The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Building	Preview, Comment	Jun 23, 2026 7:26am

PR Summary

Medium Risk
New security-adjacent PII detection path and large (~6GB) ECS sidecar with heavy memory/cold-start requirements; app/infra wiring to use it is still out of band for this PR.

Overview
Introduces a single owned PII container (docker/pii.Dockerfile + apps/pii/) that replaces separate Microsoft Presidio analyzer/anonymizer sidecars. A FastAPI app warms one AnalyzerEngine and one AnonymizerEngine at startup and exposes stock-style /health, /supportedentities, /analyze, and /anonymize on port 3000, so callers can use one PRESIDIO_URL.

The analyzer is configured for en/es/it/pl/fi with five pinned spaCy lg models in the image, plus explicit registration of locale/national-id recognizers Presidio does not load by default and a VIN recognizer with ISO 3779 check-digit validation registered per language. Requests use Pydantic models (e.g. missing text → 422; anonymize operator type defaults to replace).

CI adds the PII image to dev/staging/main build matrices in ci.yml and images.yml, resolves ECR_PII, and pushes ECR-only (no GHCR when ghcr_image is omitted). GHCR tagging is gated on a non-empty ghcr_image so ECR-only matrix entries do not get invalid tags. Workspace metadata adds @sim/pii in package.json / bun.lock without changing the JS turbo build.

^{Reviewed by Cursor Bugbot for commit 2b3bce1. Bugbot is set up for automated code reviews on this repo. Configure here.}

@greptile review

Greptile Summary

This PR replaces the two-sidecar Presidio setup (separate analyzer + anonymizer containers) with a single combined image built around a thin FastAPI service. The service loads five spaCy lg models at startup and serves stock-compatible /analyze and /anonymize endpoints on one port, with VIN check-digit validation and explicit registration of locale-specific recognizers (UK, AU, IN, SG, ES, IT, PL, FI) that Presidio ships but does not load by default.

• docker/presidio/server.py: Pydantic request models handle missing-field validation correctly; pop(\"type\", \"replace\") already supplies a safe default; the VIN ISO-3779 check-digit algorithm is correctly implemented. The entities or None expression silently converts an empty list to None, causing all entities to be analyzed instead of none.
• docker/presidio.Dockerfile: Single-stage build; pip cache mounts are used correctly; five spaCy models are downloaded with curl retry/resume; build-essential is installed for native deps but never removed, leaving compiler toolchain in the runtime image.
• CI (ci.yml / images.yml): Presidio is wired into every matrix job; the ECR ternary chain in ci.yml is extended; images.yml resolves secrets via secrets[matrix.ecr_repo_secret] and requires no ternary update.

Confidence Score: 5/5

Safe to merge; new infra files only, no changes to existing app logic.

The change adds an entirely new Docker image and CI matrix entries without touching any existing code paths. The FastAPI server is well-structured with Pydantic validation, the VIN check-digit implementation is correct, and the CI wiring mirrors the established pattern for other images.

No files require special attention; all changed files are new additions to the build infrastructure.

Important Files Changed

_{Reviews (3): Last reviewed commit: "improvement(presidio): address review fe..." | Re-trigger Greptile}

Greptile Summary

This PR introduces a single combined Presidio image (docker/presidio.Dockerfile) that replaces two separate upstream sidecars with one FastAPI service on port 3000, reducing the required env config to a single PRESIDIO_URL. CI and image workflows are wired consistently for dev/staging/prod across AMD64 and ARM64 targets.

• New server.py: one warm AnalyzerEngine (VIN check-digit recognizer + 12 extra English recognizers) and one AnonymizerEngine at startup; exposes /health, /supportedentities, /analyze, and /anonymize with stock-compatible payload shapes.
• presidio.Dockerfile: python:3.12-slim-bookworm, pinned deps, en_core_web_lg wheel fetched with curl --retry/resume to handle the ~400 MB download, non-root user at runtime.
• CI changes: matrix entries and ECR ternary expressions updated in all four relevant jobs in ci.yml; images.yml already uses dynamic secret lookup so only matrix entries needed extending.

Confidence Score: 4/5

Safe to merge; the new Presidio sidecar is additive infrastructure with no app-side wiring in this PR

The VIN check-digit algorithm and all CI matrix updates are correct. The three findings are confined to the new FastAPI server: the pip cache mount is silently wasted (not a runtime failure), and two endpoint handlers will return 500 instead of 422 for malformed payloads — unlikely in practice since callers are internal, but worth fixing before the follow-up HTTP-wiring PR lands.

docker/presidio/server.py — input validation gaps in /analyze and /anonymize; docker/presidio.Dockerfile — contradictory pip cache flags

Important Files Changed

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant App as App Container
    participant P as Presidio Sidecar (localhost:3000)
    participant AE as AnalyzerEngine
    participant AnE as AnonymizerEngine

    App->>P: GET /health
    P-->>App: "{status: ok}"

    App->>P: "GET /supportedentities?language=en"
    P->>AE: get_supported_entities(en)
    AE-->>P: [32 entity types]
    P-->>App: [PERSON, EMAIL_ADDRESS, VIN, ...]

    App->>P: "POST /analyze {text, language, entities}"
    P->>AE: analyze(text, language, entities)
    AE-->>P: [RecognizerResult...]
    P-->>App: "[{entity_type, start, end, score}...]"

    App->>P: "POST /anonymize {text, analyzer_results, anonymizers}"
    P->>AnE: anonymize(text, analyzer_results, operators)
    AnE-->>P: EngineResult
    P-->>App: "{text: redacted, items: [...]}"

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant App as App Container
    participant P as Presidio Sidecar (localhost:3000)
    participant AE as AnalyzerEngine
    participant AnE as AnonymizerEngine

    App->>P: GET /health
    P-->>App: "{status: ok}"

    App->>P: "GET /supportedentities?language=en"
    P->>AE: get_supported_entities(en)
    AE-->>P: [32 entity types]
    P-->>App: [PERSON, EMAIL_ADDRESS, VIN, ...]

    App->>P: "POST /analyze {text, language, entities}"
    P->>AE: analyze(text, language, entities)
    AE-->>P: [RecognizerResult...]
    P-->>App: "[{entity_type, start, end, score}...]"

    App->>P: "POST /anonymize {text, analyzer_results, anonymizers}"
    P->>AnE: anonymize(text, analyzer_results, operators)
    AnE-->>P: EngineResult
    P-->>App: "{text: redacted, items: [...]}"

_{Reviews (2): Last reviewed commit: "feat(presidio): build & own combined ana..." | Re-trigger Greptile}

@greptile review