Satoshi Qazi Muhammed 01a4903337 Keep the light client out of the bot images ...

@pezkuwi/rpc-provider lists @bizinikiwi/connect as an optional dependency,
so npm installed it, with smoldot, into both images. Both are GPL-3.0, and
the bots never load them: they reach the chains over WsProvider. The images
now install with --omit=optional; with that install both bots load and read
the relay, Asset Hub and People chains.

The lockfiles still list the packages, so Dependency Review, which denies
GPL-3.0, flagged them on the new payout-bot lockfile (the noter's had them
before). It allows exactly those three packages, and the bots job fails if
an image contains @bizinikiwi or smoldot, so the allowance cannot outlive
the reason for it.

2026-10-08 22:45:54 +04:00

..

bot.js

Add auto-payout bot for AH staking rewards

2026-02-21 17:03:13 +03:00

Dockerfile

Keep the light client out of the bot images

2026-10-08 22:45:54 +04:00

package-lock.json

Run the noter and payout bots on the fixed crypto stack, from their lockfiles

2026-10-08 22:45:54 +04:00

package.json

Run the noter and payout bots on the fixed crypto stack, from their lockfiles

2026-10-08 22:45:54 +04:00