fix(image): implement caching and domain matching for image rewriting #6180

cuisongliu · 2025-11-13T06:19:57Z

No description provided.

pull-request-size · 2025-11-13T06:20:03Z

Whoa! Easy there, Partner!

This PR is too big. Please break it up into smaller PRs.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2025-11-13T06:22:57Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go

+		if req.Auth == nil && s.authStore != nil {
+			domain := extractDomainFromImage(imageName)
+			if cfg, ok := s.authStore.GetCRIConfig(domain); ok {
 				req.Auth = ToV1AuthConfig(&cfg)


Fix PullImage auth lookup for normalized domains

PullImage now calls extractDomainFromImage and passes the normalized value directly to GetCRIConfig. For Docker Hub images this function always returns docker.io, while existing credentials are commonly keyed by the canonical endpoints (index.docker.io or registry-1.docker.io). After this change those entries will no longer be found and private pulls from Docker Hub will proceed without credentials. Consider keeping the original registry string or applying the same domain-matching logic used in rewriteImage before fetching the config.

Useful? React with 👍 / 👎.

dinoallo

Maybe we can use a LRU cache instead of simply evict cache entry based on their entry time

dinoallo

Also cache eviction can also be optimized. Currently eviction has O(n) time complexity, if the size of cache is n.

nowinkeyy · 2025-11-14T11:40:28Z

The following are the results of the four tests.

The current image-cri-shim configmap configuration is as follows. The global rollback address is http://sealos.hub:5000.

data:
  registries.yaml: |
    version: v1
    sealos:
      address: http://sealos.hub:5000
      auth:
        username: admin
        password: xxx

    registries:
      - address: https://ghcr.io
        auth:
          username: your-ghcr-user
          password: your-ghcr-token
      - address: https://docker.io
        auth: {}

    reloadInterval: 15s
    force: false
    debug: true
    timeout: 15m
    cache:
      imageCacheSize: 1024
      imageCacheTTL: 30m
      domainCacheTTL: 10m
      statsLogInterval: 1m
      disableStats: false

This image does not exist locally.

1、Execute the command to pull the image.

crictl --image-endpoint unix:///var/run/image-cri-shim.sock pull docker.io/nowinkey/service-cornjob:v0.0.1

The cache was not hit, and the final pull address was index.docker.io/nowinkey/service-cornjob:v0.0.1, and the image was successfully pulled.

2、Execute the command to pull the image.

crictl --image-endpoint unix:///var/run/image-cri-shim.sock pull docker.io/nowinkey/service-cornjob:v0.0.1

Cache hit.

3、Execute the command to pull the image.

crictl --image-endpoint unix:///var/run/image-cri-shim.sock pull query.io/nowinkey/service-cornjob:v0.0.1

The cache was not hit. First, it tried accessing http://sealos.hub:5000/v2/nowinkey/service-cornjob/manifests/v0.0.1, but couldn't find the image. Finally, it rewrote the address to index.docker.io/nowinkey/service-cornjob:v0.0.1 and successfully pulled the image.

4、Update the configmap and set an incorrect docker.io account.

    registries:
      - address: https://ghcr.io
        auth:
          username: your-ghcr-user
          password: your-ghcr-token
      - address: https://docker.io
        auth: 
          username: your-docker-user
          password: your-docker-token

Configmap hot update successful.

First, clean up the local image, then execute the command to pull the image.

crictl --image-endpoint unix:///var/run/image-cri-shim.sock pull docker.io/nowinkey/service-cornjob:v0.0.1

The cache was not hit. The docker.io address was matched first, then a 401 error was reported. Finally, the image was successfully pulled using the original address.

lifecycle/staging/src/github.com/labring/image-cri-shim/.github/workflows/close-pr.yml

cuisongliu · 2025-11-17T04:02:26Z

@codex review

chatgpt-codex-connector

💡 Codex Review

sealos/lifecycle/cmd/image-cri-shim/cmd/root_test.go

Lines 37 to 41 in 250c271

    
           func (f *fakeShim) Setup() error { return nil } 
        
           func (f *fakeShim) Start() error { return nil } 
        
           func (f *fakeShim) Stop() {}

Fake shim no longer satisfies shim.Shim

The unit test’s fakeShim only implements Setup, Start, Stop, and UpdateAuth (lines 37‑44), but the shim.Shim interface now also requires UpdateCache and CacheStats. As a result watchAuthConfig cannot be compiled for tests: *fakeShim does not implement shim.Shim (missing methods UpdateCache, CacheStats). Please extend the fake to implement the new methods (even with no‑ops) so go test ./lifecycle/cmd/image-cri-shim/cmd builds again.

sealos/lifecycle/cmd/image-cri-shim/cmd/root_test.go

Lines 74 to 77 in 250c271

    
           done := make(chan error, 1) 
        
           go func() { 
        
           	done <- watchAuthConfig(ctx, cfgPath, shim, 10*time.Millisecond) 
        
           }()

Test call to watchAuthConfig missing stats callback

watchAuthConfig now has a fifth parameter (the cache stats interval updater), but the test still calls it with the old four-argument signature (lines 74‑77). This causes a compile-time failure in root_test.go. Pass the new callback argument (e.g. nil for tests) so the package builds.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go

Copilot

Pull Request Overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/utils.go

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/types/configmap_sync.go

lifecycle/cmd/image-cri-shim/cmd/root.go

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1_test.go

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go

cuisongliu · 2025-11-17T06:04:30Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2025-11-17T06:10:01Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go

+	for regDomain, cfg := range registries {
+		if strings.HasSuffix(domain, "."+regDomain) || strings.HasSuffix(regDomain, "."+domain) {
+			s.cacheDomainMatch(domain, regDomain)
+			cfgCopy := cfg
+			return regDomain, &cfgCopy


Stop matching parent domains to child registry creds

In findMatchingRegistry you now treat a configured registry as a match not only when the image domain is equal or a subdomain (strings.HasSuffix(domain, "."+regDomain)) but also when the registry domain ends with the image domain (strings.HasSuffix(regDomain, "."+domain)). This second clause incorrectly matches parent domains to child registry entries. For example, if an operator only configured credentials for mirror.example.com and kubelet pulls example.com/nginx, the function will return the mirror credentials, cache that mapping, and every pull for example.com/* will be rewritten toward the wrong registry (and will usually fail auth). The cache also cements the wrong mapping so the shim never falls back to other registries. Please drop the strings.HasSuffix(regDomain, "."+domain) test so we only match when the image is an equal or more specific domain.

Useful? React with 👍 / 👎.

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/types/config.go

Copilot

Pull Request Overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 11 comments.

Copilot · 2025-11-17T06:17:36Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/types/configmap_sync_test.go

+	if cfg.Cache.DomainCacheTTL.Duration != 15*time.Minute {
+		t.Fatalf("expected domain cache ttl 15m, got %s", cfg.Cache.DomainCacheTTL.Duration)
+	}
+	if cfg.Cache.DisableStats != true {


The condition cfg.Cache.DisableStats != true uses explicit comparison with true. This should be simplified to !cfg.Cache.DisableStats for better readability and idiomatic Go style.

Suggested change

if cfg.Cache.DisableStats != true {

if !cfg.Cache.DisableStats {

Copilot · 2025-11-17T06:17:36Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go

+	s.cacheMutex.Unlock()
+	s.setMaxCacheSize(normalized.ImageCacheSize)


Race condition: The function reads and writes the cache fields outside the lock. While s.cacheMutex.Lock() is called, it's released with s.cacheMutex.Unlock() before calling s.setMaxCacheSize(normalized.ImageCacheSize). If setMaxCacheSize accesses cache-related fields that other goroutines might read/modify, this could cause a race condition. Consider whether setMaxCacheSize should be called within the locked section or if it properly handles its own locking.

Suggested change

s.cacheMutex.Unlock()

s.setMaxCacheSize(normalized.ImageCacheSize)

s.setMaxCacheSize(normalized.ImageCacheSize)

s.cacheMutex.Unlock()

Copilot · 2025-11-17T06:17:37Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go

+	// domainCacheRatio determines the size of the domain cache as imageCacheSize/ratio. A ratio of
+	// 10 keeps domain cache small relative to image cache to cap memory use while still providing
+	// effective domain-level memoization; tweak if a different ratio is desired.
+	domainCacheRatio = 10


[nitpick] The constant domainCacheRatio is defined in cri_server_v1.go but never explicitly validated. If s.maxCacheSize is less than 10 (the ratio value), the domain cache size calculation at line 349 could result in a very small cache (potentially just 1), which might not be the intended behavior. Consider documenting this edge case or adding validation.

Copilot · 2025-11-17T06:17:37Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go

+func (s *v1ImageService) logRewriteResult(action, original, rewritten, source string, cacheHit bool, replaced bool) {
+	logger.Info("rewrite action=%s cache_hit=%t source=%s original=%s result=%s replaced=%t",
+		action, cacheHit, source, original, rewritten, replaced)


The logging statement uses action as a parameter, but in the context where it's called (line 402), if action is not sanitized or validated, it could potentially contain format specifiers that interfere with the log formatting. Consider using %s format specifier for the action parameter or ensuring action values are from a controlled set.

Copilot · 2025-11-17T06:17:37Z

lifecycle/cmd/image-cri-shim/cmd/root.go

+			case <-tick:
+				stats := imgShim.CacheStats()
+				logger.Info("cache stats: image_hits=%d image_misses=%d domain_hits=%d domain_misses=%d image_evictions=%d domain_evictions=%d invalidations=%d generated_at=%s",
+					stats.ImageHits, stats.ImageMisses, stats.DomainHits, stats.DomainMisses, stats.ImageEvictions, stats.DomainEvictions, stats.Invalidations, stats.GeneratedAt.Format(time.RFC3339))
+			}


[nitpick] The stats reporter goroutine started by startCacheStatsReporter may leak if the context is cancelled while a ticker operation is in progress. The case <-tick: branch doesn't check if the context is done before calling imgShim.CacheStats() and logging. Consider adding a context check at the beginning of the tick handling to ensure clean shutdown.

Copilot · 2025-11-17T06:17:37Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/server.go

+
 func NewServer(options Options) (Server, error) {
 	if !filepath.IsAbs(options.Socket) {
 		return nil, fmt.Errorf("invalid socked")


Spelling: "socked" should be "socket" in the error message.

Suggested change

return nil, fmt.Errorf("invalid socked")

return nil, fmt.Errorf("invalid socket")

Copilot · 2025-11-17T06:17:38Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go

+func (s *v1ImageService) maxDomainCacheSize() int {
+	if s.maxCacheSize <= 0 {
+		return 0
+	}


[nitpick] Magic number: The domain cache size calculation uses a hardcoded ratio of 10 without clear justification. While there is a comment explaining the ratio, the actual value should be defined as a named constant (which it is as domainCacheRatio), but the constant is defined far from where it's used in maxDomainCacheSize(). Consider adding a comment at the usage site referencing why this specific ratio was chosen.

Suggested change

}

}

// Use a smaller domain cache to reduce memory usage; see domainCacheRatio definition for rationale.

Copilot · 2025-11-17T06:17:38Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go

+	if authStore != nil {
+		authStore.AddObserver(service.invalidateCache)
+	}
+	return service


[nitpick] Potential nil pointer dereference: If s.authStore is nil when newV1ImageService is called (line 189), the observer is not added. However, later in rewriteImage (line 210), there's a nil check for s.authStore. This is good defensive programming, but the initialization logic in newV1ImageService should be consistent - either always require a non-nil authStore or handle the nil case throughout. Consider documenting whether nil authStore is a supported configuration.

Copilot · 2025-11-17T06:17:38Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go

+		return
+	}
+	s.domainCache = domainCache


Inconsistent error handling: When lru.New() fails for the image cache (line 433-437), the code logs a warning and sets s.imageCache = nil. However, for the domain cache failure (line 446-450), it also sets s.domainCache = nil but then returns early. This means if the domain cache creation fails, the hadCache invalidation metric recording at line 453-455 is skipped. Consider making the error handling consistent for both cache creation failures.

Suggested change

return

}

s.domainCache = domainCache

} else {

s.domainCache = domainCache

}

Copilot · 2025-11-17T06:17:39Z

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/utils.go

+	}
+	ref, err := name.ParseReference(image)
+	if err != nil {
+		return normalizeDomainCandidate(registryFromImage(image))


The function registryFromImage is called in extractDomainFromImage but is not defined in the visible code changes. This could cause a compilation error if this function doesn't exist elsewhere in the codebase.

… private registry protection, ConfigMap sync + hot-reload, and logging reduction\n\n- Keep original domain on first pull; fallback only if offline manifest exists\n- Skip rewrite for configured private registries (honor original domain)\n- Sync kube-system/image-cri-shim ConfigMap at startup and periodically; emit single-line summary (offline/private domains, cache)\n- Reduce noisy startup logs; demote auth/cache details to debug\n- Add failure logs for first attempt and fallback attempt to aid troubleshooting\n\nRef: PR labring#6180

codecov · 2025-11-25T11:53:24Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.86%. Comparing base (2df0bdf) to head (a3846b6).
⚠️ Report is 20 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6180   +/-   ##
=======================================
  Coverage   61.86%   61.86%           
=======================================
  Files           8        8           
  Lines         653      653           
=======================================
  Hits          404      404           
  Misses        202      202           
  Partials       47       47

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

… private registry protection, ConfigMap sync + hot-reload, and logging reduction\n\n- Keep original domain on first pull; fallback only if offline manifest exists\n- Skip rewrite for configured private registries (honor original domain)\n- Sync kube-system/image-cri-shim ConfigMap at startup and periodically; emit single-line summary (offline/private domains, cache)\n- Reduce noisy startup logs; demote auth/cache details to debug\n- Add failure logs for first attempt and fallback attempt to aid troubleshooting\n\nRef: PR labring#6180

Signed-off-by: cuisongliu <cuisongliu@qq.com>

…hing Signed-off-by: cuisongliu <cuisongliu@qq.com>

Signed-off-by: cuisongliu <cuisongliu@qq.com>

…oad support Signed-off-by: cuisongliu <cuisongliu@qq.com>

Signed-off-by: cuisongliu <cuisongliu@qq.com>

…service Signed-off-by: cuisongliu <cuisongliu@qq.com>

…arity Signed-off-by: cuisongliu <cuisongliu@qq.com>

…mage service Signed-off-by: cuisongliu <cuisongliu@qq.com>

…nd improve case sensitivity Signed-off-by: cuisongliu <cuisongliu@qq.com>

…on failure; exact domain matching with caching (#900) * fix(image-cri-shim): prefer original registry; fallback offline only on failure; exact domain matching with caching * lifecycle: remove staging entrypoint for image-cri-shim and unify to CLI build; no functional change.

cuisongliu requested review from a team as code owners November 13, 2025 06:19

pull-request-size bot added the size/XXL label Nov 13, 2025

github-actions bot added area/imageCRIShim about image-cri-shim area/test area/lifecycle-management labels Nov 13, 2025

chatgpt-codex-connector bot reviewed Nov 13, 2025

View reviewed changes

dinoallo requested a review from Copilot November 13, 2025 07:38

Copilot started reviewing on behalf of dinoallo November 13, 2025 07:39 View session

Copilot finished reviewing on behalf of dinoallo November 13, 2025 07:43

This comment was marked as resolved.

Sign in to view

dinoallo reviewed Nov 13, 2025

View reviewed changes

github-actions bot added the area/command label Nov 13, 2025

cuisongliu force-pushed the fix-image-cri-shim-cache branch from e264ee7 to 9689300 Compare November 13, 2025 15:53

cuisongliu added this to the v5.2 milestone Nov 13, 2025

cuisongliu force-pushed the fix-image-cri-shim-cache branch from 26c58b7 to 4a64ebf Compare November 14, 2025 09:31

cuisongliu force-pushed the fix-image-cri-shim-cache branch 2 times, most recently from 2300c61 to 250c271 Compare November 15, 2025 14:57

dinoallo reviewed Nov 17, 2025

View reviewed changes

lifecycle/staging/src/github.com/labring/image-cri-shim/.github/workflows/close-pr.yml Show resolved Hide resolved

chatgpt-codex-connector bot reviewed Nov 17, 2025

View reviewed changes

lifecycle/staging/src/github.com/labring/image-cri-shim/pkg/server/cri_server_v1.go Outdated Show resolved Hide resolved

cuisongliu requested a review from Copilot November 17, 2025 04:10

cuisongliu force-pushed the fix-image-cri-shim-cache branch from 250c271 to d419a5e Compare November 17, 2025 04:13

Copilot started reviewing on behalf of cuisongliu November 17, 2025 04:14 View session

Copilot finished reviewing on behalf of cuisongliu November 17, 2025 04:15

Copilot AI reviewed Nov 17, 2025

View reviewed changes

cuisongliu force-pushed the fix-image-cri-shim-cache branch from d7873db to 1b6fe07 Compare November 17, 2025 06:03

cuisongliu requested a review from Copilot November 17, 2025 06:04

Copilot started reviewing on behalf of cuisongliu November 17, 2025 06:06 View session

Copilot finished reviewing on behalf of cuisongliu November 17, 2025 06:08

chatgpt-codex-connector bot reviewed Nov 17, 2025

View reviewed changes

Copilot AI reviewed Nov 17, 2025

View reviewed changes

cuisongliu force-pushed the fix-image-cri-shim-cache branch from bff2b2d to 148182d Compare November 19, 2025 07:14

cuisongliu force-pushed the fix-image-cri-shim-cache branch from 148182d to a3846b6 Compare November 25, 2025 11:47

cuisongliu and others added 13 commits November 26, 2025 20:22

fix(image): implement caching and domain matching for image rewriting

2f026d5

Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(image): optimize image rewriting with LRU caching and domain matc…

bfdffb3

…hing Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(cache): add cache configuration and metrics for image rewriting

c1744de

Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(image): enhance logging for image rewriting process and cache hits

76252ed

Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(config): add cache configuration for image rewriting with hot rel…

0158901

…oad support Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(config): add cache configuration for image rewriting with hot rel…

284dabc

…oad support Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(license): add Apache 2.0 license header to test files

fdce8ac

Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(docs): add example configurations for cache settings in USAGE.md

78a2562

Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(image): simplify cache access and improve thread safety in image …

80208c9

…service Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(image): enhance cache configuration with detailed comments for cl…

f351886

…arity Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(image): improve authentication handling and cache management in i…

6a4b0b8

…mage service Signed-off-by: cuisongliu <cuisongliu@qq.com>

fix(image): refine registry matching logic to enforce exact matches a…

b905974

…nd improve case sensitivity Signed-off-by: cuisongliu <cuisongliu@qq.com>

cuisongliu force-pushed the fix-image-cri-shim-cache branch from 5828c62 to c946791 Compare November 26, 2025 12:22

	func (f *fakeShim) Setup() error { return nil }

	func (f *fakeShim) Start() error { return nil }

	func (f *fakeShim) Stop() {}

	done := make(chan error, 1)
	go func() {
	done <- watchAuthConfig(ctx, cfgPath, shim, 10*time.Millisecond)
	}()

	if cfg.Cache.DisableStats != true {
	if !cfg.Cache.DisableStats {

		s.cacheMutex.Unlock()
		s.setMaxCacheSize(normalized.ImageCacheSize)

	return nil, fmt.Errorf("invalid socked")
	return nil, fmt.Errorf("invalid socket")

	}
	}
	// Use a smaller domain cache to reduce memory usage; see domainCacheRatio definition for rationale.

fix(image): implement caching and domain matching for image rewriting #6180

Are you sure you want to change the base?

fix(image): implement caching and domain matching for image rewriting #6180

Conversation

cuisongliu commented Nov 13, 2025

Uh oh!

pull-request-size bot commented Nov 13, 2025

Whoa! Easy there, Partner!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

dinoallo left a comment

Choose a reason for hiding this comment

Uh oh!

dinoallo left a comment

Choose a reason for hiding this comment

Uh oh!

nowinkeyy commented Nov 14, 2025

Uh oh!

Uh oh!

cuisongliu commented Nov 17, 2025

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cuisongliu commented Nov 17, 2025

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 17, 2025

Choose a reason for hiding this comment