undercover-cactus
|
4631a9947a
|
move publish action from workflow template to a local action
|
2026-02-12 09:06:21 +01:00 |
|
Steve Degosserie
|
746fce9328
|
security: 🛡️ Harden GitHub Actions workflows (#349)
## Summary
This PR addresses several security vulnerabilities and applies hardening
measures to the GitHub Actions workflows:
- **Replace `secrets: inherit` with explicit secret passing** - Prevents
unnecessary exposure of all repository secrets to called workflows
- **Add SHA256 checksum verification for downloaded binaries** -
Protects against supply chain attacks via compromised upstream releases
- **Add GitHub Environment protections for release workflows** -
Requires approval before publishing to Docker Hub or creating releases
- **Add explicit minimal permissions to all workflows** - Follows
principle of least privilege, removes unnecessary `packages: write` from
CI.yml
## Changes by Category
### 1. Explicit Secret Passing
| Workflow | Before | After |
|----------|--------|-------|
| CI.yml → docker-build-ci | `secrets: inherit` | No secrets
(GITHUB_TOKEN is automatic) |
| CI.yml → docker-build-release | `secrets: inherit` | Explicit
`DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN` |
| CI.yml → e2e-tests | `secrets: inherit` | No secrets (GITHUB_TOKEN is
automatic) |
### 2. Binary Checksum Verification
| Workflow | Binary | SHA256 |
|----------|--------|--------|
| task-rust-lint.yml | taplo 0.8.1 | `c62baa73c9d7c1572...` |
| task-e2e.yml | kurtosis 1.11.99 | `5e88e98c1b255362...` |
### 3. Environment Protections
| Workflow | Job | Environment |
|----------|-----|-------------|
| task-docker-release.yml | build-test-push | `production` |
| task-publish-binary.yml | publish-draft-release | `releases` |
| task-publish-binary.yml | docker-release-candidate | `production` |
| task-publish-runtime.yml | publish-draft-release | `releases` |
### 4. Explicit Permissions
All 14 workflow files now have explicit `permissions:` blocks with
minimal required access.
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Ahmad Kaouk <56095276+ahmadkaouk@users.noreply.github.com>
|
2025-12-12 09:52:50 +00:00 |
|
Steve Degosserie
|
71b5e5185f
|
fix: consolidate session timing and simplify docker release workflow (#321)
## Summary
- Consolidates `SessionsPerEra` definition in common runtime (removes
duplicate definitions)
- Simplifies docker release workflow to always use full Docker builds
- Removes binary reuse path from release workflow
## Changes
### Runtime Configuration
- Remove duplicate `SessionsPerEra` definitions from individual runtimes
- Import `SessionsPerEra` from `datahaven_runtime_common::time` instead
- This fixes inconsistency where individual runtimes had
`prod_or_fast!(6, 1)` while common had `prod_or_fast!(6, 3)`
### Docker Release Workflow
- Remove binary reuse path - now always does full Docker build
- Remove `binary-hash` input from `workflow_call`
- Consolidate to single build step using `datahaven-build.Dockerfile`
- `docker-build-release` now runs in parallel on main branch (no
dependency on `build-operator`)
## Timing Configuration
### Production Runtime
| Parameter | Value | Duration |
|------------------|-------------|------------|
| Session | 600 blocks | 1 hour |
| Sessions per era | 6 | - |
| Era | 6 sessions | 6 hours |
| Bonding duration | 28 eras | 7 days |
### Fast Runtime (for testing)
| Parameter | Value | Duration |
|------------------|-------------|------------|
| Session | 10 blocks | 1 minute |
| Sessions per era | 1 | - |
| Era | 1 session | 1 minute |
| Bonding duration | 3 eras | 3 minutes |
---------
Co-authored-by: Claude <noreply@anthropic.com>
|
2025-11-26 10:25:24 +01:00 |
|
Steve Degosserie
|
72cac823af
|
fix: 🔧 Fix invalid condition on workflow_call in Docker release task (#238)
|
2025-10-15 21:33:54 +02:00 |
|
Steve Degosserie
|
d202869438
|
fix: 🔧 Fix Docker release extract tag logic (#237)
|
2025-10-15 19:50:59 +02:00 |
|
Steve Degosserie
|
ff694b0055
|
fix: 🔧 Fix Docker release extract tag logic (#236)
|
2025-10-15 18:52:27 +02:00 |
|
Steve Degosserie
|
8be3c0f979
|
fix: 🔧 Fix Docker image tags in Docker release task (#235)
Co-authored-by: Claude <noreply@anthropic.com>
|
2025-10-15 18:30:37 +02:00 |
|
Steve Degosserie
|
9a5404de82
|
refactor: Consolidate and optimize Docker image architecture (#233)
## Overview
This PR consolidates and optimizes the Docker build system, reducing
redundancy and improving CI/CD performance. The changes eliminate
duplicate Dockerfiles, introduce a flexible build template, and optimize
release builds to reuse CI artifacts.
## Changes Summary
### 🐳 Docker Images Restructured
**Before:** 5 Dockerfiles with significant overlap
**After:** 4 focused images + 1 utility
#### Final Structure:
1. **`operator/Dockerfile`** ✨ Updated
- **Standard operator image** for CI and release builds
- Minimal node image (accepts pre-built binaries)
- GHCR: `ghcr.io/datahaven-xyz/datahaven/datahaven` (CI)
- DockerHub: `datahavenxyz/datahaven` (releases)
2. **`docker/datahaven-build.Dockerfile`** (moved from
`operator/Dockerfile`)
- Full source-to-binary build for manual releases
- DockerHub: `datahavenxyz/datahaven:{label}`
- Supports custom RUSTFLAGS and fast-runtime feature
- Only used for manual workflow_dispatch builds
3. **`docker/datahaven-production.Dockerfile`** (kept)
- Binary builder for CPU-specific releases
- Used by build-prod-binary workflow template
- Supports custom target-cpu flags
4. **`docker/datahaven-dev.Dockerfile`** ✨ NEW (local dev only)
- **FOR LOCAL DEVELOPMENT/TROUBLESHOOTING ONLY**
- Includes debug tools: gdb, strace, vim, sudo
- Extra dependencies: librocksdb-dev, curl
- RUST_BACKTRACE enabled by default
- **DO NOT USE for CI or production builds**
5. **`test/docker/crossbuild-mac-libpq.dockerfile`** (kept)
- Utility for macOS → Linux cross-compilation
#### Removed (Redundant):
- ❌ `docker/datahaven.Dockerfile` → replaced by operator/Dockerfile
- ❌ `test/docker/datahaven-node-local.dockerfile` → replaced by
datahaven-dev.Dockerfile
---
### 🔄 Workflow Improvements
#### Enhanced `publish-docker` Template
- Supports both GHCR and DockerHub registries
- Flexible inputs: dockerfile, context, build-args, cache scope
- Auto-generates OCI-compliant labels
- Reduces code duplication (~70 lines → ~15 per workflow)
#### Refactored CI Pipeline
- **`docker-build-ci`**: Builds `operator/Dockerfile` → GHCR for CI/E2E
testing
- **`docker-build-release`**: Builds `operator/Dockerfile` → DockerHub
(main branch only)
- Both CI and release workflows now use the same minimal operator image
- Release builds **reuse CI binaries** instead of rebuilding from source
#### Optimized Release Workflow
The `task-docker-release` workflow now has dual modes:
**Mode 1: `workflow_call` (CI - main pushes)**
- ✅ Reuses binary from CI's build-operator task
- ✅ Uses lightweight `operator/Dockerfile`
- ✅ Tags: `latest`, `sha-{short}`
- ⚡ **Fast**: ~5 minutes (vs ~30 min previously)
**Mode 2: `workflow_dispatch` (Manual)**
- ✅ Full source build with `datahaven-build.Dockerfile`
- ✅ Custom branch and label selection
- ✅ Optional fast-runtime feature
- ✅ Tags: `PROD-{label}` or user-defined
---
### 🔧 Additional Optimizations
- Copy libpq5 from builder stage instead of reinstalling (smaller,
faster)
- Remove redundant protobuf-compiler package (use protoc v21.12
directly)
- Standardize user UID to 1000 across all runtime images
- Consistent OCI labeling and metadata
---------
Co-authored-by: Claude <noreply@anthropic.com>
|
2025-10-15 01:33:20 +02:00 |
|