webknossos, datastore and tracingstore
+        run: docker compose up -d webknossos && docker compose up -d webknossos-datastore && docker compose up -d webknossos-tracingstore
+      - name: Run webknossos smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9000/api/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Run webknossos-datastore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9090/data/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Run webknossos-tracingstore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9050/tracings/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Stop webknossos, datastore and tracingstore
+        run: docker compose down --volumes --remove-orphans
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry sh -c 'echo $DOCKER_PASS | docker login -u $DOCKER_USER --password-stdin'
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [ -n "$CIRCLE_BRANCH" ]; then
+            docker tag \
+              scalableminds/webknossos:${DOCKER_TAG} \
+              scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-datastore:${DOCKER_TAG} \
+              scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-tracingstore:${DOCKER_TAG} \
+              scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-dev \
+              scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Docker Push Steps – Legacy Variable and Quoting Issues**  
Within the "Push docker images" block, note the following concerns:  
1. The condition `[ -n "$CIRCLE_BRANCH" ]` relies on a CircleCI variable, which is not defined in GitHub Actions. Replace it with a check based on a GitHub Actions variable (for example, using `${{ github.ref_type }}` or by comparing `$NORMALIZED_BRANCH` to "master").  
2. The docker tag commands should quote variable expansions to prevent word splitting issues. For example:  
   ```diff
   - scalableminds/webknosos:${DOCKER_TAG}
   + "scalableminds/webknosos:${DOCKER_TAG}"
   ```  
A suggested diff for the conditional:  
```diff
-          if [ -n "$CIRCLE_BRANCH" ]; then
+          if [ "${{ github.ref_type }}" == "branch" ]; then
```  
These changes are critical to ensure the docker tagging and push logic work reliably in the new environment.  
 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Push docker images
        run: |
          function retry() {
            for i in {1..5}; do
              "$@" && s=0 && break || s=$?
              sleep 10
            done
            return $s
          }
          retry sh -c 'echo $DOCKER_PASS | docker login -u $DOCKER_USER --password-stdin'
          retry docker compose push webknosos
          retry docker compose push webknosos-datastore
          retry docker compose push webknosos-tracingstore
-          if [ -n "$CIRCLE_BRANCH" ]; then
+          if [ "${{ github.ref_type }}" == "branch" ]; then
             docker tag \
-              scalableminds/webknosos:${DOCKER_TAG} \
-              scalableminds/webknosos:${NORMALIZED_BRANCH}
+              "scalableminds/webknosos:${DOCKER_TAG}" \
+              "scalableminds/webknosos:${NORMALIZED_BRANCH}"
             retry docker push scalableminds/webknosos:${NORMALIZED_BRANCH}
             docker tag \
-              scalableminds/webknosos-datastore:${DOCKER_TAG} \
-              scalableminds/webknosos-datastore:${NORMALIZED_BRANCH}
+              "scalableminds/webknosos-datastore:${DOCKER_TAG}" \
+              "scalableminds/webknosos-datastore:${NORMALIZED_BRANCH}"
             retry docker push scalableminds/webknosos-datastore:${NORMALIZED_BRANCH}
             docker tag \
-              scalableminds/webknosos-tracingstore:${DOCKER_TAG} \
-              scalableminds/webknosos-tracingstore:${NORMALIZED_BRANCH}
+              "scalableminds/webknosos-tracingstore:${DOCKER_TAG}" \
+              "scalableminds/webknosos-tracingstore:${NORMALIZED_BRANCH}"
             retry docker push scalableminds/webknosos-tracingstore:${NORMALIZED_BRANCH}
             docker tag \
-              scalableminds/webknosos-dev \
-              scalableminds/webknosos-dev:${NORMALIZED_BRANCH}
+              "scalableminds/webknosos-dev" \
+              "scalableminds/webknosos-dev:${NORMALIZED_BRANCH}"
             retry docker push scalableminds/webknosos-dev:${NORMALIZED_BRANCH}
          fi
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits e9d2d0c to 4656bdc
created_at: 2025-04-03T14:57:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,226 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: docker compose run -e PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true base yarn install --immutable
+      - name: Assert unique evolution numbers
+        run: docker compose run base tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          docker compose run compile tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          docker compose run base yarn run docs --project-version $WK_VERSION
+      - name: Build webknossos (webpack)
+        run: docker compose run base yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${CIRCLE_BRANCH}" == 'master' ]; then
+            docker compose run compile sbt -no-colors clean compile stage
+          else
+            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
+          fi
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**sbt Build Step – Replace CircleCI Variable**  
In the "Build webknosos (sbt)" step, the conditional checks `[ "${CIRCLE_BRANCH}" == 'master' ]` to determine the build parameters. Since `CIRCLE_BRANCH` is a CircleCI variable, it should be replaced with a proper GitHub Actions variable (e.g. `${{ github.ref_name }}`).  
For example:  
```diff
- if [ "${CIRCLE_BRANCH}" == 'master' ]; then
+ if [ "${{ github.ref_name }}" == 'master' ]; then
```  
This change is critical to ensure correct branch detection.  



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
        run: |
          if [ "${{ github.ref_name }}" == 'master' ]; then
            docker compose run compile sbt -no-colors clean compile stage
          else
            docker compose run compile sbt -no-colors -DfailOnWarning compile stage
          fi
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits e9d2d0c to 4656bdc
created_at: 2025-04-03T14:57:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,241 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+      POSTGRES_USER: "webknossos_user"
+      POSTGRES_PASWORD: "secret_password"
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          yarn run docs --project-version "$WK_VERSION"
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run backend-lint-format
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run backend-tests
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+      - name: Validate frontend types
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn typecheck
+      - name: Start webknossos, datastore and tracingstore
+        run: docker compose up -d webknossos && docker compose up -d webknossos-datastore && docker compose up -d webknossos-tracingstore
+      - name: Run webknossos smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9000/api/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Run webknossos-datastore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9090/data/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Run webknossos-tracingstore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9050/tracings/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Stop webknossos, datastore and tracingstore
+        run: docker compose down --volumes --remove-orphans
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry sh -c 'echo $DOCKER_PASS | docker login -u $DOCKER_USER --password-stdin'
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [ -n "${{ github.ref_name }}" ]; then
+            docker tag \
+              scalableminds/webknossos:${DOCKER_TAG} \
+              scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-datastore:${DOCKER_TAG} \
+              scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-tracingstore:${DOCKER_TAG} \
+              scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-dev \
+              scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
+          docker logout
+      - name: Report coverage
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose run base yarn coverage || true
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**[Issue] Coverage Reporting Error Suppression**

The final "Report coverage" step uses:
```bash
docker compose run base yarn coverage || true
```
Silently suppressing errors here may mask critical coverage regressions. It is recommended to remove the error suppression or to handle the error explicitly (e.g., by failing the job if coverage drops below a set threshold).

 

*Proposed diff:*
```diff
-        run: docker compose run base yarn coverage || true
+        run: docker compose run base yarn coverage
```

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T15:40:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,241 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**[Security Concern] Global Environment Configuration Insecure Values**

The global environment block currently sets:
- `USER_NAME: root` – Running jobs as root poses security risks. It is recommended to use a non‑root service account (for example, `webknosos`).
- `POSTGRES_PASSWORD: "secret_password"` – Hardcoding sensitive credentials is insecure. Please replace this with a reference to a GitHub secret (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).

 
  
*Proposed diff:*
```diff
-  USER_NAME: root
+  USER_NAME: webknosos
...
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
env:
  USER_NAME: webknosos
  USER_UID: 1000
  USER_GID: 1000
  DOCKER_USER: ${{ secrets.DOCKER_USER }}
  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T15:40:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,241 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+      POSTGRES_USER: "webknossos_user"
+      POSTGRES_PASWORD: "secret_password"
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Avoid Silently Ignoring Docker Pull Failures**  
The command in the “Build webknosos-dev docker image” step uses `|| true` after the `docker pull` command (line 112). This practice can mask critical errors in image retrieval.  

**Recommendation:**  
Remove the `|| true` or implement proper error handling (such as a retry mechanism) to ensure that failures are caught and handled.

```diff
-          docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH || true
+          docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH
```




<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
          docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH
          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 3d39b97 to 93c1492
created_at: 2025-04-03T15:46:02Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,245 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Global Environment Variables: Security Concerns**  
The global environment block sets `USER_NAME: root` and hardcodes `POSTGRES_PASSWORD` to the literal `"secret_password"`. Running CI jobs as root is risky, and hardcoded credentials are a security vulnerability. Please update `USER_NAME` to a non‑root account (e.g. `"webknosos"`) and source `POSTGRES_PASSWORD` from GitHub Secrets (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 3d39b97 to 93c1492
created_at: 2025-04-03T16:07:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,245 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+      POSTGRES_USER: "webknossos_user"
+      POSTGRES_PASWORD: "secret_password"
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Job Environment Variables in Build Test Deploy**  
Within the `build_test_deploy` job, note that there is a typo in the environment variable name on line 74: `POSTGRES_PASWORD` should be `POSTGRES_PASSWORD`. Moreover, the hardcoded credential `"secret_password"` is insecure. Please update the variable name and source its value from GitHub Secrets.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 3d39b97 to 300cca4
created_at: 2025-04-03T16:07:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,245 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+      POSTGRES_USER: "webknossos_user"
+      POSTGRES_PASWORD: "secret_password"
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          yarn run docs --project-version "$WK_VERSION"
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Frontend Documentation Build: Versioning Variables Issue**  
The documentation build step uses CircleCI variables (`CIRCLE_TAG` and `CIRCLE_BUILD_NUM`) to determine `WK_VERSION`, but these will not be defined in GitHub Actions. Please update this assignment to use a proper GitHub Actions variable (for example, `${{ github.run_number }}`) or another versioning scheme that reflects the new environment.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 3d39b97 to 93c1492
created_at: 2025-04-03T16:07:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,245 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+      POSTGRES_USER: "webknossos_user"
+      POSTGRES_PASWORD: "secret_password"
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: |
+          WK_VERSION=${CIRCLE_TAG:-${CIRCLE_BUILD_NUM:-dev}}
+          yarn run docs --project-version "$WK_VERSION"
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**End-to-End Tests: Filesystem Permissions**  
The e2e tests step creates the directory `binaryData/Organization_X` and sets permissions with `chmod 777`, which is excessively permissive. It is recommended to use a more restrictive permission (e.g. `chmod 755`) to minimize security risks.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T16:07:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,272 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: docker.io/library/postgres:17-alpine
+        env:
+          POSTGRES_DB: "webknossos"
+          POSTGRES_USER: ${{ env.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+      redis:
+        image: docker.io/library/redis:7.4.2
+        options: >-
+          --health-cmd "bash -c 'exec 3<> /dev/tcp/127.0.0.1/6379 && echo PING >&3 && head -1 <&3 | grep PONG'"
+          --health-interval 5s
+          --health-timeout 1s
+          --health-retries 10
+        ports:
+          - 6379:6379
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**[Configuration Review] Service Definitions for Postgres and Redis**  
The `postgres` and `redis` services are appropriately defined with health-check options. However, note that the Postgres service uses the password from the global env (currently insecure), so securing that variable (as mentioned above) will improve overall security.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T16:41:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,272 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: docker.io/library/postgres:17-alpine
+        env:
+          POSTGRES_DB: "webknossos"
+          POSTGRES_USER: ${{ env.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+      redis:
+        image: docker.io/library/redis:7.4.2
+        options: >-
+          --health-cmd "bash -c 'exec 3<> /dev/tcp/127.0.0.1/6379 && echo PING >&3 && head -1 <&3 | grep PONG'"
+          --health-interval 5s
+          --health-timeout 1s
+          --health-retries 10
+        ports:
+          - 6379:6379
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**[Error Handling] Docker Pull for Dev Image**  
The command `docker pull scalableminds/webknosos-dev:$NORMALIZED_BRANCH || true` (lines 137–139) silently suppresses failures. This could mask image pull issues. Consider removing `|| true` or implementing a proper retry mechanism so that failures are properly reported.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T16:41:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,272 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: docker.io/library/postgres:17-alpine
+        env:
+          POSTGRES_DB: "webknossos"
+          POSTGRES_USER: ${{ env.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+      redis:
+        image: docker.io/library/redis:7.4.2
+        options: >-
+          --health-cmd "bash -c 'exec 3<> /dev/tcp/127.0.0.1/6379 && echo PING >&3 && head -1 <&3 | grep PONG'"
+          --health-interval 5s
+          --health-timeout 1s
+          --health-retries 10
+        ports:
+          - 6379:6379
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**[Security Concern] Overly Permissive Filesystem Permissions**  
The "Run end-to-end tests" step creates a directory `binaryData/Organization_X` and sets its permissions with `chmod 777` (lines 201–205). Granting full permissions can expose your system to security risks. Consider using more restrictive permissions (such as `chmod 755`) and, if necessary, adjust ownership with `chown`.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-03T16:41:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,276 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Global Environment Variables – Security Concerns**  
The global environment block currently sets:  
• `USER_NAME: root` – Running jobs as root can pose security risks.  
• `POSTGRES_PASSWORD: "secret_password"` is hardcoded.  
It is recommended to run as a non‑root user (e.g. “webknosos” or another dedicated username) and source sensitive credentials (such as the PostgreSQL password) from GitHub Secrets (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T10:13:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,276 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: docker.io/library/postgres:17-alpine
+        env:
+          POSTGRES_DB: "webknossos"
+          POSTGRES_USER: ${{ env.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+      redis:
+        image: docker.io/library/redis:7.4.2
+        options: >-
+          --health-cmd "bash -c 'exec 3<> /dev/tcp/127.0.0.1/6379 && echo PING >&3 && head -1 <&3 | grep PONG'"
+          --health-interval 5s
+          --health-timeout 1s
+          --health-retries 10
+        ports:
+          - 6379:6379
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**tmate Debug Session Step**  
A tmate session is conditionally enabled if the workflow is dispatched with debug input. This is very useful for debugging, but as mentioned earlier the overall debug configuration would benefit from explicit permissions to restrict access.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T10:13:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,276 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: docker.io/library/postgres:17-alpine
+        env:
+          POSTGRES_DB: "webknossos"
+          POSTGRES_USER: ${{ env.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+      redis:
+        image: docker.io/library/redis:7.4.2
+        options: >-
+          --health-cmd "bash -c 'exec 3<> /dev/tcp/127.0.0.1/6379 && echo PING >&3 && head -1 <&3 | grep PONG'"
+          --health-interval 5s
+          --health-timeout 1s
+          --health-retries 10
+        ports:
+          - 6379:6379
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose up -d fossildb
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            sbt "testOnly e2e.*" -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false && s=0 && break || s=$?
+            # docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**End-to-End Tests – Filesystem Permissions and Retry Logic**  
The e2e tests step creates a directory (`binaryData/Organization_X`) and sets its permissions with `chmod 777`, which is overly permissive. It is recommended to use more restrictive permissions (e.g. `chmod 755`) and, if needed, adjust ownership appropriately. Additionally, while the retry loop is a good idea, ensure that the exit-status handling is robust.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T10:13:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,276 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: docker.io/library/postgres:17-alpine
+        env:
+          POSTGRES_DB: "webknossos"
+          POSTGRES_USER: ${{ env.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        options: >-
+          --health-cmd "pg_isready -U '${{ env.POSTGRES_USER }}'"
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+      redis:
+        image: docker.io/library/redis:7.4.2
+        options: >-
+          --health-cmd "bash -c 'exec 3<> /dev/tcp/127.0.0.1/6379 && echo PING >&3 && head -1 <&3 | grep PONG'"
+          --health-interval 5s
+          --health-timeout 1s
+          --health-retries 10
+        ports:
+          - 6379:6379
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose up -d fossildb
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            sbt "testOnly e2e.*" -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false && s=0 && break || s=$?
+            # docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Filesystem Permissions: Overly Permissive chmod**

The "Run end-to-end tests" step (lines 201–209) creates a directory (`binaryData/Organization_X`) and sets its permissions to `777`. Permissions `777` are overly permissive and introduce potential security risks. It is advisable to use a more restrictive permission mode (such as `755`).

For example:

```diff
-          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Run end-to-end tests
        if: ${{ github.ref_name != 'master' }}
        run: |
          mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
          for i in {1..3}; do # retry
            sbt "testOnly e2e.*" -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false && s=0 && break || s=$?
            # docker compose run e2e-tests && s=0 && break || s=$?
          done
          (exit $s)
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 407ed15 to ebd45aa
created_at: 2025-04-08T11:37:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,276 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: docker.io/library/postgres:17-alpine
+        env:
+          POSTGRES_DB: "webknossos"
+          POSTGRES_USER: ${{ env.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        options: >-
+          --health-cmd "pg_isready -U '${{ env.POSTGRES_USER }}'"
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+      redis:
+        image: docker.io/library/redis:7.4.2
+        options: >-
+          --health-cmd "bash -c 'exec 3<> /dev/tcp/127.0.0.1/6379 && echo PING >&3 && head -1 <&3 | grep PONG'"
+          --health-interval 5s
+          --health-timeout 1s
+          --health-retries 10
+        ports:
+          - 6379:6379
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose up -d fossildb
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            sbt "testOnly e2e.*" -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false && s=0 && break || s=$?
+            # docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+      - name: Validate frontend types
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn typecheck
+      - name: Start webknossos, datastore and tracingstore
+        run: docker compose up -d webknossos && docker compose up -d webknossos-datastore && docker compose up -d webknossos-tracingstore
+      - name: Run webknossos smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9000/api/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Run webknossos-datastore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9090/data/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Run webknossos-tracingstore smoke test
+        run: |
+          for i in {1..20}; do # retry
+            curl --fail -v http://localhost:9050/tracings/health && s=0 && break || s=$?
+            sleep 5
+          done
+          (exit $s)
+      - name: Stop webknossos, datastore and tracingstore
+        run: docker compose down --volumes --remove-orphans
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          retry docker compose push webknossos
+          retry docker compose push webknossos-datastore
+          retry docker compose push webknossos-tracingstore
+          if [ -n "${{ github.ref_name }}" ]; then
+            docker tag \
+              scalableminds/webknossos:${DOCKER_TAG} \
+              scalableminds/webknossos:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-datastore:${DOCKER_TAG} \
+              scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-datastore:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-tracingstore:${DOCKER_TAG} \
+              scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-tracingstore:${NORMALIZED_BRANCH}
+            docker tag \
+              scalableminds/webknossos-dev \
+              scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+            retry docker push scalableminds/webknossos-dev:${NORMALIZED_BRANCH}
+          fi
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Docker Push: Improve Variable Quoting and Error Handling**

Within the "Push docker images" block (lines 243–272), the docker tag commands use unquoted variable expansions (e.g., `${DOCKER_TAG}` and `${NORMALIZED_BRANCH}`). This can lead to word splitting issues if the variables contain unexpected characters. It is recommended to quote these variables in the tag commands. For example:

```diff
-            docker tag \
-              scalableminds/webknossos:${DOCKER_TAG} \
-              scalableminds/webknossos:${NORMALIZED_BRANCH}
+            docker tag \
+              "scalableminds/webknossos:${DOCKER_TAG}" \
+              "scalableminds/webknossos:${NORMALIZED_BRANCH}"
```

Also, review the custom `retry` function to ensure that errors are appropriately propagated rather than silently swallowed.

 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Push docker images
        run: |
          function retry() {
            for i in {1..5}; do
              "$@" && s=0 && break || s=$?
              sleep 10
            done
            return $s
          }
          retry docker compose push webknosos
          retry docker compose push webknosos-datastore
          retry docker compose push webknosos-tracingstore
          if [ -n "${{ github.ref_name }}" ]; then
            docker tag \
              "scalableminds/webknosos:${DOCKER_TAG}" \
              "scalableminds/webknosos:${NORMALIZED_BRANCH}"
            retry docker push "scalableminds/webknosos:${NORMALIZED_BRANCH}"
            docker tag \
              "scalableminds/webknosos-datastore:${DOCKER_TAG}" \
              "scalableminds/webknosos-datastore:${NORMALIZED_BRANCH}"
            retry docker push "scalableminds/webknosos-datastore:${NORMALIZED_BRANCH}"
            docker tag \
              "scalableminds/webknosos-tracingstore:${DOCKER_TAG}" \
              "scalableminds/webknosos-tracingstore:${NORMALIZED_BRANCH}"
            retry docker push "scalableminds/webknosos-tracingstore:${NORMALIZED_BRANCH}"
            docker tag \
              scalableminds/webknosos-dev \
              "scalableminds/webknosos-dev:${NORMALIZED_BRANCH}"
            retry docker push "scalableminds/webknosos-dev:${NORMALIZED_BRANCH}"
          fi
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T11:37:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,276 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: docker.io/library/postgres:17-alpine
+        env:
+          POSTGRES_DB: "webknossos"
+          POSTGRES_USER: ${{ env.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 2s
+          --health-timeout 5s
+          --health-retries 30
+        ports:
+          - 5432:5432
+      redis:
+        image: docker.io/library/redis:7.4.2
+        options: >-
+          --health-cmd "bash -c 'exec 3<> /dev/tcp/127.0.0.1/6379 && echo PING >&3 && head -1 <&3 | grep PONG'"
+          --health-interval 5s
+          --health-timeout 1s
+          --health-retries 10
+        ports:
+          - 6379:6379
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose up -d fossildb
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**[Security] Overly Permissive File Permissions in End-to-End Tests**  
The "Run end-to-end tests" step creates `binaryData/Organization_X` with `chmod 777` (lines 203–205), which is excessively permissive. For better security, use more restrictive permissions (such as `chmod 755`).  
 [security]

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T11:46:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,255 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: |
+          docker compose up -d postgres
+          sleep 3
+          tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            sbt "testOnly e2e.*" -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false && s=0 && break || s=$?
+            # docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Overly Permissive Filesystem Permissions in End-to-End Tests**

In the "Run end-to-end tests" step, the directory `binaryData/Organization_X` is created and its permissions are set using `chmod 777`, which is excessively permissive and poses a security risk. It is recommended to use a more restrictive permission (e.g. `chmod 755`).  
_Proposed diff:_
```diff
- mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+ mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```
 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
        if: ${{ github.ref_name != 'master' }}
        run: |
          mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
          for i in {1..3}; do # retry
            sbt "testOnly e2e.*" -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false && s=0 && break || s=$?
            # docker compose run e2e-tests && s=0 && break || s=$?
          done
          (exit $s)
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 307dc52 to ec411a8
created_at: 2025-04-08T12:08:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,278 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Optional: Secure Debug Session Activation**  
The tmate debug session step is conditionally enabled when a workflow_dispatch event occurs and the debug input is true. For additional security, consider enforcing access restrictions in your overall workflow (for example via an explicit `permissions` block).

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T12:25:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,278 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Error Handling: Review Docker Pull Suppression**  
The docker pull command here uses `|| true` (on line 118), which may hide critical errors if the pull fails. Consider removing this error suppression or implementing an explicit retry mechanism.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits b637a2b to 0595cac
created_at: 2025-04-08T12:25:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,278 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Error Handling: Docker Pull in Build Step**  
Similarly, in the “Build webknossos docker image” step the docker pull command again uses `|| true`. You might want to handle errors more explicitly so that image pull failures don’t go unnoticed.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T12:25:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,278 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Security: Tighten Filesystem Permissions for E2E Tests**  
The “Run end-to-end tests” step creates the directory `binaryData/Organization_X` and sets its permissions with `chmod 777`, which is overly permissive. Consider using a more restrictive permission (for example, `chmod 755`) to reduce security risks.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T12:25:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,107 @@
+name: webknossos-ci
+
+services:
+  webknossos:
+    image: scalableminds/webknossos:${DOCKER_TAG}
+    ports:
+      - "9000:9000"
+    command:
+      - -Dconfig.file=conf/application.conf
+      - -Djava.net.preferIPv4Stack=true
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.redis.address=redis
+      - -DwebKnossos.sampleOrganization.enabled=false
+    volumes:
+      - ../binaryData:/webknossos/binaryData
+    environment:
+      - CERTIFICATE
+      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  webknossos-datastore:
+    image: scalableminds/webknossos-datastore:${DOCKER_TAG}
+    ports:
+      - "9090:9090"
+    volumes:
+      - ../binaryData:/webknossos-datastore/binaryData
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-datastore.conf
+      - -Dhttp.port=9090
+      - -Dhttp.uri=http://webknossos-datastore:9090
+      - -Ddatastore.webKnossos.uri=webknossos:9000
+      - -Ddatastore.redis.address=redis
+    depends_on:
+      redis:
+        condition: service_healthy
+
+  webknossos-tracingstore:
+    image: scalableminds/webknossos-tracingstore:${DOCKER_TAG}
+    ports:
+      - "9050:9050"
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-tracingstore.conf
+      - -Dhttp.port=9050
+      - -Dhttp.uri=http://webknossos-datastore:9050
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.webknossos.uri=webknossos:9000
+    depends_on:
+      redis:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+
+  fossildb:
+    image: scalableminds/fossildb:master__510
+    command:
+      - fossildb
+      - -c
+      - skeletons,volumes,volumeData,volumeSegmentIndex,editableMappingsInfomeditableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate,annotations,annotationUpdates
+    ports:
path: .github/docker-compose.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Critical: Fix Concatenation Error in Fossildb Command**  
In the `fossildb` service, the command argument on line 72 includes:  
```
editableMappingsInfomeditableMappingsAgglomerateToGraph
```  
This appears to be a concatenation error. Please correct it so that the intended parameters are clearly separated (for example, `editableMappingsInfo,editableMappingsAgglomerateToGraph` if that is what was meant).

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits c668132 to 425bb07
created_at: 2025-04-08T12:25:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,275 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+      - name: Build webknossos-dev docker image
+        run: |
+          docker pull scalableminds/webknossos-dev:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build base
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Filesystem Permissions: Overly Permissive Directory Mode**

In the "Run end-to-end tests" step, the directory `binaryData/Organization_X` is created with permissions set via:

  `mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X`

Using `777` is too permissive and may expose the system to unintended modifications. It is safer to use a more restrictive mode (for example, `755`):

```diff
-          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```




<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
          mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
          for i in {1..3}; do # retry
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T13:31:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,275 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Issue: Update Environment Variables**  
Running jobs as root (`USER_NAME: root`) poses a security risk. Please change this to a non‑root user (for example, `webknosos` or a similarly lower‑privileged account). Also, avoid hardcoded sensitive credentials; update  
```yaml
POSTGRES_PASSWORD: "secret_password"
```  
to use a secret (e.g. `${{ secrets.POSTGRES_PASSWORD }}`).

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T13:48:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,275 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false" && s=0 && break || s=$?
+            # docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+      - name: Validate frontend types
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Security Concern: Overly Permissive Filesystem Permissions in e2e Tests**  
The command  
```bash
mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
```  
sets full read/write/execute permissions for all users. Consider using a more restrictive mode such as `chmod 755` (and use `chown` if needed) to reduce the security risk.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T13:48:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,264 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Avoid Masking Errors in Docker Pull Command**  
The command  
```bash
docker pull scalableminds/webknosos:$NORMALIZED_BRANCH || true
```  
uses `|| true`, which can mask critical errors. It is advised to remove the `|| true` or implement proper error handling. Additionally, quoting the variable is recommended:
```diff
-          docker pull scalableminds/webknosos:$NORMALIZED_BRANCH || true
+          docker pull "scalableminds/webknosos:${NORMALIZED_BRANCH}"
```

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits b637a2b to 0595cac
created_at: 2025-04-08T14:07:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,264 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false" && s=0 && break || s=$?
+            # docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+      - name: Validate frontend types
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Tighten Filesystem Permissions in End-to-End Tests**  
In the "Run end-to-end tests" step, the directory is created and its permissions set with:  
```bash
mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
```  
Using `777` is overly permissive. It is recommended to use a more restrictive mode, such as `755`, for improved security:
```diff
-          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T14:07:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,264 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+
+      - name: Build webknossos docker image
+        run: |
+          docker pull scalableminds/webknossos:$NORMALIZED_BRANCH || true
+          DEV_CACHE=$NORMALIZED_BRANCH docker compose build --pull webknossos
+      - name: Build webknossos-datastore docker image
+        run: docker compose build --pull webknossos-datastore
+      - name: Build webknossos-tracingstore docker image
+        run: docker compose build --pull webknossos-tracingstore
+
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        run: |
+          mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+          for i in {1..3}; do # retry
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false" && s=0 && break || s=$?
+            # docker compose run e2e-tests && s=0 && break || s=$?
+          done
+          (exit $s)
+      - name: Validate frontend types
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn typecheck
+
+      - name: Start webknossos, datastore and tracingstore
+        run: |
+          set -e
+          docker compose --file .github/docker-compose.yml up -d webknossos
+          docker compose --file .github/docker-compose.yml up -d webknossos-datastore
+          docker compose --file .github/docker-compose.yml up -d webknossos-tracingstore
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9000/api/health
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9090/data/health
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/url-health-check
+        with:
+          url: http://localhost:9050/tracings/health
+      - name: Stop webknossos, datastore and tracingstore
+        run: docker compose --file .github/docker-compose.yml down --volumes --remove-orphans
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Push docker images
+        run: |
+          function retry() {
+            for i in {1..5}; do
+              "$@" && s=0 && break || s=$?
+              sleep 10
+            done
+            return $s
+          }
+          if [ -n "${{ github.ref_name }}"]; then
+            retry docker push scalableminds/webknossos:$NORMALIZED_BRANCH
+            retry docker push scalableminds/webknossos:$DOCKER_TAG
+
+            retry docker push scalableminds/webknossos-datastore:$NORMALIZED_BRANCH
+            retry docker push scalableminds/webknossos-datastore:$DOCKER_TAG
+
+            retry docker push scalableminds/webknossos-tracingstore:$NORMALIZED_BRANCH
+            retry docker push scalableminds/webknossos-tracingstore:$DOCKER_TAG
+          fi
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Refine Docker Push Command & Conditional Syntax**  
Within the "Push docker images" step:  
1. The if-condition syntax is problematic:
   ```bash
   if [ -n "${{ github.ref_name }}"];
   ```
   It is missing a space before the closing bracket. It should read:
   ```bash
   if [ -n "${{ github.ref_name }}" ]; then
   ```
2. Additionally, ensure that variable expansions in docker tag and push commands are quoted to prevent word splitting:
   ```diff
   - retry docker push scalableminds/webknosos:$NORMALIZED_BRANCH
   + retry docker push "scalableminds/webknosos:${NORMALIZED_BRANCH}"
   ```
Please review and adjust these commands accordingly.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T14:07:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,298 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Filesystem Permissions in Dependency Preparation**  
The step “Prepare binaryData folder” (line 196) uses:
```bash
mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
```
Setting permissions to `777` is overly permissive. It is recommended to use `chmod 755` (or a similarly restrictive mode) to minimize security risks.  
```diff
-        mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+        mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T14:50:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,298 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+
+      - name: Lint frontend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn run check-frontend
+      - name: Check for cyclic dependencies in front-end
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn test-verbose
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        uses: ./.github/actions/retry
+        with:
+          run: |
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false" && s=0 && break || s=$?
+          reties: 3
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Run End-to-End Tests - Input Name Typo**  
The end-to-end tests step uses a custom retry action. However, the input key is misspelled as `reties` instead of `retries`:
```yaml
-    reties: 3
+    retries: 3
```
This mistake prevents the retry mechanism from working as expected. Please fix the typo.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

199-199: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

203-203: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 4292d4e
created_at: 2025-04-08T14:50:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,298 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  DOCKER_USER: ${{ secrets.DOCKER_USER }}
+  DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  static_frontend_code_checks:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
+      - name: Start Docker Services
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Update Buildx Action Version**  
The workflow uses `docker/setup-buildx-action@v2` (line 79), but static analysis recommends updating this to a more recent version. Upgrading to v3 can provide improved performance and new features.  
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - uses: docker/setup-buildx-action@v3
      - name: Start Docker Services
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

79-79: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 307dc52 to ec411a8
created_at: 2025-04-08T14:50:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,350 @@
 name: CI Pipeline
 
 on:
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security: Add explicit workflow permissions**  
There is no top‑level `permissions` field in this workflow. To restrict who can trigger workflow_dispatch (especially when debug inputs are enabled), please add a dedicated permissions block (for example, setting `contents: read`).  
```yaml
permissions:
  contents: read
```

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-08T15:14:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,112 @@
+name: webknossos-ci
+
+services:
+  webknossos:
+    image: scalableminds/webknossos:${DOCKER_TAG}
+    pull_policy: never
+    ports:
+      - "9000:9000"
+    command:
+      - -Dconfig.file=conf/application.conf
+      - -Djava.net.preferIPv4Stack=true
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.redis.address=redis
+      - -DwebKnossos.sampleOrganization.enabled=false
+    volumes:
+      - ../binaryData:/webknossos/binaryData
+    environment:
+      - CERTIFICATE
+      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  webknossos-datastore:
+    image: scalableminds/webknossos-datastore:${DOCKER_TAG}
+    pull_policy: never
+    ports:
+      - "9090:9090"
+    volumes:
+      - ../binaryData:/webknossos-datastore/binaryData
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-datastore.conf
+      - -Dhttp.port=9090
+      - -Dhttp.uri=http://webknossos-datastore:9090
+      - -Ddatastore.webKnossos.uri=webknossos:9000
+      - -Ddatastore.redis.address=redis
+    depends_on:
+      redis:
+        condition: service_healthy
+
+  webknossos-tracingstore:
+    image: scalableminds/webknossos-tracingstore:${DOCKER_TAG}
+    pull_policy: never
+    ports:
+      - "9050:9050"
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-tracingstore.conf
+      - -Dhttp.port=9050
+      - -Dhttp.uri=http://webknossos-datastore:9050
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.webknossos.uri=webknossos:9000
+    depends_on:
+      redis:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+
+  fossildb:
+    image: scalableminds/fossildb:master__510
+    command:
+      - fossildb
+      - -c
+      - skeletons,skeletonTreeBodies,volumes,volumeData,volumeSegmentIndex,editableMappingsInfomeditableMappingsAgglomerateToGraph,editableMappingsSegmentToAgglomerate,annotations,annotationUpdates
+    ports:
path: .github/docker-compose.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical: Fix concatenation error in Fossildb command**  
In the `fossildb` service (line 75) the command argument  
```
editableMappingsInfomeditableMappingsAgglomerateToGraph
```  
appears to be a concatenation error. Verify whether this should be two separate parameters (for example, `editableMappingsInfo,editableMappingsAgglomerateToGraph`) or corrected to include an appropriate delimiter.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits c668132 to 425bb07
created_at: 2025-04-08T15:14:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,302 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v2
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Update Setup Buildx Action Version**  
The workflow currently uses `docker/setup-buildx-action@v2` (line 77). Recent static analysis hints as well as new features suggest updating this to v3.  
_Proposed diff:_
```diff
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@v3
```



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - uses: docker/setup-buildx-action@v3
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

77-77: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 0f5cb1e
created_at: 2025-04-08T15:23:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,325 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Mitigate Security Risks in Global Environment**

The global environment sets `USER_NAME: root` along with hardcoded credentials (`POSTGRES_PASSWORD: "secret_password"`). Running jobs as the root user and exposing credentials in plain text pose significant security risks. Please change `USER_NAME` to a non‑root account (for example, `webknosos` or a dedicated CI user) and source sensitive values from GitHub Secrets.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T08:35:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,325 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_NAME: root
+  USER_UID: 1000
+  USER_GID: 1000
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend_tests:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    env:
+      USER_UID: 1001
+      USER_GID: 1001
+      POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Secure Debugging via tmate Session**

Enabling a tmate session for the build job facilitates on‑demand debugging. However, since such sessions may expose sensitive runtime information, ensure that additional security measures (like incorporating a top‑level permissions field) are in place to restrict who can trigger debug sessions.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 407ed15 to 9dc8ca4
created_at: 2025-04-09T08:35:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,325 @@
 name: CI Pipeline
 
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Overall Workflow Security Enhancement**

Consider adding a top‑level `permissions` field (e.g., `permissions: { contents: read }`) at the beginning of the workflow file. This would restrict who can manually trigger the workflow via workflow_dispatch and help prevent unauthorized activation of debugging features.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T08:35:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,324 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Security: Add Explicit Workflow Permissions**  
The workflow’s trigger section (push, pull_request, and workflow_dispatch with debug inputs) is well defined; however, there is no top‑level `permissions` field. To restrict who can manually trigger the workflow (and especially the debugging options), consider adding an explicit permissions block (for example, `permissions: { contents: read }`).

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T08:55:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,324 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend_tests:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        uses: ./.github/actions/retry
+        with:
+          run: |
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false" && s=0 && break || s=$?
+          reties: 3
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Typo Correction: Fix Retry Input Key**  
The retry action’s input is mistakenly labeled as `reties` instead of `retries`. This typo prevents the action from receiving the correct input and may disable the retry mechanism. Please change `reties: 3` to `retries: 3`.

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

225-225: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 4292d4e
created_at: 2025-04-09T08:55:14Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,342 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: sbt -v "testOnly backend.*"
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        uses: ./.github/actions/retry
+        with:
+          run: |
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false" && s=0 && break || s=$?
+          reties: 3
+      - name: Validate frontend types
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Fix Typo in Retry Action Input**

In the "Run end-to-end tests" step, the input key is misspelled as `reties: 3` instead of the correct `retries: 3`. Correcting this typo is essential for the retry mechanism to work properly:

```diff
-          reties: 3
+          retries: 3
```




<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Run end-to-end tests
        if: ${{ github.ref_name != 'master' }}
        uses: ./.github/actions/retry
        with:
          run: |
            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false" && s=0 && break || s=$?
          retries: 3
      - name: Validate frontend types
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 actionlint (1.7.4)</summary>

242-242: missing input "retries" which is required by action "Shell Retry" defined at "./.github/actions/retry". all required inputs are "retries", "run"

(action)

---

246-246: input "reties" is not defined in action "Shell Retry" defined at "./.github/actions/retry". available inputs are "retries", "retry_delay_seconds", "run"

(action)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit 4292d4e
created_at: 2025-04-09T09:12:17Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,342 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: sbt -v "testOnly backend.*"
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        uses: ./.github/actions/retry
+        with:
+          run: |
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false" && s=0 && break || s=$?
+          retries: 3
+      - name: Validate frontend types
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**End-to-End Tests with Retry Action**  
The step for running e2e tests uses a custom retry action. However, the inline command with constructs like `&& s=0 && break || s=$?` seems error‑prone. Consider refactoring this step or using a well‑tested retry mechanism that properly propagates errors without resorting to such shell control constructs.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T09:16:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,342 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - uses: actions/cache@v4
+        id: node_modules
+        with:
+          path: |
+            tools/postgres/node_modules
+            tools/proxy/node_modules
+            node_modules
+          key: node_modules-${{ hashFiles('**/yarn.lock') }}
+      - name: Install frontend dependencies
+        if: steps.node_modules.outputs.cache-hit != 'true'
+        run: yarn install --immutable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: sbt -v "testOnly backend.*"
+
+
+  build_test_deploy:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ ${{ github.ref_type }} == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo ${{ github.ref_name }} | sed 's/[\/-]/_/g')
+            echo "normalized_branch=$NORMALIZED_BRANCH" >> "$GITHUB_OUTPUT"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_number }}"
+            echo "docker_tag=$DOCKER_TAG" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "normalized_branch=master" >> "$GITHUB_OUTPUT"
+            echo "docker_tag=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.tmate_debug_build }}
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_number }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+
+      - name: tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+
+      - name: Lint backend code and check formatting
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        if: ${{ github.ref_name != 'master' }}
+        run: sbt -v "testOnly backend.*"
+
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        uses: ./.github/actions/retry
+        with:
+          run: |
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false" && s=0 && break || s=$?
+          retries: 3
+      - name: Validate frontend types
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn typecheck
+
+      - name: Start webknossos, datastore and tracingstore
+        run: |
+          set -e
+          docker compose --file .github/docker-compose.yml up -d webknossos
+          docker compose --file .github/docker-compose.yml up -d webknossos-datastore
+          docker compose --file .github/docker-compose.yml up -d webknossos-tracingstore
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/retry
+        with:
+          run: curl -v --fail "http://localhost:9000/api/health"
+          retries: 20
+          retry_delay_seconds: 5
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/retry
+        with:
+          run: curl -v --fail "http://localhost:9090/data/health"
+          retries: 20
+          retry_delay_seconds: 5
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/retry
+        with:
+          run: curl -v --fail "http://localhost:9050/tracings/health"
+          retries: 20
+          retry_delay_seconds: 5
+      - name: Stop webknossos, datastore and tracingstore
+        run: docker compose --file .github/docker-compose.yml down --volumes --remove-orphans
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+
+      - name: Push webknossos image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push normalized webknossos image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push webknossos-datastore image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push normalized webknossos-datastore image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push webknossos-tracingstore image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push normalized webknossos-tracingstore image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+          retries: 5
+          retry_delay_seconds: 10
+#      - name: Push docker images
+#        run: |
+#          function retry() {
+#            for i in {1..5}; do
+#              "$@" && s=0 && break || s=$?
+#              sleep 10
+#            done
+#            return $s
+#          }
+#          if [ -n "${{ github.ref_name }}"]; then
+#            retry docker push scalableminds/webknossos:$NORMALIZED_BRANCH
+#            retry docker push scalableminds/webknossos:$DOCKER_TAG
+#
+#            retry docker push scalableminds/webknossos-datastore:$NORMALIZED_BRANCH
+#            retry docker push scalableminds/webknossos-datastore:$DOCKER_TAG
+#
+#            retry docker push scalableminds/webknossos-tracingstore:$NORMALIZED_BRANCH
+#            retry docker push scalableminds/webknossos-tracingstore:$DOCKER_TAG
+#          fi
+      - name: Report coverage
+        if: ${{ github.ref_name != 'master' }}
+        continue-on-error: true
+        run: yarn coverage
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Coverage Reporting – Error Suppression**  
The final "Report coverage" step uses `continue-on-error: true`, which may mask test coverage regressions. It is recommended to remove this option or implement a mechanism to enforce a minimum coverage threshold so that failures are not silently ignored.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commits 407ed15 to 60bcd72
created_at: 2025-04-09T09:16:58Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,287 @@
 name: CI Pipeline
 
 on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
   workflow_dispatch:
+    inputs:
+      tmate_debug_build:
+        type: boolean
+        description: "Debug Build Job"
+        required: false
+        default: false
+      tmate_debug_e2e_tests:
+        type: boolean
+        description: "Debug e2e Tests"
+        required: false
+        default: false
+      debug_enabled:
+        type: boolean
+        description: 'Run the build with tmate debugging enabled (https://github.com/marketplace/actions/debugging-with-tmate)'
+        required: false
+        default: false
+
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Workflow Triggers and Dispatch Inputs:**  
The definitions for push (to master), pull_request (all branches), and workflow_dispatch (with debug inputs) are well structured. However, because the workflow_dispatch trigger now offers debug options (e.g. tmate_debug_build, tmate_debug_e2e_tests, debug_enabled), it is advisable to add a top-level `permissions:` block (for example, `permissions: { contents: read }`) to restrict who may manually trigger these runs. This extra safeguard can help prevent unintended or unauthorized debug sessions.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T10:08:20Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+author=${GITHUB_ACTOR}
+author=${author/fm3/<@florian>}
+author=${author/daniel-wer/<@daniel>}
+author=${author/hotzenklotz/<@tom>}
+author=${author/MichaelBuessemeyer/<@michael>}
+author=${author/normanrz/<@norman>}
+author=${author/philippotto/<@philipp>}
+author=${author/valentin-pinkau/<@valentin>}
+author=${author/frcroth/<@felix.roth>}
+author=${author/dieknolle3333/<@charlie.meister>}
+channel="webknossos-bots"
+commitmsg=$(git log --format=%s -n 1)
+pullregex="(.*)#([0-9]+)(.*)"
+
+while [[ "$commitmsg" =~ $pullregex ]]; do
+    commitmsg="${BASH_REMATCH[1]}#<https://github.com/scalableminds/webknossos/issues/${BASH_REMATCH[2]}|${BASH_REMATCH[2]}>${BASH_REMATCH[3]}"
+done
+
+buildlink="<https://circleci.com/gh/scalableminds/webknossos/${}|ready>"
+mesg="${author} WEBKNOSSOS docker image \`master__${GITHUB_RUN_ID}\` for “${commitmsg}” is ${buildlink}."
path: .github/slack-notifiaction.sh
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Build Link and Unicode Quote Issue**  
The variable `buildlink` is still pointing to a CircleCI URL (`https://circleci.com/gh/scalableminds/webknossos/${}|ready`), which contradicts the PR’s objective of converting the CI to GitHub Actions. Additionally, the commit message in line 24 uses Unicode “curly” quotes (`“”`), which can trigger shellcheck warnings (SC1111) and may lead to issues in certain shell environments.  
Please update the build link to reference the appropriate GitHub Actions context and replace the curly quotes with standard ASCII double quotes. For example:  

```diff
- mesg="${author} WEBKNOSSOS docker image \`master__${GITHUB_RUN_ID}\` for “${commitmsg}” is ${buildlink}."
+ mesg="${author} WEBKNOSSOS docker image \`master__${GITHUB_RUN_ID}\` for \"${commitmsg}\" is ${buildlink}."
```



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
buildlink="<https://circleci.com/gh/scalableminds/webknossos/${}|ready>"
mesg="${author} WEBKNOSSOS docker image \`master__${GITHUB_RUN_ID}\` for \"${commitmsg}\" is ${buildlink}."
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 Shellcheck (0.10.0)</summary>

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

---

[warning] 24-24: This is a unicode quote. Delete and retype it (or ignore/singlequote for literal).

(SC1111)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T10:08:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,35 @@
+FROM eclipse-temurin:21-jammy
+ARG VERSION_NODE="18.x"
+
+RUN curl -sL "https://deb.nodesource.com/setup_${VERSION_NODE}" | bash - \
+  && apt-get -y install libblosc1 libbrotli1 postgresql-client libdraco4 git nodejs \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /webknossos
+WORKDIR /webknossos
+
+# Copy compiled Scala output from a previous build step, e.g. output of the Docker-dev image
+COPY target/universal/stage .
+
+RUN addgroup --system --gid 999 webknossos \
+  && adduser --system --uid 999 --ingroup webknossos webknossos \
+  && mkdir disk \
+  && chown -R webknossos . \
+  && chmod +x bin/webknossos \
+  && chmod +x tools/postgres/dbtool.js \
+  && chmod go+w .
+
+RUN echo '#!/bin/bash\numask 002\nbin/webknossos "$@"\n' > /docker-entrypoint.sh \
+  && chmod +x /docker-entrypoint.sh
+
+HEALTHCHECK \
+  --interval=1m --timeout=5s --retries=10 \
+  CMD curl --fail http://localhost:9000/api/buildinfo || exit 1
+
+USER webknossos
+
+EXPOSE 9000
+
+ENV CERTIFICATE "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzY2FsYWJsZW1pbmRzIiwiaWF0IjoxNzM5ODExMTc3LCJleHAiOjE4OTM0NTYwMDAsImZlYXR1cmVzIjp7Im9wZW5JZENvbm5lY3RFbmFibGVkIjpmYWxzZSwic2VnbWVudEFueXRoaW5nRW5hYmxlZCI6ZmFsc2UsImVkaXRhYmxlTWFwcGluZ3NFbmFibGVkIjpmYWxzZX19.c_zBzj7bKPCXp5eTjFrCC4YmOxSH9uQx3BRMYbVx9dPsiCwlyvi7jepqOP7bS8QIcdoSHnrhHpZ-tQKkTi3rkw"
+
path: .github/Dockerfile.webknossos
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**Security Concern: Exposed Certificate**  
The `ENV CERTIFICATE` line exposes a JSON Web Token directly in the Dockerfile. This practice can lead to unauthorized access if the image is published or inspected. It is recommended to remove this hardcoded token and instead inject it via build-time arguments, runtime environment variables, or a secrets management solution.  
For instance, you could remove the line:  

```diff
- ENV CERTIFICATE "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzY2FsYWJsZW1pbmRzIiwiaWF0IjoxNzM5ODExMTc3LCJleHAiOjE4OTM0NTYwMDAsImZlYXR1cmVzIjp7Im9wZW5JZENvbm5lY3RFbmFibGVkIjpmYWxzZSwic2VnbWVudEFueXRoaW5nRW5hYmxlZCI6ZmFsc2UsImVkaXRhYmxlTWFwcGluZ3NFbmFibGVkIjpmYWxzZX19.c_zBzj7bKPCXp5eTjFrCC4YmOxSH9uQx3BRMYbVx9dPsiCwlyvi7jepqOP7bS8QIcdoSHnrhHpZ-tQKkTi3rkw"
```



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
# (The following line has been removed)
`````

</details>

<!-- suggestion_end -->

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 Gitleaks (8.21.2)</summary>

33-33: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.

(jwt)

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T10:08:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,34 @@
+FROM eclipse-temurin:21-jammy
+
+RUN apt-get update \
+  && apt-get -y install libblosc1 libbrotli1 libdraco4 \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /webknossos-tracingstore \
+  && groupadd -g 1000 -r webknossos \
+  && useradd -u 1000 -r -g webknossos webknossos \
+  && mkdir /webknossos-tracingstore/tracingData
+
+WORKDIR /webknossos-tracingstore
+
+VOLUME /webknossos-tracingstore/tracingData /tmp
+
+COPY target/universal/stage .
+
+RUN chown -R webknossos . \
+  && chmod +x bin/webknossos-tracingstore \
+  && chmod go+w .
+
+RUN echo '#!/bin/bash\numask 002\nbin/webknossos-tracingstore "$@"\n' > /docker-entrypoint.sh \
+  && chmod +x /docker-entrypoint.sh
+
+USER webknossos
+
+HEALTHCHECK \
+  --interval=1m --timeout=5s --retries=10 \
+  CMD curl --fail http://localhost:9050/tracings/health || exit 1
+
+EXPOSE 9050
+
+ENTRYPOINT ["/docker-entrypoint.sh"]
+CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9090", "-Dhttp.address=0.0.0.0"]
path: .github/Dockerfile.tracingstsore
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Inconsistent Port Configuration**  
There is an inconsistency in the port settings: the Dockerfile exposes port 9050 and the healthcheck targets port 9050, but the CMD parameters specify `-Dhttp.port=9090`. This mismatch can cause connectivity issues since the application will listen on a different port than expected.  
Please update the CMD argument to use port 9050 to maintain consistency. For example:  

```diff
- CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9090", "-Dhttp.address=0.0.0.0"]
+ CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9050", "-Dhttp.address=0.0.0.0"]
```  



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
EXPOSE 9050

ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9050", "-Dhttp.address=0.0.0.0"]
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T10:08:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,270 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
 
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical: Avoid Hardcoding Sensitive Credentials**  
The global environment variables defined on lines 11–17 include hardcoded values for sensitive settings (e.g., `POSTGRES_PASSWORD: "secret_password"`). Hardcoding credentials poses a serious security risk. Please switch to sourcing such values from GitHub Secrets (for example, use `${{ secrets.POSTGRES_PASSWORD }}`) to ensure these secrets aren’t exposed in your repository.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T11:15:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,34 @@
+FROM eclipse-temurin:21-jammy
+
+RUN apt-get update \
+  && apt-get -y install libblosc1 libbrotli1 libdraco4 \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /webknossos-tracingstore \
+  && groupadd -g 1000 -r webknossos \
+  && useradd -u 1000 -r -g webknossos webknossos \
+  && mkdir /webknossos-tracingstore/tracingData
+
+WORKDIR /webknossos-tracingstore
+
+VOLUME /webknossos-tracingstore/tracingData /tmp
+
+COPY target/universal/stage .
+
+RUN chown -R webknossos . \
+  && chmod +x bin/webknossos-tracingstore \
+  && chmod go+w .
+
+RUN echo '#!/bin/bash\numask 002\nbin/webknossos-tracingstore "$@"\n' > /docker-entrypoint.sh \
+  && chmod +x /docker-entrypoint.sh
+
+USER webknossos
+
+HEALTHCHECK \
+  --interval=1m --timeout=5s --retries=10 \
+  CMD curl --fail http://localhost:9050/tracings/health || exit 1
+
+EXPOSE 9050
+
+ENTRYPOINT ["/docker-entrypoint.sh"]
+CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9090", "-Dhttp.address=0.0.0.0"]
path: .github/Dockerfile.tracingstore
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>🧩 Analysis chain</summary>

**Port Exposure and CMD Discrepancy**

While the container exposes port 9050 (and the healthcheck targets port 9050), the final CMD sets `-Dhttp.port=9090`. This inconsistency could lead to health check failures and misrouted traffic. Align the application’s port with the exposed port and healthcheck by updating the CMD. For example:

```diff
- CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9090", "-Dhttp.address=0.0.0.0"]
+ CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9050", "-Dhttp.address=0.0.0.0"]
```

---

**CMD Port Mismatch in .github/Dockerfile.tracingstore**

The Dockerfile exposes port **9050** but the CMD sets the HTTP port to **9090**. This inconsistency between the exposed port and the internal application configuration can lead to healthcheck failures and misrouted traffic. Please update the CMD to ensure the application's HTTP port aligns with the exposed port. For instance:

```diff
- CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9090", "-Dhttp.address=0.0.0.0"]
+ CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9050", "-Dhttp.address=0.0.0.0"]
```

Please address this discrepancy to maintain proper routing and healthcheck functionality.

---

🏁 Script executed:

```shell

#!/bin/bash
echo "Verifying port configuration in .github/Dockerfile.tracingstore:"
echo "Extracting lines 31-34..."
sed -n '31,34p' .github/Dockerfile.tracingstore

echo ""
echo "Searching for the CMD configuration of '-Dhttp.port=9090'..."
rg "Dhttp.port=9090" .github/Dockerfile.tracingstore || echo "No CMD with port 9090 found."
```

Length of output: 1066

---



</details>

**CMD Port Correction Required**

The Dockerfile exposes port **9050**, but the CMD still sets `-Dhttp.port=9090`. This discrepancy can lead to healthcheck misconfigurations and routing issues. Please update the CMD to set the HTTP port to 9050. For example:

```diff
- CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9090", "-Dhttp.address=0.0.0.0"]
+ CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9050", "-Dhttp.address=0.0.0.0"]
```

Please address this to ensure consistency between the exposed port and the application’s configuration.



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
EXPOSE 9050

ENTRYPOINT ["/docker-entrypoint.sh"]
CMD ["-J-Xmx20G", "-J-Xms1G", "-Dconfig.file=conf/standalone-tracingstore.conf", "-Dlogger.file=conf/logback-docker.xml", "-Dlogback.configurationFile=conf/logback-docker.xml", "-Dhttp.port=9050", "-Dhttp.address=0.0.0.0"]
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit c43c9e5
created_at: 2025-04-09T11:15:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,112 @@
+name: webknossos-ci
+
+services:
+  webknossos:
+    image: scalableminds/webknossos:${DOCKER_TAG}
+    pull_policy: never
+    ports:
+      - "9000:9000"
+    command:
+      - -Dconfig.file=conf/application.conf
+      - -Djava.net.preferIPv4Stack=true
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.redis.address=redis
+      - -DwebKnossos.sampleOrganization.enabled=false
+    volumes:
+      - ../binaryData:/webknossos/binaryData
+    environment:
+      - CERTIFICATE
+      - POSTGRES_URL=jdbc:postgresql://postgres/webknossos
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  webknossos-datastore:
+    image: scalableminds/webknossos-datastore:${DOCKER_TAG}
+    pull_policy: never
+    ports:
+      - "9090:9090"
+    volumes:
+      - ../binaryData:/webknossos-datastore/binaryData
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-datastore.conf
+      - -Dhttp.port=9090
+      - -Dhttp.uri=http://webknossos-datastore:9090
+      - -Ddatastore.webKnossos.uri=webknossos:9000
+      - -Ddatastore.redis.address=redis
+    depends_on:
+      redis:
+        condition: service_healthy
+
+  webknossos-tracingstore:
+    image: scalableminds/webknossos-tracingstore:${DOCKER_TAG}
+    pull_policy: never
+    ports:
+      - "9050:9050"
+    command:
+      - -J-Xmx20G
+      - -J-Xms1G
+      - -Dconfig.file=conf/standalone-tracingstore.conf
+      - -Dhttp.port=9050
+      - -Dhttp.uri=http://webknossos-datastore:9050
+      - -Dtracingstore.fossildb.address=fossildb
+      - -Dtracingstore.redis.address=redis
+      - -Ddatastore.webknossos.uri=webknossos:9000
+    depends_on:
+      redis:
+        condition: service_healthy
+      fossildb:
+        condition: service_healthy
+
path: .github/docker-compose.yml
user: login: coderabbitai[bot]
body: _💡 Verification agent_

<details>
<summary>❓ Verification inconclusive</summary>

**WebKnossos-Tracingstore Service: Potential URI Mismatch**

Within the `webknossos-tracingstore` service, the command argument on line 60 specifies `-Dhttp.uri=http://webknossos-datastore:9050`. Given that this service is responsible for tracing, it would be more logical for its URI to reference itself (i.e., `http://webknossos-tracingstore:9050`). Please verify if this reference is intentional; if not, update it as follows:

```diff
-      - -Dhttp.uri=http://webknossos-datastore:9050
+      - -Dhttp.uri=http://webknossos-tracingstore:9050
```

---



</details>

**Action Required: Correct the URI for the Tracingstore Service**

It appears that within the `webknossos-tracingstore` service (in file `.github/docker-compose.yml`, lines 50–69), the command argument on line 60 currently specifies:

```yaml
- -Dhttp.uri=http://webknossos-datastore:9050
```

Since the service is named `webknossos-tracingstore`—and given that the tracingstore should reference itself—you should verify whether this was intentional. If not, please update the URI so that it points to `webknossos-tracingstore` rather than `webknossos-datastore`. For example:

```diff
-      - -Dhttp.uri=http://webknossos-datastore:9050
+      - -Dhttp.uri=http://webknossos-tracingstore:9050
```

Please review and adjust the configuration accordingly.

<!-- This is an auto-generated comment by CodeRabbit -->

✅ Addressed in commit c43c9e5
created_at: 2025-04-09T11:15:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,272 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Concern: Avoid Hardcoded Credentials in Environment Variables**  
The environment block (lines 11–16) defines sensitive values including `POSTGRES_PASSWORD: "secret_password"`. Hardcoding such credentials can expose them in logs and the codebase. It’s recommended to move this value (and any similar sensitive data) to GitHub Secrets (e.g. `${{ secrets.POSTGRES_PASSWORD }}`) so that they aren’t exposed in plaintext.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T11:55:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,274 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
+  CERTIFICATE: ${{ secrets.CERTIFICATE_FOR_CI_ONLY }}
+  CERTIFICATE_PUBLIC_KEY: ${{ secrets.CERTIFICATE_PUBLIC_KEY }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: sbt -v "testOnly backend.*"
+
+
+  build-test-e2e-deploy:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ "${{ github.ref_type }}" == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_id }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_id }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.webknossos
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.datastore
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.tracingstore
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+      - name: Run end-to-end tests
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

**File Permission Security: binaryData Folder**  
The “Prepare binaryData folder” step creates the directory with `chmod 777`, which is overly permissive. Consider using a more restrictive setting such as `chmod 755` to reduce the security exposure.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T12:08:48Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,274 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Avoid Hardcoded Sensitive Credentials in Global Environment Variables**  
The environment block explicitly sets sensitive values (e.g. `POSTGRES_PASSWORD: "secret_password"`) in plain text. This poses a security risk. It is recommended to source these sensitive credentials from GitHub Secrets instead of hardcoding them.  
```diff
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```  
Additionally, review whether constants like `POSTGRES_USER` and `POSTGRES_URL` should also be externalized.  



<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
env:
  USER_UID: 1001
  USER_GID: 1001
  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
  POSTGRES_USER: "webknossos_user"
  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T12:41:49Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,112 @@
+name: webknossos-ci
path: .github/docker-compose.yml
user: login: normanrz
body: ```suggestion
# For CI only
name: webknossos-ci
```
created_at: 2025-04-09T12:43:40Z
author_association: MEMBER
diff_hunk: @@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+author=${GITHUB_ACTOR}
+author=${author/fm3/<@florian>}
+author=${author/daniel-wer/<@daniel>}
+author=${author/hotzenklotz/<@tom>}
+author=${author/MichaelBuessemeyer/<@michael>}
+author=${author/normanrz/<@norman>}
+author=${author/philippotto/<@philipp>}
+author=${author/valentin-pinkau/<@valentin>}
+author=${author/frcroth/<@felix.roth>}
+author=${author/dieknolle3333/<@charlie.meister>}
path: .github/slack-notification.sh
user: login: normanrz
body: ```suggestion
author=${author/knollengewaechs/<@charlie.meister>}
```
created_at: 2025-04-09T12:44:18Z
author_association: MEMBER
diff_hunk: @@ -1,13 +1,274 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
+  CERTIFICATE: ${{ secrets.CERTIFICATE_FOR_CI_ONLY }}
+  CERTIFICATE_PUBLIC_KEY: ${{ secrets.CERTIFICATE_PUBLIC_KEY }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: sbt -v "testOnly backend.*"
+
+
+  build-test-e2e-deploy:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
path: .github/workflows/build_test_deploy.yml
user: login: normanrz
body: Unused?
```suggestion
```
created_at: 2025-04-09T12:45:33Z
author_association: MEMBER
diff_hunk: @@ -1,13 +1,274 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
+  CERTIFICATE: ${{ secrets.CERTIFICATE_FOR_CI_ONLY }}
+  CERTIFICATE_PUBLIC_KEY: ${{ secrets.CERTIFICATE_PUBLIC_KEY }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend-tests:
+    runs-on: ubuntu-24.04
+    if: ${{ github.ref_name != 'master' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: sbt -v "testOnly backend.*"
+
+
+  build-test-e2e-deploy:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        id: configure
+        run: |
+          if [[ "${{ github.ref_type }}" == "branch" ]]; then
+            NORMALIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[\/-]/_/g')
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_id }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_id }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.webknossos
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.datastore
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.tracingstore
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+
+      - name: Start Fossildb
+        if: ${{ github.ref_name != 'master' }}
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+      - name: Run end-to-end tests
+        if: ${{ github.ref_name != 'master' }}
+        uses: ./.github/actions/retry
+        with:
+          run: |
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false"
+          retries: 3
+      - name: Validate frontend types
+        if: ${{ github.ref_name != 'master' }}
+        run: yarn typecheck
+
+      - name: Start webknossos, datastore and tracingstore
+        run: |
+          set -e
+          docker compose --file .github/docker-compose.yml up -d webknossos
+          docker compose --file .github/docker-compose.yml up -d webknossos-datastore
+          docker compose --file .github/docker-compose.yml up -d webknossos-tracingstore
path: .github/workflows/build_test_deploy.yml
user: login: normanrz
body: Why separate?
```suggestion
          docker compose --file .github/docker-compose.yml up -d \
            webknossos \
            webknossos-datastore \
            webknossos-tracingstore
```
created_at: 2025-04-09T12:47:15Z
author_association: MEMBER
path: webknossos-jni/src/bucketScanner.cpp
user: login: normanrz
body: Why change?
created_at: 2025-04-09T12:48:11Z
author_association: MEMBER
path: webknossos-jni/src/bucketScanner.cpp
user: login: robert-oleynik
body: Does not compile without these headers. This is also the case on my system.
created_at: 2025-04-09T12:56:14Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,6 +1,8 @@
 #include "com_scalableminds_webknossos_datastore_helpers_NativeBucketScanner.h"
 
 #include "jniutils.h"
+#include <array>
+#include <cstdint>
path: webknossos-jni/src/bucketScanner.cpp
user: login: robert-oleynik
body: ```suggestion
```

Already added as `stdint.h`
created_at: 2025-04-09T12:57:38Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,274 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
+  CERTIFICATE: ${{ secrets.CERTIFICATE_FOR_CI_ONLY }}
+  CERTIFICATE_PUBLIC_KEY: ${{ secrets.CERTIFICATE_PUBLIC_KEY }}
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _⚠️ Potential issue_

**Sensitive Environment Variable Values**  
In this environment block, the POSTGRES_PASSWORD is hardcoded as `"secret_password"`. Hardcoding credentials poses a significant security risk. It’s strongly recommended to source this value from GitHub Secrets (e.g. `${{ secrets.POSTGRES_PASSWORD }}`) instead.

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T13:03:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,279 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
+  # CERTIFICATE: ${{ secrets.CERTIFICATE_FOR_CI_ONLY }}
+  # CERTIFICATE_PUBLIC_KEY: ${{ secrets.CERTIFICATE_PUBLIC_KEY }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: github.ref != 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend-tests:
+    runs-on: ubuntu-24.04
+    if: github.ref != 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: sbt -v "testOnly backend.*"
+
+
+  build-test-e2e-deploy:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        run: |
+          CI_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          echo "CI_BUILD=${{ github.run_id }}" >> "$GITHUB_ENV"
+          if [[ "${{ github.ref_type }}" == "branch" ]]; then
+            NORMALIZED_BRANCH="${CI_BRANCH//[\/-]/_}"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_id }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "CI_TAG=${{ github.ref_name }}" >> "$GITHUB_ENV"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_id }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.webknossos
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.datastore
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.tracingstore
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+
+      - name: Start Fossildb
+        if: github.ref != 'refs/heads/master'
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+      - name: Run end-to-end tests
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Filesystem Permissions Issue: Overly Permissive Mode**  
The step “Prepare binaryData folder” uses:  
```bash
mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
```  
Using `chmod 777` grants full permissions for all users and poses a significant security risk. It is recommended to use a more restrictive permission mode such as `755`. For example:  
```diff
- mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+ mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T13:32:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,279 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
+  # CERTIFICATE: ${{ secrets.CERTIFICATE_FOR_CI_ONLY }}
+  # CERTIFICATE_PUBLIC_KEY: ${{ secrets.CERTIFICATE_PUBLIC_KEY }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: github.ref != 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend-tests:
+    runs-on: ubuntu-24.04
+    if: github.ref != 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: sbt -v "testOnly backend.*"
+
+
+  build-test-e2e-deploy:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        run: |
+          CI_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          echo "CI_BUILD=${{ github.run_id }}" >> "$GITHUB_ENV"
+          if [[ "${{ github.ref_type }}" == "branch" ]]; then
+            NORMALIZED_BRANCH="${CI_BRANCH//[\/-]/_}"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_id }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "CI_TAG=${{ github.ref_name }}" >> "$GITHUB_ENV"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_id }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.webknossos
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.datastore
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.tracingstore
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+
+      - name: Start Fossildb
+        if: github.ref != 'refs/heads/master'
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+      - name: Run end-to-end tests
+        if: github.ref != 'refs/heads/master'
+        uses: ./.github/actions/retry
+        with:
+          run: |
+            sbt "testOnly e2e.* -- -Dtracingstore.fossildb.address=localhost -Dtracingstore.redis.address=localhost -Ddatastore.redis.address=localhost -Ddatastore.watchFileSystem.enabled=false"
+          retries: 3
+      - name: Validate frontend types
+        if: github.ref != 'refs/heads/master'
+        run: yarn typecheck
+
+      - name: Start webknossos, datastore and tracingstore
+        run: |
+          set -e
+          docker compose --file .github/docker-compose.yml up -d \
+            webknossos \
+            webknossos-datastore \
+            webknossos-tracingstore
+      - name: Run webknossos smoke test
+        uses: ./.github/actions/retry
+        with:
+          run: curl -v --fail "http://localhost:9000/api/health"
+          retries: 20
+          retry_delay_seconds: 5
+      - name: Run webknossos-datastore smoke test
+        uses: ./.github/actions/retry
+        with:
+          run: curl -v --fail "http://localhost:9090/data/health"
+          retries: 20
+          retry_delay_seconds: 5
+      - name: Run webknossos-tracingstore smoke test
+        uses: ./.github/actions/retry
+        with:
+          run: curl -v --fail "http://localhost:9050/tracings/health"
+          retries: 20
+          retry_delay_seconds: 5
+      - name: Stop webknossos, datastore and tracingstore
+        run: docker compose --file .github/docker-compose.yml down --volumes --remove-orphans
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+
+      - name: Push webknossos image
+        uses: ./.github/actions/retry
+        with:
+          run: docker push "scalableminds/webknossos:${{ env.DOCKER_TAG }}"
+          retries: 5
+          retry_delay_seconds: 10
+      - name: Push normalized webknossos image
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical Naming Mismatch in Docker Image Push**  
The docker build steps tag the image using the repository name `scalableminds/webknossos` (with two “s” characters in “knossos”), but the push steps reference `"scalableminds/webknosos:${{ env.DOCKER_TAG }}"` (missing one “s”). This inconsistency will likely cause deployment issues. Please update the push commands to consistently use the correct repository name. For example:  
```diff
- docker push "scalableminds/webknosos:${{ env.DOCKER_TAG }}"
+ docker push "scalableminds/webknossos:${{ env.DOCKER_TAG }}"
```  
…and similarly for the normalized image push.  
 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Push webknossos image
        uses: ./.github/actions/retry
        with:
          run: docker push "scalableminds/webknossos:${{ env.DOCKER_TAG }}"
          retries: 5
          retry_delay_seconds: 10
      - name: Push normalized webknossos image
        uses: ./.github/actions/retry
        with:
          run: docker push "scalableminds/webknossos:${{ env.DOCKER_TAG }}"
          retries: 5
          retry_delay_seconds: 10
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T13:32:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,276 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
+  CERTIFICATE: ${{ secrets.CERTIFICATE_FOR_CI_ONLY }}
+  CERTIFICATE_PUBLIC_KEY: ${{ secrets.CERTIFICATE_PUBLIC_KEY }}
 
 jobs:
-  foo:
-    runs-on: ubuntu-20.04
+  frontend-tests:
+    runs-on: ubuntu-24.04
+    if: github.ref != 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - name: Lint frontend code and check formatting
+        run: yarn run check-frontend
+      - name: Typecheck frontend code
+        run: yarn typecheck
+      - name: Check for cyclic dependencies in frontend
+        run: yarn check-cyclic-dependencies
+      - name: Run frontend tests
+        run: yarn test-verbose
+
+  backend-tests:
+    runs-on: ubuntu-24.04
+    if: github.ref != 'refs/heads/master'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Start postgres"
+        run: docker compose --file .github/docker-compose.yml up -d postgres
+
+      - name: Lint backend code and check formatting
+        run: sbt ";scapegoat; scalafmtCheck; util/scalafmtCheck; webknossosTracingstore/scalafmtCheck; webknossosDatastore/scalafmtCheck"
+      - name: Run backend tests
+        run: sbt -v "testOnly backend.*"
+
+
+  build-test-e2e-deploy:
+    runs-on: ubuntu-24.04
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 5
\ No newline at end of file
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 5
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker
+      - name: Start Docker Services
+        run: docker compose --file .github/docker-compose.yml up -d postgres redis
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      - run: corepack enable
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+      - uses: sbt/setup-sbt@v1
+
+      - name: "Install System Dependencies"
+        run: sudo apt-get update && sudo apt-get install -y libdraco-dev libblosc1
+
+      - name: "Custom environment variables"
+        run: |
+          echo "CI_BUILD_NUM=${{ github.run_id }}" >> "$GITHUB_ENV"
+          if [[ "${{ github.ref_type }}" == "branch" ]]; then
+            NORMALIZED_BRANCH="${GITHUB_HEAD_REF//[\/-]/_}"
+            DOCKER_TAG="${NORMALIZED_BRANCH}__${{ github.run_id }}"
+            echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=$NORMALIZED_BRANCH" >> "$GITHUB_ENV"
+          else
+            echo "CI_TAG=${{ github.ref_name }}" >> "$GITHUB_ENV"
+            echo "DOCKER_TAG=master" >> "$GITHUB_ENV"
+            echo "NORMALIZED_BRANCH=${{ github.ref_name }}" >> "$GITHUB_ENV"
+          fi
+
+      - name: Prepare Dependency Folders
+        run: mkdir -p project/target target ~/.ivy2 ~/.cache/coursier
+      - name: Install frontend dependencies
+        run: yarn install --immutable
+        env:
+          PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: "true"
+
+      - name: Assert unique evolution numbers
+        run: tools/postgres/dbtool.js assert-unique-evolution-numbers
+      - name: Assert schema.sql and evolutions are equal
+        run: tools/postgres/dbtool.js check-evolutions-schema
+      - name: Assert that all migrations are mentioned in one migration guide and that they have a reversion counterpart.
+        run: tools/assert-complete-migrations.sh
+
+      - name: Build frontend documentation
+        run: yarn run docs --project-version "$WK_VERSION"
+        env:
+          WK_VERSION: ${{ github.run_id }}
+      - name: Build webknossos (webpack)
+        run: yarn build
+      - name: Build webknossos (sbt)
+        run: |
+          if [ "${{ github.ref_name }}" == 'master' ]; then
+            sbt clean compile stage
+          else
+            sbt -DfailOnWarning compile stage
+          fi
+      - name: Build webknossos-datastore (sbt)
+        run: sbt -DfailOnWarning "project webknossosDatastore" copyMessages compile stage
+      - name: Build webknossos-tracingstore (sbt)
+        run: sbt -DfailOnWarning "project webknossosTracingstore" copyMessages compile stage
+      - name: Checksum App Dirs
+        run: find app webknossos-datastore/app webknossos-tracingstore/app -type f -exec md5sum {} \; | sort -k 2 | md5sum > app_checksum.txt
+
+      - name: Build webknossos docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.webknossos
+          context: .
+          push: false
+          tags: |
+            scalableminds/webknossos:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-datastore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.datastore
+          context: webknossos-datastore
+          push: false
+          tags: |
+            scalableminds/webknossos-datastore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-datastore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+      - name: Build webknossos-tracingstore docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: .github/Dockerfile.tracingstore
+          context: webknossos-tracingstore
+          push: false
+          tags: |
+            scalableminds/webknossos-tracingstore:${{ env.NORMALIZED_BRANCH }}
+            scalableminds/webknossos-tracingstore:${{ env.DOCKER_TAG }}
+          outputs: |
+            type=image
+
+      - name: Start Fossildb
+        if: github.ref != 'refs/heads/master'
+        run: docker compose --file .github/docker-compose.yml up -d fossildb
+      - name: Prepare binaryData folder
+        run: mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Security Issue: Overly Permissive Filesystem Permissions**  
The "Prepare binaryData folder" step uses `chmod 777` on `binaryData/Organization_X`, granting full access to all users. This setting is overly permissive and can be a security risk. It is recommended to use a more restrictive mode such as 755. For example:

```diff
-        mkdir -p binaryData/Organization_X && chmod 777 binaryData/Organization_X
+        mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
```

 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
      - name: Prepare binaryData folder
        run: mkdir -p binaryData/Organization_X && chmod 755 binaryData/Organization_X
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T14:21:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,13 +1,276 @@
 name: CI Pipeline
 
 on:
-  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - '*'
+
+env:
+  USER_UID: 1001
+  USER_GID: 1001
+  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
+  POSTGRES_USER: "webknossos_user"
+  POSTGRES_PASSWORD: "secret_password"
+  CERTIFICATE: ${{ secrets.CERTIFICATE_FOR_CI_ONLY }}
+  CERTIFICATE_PUBLIC_KEY: ${{ secrets.CERTIFICATE_PUBLIC_KEY }}
 
path: .github/workflows/build_test_deploy.yml
user: login: coderabbitai[bot]
body: _🛠️ Refactor suggestion_

_⚠️ Potential issue_

**Critical: Hardcoded Sensitive Credentials**  
The global environment block still hardcodes sensitive credentials (e.g. `POSTGRES_PASSWORD: "secret_password"`). Hardcoding such values can expose secrets in logs and source control. Please consider replacing the literal with a GitHub secret reference. For example:

```diff
-  POSTGRES_PASSWORD: "secret_password"
+  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
```

 


<!-- suggestion_start -->

<details>
<summary>📝 Committable suggestion</summary>

> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

`````suggestion
env:
  USER_UID: 1001
  USER_GID: 1001
  POSTGRES_URL: "jdbc:postgresql://localhost:5432/webknossos"
  POSTGRES_USER: "webknossos_user"
  POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
  CERTIFICATE: ${{ secrets.CERTIFICATE_FOR_CI_ONLY }}
  CERTIFICATE_PUBLIC_KEY: ${{ secrets.CERTIFICATE_PUBLIC_KEY }}
`````

</details>

<!-- suggestion_end -->

<!-- This is an auto-generated comment by CodeRabbit -->
created_at: 2025-04-09T14:21:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -24,6 +24,8 @@ For upgrade instructions, please check the [migration guide](MIGRATIONS.released
 - The skeleton tool can no longer be activated if the skeleton layer is invisible. [#8501](https://github.com/scalableminds/webknossos/pull/8501)
 - Improved speed of mesh rendering and mouse interaction in 3D viewport. [#8106](https://github.com/scalableminds/webknossos/pull/8106)
 
+- Numbered docker image no use different and larger numbers. [#8147](https://github.com/scalableminds/webknossos/pull/8147)
path: CHANGELOG.unreleased.md
user: login: normanrz
body: ```suggestion
- Numbered docker image now use different and larger numbers. [#8147](https://github.com/scalableminds/webknossos/pull/8147)
```
created_at: 2025-04-10T11:36:16Z
author_association: MEMBER

PR comments:
user: login: coderabbitai[bot]
created_at: 2024-10-24T14:02:10Z
body: <!-- This is an auto-generated comment: summarize by coderabbit.ai -->
<!-- walkthrough_start -->

<details>
<summary>📝 Walkthrough</summary>

## Walkthrough
The changes update the CI/CD pipeline and Docker configurations. The GitHub workflow file now triggers on push and pull requests, adds environment variables, and splits tests into separate jobs. New Dockerfiles and a Docker Compose file defining multiple services have been introduced, while obsolete CircleCI configurations, development Dockerfiles, and Docker startup scripts were removed. Minor code improvements and updates to CI build information are also included.

## Changes
| File(s) | Change Summary |
|---------|-----------------|
| `.github/.../build_test_deploy.yml` | Updated CI pipeline: replaced `workflow_dispatch` with `push`/`pull_request` triggers, added environment variables, renamed/restructured jobs (e.g., `foo` to `frontend-tests` and new `backend-tests`), and enhanced deployment steps. |
| `.github/.../docker-compose.yml`, `.github/.../Dockerfile.datastore`,<br>`.github/.../Dockerfile.webknossos`, `.github/.../Dockerfile.tracingstore`,<br>`.github/.../actions/retry/action.yml`, `.github/slack-notification.sh` | Introduced a new multi-service Docker Compose configuration, new Dockerfiles for various services, a GitHub Action for shell command retries, and a Slack notification script. |
| `docker-compose.yml`, `Dockerfile.dev`, `start-docker.sh` | Removed obsolete configurations and scripts for Docker orchestration and development environment setup. |
| `.circleci/...` files (`config.yml`, `not-on-master.sh`, `slack-notification.sh`) | Removed deprecated CircleCI configurations and related Bash scripts. |
| `project/.../BuildInfoSettings.scala` | Updated environment variable keys for CI build information by switching from `CIRCLE_*` to `CI_*` variables. |
| `webknossos-jni/.../bucketScanner.cpp` | Added `<array>` header include to support the use of `std::array`. |

## Poem
> I’m just a bunny on a coding spree,  
> Hopping through pipelines wild and free.  
> Docker dreams and CI delights,  
> New scripts and tests light up my nights.  
> With whiskers twitching in the code’s parade,  
> I celebrate these changes in a playful charade!  
> 🐇✨

</details>

<!-- walkthrough_end -->
<!-- internal state start -->


<!-- DwQgtGAEAqAWCWBnSTIEMB26CuAXA9mAOYCmGJATmriQCaQDG+Ats2bgFyQAOFk+AIwBWJBrngA3EsgEBPRvlqU0AgfFwA6NPEgQAfACgjoCEYDEZyAAUASpADK2VmgqyjcEj2wAbb5AokAI7Y0riQ4rjedJAARADC+BhSFGFx8BQMUXEAkgoYAGbwROH4kADi6rDYApAAgmLwiYgxkADuaMiI1czqNPRy4bCe2IiUkLD4uABeZADW3pNT6Bj0qPBKGOKF0R2QGE4CYwAcAIwALADsGjBDPBTwzC7ygiINUvz5g6i2KMgE4VQMIh1I0sLhbkxNvB9vgRihNiQiFRxIk8oUiNhkaDIPkKCxIGkMllcv8KrgABLVOoNJrXDyQEZjbTMP6lEgSNDebDUTzgzzcSj5fAUR4YBiefCfMmUmr1FFAhTMbguaL/QmZEg5Zb0f6QxD4bzrHnoXwE3JCQTIVqVaHldQy6nyxAAGkGlBIAwCtGwDGhxQChsw4v4WEw6FotBBiU5kFGFAk8HFdNu0JoSOo2Ot4Ic3jQDFmvxN+r2kx2yDQkEO5EKvpj+RI1ExEql9qpctBiA07luSkQDHu3Hl8My2F76EgAFUbAAZHHC8dKbgLWTRJRSBbcNibeGIXBBzypshKehCvg0Xd+rwUbj4UaILiwXC4bj3gD0r4A+l+NK0PbMMLe+qdgAHrIUzXNkYSIAKvrbH8sDUG6eTiDCcKHumQ4ABQ5AAlHc+DiognQTD4/SeF0+Q1vA7BzmeoSXnyjAIRgpDII8Sjwl8yC2F2Bi1BGUYYJy3iyK6jE/LCkTQtIsbssofh7ogszwYh5CqqUhyKkuJB9K60KRgwPL9PIFYMEM+aGrutGPJokDkvgv7JGJtzQaI8A1igNAspxjHQAA8gAIn5kCWWEKolmESh7vAUSrGCty8PgCbHvCp42aCybuoWnLFhWow0lgp6/F00iugIeCeYWAF9IMqmlK5sGJsVITlgEOLwMB0QDOC3w2Lx9I/NCI5jhWAQ9CsYz/EoUQ0AyGBqSl6gkN5mA6qUbAUKQIYiW0QyhqaZmiPMSBhEtK1tWgEYBERdCZUxR2hcOXJjopymxj6sDoMg2DcLQGYsUhZmYKQCxEK6PQYdiGLrCQrqrZAtAEU47AZqi7noNwS6JioURw39g4MbcrSzGAhoCMg3CyOCqKZNR25FZg8gBuymBhLUVi5EDLGlf4y1JZea4kBuW64GAiQ7VzrGunqMP3ADTCsKidBbYZd5wysEWE4hFZ/YpBBtT9uueNapqaeQhGIE86D5DQfCLsuIu8QAYvO+SYnyds6do3gukhPyGVgml5hbOxhIxQq+A5l5TtOXAANrSlSPxmKclwALqYY+z5vq+RCVNUGgK6+facjjy36Ygr6/gI/6Aber7cD43ivqnFw4bxFgEiwIvII4ziuEY2TxZ4Cs9yGfs2K6jJ8ABIqYBQSyJcl0T1nQAh5gW+nYyhxTgohjGSzJCz4AWRD4Io/DJMJlYVV0RCsTV+psJA43zpdQgjLgPfXPYMHudjvhRIljnhgBevNgihFVLcS6kYhySnHIfUGkB2CuG1OOAICZgSongeJOwXR+7yH+GQZiwZMguHUCZDWCttI0HIERZMqBV60HXvmcYRRYCGiII+eCB4lTCj3GKZsL9tCbBEQLJGItUahg1mQLoctd4ITCqaZmHJtzQjSlIwsQ1nrRFtLghG0h+zwAJqiIqhwnxjGwBNCgu5VqXnhrgKg+ZLzwMPp2IwE44z+EEJQUWBoSCyAwPAAs+DHj3BmDqCEzFWLCI4no24PxdgRwWK0e85hO42D5lIWgBgoC1AOokdEmJNGFCiMgAMRkSgEnSBqHIroGr/0MoApCAADQuNSoi+haQjdIoh9ayC7FAekLTEb5koGAaht4SAaFkMwbw3TSnG12AEJceZohZk+hWaqnhIwBAaADf4jE0CYzxLweAxoJgXgBosjunc4jRLoLkyAAUCKzEFDFGSRVq61yIreV0usOj61hmgxxeY/S7mFMbLKzAkrqVaRoPO4JqjdN2X04UQDdh8hMm1Q8E16D6iiDtIqWpG7Xime4gwFhLD8WPE82ojBP74kTjUPMQ4ioBEcbIS8o9Vq+wWIZGqto2mIqqAIV8rKOyvg5a4NpdK9gkFaHaCkVIADqwpZj5BSbVU6YodHwQCJ4C05MuAtJYW8lYYBzy4EQC010LTcSJFobQS1oQbXq3oKa7AMVnVWrACQAATCQMA9t8CyDaTcaQhrLS8yxgK/kLhrUfCQsKIo0IYzqmJDwYxQtpJpMgLoSAAAqQtZqjwut3IgYtXAACinUGB4BkvYQyAoz7UFdE20u+RmC4HdbGAQYdXVdnzVAYtDqEQWqtZWwtXAEgrB9Im2x4gGDhFdWgigVjkAtNkC4MEoQwDJAEFM2Vw6i0lq9d4H1e6A1BpDbIKt1hBTChWjiJuN9vVJu+QBX5vttGjkJiPAImj4EvLGXwB4aApZzkjr+YyyCJ2ECPCuitaDEAwreUh611x8l+BA28sDjwYnhUbogIYqxPjX0nT5BAyAjU8A6BSvyV9fDORHt3dg5SSCar6Qgpojj52SE8Bg6iirEoW1dBs96996JNHQA8UOKAlR4gTAciEuZ7i4EofQahM0yDSGQDghJfUjD6GMOAKAiH4FoDwIQUg5BkTRFHuwLgvB+DCD6QJmQ8gmBKCoKodQWgdAmZMEM6j2VQzWeILp+zWm2ObC4FQRVoSrYDG88oPzmhtC6DAIYUzpgDAIvzmK1o6rNUOUruVb1H4rUflvTMuZHADAxCa5S6l2RIt2cqUl1BriHmIG7Ds9ynxUx4m9IRZBwFaHAneDCyMNYpGsiQiS7NhpyBoiKMUoc8TPDCsK1XErKTyvntoFV0INWSBLlDXV+Z7Uoh3RacVigGqUk1aQMqXAZlumOKKKQMDHHVninoBJlpxHYDdLkpsZARVGItMeLuSg3SBCAjMmg4HTcPwBAgbuMHUgIe0RNH4RHQYhidjqFgFpZAJDdPypt8sEY6D/M49CS8owmNwYTHiDAItIAcnuGXe8kAWkTnsNWmwH4JzZACragXQuRcfjKBLqXLSrB+XsNAMoNhq32DFzORXyvVfq812L4XNhdcq7VxrrXVhaj2HsCqvyNhJd2riCL6A2QnbZDiLUaA1apfwxac7mwrv3ee+9x+KwE4ABC04PcfgANLVoAJqyoMPSWjvB2SNBGDtISbAPVCnwN01AY1YX0Hhis3MAO2iVHCMV+ViqjX8/tRzp15brXdL96WidrqpeHuzJCIpXoqnrqwKiFp1QrG4GwGAf1ZwNAAAYzjhuGWOlvk7um0d/WOOHL48eHWcQDSSgNFDAtGE+S8P1IAADlj8aCED+oEe5fCXhX4hxcR4yC+h5itneYlZACnuvvmDGulYkEgcoOhGgLp3pehWuvoILGA8DFC4BLOZG9IfgfMfvUjpN9NwFfjfnfmggAFJoAch6QP7CSdCyBw7MAGICgTRijUS+y2IpDcS3i4BIgkD2AACK04vaw+MgG8iGk6/Utwnq3qrefqgawa52y4sBNQqAwIRAQSc2mwO0JAwEyoeKVe2YMCgkMY2+kO84p+O8DIOBuGYwcYCYhEpBtiT+AMiAlBXkNB7+9BPM8MFWF6l4POmeyAky5AuOIwl4ZhfACQfCowEEOqw0R8+Aecy6RUzEtAK2xQhOYon0OeMk8MQR4QEGvsxyS4XKKmrGFAeyYc2RlYHQ0QqIjEyRyOkINAE2d0G+SoUQY80q8goMTURUmR7R0i9AQwnIfeKBvsxCQYl4eI5Uu4dCFKNKuhfg+hT0o4ng9GviHYeOVi8AECyCEgBoeA2I+wzAhwNi9Sh0jwABykva7hkY1yzer+EiKM8oDRcBOUpQm+MkcxRU3+9iGsw+oBSRkwn0L+GsbhAhGsk6cMVoQsfguwZaBAfqIJ4B9IsKVAB0vWvMXGYg44XQ5MAi4gMYwxgiXOW2ZoWaAoK2JAAA5J0HxmIE2Ggm7GKPKJyBQq6EKPWsCAfoVNcVQoMWghWDCm1MKEQJgPABEhjIlHmJ9P8BcZ8TqPRAUaKYaAKhlOknUN4LbPNlUoxEoGQliDJvAmoTeCkBUXwI3AIAqXBhEAwcZpAGqo9qVoql9lJnwDAnQCaiDt0qiNUZ9DDoCvDpxDtkikVvtmVq+BcSdruGdhdgMrMvMk8jaU9g5ACN9kyHTrQK6Wjhji1LgO6YHEjsTgLmSYWmSYXmTgVgGXtraQdiGUdmGbgBGcuFdi0k8tWkkOkIkFzl4XzuGMeA1ieoLsbmLgrn6aWaKuWfGaklWZVtVrVtGY2b2TLqLvLpLkOSKtUKOXaYdpOadtOXMrOQWkrmbgblrjHMWQLsOauQ9mORuRejWXWZdjOQYL2XrubobvOSef6SOReeuROdeVOdIXeTuQ+XuU+YeWHtbrbvbkuUKmeYGRWcGaGb+ZGQ2YBVAP7i7m7h7l7j7subtp+ZWfBVuX+VGQBb2QHkHhhaHuHlHjHvHknthWWbhXBdWQhfWfeVAAQXAQEGkamQLvnt0oAEmEPFnJ0BbedFH5QZ45+F4Z25MZUAl+CqkAtGzp3FpqwJwlNqol554lV5x2zF/5MlkA7FNQnFaAueJqkltZt6b50Fa5eFTFBFiF95TWMQxmeWoyeGEyLAN4YR0ZDWTlLWdQbWtmygj8TgYSzwnwbi/WAubl4yky3lO5N2ngCEMgJAZAWkOmO0xe2S4m1e18FhiY6RVChS62OpCo00Okt0EB4sTMy0YiAMpJ2UioBJKw28WsYcoWiyVUpQCw3MfAjIpeGs0Iu466+yxQ08C2AQ9YZ4pQLSBABolclyO8r4MVFAHloR0yM5O4NAl0mUF0bUAEL69JoIuJzR7GIUnGOqSEiyYJ+OdwGesInQlAlhOyjOQSToroFOrZnONEHZpprhRVBQJV6pCE7whwaVOa40RktyKpapToGpPYogam6pep6h/CRpXgppTU7AII0gVpzZ4gbUnVIyrysVnlUyDZvMMK2SXYfluSeWiUrwuAr4EeR2Q8Qo9gOkO8nYJcuYvlzWnctQgVUWnWoVVsPWwMuNKePYg2L8ig/8Mk0OLN3qbN+AHNZ+LE6lLw3GQqDNfSzNrNBQqtnN4KGgPNaAS+CU9wYVTEEtyA0IWx3g7whs/0Cingn1HO7Z5CZckAbylBDIowa0vMX2ckyE0I2AD18IaYpVb6F6qUT6UiP8f8c2gCLG3OXtf1AuvoStF63SAEiqe+b0UOtw7tbZP16dUQAuOQH4Ee4u04AUH4l+E4AAssWXDpdEmv7tkDYHENONWtXbXfXY3S3b2i0r6NABBrnQmQXQYXwJ3R+NALUGUK3dtfQPAp3d3b3fPYvRbZ4O0bEfONKtRMpq7aMGnVyDJGNCIt9CkRLbQDdb3p9L9WUgYvkFZqqVUmGMtIOPIMNZeOjIxNdDBOIO8CXd9duE/ekftZMHOFYrQHdNdGEAZqxkoKQcNJeGwNTLQDPa5tFD8UfqwOoOMB0JshrEbDdb+KaJircBcXHbJOrUQNg7NlNTRDNj4DzJfUNZHayloSRGFBgPIDNo0vNrxMqfkrDSsYcgjdqcjZ8PqWjavcadUGadjeIJLVAAAGrl3DC/RGQmoch+BZ1HZcD2BfYsRvm61iD63K2G1q1c2m1NLm2QACXT144tL2AOHLQIoVVJCYTty1FX2x4BKYTxDZD93ZB10N3N0xA4TL0Nir2fBuMePMBeO0ISC+OFyOoBNBMhMb19013hOD1RMxNPKaO84Z3O19B6Mxhj0QbGOmNEDmN4iM1WMXoq22Mm1m38WnHYOJNUEpMU7pP+NDWBOyDBNV0L1lDROxPt1r3uN9OkCpODOZPDPZM5C5Nb2TPFO00QBgBGDWUrVrVeUbX1aNb82tbtbBXRBdbhU23cx9Z8R17PIk3BFk2n395A1sofJ7AmXRDE2gaHPk2bXJWVipVYDDaKA+grzzjQ6fp1zqW5EKlSIM6FB4O8k+DiBgD5XBguBmRLTUkBB3TvMYjR0vGdAdSyTxgFWN6wvfqK40tATBrUCAqQp0t/hfoMugq+ga1AqK5ChETeoCCK5eVsHXS+4awtJehIDJ7DL0u3hU5PUFUMjiCGgzA8IC5m1/XjRYNVxstwuF4EbAoSZ5RJ3UT0CNymg3gKmaZs5fWe1lPP1FQArrxvOJDmxDhRTewk6QTjZHMUz8KQAACcc+wbaCpLPGzgGsEmXhEdRBHI/AJiQId0WLL1tBWD48wOrB7BbqPFgEArYrHqkr2brQCAyOzAn8IL4wDYqpsA8ghwp4B4UEe4zBwh22sriAjLesLLFLz1hYzrFRw86rDjmrFcOrNc7Lt4HbzLAQ+rEGwKcjbJxQBpYQQbQbaCRLmI6DfMqCRh4KaC5I0A0AVgdGVAGDlAXrSixYb+Kw+mA7ErdAUr3bBVLbAubblqTi4KPLj7wYOxKrCtIhGrzRI7r7nLH7Xb4GpAH1qNC7PA/rQbAArHPihsbXYQgWpgZcQRWPgAm+WBrPu4e2tsS+qVQzskyxCm1Mm+EU4de+PA/a0oW+3uK3y8CBeoK1+9IM+/armyx/K5S8GHwa0gB+XNe6+Ex3mwprOyhia+kU1Q4vVE2+1Z4C7Py94AFBHt22MEawRxttiI60y8IkJKQI7JAN6zChPsgPyjGKimICmp8vOACmgmaj9Bx8K1mzxz24yGq5KFRDGBm7uK5+JxB3Q8YRfpqUy32zwzax7WXfa7Z2eD2GF+Ud82wFPHGL2sqERA9nA8Z2EPOzJEu5AHB2cAAMz+qhu6oLHliVv9GfQF1VKyI0mhd7jhdF5xMDJRV3uRjqXJv+Abp0f3vqXgeLGDXlcjRVfVunFVLJDuTyDqDlgciIFqCGgaa8SMbyTeDOSoDrvR2hA4xIB5mmSeUBB7RTZu0tlRf0wH0gH/ovu6u0vymtWojwyzdUcbCf4UoC2qnBUSOlCamI0uAyM+vyP8CKOY3LoqOWlPJyWJYKvBhKAosuk3djt6saVioHNxXHP6VQ9scv3STKWvsApkckBWUrmo/PMAvxWY/yXddw+48mrAfvvctgclkk/LVk/o9IWyVU8w8vXw/KWifcco+s//Ps+sVX5c+8c8+08C4ueiuC9o+vMY+Nmc/Q8S84/kDKX0dy9s8K9IXbN5avtCBBLFwZBVljK4AdrzSUCFyYx83OUC1C0dYhUEJJqRVS0jwPKR0jaQtqu/pYIj6fDQ7AAuBUCyB6DdJ9E+aJV+nlRm8W92bW/cAW2oA6FDjCRlZ46MSMhJrQ67ipkcDB9oBhrhB/6GslufSoA/vCm6K3tqFOoc1EAiwR6wgtUsRN/AQLJWIFRVKigSeHqwOXiHrAQKDCiXE8gk70i+/YgGaoAR9jCIwyTVQmi2zLDyBqEnTP6d8MlLdAJ72ujzi1F4h+B2k8OEmpa7WLFQOy2zYPcKj/B0ld8KFCST7XQfVFHzjxGJF79xe73RFNQo3r/XJN+HYaGmIy+4yZJGL1aRnDRRpLt0aJpZRlCFUb3NZKpQfomANv4/cpGSNaAbI1RqGkFGGNBARaRki/g2o7EaZKc2cp01dm+WFnhKiaBSodIrgcVAVCuy29/KgtC5tFnejO9xadzIwPSnICKpmUjoXYj83oAxB7AQwU0Jkk5QtBgWYNMFpsC94A5xMZfcbKIAbSVcGk2wfFNIIMbdx4YmnLbt7T2IHEk0h9djhAXoGhgGA4oQcPqlSrwhG41qE1MPilzFtEw5fNVjyhBJsg60DaAANwC5LBRbdQToIYJIRHgwEB4E4D2AHAxg8CVougAsRKhrUwQv3K0TOy5hZAH4fKIkCwYeD1BNPOhEhGmiF8QWuAX8GlVCHIs36xhf4Ih3yHXs7oNgwsCULhTD5/a9iLSLeCWjoAH+VJZ/tMggJMA2oe9eEA7SkCVdj4OBPeGFFSEOC6uAQ2aOgQjb0AQumA8iFJ3oBmDEhnwUIRBAD4QhDBGsLoHYNSpYNU6bQtfomk07nCLYsYPcJPi9bHDWM6wnEJ6z0hhB2gz3IupL3V4GIchILetkHVcB+gjht1agF5CWGv0Yo1wrvrcKtC5VPhMUGkouhGAiMOBn3Uqgtl+5QCViMAoHvOHgFY1EBEPZXgMNT4pkTUUgiEpAFkEypBeNgyuK0RYH3FNqEmaEC4M3TuC7UoQ/NiEKYG5DyhuQ5oYUJprNZqBezFnkERuQE8gU7A+3lwJFq8CIqvWAQY8zlFfN/hiPH5AywVFdsFBoLT3hCwByUdDgecBUAMB0H5FXaZRU+oNy+gC5EaxiUYC6jLZywOA/qE4GACEAmVmAYaO6NqIroVM/28afMBJ0ehPcyCvgZAObD0xWwyYVAe4NIBNRkxTSt4BgCcEVwZi8QUkHMSPTJi0AnE+ARfMyQNApIuoXmKIEKQBghcEoG8KMSdAmp0BIWAXciFX0o79gGw54BcL0ms6oJdRhoi6GcKwImFxw08NBEiFhA4EuKeo8dupQkwRDl0U4iXOPyJjqoBYA4/pIWFPxVIWko7fUROxHFE9e0VQ0oA7WRitQARULPgGoCEioJ7ODiL+sKCtiLIKU9IEMaxm4CRD0C46RNA6moKzUXACzV8GsWSCWxm4tiUgMWQgEdjpYKJByHZhIzGJs+twD8fDVba3cgI3SaeL2lPzIA1CmgprhXQFAigkAfvG9q0gfFHjFxk7Qngsg+RYYsAKCP/PgFTCxgjEg4QsD2MqT/B9xmfOMIAEwCb6LDgLDwxiJ9aVYfF07ZtQHxVsI1vw3wjLxS8m0ZGBDiTbcTTobES6G7RWFlxeI9KPouN1q6oAOhgdciY0AMjCR5AU3fIIQhcjc8KS6AebrmEW4UJKwP9I8D0IzKhADxWcbgBwHfAWdvAi1DgCuznzLUmWr4EyeCB3pPNQMnVXLn6xSAC5IpDHfFOOMYhsSbwnE+CengTAPUdoFkriQOB7QRcdYnGeoTJxBKKJ5iY4aNnCFjaYdsOa7YqoR0+YOtoWskqdhQKMDYjxG4ArYQYgJG6lcBsAggaSLB7ki1GuBJfugLxFYD/uOAwHvgOB6ECyRxA8EmQL0lUZzJg2SUVQJ2Yyjds34n8DhNvBKjzmQVbgdcxd4aiHmQgxKXhk6q6i2293RUqiGNFpVwWo2Sqt60tGcNNOzXA1h3VdEvgg0XkDdhgG9G+j/RrAIvvDA6GVcaGoEjSWEF1HX4lAt+ZAJBIygQFvxW1cgrJFZzKhIxkGTfJeBaQZiFgfYQsQLjzGTBDQDM3ziK2kCBBvAEyQ0OwFzHwABAJYvMGWMVyIpBRLSACEoDvxFCvmGoOsWNTmGNiKZu9FsdbFtjtAKAWXTUReW3HFF0UAuOicj026AZdIIKE4UqA+T0AO0uYfgHgBcE4g8Q1BCsIVO8Ix18UNAHAptyw6mtI6mAg6brNcDBjnmnVPkFgD4l9i8oSTSADOIvzwwpx84+7JdOzaESJxOsHcXrKaSxRoqSAWYIKPfifwKYlAHoPyxkxFQmpkOD5Atnq5tQYWicvCV4mBaMQExREK2MHD0zXBNRrJAgNQVykcTtwfYcqbxONn05doXguhmqycAdAJJMiFYeGIXHI8FJqCJSfIHS4B10A6k7+HUDG4DEjo7Q16nCisly0M5dkygNNyQgIsb+LkjDgtxiieSBgjwWYL5KCCZkP6sYE1sunZi5AjweUzYHdCnHyEswh0QOgnKR60tXQ+XFpEG2DaF4iJUHYefDE/pndS64DLRnjlMjLE5ss0eQjpGuBOw00KdJCD3M4m6ihmdmPcTsKqRZ8D4jKagv3OMSaABpg0xaVhNGnYDCRE04kSDyIE41kB80tAbiOYValWF40taTVBJFKMtp3CtoNCj2nxIDplEI6S5RoHWVzpIHRngEGukBUVRTva2nwNYiajnpRM3UbNQZ4MNP23XH6UoMcRmiAZYQIGdaPkABE5S5OWmJDI9Ewy4ZfogMUX1BmztA5SUr5mGLVbkzZgzYqyDGJsI+x5UFsJMfzJTEMF0x/MzMfTL5mqB8xLMsWcWNLHlioMVY2DLLLwYNiIxISraKFFbH/SOx8BGYN2KHmVcrOu44avOhpJGL6eYKNRWeK7KVcpx8MaOXOPEFzzQFSHRNDHLaBbiAYdS9FFhm5zbFn45kveSeHnDGLWlRAAKEy0ynjgYRb4p8WnIDmjDHUZ1JBgLibZgSIJZ7TkMXD3CwSek/s7FD+O9mpgRpg3a4H5FaAoSEAOBeGORKLlUS15ixWgB/DhzzLv+CgX8SvArkfUgQMMhRPvBEJts65YwAOBoOkm8gYVict9kssYmVg00AcgQaxOUHsTOJtCniUbN7FwpBJtwKcZ1TDnYhxJaCKSQ2laQtKuWpirtkvJUkww1JGIDecZKrbbzWEsy3nlUgPk2Tmk9kxyeRGcnIA4pn0FLCgR6Eri4MtAb+bZHpDdcUpMHNKRArnwIc1lyc37q/XRa1TAc1eMuehzjZYc4a8MEwV1Ni5nzMYiLe4qIxxHql4JgilaWwpEVwDxFM07aVaWvwLT+FLqv7vwqJHrSxFoPc0pItIGeByB+05AEwwUXSjaBu2RABXhJjVQhG9xEjBos4G3TVROi9UbbX0XyUI8xDMqXQqj7xyU1G8MAOmowUZQSM4fXYIoNNH/SsucAeQtpN3mP9SViGWtTfwWzGs3IugnMBvFubkA/AxbNKhWBEFtDUADpH7DYpBZWjPMQXZnF9nRKUA8QfAD/i4jalEIIV1clyJ2qRHjxN1woDceRE7WWDphSEGdYOJcnTw0iaCR4DvkIa6hhQgDAoZeHsCpr/aYwEWCsUcXFA8oJ8mSPAl/oAxy8ayDed6z1BDDKuo8QhmwGblbQBgtfJxA0NuC5grUTVJDYmK2jwwNE9DFfl9H1C1gao5rPwH5KsiTV3QgiO2psFKC0xIxGdFbMpGfaErIoe8tVj+tHVcxx1VSTwcjj7VfSFQJsAnOKu3CWreMI1RNLyXw3IrEIYbI5HgAmAUA4YqJOjcGHgmZEnR7hSKJCtvWtgWUBUXtBWDY3MKLilHSvqqyQi8bWEH8qpKMDqmsYH8sm6IMhstiBcqZcpJuZbFQRWYQ5S6TRAQHNRoIpxHrGKCTlqA2xzCPk3zZMAzWghU6nG7pkhE/VAhPAQEuzb+o/mQiAG0gG8JlvhA2Tw5rEt/upsqigxKu6svBp5ok4SYcpFWgxNFB9g4K8FIkb4SFGiI4c46c8Lfi/AU1rYKJKmaFZ4BE2aJ2gj1H+Y6qGkYCyhQagHnI1DWcKJFSA31VT07WLITU1lKtfmBrWJa61iQU2qDkoGKK9mvoIkG5FfBEs2BZ25Ubmu0Vi0C1/At3kCIqongvmbSS7RqF9A3aOpFNEhTsC0hHdZEAmLTtHWJQdJNQ2QZFkzgBgVhaM8c8yreSDE3BUAtGKbXQwnH/Auhj3LABOHKibBsAkAf1HPnnxnBhEuLVbDGMiL0ATVoDO1ucj+rYMulIJOTFMESDir6GF6hSoIBclzEXiWmHqtdxWR9DdxfbVegO09IbSLlmBYjRfk7n4hGd0XZnWUjKhHZAizzDsYw0Gx0awgvhfZW8M+lIs7qyoeRC9w/zyAI4Pme/BEufxCVLdLhHIl8Su4AwTVlGTCACTvplExkKwXtNCQQwrB24kAKKlauxBPEGpDmU4Wm3eKphuUGBU4s/n36yBmNTut7q6H0ZGgGhJfF3Wa0fQjbigqGE+LyFXSVEiYHoE3an0GqJpDdmkuoAJC36dbKoH/KBORAICYwXEnwZNjh0iT8gRgCAA/J8F00GsB1MacXeihyrZhkhEwoqEYmC1+AsOi0u6AxUVSlTCSnVCIVAjG2QE7KUlQirIRGWkQeuSgo/AiAmxJogiDoIwbsEEk/d7gjpceBRmyIrcmM63K6l8w/zHIug2G4HZFszk5BXwcQAKMSRzQ065MpeHLgeoT0cRggjJDTBru9T2I7VN/XoX4WtS9oe+Vo4oCPtnYUpZtTCwNWNIVAhrRFq271dwqtKGVKaJeMynvosoH6hyP2zpPAH+2A0iAHPa0uJRoPZITUzBtyB+AuJWV+Df227Y5SlEnT8sIh1g9VDFgYAwAsOW2CduzUO9Lm+KUWt1he16K3t5VGqETXaRXa/tshxIAoZ9IUATt3SLHRWBLUkYy1PE3sEUEBHvrlBBoAhSsKn7d7qgowCBNuF8FptJd48KhUURogy7bQFYDNDDsi5ILbIgMxEGGBtHIci966nLs1p3UH491bIA9YpoU52GfhsIWOrcNPUVbfYViPvhrAga+xXY3saPesIY3jhfxJJaSFpIHkF1dExu9ej3TyY2Bagl+OIOSDByIKwGYQCBm0ChJwGFIpQGIIocoAxB8t1DXMqMeQBTGzDMQLrWcgRCl5BtKGg8C1UVKjacj2+RYyC2ZwPzMYAM43TLqx2L9ljcOCgKscqh0qaoaw0UGmxXllg15nKs6vBM40MJzOv/ZdGnxgy74v1A2x4x4cNX8FV55ezwDLtqK196kb82yXdRxzGFxQKQERFSJWLZaCI9aIoi4gHbTH7xuZLER9zm1LTIBQikg+wpW2bSKD62yHqgKdVw0iDlJ/TNSbIO0mI1SAqRbtJxlnbE1Bh37awb21prDtN/ZQ/dpunC0ntmh25tofpC6HQVFdb7dDr+0imDtWwcUw2uQgiJgdNhz6KlocOKEe1GsCbcydQEjrWE/GoWLtCnW4afhuwGNfBMJOVgFjlmcfcCH6TNHy1lo+I95OI2/0N1qR1aIkXjbmm4McibIyRr8OoiuQbUYrMfttiQ0ZJl68qd2JQJtHAYmITirYoWNY6bjtsFoA4j2j4RxQdAOFC+tflDqmoj6n5uSfSAKBgj0EL9QDHs0Fg1xAUbBmaexCkpfW7ct7alrg3ubNj9WraPMKj196cA1MCgC5LSIaaLN8EiI1qAuLnizZPQMIKOdL6jysdRGp488RG7KyMAb0UkMZuagyR0Y58wyH9Ws3Ksq+mxgIBiDQ76lrofvZYZyx0klR4h+xM9vbPxDPG8N2xtdNITWRuhqCEmXc9EDY287uzqILHc5rDgWn08pUts2OptNAbxwT5cBM/PgkoWP5qDZ6Nd03OITMA463tBFq9hRb+z1aYMysFDNY6Hg2kEWHClq4FbmzxW7LYxFwscxXQoMbA+OFq1/1jdMFwqNUcDrOasuuCoSPgrDDqJ46A2zc0cfWN7mSt28KM43LFOiaiGZENKvBfegXCiIbsQBCSepRMnvuC24g2yY9VTSvVXJikbwtMvDTzLrJpNMto5PTTbLJA6RXyb140Dzpa4FQ1oquYaGbmrvBU0LA+0C4/L7IbpEvHZU8Z2D2nUxPOClII6DE64LDlzhV3bh0Lg6xqMuh8VbRMILSQTlq0riIB+0HAQk1+AuBHAiuC+OfEVyOD+oAAbC0hD3etSpYYdGVzixl4E8ZZ7CPWOKgPs5ojadGLl2ZMOHgMN4Ooao/mw2DXLZEeaAGGeAEQFOqQu8Ni8YoU6MUzdGJWSFBOhlcIlrSY5KLFBRAgl2YAQKepWCUSdcd0gA0O8EoktQIujEPDlYHsCDbMGeOdmNAEo6R6lK44bGdMnwK3Wto+oTEN+2g6mRMQBg9Yf2ccDkwn5NEPw3UcYhEzZrwkaIAzpuhQgYwYNnmD5uKCiEL0fqXGziXmR2oJZJAKWXahl4cyuZtMXmb2j+I/m/N745K5roR2u75oyB2NMIwgKY3fAmiUTHpgnOMBaxBSuYa+JTHW6K5Q+NsdppTBgzgQVShvbAmOr4L0bQcz/UJD+r0AEgKyUdUVGBu4y1Bo81+r6CW78SUwsY+a9gk+AJ4d0UchYOvCMtGBVuSJd/eHC+ZY6MtwIDOkVB3b1j3lIOkgMd3B2CxhYNELKz8OryNzRAiY1BHNUiXIzzszhN7njhSvAaebqLFA6JvwOMKA1I011cGvZOerw14POaX6r4XOqS7i21aa5YrtcLuTUa2JBQJ8tGAmCosFahKb8oPbpTQVtUXKclphWdMn25U93eDTPMLDRx6w6WsNPSBHDPasIMMsyKx3UF+ERmhaLiNYB7hQwdePVWkhOak6YqyOpQHTzL9adOiVehkfGyEMlYxRsSMbLmj7iKjzos9YcVpLexx4DRt2sUe9M8Sw5f+7ZfIGR1YrZAKyvcJ9jk6QpMVj4+QPZw/GUcQ5YIo+m3oZTBHsrcYFyeLhAPwxFy3QpxesG6QxmPlSxPvafX0YvX4JfzPDL0NPo/RSHMepzfJwZW1y2O4KuRG1SQiZEgdfAQEK9Zcg/M/1xpQuZRJWLEdxgrBUR8ZZhqEH67Flly3gLcs2Wq7PCmuw5fm34jnLpB5u2tsiFt3yBCayQ30Z6NlBq004PyGUA0BWJmY5ROBswFTKSnNFj2oe/mpHv3N6QiCaIkQxSppUwxgdF4uOGelsS5okfRiPEAeS0AWg1OZLU8JdrapYgl+BIYPhWoVK86f6npJRH11oI1MP2L8wcU7AtBpiTejFI8zCcWKuycKSJxHkAwPyAY9yW2rE/cyJBSCpWnh3Q9JrrUKaVTrKtX0+FbE+Aa9FOwtVYJ+ghe7lEXjuUyhvMUSk1TpKvZ2sK0RpaR4oMBm12Dde9yaTaEKSmBAZh9ZPCpHoYrkgCtH5JlhW6uEVN3rLld2aRo8ZNkmBFDd91Tc42nuX1HPJ6NTIvihyL8gJj7LLlnMwaxLMEWNxzFlYBOZ/AaARLMFa8kKAfMKgNQBlkCyAvgs9pj8OsEQDo4M8CqOgHkLYcmYDA6Ls4GgADanATgnGfIBcGzFnBmEc+BgHPgEABsA2DAAWRcAuC0AiuAs5q2cDg7kuA2/qBgPkGXRBYzMBXIriQCK5wcGAZwZq0VwYABs0AJAANnQAaupV8gXL/IEV3JdoB8gAgf1AGwjCavGrAbIrllkMDouPQRwPV0y/yBCuLgdAM4CcFoBaqLg5wC4HBzQBFdmrrL/1GgCOCMu4O2rrlzVYtfEvxXLrjl1K4YBHAF8gbgQGcEMgXA+XcHE4AG2au0A430ro4PkAZdwdaA/qfICcDny0BPgYriAJAAuB5htXZLuDkV3yCFcU3bLufJRDQCFcF8Mro4AG3ddHB+XQbWgCcCFfNXw36Lv6EcGrf+umXBb/IM1YEA0v53vr2gM1bQAnBg3bLhV39H9SOvuXzV2V6O/FeDuhXJwEtwvmLdkujgqgSiAIDXdsvLgZwI1868dd0BBX9YZq4hwrdQB7XMrwyAvjpfdu03bLuDqICOBcuGAWbgQHu7XdFuiuRXNAJy4LcVhP3kAU4L6+7dluA3AbE9wG8zfNWSAc+E9zq4uBGvmrJwI4PK4uBwe03xHzwMh9oBmv/UQrkgPy7lezvWXK7gQNq7ODcf03absnZB7OCiBVAJwA1wGwPeVub3zV/1IcBnwJuXXcHQ4NW9UAqBqXQr+17QFlegfDXaAPDyW/E9QAOXtAQrocEvdwdg3D75j0q4EDge4PFwal6/R1fCvmrvrufHO+Ff6fIArH5zxm/9QIcFXc+TjA2AYDvuzX0rzj0V2XeFuf31bhl3q488kByPdL1QP6loAXAhXKgaT3u4auauAvWXyiDa7g+zuGA0ntAKV2Q+Kv8gRwcjza7J2svLgKr1zwl+avEeiuZwH0RF/1dcu4OtVoNs1aOAeefRSrvr+p8Nfuv63eYbl428Y8MvmvAbRNwGzzd6vVXJAUlx56ZdSvvX68fIAGzTeuvmXMrwd3Z4U8nB6wPrm1+65W/wfDgSHtF4e8Y9/QlAN77d1h+3cMBJXrLplxO7pfUumXKb+j81bg7yvgw5XhlxF4EBwcYvfLyV5S9VeA+nXabhfDt5ODVupXznwLycA89svmrs7hl4cHA99uGAHLtAAy8DQRgk3E7l98R71cnBxQrnm75a/FfAfNXyrorjS8e8XA58hr0D6lRLfrwXX87kgCcDg/OezgIryryO+Q9ze2vAgI4JcDw8NW8PsrvNzS/g7rw6rnH5r6L4Q7Kv/UtVjz4l6leueFvwbAL759K+rvCfrn1t2ToZeGRvXfbuD4L/Le3fK3/rs15cPA+FuA3Zb3z46+29mv6P7b5L+vA59Ge58aXiXy76gBz40AeYYz8wnZeQeA2pLuD2TsLfUvuveb6l3O9a+E/JXkfhn5W7XdSe93qVb13B189mvyPrXi4G56Vc1XrP9HjN1m9S9Gv+vyH0QDq9ZeKuPQ0n84Ia4S+HATgUnnt0O8E/J+BARXSlxN8q8eeIwZbgH4W7Z8qul/Wbo4J3/rC3vZfHPtN/W5W8NgC/Ebytw2Ffr4fVXKXk9xy7vcKufXq70t0m7I9svX3c7wV/y48+i/OPpb3X9mP9SwfnPWqqf0q86rfDwC8RXA127dZ3MGkLd3/UD0uAfXYr058lAGn3ldwfYtwr8afBDnncWrId1zcZ8IzwuAPPNn2HdV3Obyk9DXFlxH8OXYf35d23Zd1AD6POlw59E3Dz19cydd9yn9u3Yr3rcOfYLxj8F8Q1zOBOPRt1bc+vLVXTdhAjz3B8afVKl/dzgV92m9t3QXwuADXXz1/8fXeV2LcNPM4CZdRXKPxQ98/Vr1zdVXOwRZdw/WPwNcIfUry4DwPKl0ohFfZl3NdkPVQOC9LgTnxE9WAgtxq8tVUr23cXXLN2lcU3edxqsOXAgOQ9GrDn2H8g/AWUZdKPYn3a8wvLT1ndA0QH00DFPdN0IDtAv9wQ5pPZjz69xAugDs8V3Gz21cyPUj2r803AQAat4vOzze8A0CMAVdDIPNxtc8fSoO9c2vNLzs8ZfFb2DYh3Qrg89yXeVxVcTgUryNdw/dfzncTvSfwXxeXEgCk8+XZP0HcdvOzwW85/ZhBp8UvHb0asGrRj35cNPSiFqCzXB90zdY3bQLS9uXOL2Q8NfE71mC6Ajl1M8pXIzwh9q3U1zjdWgvMGk9tvbl0p1kPWPzOAmrA1zI9J/RV1ZcdPONzJdKPFryNd03Dnzpd+A/12d9C/KAHXgUvZl3FBkfPNyF98gbjxnxlAkrnB853VL3g83vYrlM8zXfXwDdi3fV2T9QPPMBvdzvEVwh9nXQf3OBhXQ12R843QrjK89AufDjcsQml0I9Y/CALnwsPFVzJdmXDPz+DOMWX19dgvWDw/c9AiD1LdmXJNzp8+fYrkatSvYjwB94POV0zcRXAN1yDtvOf2Dcl3NtyUAGrLDyn9gvTUOdcy3TVwh9KvU/3A9uvLkMRDKwaTy0C7PdfyHcZfejxp82XYrwbdl3H1zq8vXCdwVc8PUIL0DmXTn0bdqvQrmc9wfL11XdTPX/1K8RPHYJ1cIwRoNZcBvFl1F9S3BNzTd4PZQOA8oQrD31cGwTnyTdjXK83+CPPSl2vRq/c4FF8jXGz0g8XXET2p9YQiL1oBiuQH2ddkfDz1Z8U3d93X8ZfaV2DcsQtMIW8XXUD1UASAWvzTdM3At1lcAvOfz+CAfRv3D8/oVr05D4PWd2O9M3G9wXx3XdeC09c3b4L0Df/NdyzcpvYnyxCfXNnzXdrgj0DJdf/DN20CVAPsIasMfZDw9ch3Bb0B8yPGfGLcWrD0E4wTvV+j7CpXe13OBCuYN04xHAvQN9dwfS7wbc8PFPz+g9Qv4J7cGvPgMFd4I2QNfp3/NADlcifTn2K9UPMjx9cZXNr2JCfRYr3TdGXPMDS8CPdvz0CFXWP3A9eXGqwi80wy91/8k3QH2A8tVS9xZdDgHkLXdIAhsIp8T3L1w9As3S/1Z8vXFLzldVIkrmc9KIFj3dchI/oKbdivUYN99c3MlwDR9XWv2R8WrLlwbcAvdeDm8Y/AWQ89vXLNwLdiPOALJ1QPGV0XCZfalzsEh3Vd3OAzIrXxdddAt0Os91fGl2VcmrIVwzcg2FhBnxWfF/1ncIvJq19cyIzl3oAwgkjyTdBffl269cPDT0lcarHtwH88fF8LsEfXAWT09yvW1zXcFXBDkzcmXUCNS9g3JQFOBG3YrkPDgPAHz4i4OfXxVdGXRcKNdRw2vyNc9XZhDZd/Q2YIwi8PCv189hQsiMkDZvUb3bctVYLwaiGXKrzPdf/YUO79/XeD1DcfRPqI79tA7MSHdtXJV1j8fRAH3rAzPbCPXhRfYYMZcRXWV1Z8IvTHxFc53e11JdJ/Pdzgi+fatx08p/SoOjc/ocDwFdA0MT2Q9yPYLw599XMgPrBw/YYO68M3XNw58GwOq0LdZwvr3X9lA4cODY7BMiIZdoQlt27c6ralxl8yIpCPldKXWq1j9HXZgLCCTvRjwW9wQ1lytCAw3GO9ca3At0n8b3GVxK5w/Olw89uvYrk7DeXUj1a8AvJgOFdBAt71S9a/KyJ5C+3NNz5cOIt0Pfd8PYt25cGPUQGVc4w0r0ogT3DAJfdsxIEO5ci3dWKP8oABb3ddpXBVxg9JXOgEK4GAet3D9sfQVwfdJXer0pc5o6TwbDi/NHz38p/P925cJ3eD1oD9XBl3tctQmsMHdIPQgLt9tvU31jcSuYn2R8AfKr0NcaAm10ts+XD0Jl9M3EWKDYhfetyUAfRMiJUCJ3Kr248q/RgO0Df/V1zLcwQq8LdDtAnGKq86rALyWCsArUIU8A3cUO49ifTN0atE3NdyhjuQvKMMhCfD0KK9BAtLwU9fXE7zjchXZ1ybdAfRKLzB4vWV2w9c3Rq1a9pPAj0z9/XXSILci3PsNz8Wooz2XdhwszzyC6XPd0B9A0esFfpuPOgG5dUvQT1LdeXGP3fCw/Nb0bdJoqV1JdnXPDxK5hXdeHXhOQyVzvCZXHHzWRfXQgNXcu48D0bcZXAcJYiV3G11bc5ohL119nPHV1zdzQyQO1dsxFQHTc+vS6JMiBPNN0CjeXHTz89mgsl0X8PPfV3BC43VOIDQwaFlx2ivXP6Eg9XYxoJTdZgl1wS9kIsKMDQlPRAJii93Jq2fdC3OmN885XQNyasLQugB09D/El0Nc1IkROFDL3cENj9Y/fVxl9PYiL2x8vgurzMj4vAWT5d6Y5H0Tcg3ErnDju/Lt0ohtXOq2H9tY5z0yi9AtrwU8QY5V0fiHXWDzZCmXUwMgihfBbyq9Aw9f3lC3Q16J78vXI1y5ckfaz2VD3vMROGDt3B1xAj03BV319g3aDyatQPUjzndIPC2Nbdbw12L5dPE1+k9c93PlwRDrYwNnB8b3Bb00iyY2/15cIvJVxxD4Qh73V8xg2DyaT0XVz3hCXAqn229vXTVy5ceQyj3qDlAz70ugyI4sLS8RYwn1mDBPWGLZde/ON1JdKIMt0Zc6cNl09cjA0AOI94vPDzHDFXVtx8ja/RN1y9sfS9yNjNXQEKS8ZfRlziTmk4nxldfPRqzlj/kh93tdW3alxLc+Ig11jdsfGnxZcg3VhMWDSA4SNqtY3UWL1cSuQP15cTXWv2Y84wkV2T94vINkvcVvCvxTcdXIkNm8HE+DyLdRAC0MwDmvSlOOiUI2VzM9vXBlzLdW3D0CkjdfLDxi8+PWN3OBBg8DxvdxE5pKZC1PUnwxi/grNw58uUsjxddsfZQPDjeXINgfDhU9FyasPQGeMo843MjyxCwQw4Cn8U/TP3ndYPHT0pTYw8N2aTENWsixccXBMDxdjsRDH0AgAA== -->

<!-- internal state end -->
<!-- tips_start -->

---



<details>
<summary>🪧 Tips</summary>

### Chat

There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=scalableminds/webknossos&utm_content=8147):

- Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  - `I pushed a fix in commit <commit_id>, please review it.`
  - `Generate unit testing code for this file.`
  - `Open a follow-up GitHub issue for this discussion.`
- Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples:
  - `@coderabbitai generate unit testing code for this file.`
  -	`@coderabbitai modularize this function.`
- PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  - `@coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.`
  - `@coderabbitai read src/utils.ts and generate unit testing code.`
  - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.`
  - `@coderabbitai help me debug CodeRabbit configuration file.`

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

### CodeRabbit Commands (Invoked using PR comments)

- `@coderabbitai pause` to pause the reviews on a PR.
- `@coderabbitai resume` to resume the paused reviews.
- `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
- `@coderabbitai full review` to do a full review from scratch and review all the files again.
- `@coderabbitai summary` to regenerate the summary of the PR.
- `@coderabbitai generate docstrings` to [generate docstrings](https://docs.coderabbit.ai/finishing-touches/docstrings) for this PR.
- `@coderabbitai resolve` resolve all the CodeRabbit review comments.
- `@coderabbitai plan` to trigger planning for file edits and PR creation.
- `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository.
- `@coderabbitai help` to get help.

### Other keywords and placeholders

- Add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed.
- Add `@coderabbitai summary` to generate the high-level summary at a specific location in the PR description.
- Add `@coderabbitai` anywhere in the PR title to generate the title automatically.

### CodeRabbit Configuration File (`.coderabbit.yaml`)

- You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository.
- Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information.
- If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json`

### Documentation and Community

- Visit our [Documentation](https://docs.coderabbit.ai) for detailed information on how to use CodeRabbit.
- Join our [Discord Community](http://discord.gg/coderabbit) to get help, request features, and share feedback.
- Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.

</details>

<!-- tips_end -->
author_association: CONTRIBUTOR
user: login: normanrz
created_at: 2025-04-09T12:49:00Z
body: Looks good. Just some nitpicking from my side. Please add a changelog entry and revise the PR summary.
author_association: MEMBER
user: login: robert-oleynik
created_at: 2025-04-09T14:02:48Z
body: Summary of all Changes:

# Removed

- All configurations file related to CircleCI (`.circleci` directory)
- The `docker-compose.yml` file is replaced with a note to the proper hosting file.

# Changed

- Moved Dockerfiles for webknossos, datastore and tracingstore to `.github` (All of them are for CI only)

# Added

- a custom GitHub action for retrying commands (see `.github/actions/retry`)
- a new GitHub Workflow with three jobs `backend-tests`, `frontend-tests` and `build-test-e2e-deploy`. All of them carry out parts of the original CircleCI pipelines:
  - `backend-tests`: Runs Scapegoat, Scalafmt and sbt tests
  - `frontend-tests`: Static tests and `yarn test-verbose`
  - `build-test-e2e-deploy`: Full build of webknossos including docker images followed by e2e tests and smoking tests. All docker images get pushed if all tests in this job pass.
author_association: CONTRIBUTOR