From 0891220c90b3f22c2aaffaf18bdb2be168dbbf76 Mon Sep 17 00:00:00 2001 From: "Richard J. Reyes" Date: Thu, 9 Jul 2026 19:12:01 -0700 Subject: [PATCH 1/6] Add container image for WaveLock node and CLI --- Dockerfile | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 Dockerfile diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..dc892bd --- /dev/null +++ b/Dockerfile @@ -0,0 +1,25 @@ +FROM python:3.12-slim + +ENV PYTHONDONTWRITEBYTECODE=1 \ + PYTHONUNBUFFERED=1 \ + PIP_NO_CACHE_DIR=1 + +WORKDIR /app + +RUN addgroup --system wavelock \ + && adduser --system --ingroup wavelock wavelock + +COPY pyproject.toml README.md ./ +COPY wavelock ./wavelock + +RUN python -m pip install --upgrade pip \ + && python -m pip install . \ + && mkdir -p /app/ledger /app/commitments \ + && chown -R wavelock:wavelock /app + +USER wavelock + +EXPOSE 9001 +VOLUME ["/app/ledger", "/app/commitments"] + +CMD ["wavelockd"] From a4e1173d664ed018f897c555023c82155b9c1c4c Mon Sep 17 00:00:00 2001 From: "Richard J. Reyes" Date: Thu, 9 Jul 2026 19:12:06 -0700 Subject: [PATCH 2/6] Add WaveLock Docker build exclusions --- .dockerignore | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .dockerignore diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..7f19a73 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,21 @@ +.git +.github +__pycache__/ +*.py[cod] +.pytest_cache/ +.mypy_cache/ +.ruff_cache/ +.venv/ +venv/ +build/ +dist/ +*.egg-info/ +tests/ +curvature_audit/ +pde_audit/ +archive/ +ledger/ +commitments/ +*.jsonl +*.npz +.env From c0949685d0134e1adb92bf217f329b69f95557ce Mon Sep 17 00:00:00 2001 From: "Richard J. Reyes" Date: Thu, 9 Jul 2026 19:12:18 -0700 Subject: [PATCH 3/6] Add WaveLock core and container CI --- .github/workflows/container-ci.yml | 47 ++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 .github/workflows/container-ci.yml diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml new file mode 100644 index 0000000..138e5dd --- /dev/null +++ b/.github/workflows/container-ci.yml @@ -0,0 +1,47 @@ +name: Container and core CI + +on: + push: + branches: [master] + pull_request: + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: container-ci-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + core-tests: + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 + with: + python-version: "3.12" + cache: pip + - name: Install package and test dependencies + run: | + python -m pip install --upgrade pip + python -m pip install -e ".[blake3]" pytest + - name: Run fast core tests + run: python -m pytest tests/ -m "not slow" -q + - name: Smoke-test installed commands + run: | + wavelock-cli --help + wavelock-ots --help + wavelock-encrypt --help + + container: + runs-on: ubuntu-24.04 + needs: core-tests + steps: + - uses: actions/checkout@v4 + - name: Build CPU image + run: docker build --tag wavelock-ci . + - name: Smoke-test image commands + run: | + docker run --rm wavelock-ci wavelock-cli --help + docker run --rm wavelock-ci wavelock-ots --help From 95f1c6a71d570b871b1ef54ec0e386075db7aef3 Mon Sep 17 00:00:00 2001 From: "Richard J. Reyes" Date: Thu, 9 Jul 2026 19:19:54 -0700 Subject: [PATCH 4/6] Install WaveLock optional BLAKE3 support in image --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index dc892bd..f2d71b5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ COPY pyproject.toml README.md ./ COPY wavelock ./wavelock RUN python -m pip install --upgrade pip \ - && python -m pip install . \ + && python -m pip install ".[blake3]" \ && mkdir -p /app/ledger /app/commitments \ && chown -R wavelock:wavelock /app From 8cfa2d2c92bdda085b90406ab4cb7969e378d71e Mon Sep 17 00:00:00 2001 From: "Richard J. Reyes" Date: Thu, 9 Jul 2026 19:22:27 -0700 Subject: [PATCH 5/6] Expose WaveLock container smoke-test errors --- .github/workflows/container-ci.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index 138e5dd..5407743 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -40,8 +40,14 @@ jobs: steps: - uses: actions/checkout@v4 - name: Build CPU image - run: docker build --tag wavelock-ci . + run: docker build --quiet --tag wavelock-ci . - name: Smoke-test image commands + shell: bash run: | - docker run --rm wavelock-ci wavelock-cli --help - docker run --rm wavelock-ci wavelock-ots --help + set -o pipefail + { + echo "== wavelock-cli ==" + docker run --rm wavelock-ci wavelock-cli --help + echo "== wavelock-ots ==" + docker run --rm wavelock-ci wavelock-ots --help + } 2>&1 | tail -n 250 From 52232a0185c8b87cd80d62b0a4062a42049c7c54 Mon Sep 17 00:00:00 2001 From: "Richard J. Reyes" Date: Thu, 9 Jul 2026 19:24:19 -0700 Subject: [PATCH 6/6] Upload complete WaveLock container smoke diagnostics --- .github/workflows/container-ci.yml | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/container-ci.yml b/.github/workflows/container-ci.yml index 5407743..6d92c75 100644 --- a/.github/workflows/container-ci.yml +++ b/.github/workflows/container-ci.yml @@ -42,12 +42,26 @@ jobs: - name: Build CPU image run: docker build --quiet --tag wavelock-ci . - name: Smoke-test image commands + id: container_smoke shell: bash run: | - set -o pipefail + set +e { echo "== wavelock-cli ==" docker run --rm wavelock-ci wavelock-cli --help echo "== wavelock-ots ==" docker run --rm wavelock-ci wavelock-ots --help - } 2>&1 | tail -n 250 + } > container-smoke.log 2>&1 + status=$? + echo "status=$status" >> "$GITHUB_OUTPUT" + tail -n 250 container-smoke.log + exit 0 + - name: Upload container diagnostics + if: always() + uses: actions/upload-artifact@v4 + with: + name: wavelock-container-smoke-${{ github.sha }} + if-no-files-found: error + path: container-smoke.log + - name: Enforce container smoke result + run: test "${{ steps.container_smoke.outputs.status }}" -eq 0