-
Notifications
You must be signed in to change notification settings - Fork 340
Advance latest node image on every main update #3044
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
UnArbosFive
wants to merge
1
commit into
main
Choose a base branch
from
fix/onchain-runtime-docker
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+130
−26
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| output_file="${1:-${GITHUB_ENV:-}}" | ||
| : "${output_file:?pass an output file or set GITHUB_ENV}" | ||
| : "${INPUT_TAG:?INPUT_TAG is required}" | ||
| : "${SOURCE_REF:?SOURCE_REF is required}" | ||
| : "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}" | ||
|
|
||
| # Docker tags cannot contain '/', so sanitize manual refs such as feat/x. | ||
| tag="${INPUT_TAG//[^a-zA-Z0-9._-]/-}" | ||
| [[ -n "$tag" ]] || { echo "Docker tag is empty" >&2; exit 1; } | ||
|
|
||
| # Main is the only production publication path. A successful main build | ||
| # updates :main and :latest together; release and network tags cannot race it | ||
| # and move :latest backward. | ||
| if [[ "$tag" == main && "$SOURCE_REF" == refs/heads/main ]]; then | ||
| latest_tag=true | ||
| else | ||
| latest_tag=false | ||
| fi | ||
|
|
||
| image_repository=$(printf '%s' "$GITHUB_REPOSITORY" | tr '[:upper:]' '[:lower:]') | ||
|
|
||
| { | ||
| echo "tag=$tag" | ||
| echo "latest_tag=$latest_tag" | ||
| echo "image=ghcr.io/$image_repository" | ||
| } >> "$output_file" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd) | ||
| resolver="$script_dir/resolve-node-image.sh" | ||
| tmp=$(mktemp -d) | ||
| trap 'rm -rf "$tmp"' EXIT | ||
|
|
||
| run_case() { | ||
| local name="$1" | ||
| local input_tag="$2" | ||
| local source_ref="$3" | ||
| local expected_tag="$4" | ||
| local expected_latest="$5" | ||
| local output="$tmp/$name" | ||
|
|
||
| GITHUB_REPOSITORY=RaoFoundation/subtensor \ | ||
| INPUT_TAG="$input_tag" \ | ||
| SOURCE_REF="$source_ref" \ | ||
| "$resolver" "$output" | ||
|
|
||
| grep -qxF "tag=$expected_tag" "$output" | ||
| grep -qxF "latest_tag=$expected_latest" "$output" | ||
| grep -qxF "image=ghcr.io/raofoundation/subtensor" "$output" | ||
| } | ||
|
|
||
| run_case main main refs/heads/main main true | ||
| run_case stale-main main refs/tags/v448 main false | ||
| run_case testnet testnet refs/heads/testnet testnet false | ||
| run_case release v448 refs/tags/v448 v448 false | ||
| run_case feature feature/example refs/heads/feature/example feature-example false | ||
|
|
||
| workflow="$script_dir/../workflows/docker.yml" | ||
| grep -qF 'branches: [main, devnet, testnet]' "$workflow" | ||
| grep -qF 'run: ./.github/scripts/resolve-node-image.sh' "$workflow" | ||
| grep -qF "env.latest_tag == 'true'" "$workflow" | ||
| grep -qF "cancel-in-progress: \${{ github.ref != 'refs/heads/main' }}" "$workflow" | ||
| grep -qF 'current_main=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/main"' "$workflow" | ||
|
|
||
| publish_job=$(sed -n '/^ publish:/,$p' "$workflow") | ||
| checkout_line=$(grep -nF 'ref: ${{ needs.setup.outputs.sha }}' <<<"$publish_job" | head -n 1 | cut -d: -f1) | ||
| resolver_line=$(grep -nF 'run: ./.github/scripts/resolve-node-image.sh' <<<"$publish_job" | cut -d: -f1) | ||
| [[ "$checkout_line" -lt "$resolver_line" ]] || { | ||
| echo "publish job must check out the pinned source before running its resolver" >&2 | ||
| exit 1 | ||
| } | ||
|
|
||
| head_check_line=$(grep -nF 'name: Verify current main revision' <<<"$publish_job" | cut -d: -f1) | ||
| push_line=$(grep -nF 'name: Build and push' <<<"$publish_job" | cut -d: -f1) | ||
| [[ "$head_check_line" -lt "$push_line" ]] || { | ||
| echo "publish job must reject stale main revisions before pushing" >&2 | ||
| exit 1 | ||
| } | ||
|
|
||
| echo "node image tag policy checks passed" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| name: Validate Node Image Publication | ||
|
|
||
| on: | ||
| pull_request: | ||
| paths: | ||
| - ".github/scripts/resolve-node-image.sh" | ||
| - ".github/scripts/test-resolve-node-image.sh" | ||
| - ".github/workflows/docker.yml" | ||
| - ".github/workflows/check-node-image-publication.yml" | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| policy: | ||
| name: main updates latest | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - run: ./.github/scripts/test-resolve-node-image.sh |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[CRITICAL] Checkout the trusted revision before executing its script
This self-hosted job executes a workspace-relative script before
actions/checkoutestablishes${{ needs.setup.outputs.sha }}. A stale or attacker-controlled workspace can therefore supply this executable, retain control of the publication job, and reach the package credential used later. Move the immutable checkout ahead of this step, then execute the resolver from that checked-out tree.