Keep the light client out of the bot images

@pezkuwi/rpc-provider lists @bizinikiwi/connect as an optional dependency,
so npm installed it, with smoldot, into both images. Both are GPL-3.0, and
the bots never load them: they reach the chains over WsProvider. The images
now install with --omit=optional; with that install both bots load and read
the relay, Asset Hub and People chains.

The lockfiles still list the packages, so Dependency Review, which denies
GPL-3.0, flagged them on the new payout-bot lockfile (the noter's had them
before). It allows exactly those three packages, and the bots job fails if
an image contains @bizinikiwi or smoldot, so the allowance cannot outlive
the reason for it.

.github/workflows/ci.yml

@@ -37,6 +37,7 @@ jobs:
   # with every key type, and the bot must load its whole module graph and stop
   # only where it reads the mnemonic that CI does not have.
   bots:
+    name: bots (${{ matrix.bot }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -56,6 +57,13 @@ jobs:
       - name: Build the image
         run: docker build -t bot ${{ matrix.bot }}
 
+      # Dependency Review allows these GPL-3.0 packages in the lockfiles only
+      # because no image installs them; this is the check that keeps it true.
+      - name: No light client in the image
+        run: |
+          docker run --rm bot sh -c '! [ -e node_modules/@bizinikiwi ] && ! [ -e node_modules/smoldot ]' || {
+            echo "the image installs the light client; it must be built with --omit=optional"; exit 1; }
+
       - name: Crypto stack
         run: docker run --rm -v "$PWD/scripts/bot-smoke.mjs:/app/bot-smoke.mjs:ro" bot node bot-smoke.mjs ${{ matrix.mode }}
 

.github/workflows/security.yml

@@ -56,6 +56,13 @@ jobs:
         with:
           fail-on-severity: high
           deny-licenses: GPL-3.0, AGPL-3.0
+          # The light client is an optional dependency of @pezkuwi/rpc-provider,
+          # so it is listed in the bots' lockfiles, but their images are built
+          # with --omit=optional and never contain it (checked in ci.yml, bots).
+          allow-dependencies-licenses: >-
+            pkg:npm/@bizinikiwi/connect,
+            pkg:npm/@bizinikiwi/connect-extension-protocol,
+            pkg:npm/@bizinikiwi/connect-known-chains
 
   secret-scan:
     name: Secret Scan

noter/Dockerfile

@@ -4,9 +4,11 @@ WORKDIR /app
 
 # Install exactly what package-lock.json records, so the image runs the
 # versions that were reviewed and tested rather than whatever the ranges
-# resolve to on the day it is built.
+# resolve to on the day it is built. The optional dependencies are the light
+# client (@bizinikiwi/connect, smoldot), which the bot never loads: it talks to
+# the chains over WsProvider.
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev --no-audit --no-fund
+RUN npm ci --omit=dev --omit=optional --no-audit --no-fund
 
 COPY bot.js ./
 

payout-bot/Dockerfile

@@ -4,9 +4,11 @@ WORKDIR /app
 
 # Install exactly what package-lock.json records, so the image runs the
 # versions that were reviewed and tested rather than whatever the ranges
-# resolve to on the day it is built.
+# resolve to on the day it is built. The optional dependencies are the light
+# client (@bizinikiwi/connect, smoldot), which the bot never loads: it talks to
+# the chains over WsProvider.
 COPY package.json package-lock.json ./
-RUN npm ci --omit=dev --no-audit --no-fund
+RUN npm ci --omit=dev --omit=optional --no-audit --no-fund
 
 COPY bot.js ./