ci(hermes): build the hermes sidecar image from our fork at a pinned ref - #67
ci(hermes): build the hermes sidecar image from our fork at a pinned ref#67CryptoFewka wants to merge 4 commits into
Conversation
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 30 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository: getoptimum/coderabbit/.coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
Comment |
The build cloned a moving branch and tagged the result with this repo's commit SHA, so an image tag did not identify the hermes code inside it and the same tag could not be rebuilt later. Pin the source commit in HERMES_REF, check it out explicitly, log the resolved SHA at build time, and publish an additional hermes-<sha> tag so a tag identifies its contents. The existing tag is unchanged. HERMES_REPO now points at our fork, which adds an opt-in gossip validator for beacon blocks. It is off unless enabled by flag, so the image behaves the same as before by default.
44c3fc3 to
eec699e
Compare
CryptoFewka
changed the title
CryptoFewka
changed the title
Scope the registry credential to the build job. It was workflow-level env, so it
sat in the environment of every step of every job, including the sign job's
checkout. The sibling publish workflows already scope it this way.
Declare permissions: {} on the build job. It never uses the GITHUB_TOKEN and the
repository default is write.
Pass the ref name through env rather than interpolating it into the shell. Ref
names may contain shell metacharacters, and this step runs in a job holding a
registry credential. Needs write access to reach, so this is defence in depth.
Assert each Dockerfile patch applied. sed exits 0 when its pattern does not match,
so a change to the source Dockerfile, for example pinning the base image by
digest, would silently drop the Go version or the multi-arch build args and still
publish. The assertions use grep -F because the expected strings contain ${...},
which grep would otherwise read as a regex interval and never match.
The previous pin was a commit on a feature branch, which predated several fixes and would stop resolving once that branch was deleted. Point it at the fork's main instead, where the sidecar work is now merged, so the pin is both current and durable.
Picks up getoptimum/hermes#6, which gives validation_duration_seconds usable bucket boundaries; the previous build collapsed every observation into one.
2 participants
Why
The hermes sidecar build cloned a moving branch and tagged the resulting image with this repo's commit SHA. Two consequences:
What changed
HERMES_REFpins the source commit, checked out explicitly, with the resolved SHA logged at build time.hermes-<sha>image tag, so a tag identifies its contents. The existing${{ github.sha }}tag is unchanged, so nothing downstream breaks.HERMES_REPOpoints at our fork, which adds an opt-in gossip validator for beacon blocks (feat(eth): optional gossip validation for beacon blocks hermes#1). It is off unless enabled by flag, so the image behaves identically by default.Note
HERMES_REFcurrently points at the PR branch on the fork. Repoint it at the merge commit once getoptimum/hermes#1 lands, before publishing an image intended for production.Written with Claude Code