fix: install the onnx-asr plugin on alpha only

[goldyfruit]

Why

#200 installs ovos-stt-plugin-onnx-asr in the listener image, with a fallback for channels where it doesn't resolve. On testing it does resolve, by raising ovos-plugin-manager to 2.2.0. That is past the <2.0.0 the testing channel's ovos-vad-plugin-noise 0.1.2 and ovos-vad-plugin-silero 0.0.5 accept. The arm64 testing listener then failed its pip check smoke test and was not published (run 37535956317, job "testing / Create channel manifests"). Alpha passed on both architectures and is published.

Change

The install now only runs when OVOS_CHANNEL is alpha, which the base image sets as an environment variable. ovos-installer only configures local speech on alpha (OpenVoiceOS/ovos-installer#648), so the other channels never need the plugin. The model directory is still created everywhere, which keeps the ovos_stt_models volume owned by ovos whatever the channel.

Test plan

• bash -n on the listener's RUN instruction, with the comment lines dropped and the continuations joined as Docker does.
• This PR's image builds, testing included.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Installation Changes
  • Alpha-channel builds now attempt to install the ONNX speech recognition plugin. If installation fails, the build logs how to add it through listener.list.
  • Builds on other channels skip this installation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5cfe2714-e2b6-4cb5-90f0-e60c85970114

📥 Commits

Reviewing files that changed from the base of the PR and between fb239f3 and bd8a6fc.

📒 Files selected for processing (1)

• listener/Dockerfile

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The listener Dockerfile now attempts to install ONNX ASR packages only when OVOS_CHANNEL is alpha. If installation fails on alpha, it prints a message directing users to listener.list.

Changes

ONNX ASR installation

Layer / File(s)	Summary
Channel-gated package installation listener/Dockerfile	The Dockerfile installs the ONNX ASR packages only on alpha. If installation fails, it prints a fallback message directing users to listener.list. Comments describe the channel restriction and the hub extra.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to bd8a6

The change limits the explicit ONNX ASR install to alpha. No actionable regression from this change is established; the reported image build remains unchecked.

Security Architecture Review

Security architecture risk: 🔵 Low · up to bd8a6

The change narrows automatic package installation without expanding listener privileges or changing model-directory ownership. No introduced security concern was identified. Compatibility across channels remains uncertain because resolved dependencies and completed image-build results were not available.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The supported change in exposure is bounded to listener image package composition by channel. Alpha retains the prior explicit install, and other channels lose that build-time attempt. No expanded runtime identity or model-data ownership is evidenced.

Trust Boundaries and Controls

• inferred — Control of listener.list already allows selection of packages installed under the listener identity. Non-alpha users may need this existing path to supply omitted packages, but the gate grants no new configuration-write privilege or higher-privilege installer. No newly enabled attacker path is supported by the inspected comparison.

Resilience and Maintainability Implications

• observed — The unchanged runtime transition records state only after installation succeeds. Installation failure leaves the prior marker and prevents normal listener startup under set -e. There is no lock around comparison, installation and marker copying, nor an explicit rollback for interrupted installation; these limitations predate the PR, and no worsened security exposure was established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: install the ONNX ASR plugin only on the alpha channel.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}