mirror of
https://github.com/pezkuwichain/pezkuwi-subquery.git
synced 2026-10-20 18:56:24 +00:00
Satoshi Qazi Muhammed
2937263461
Both images ran `npm install` with version ranges and ignored any lockfile, so what production ran depended on the day the image was built. The live containers, built on 2026-10-03, run @pezkuwi/wasm-crypto 7.5.17, whose ed25519, ecdsa and mnemonic generation are stubs that throw. Both bots sign with sr25519 only, which is why they kept working. Each bot now has a package.json and package-lock.json (@pezkuwi/api 16.5.37, keyring, util and util-crypto 14.0.26, wasm-crypto 7.5.20) and its image installs exactly that with `npm ci`. Node 20 is past its end of life; the images move to node:24-alpine. CI gains a `bots` job that builds each image and runs inside it: scripts/bot-smoke.mjs checks the installed versions against the lockfile and signs and verifies with sr25519, ed25519 and ecdsa, and the bot itself must load and stop at the mnemonic it is not given. Against the previous lockfile the smoke check fails on mnemonic generation, ed25519 and ecdsa.
73 lines
2.0 KiB
YAML
73 lines
2.0 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '18'
|
|
|
|
- name: Enable Corepack
|
|
run: corepack enable
|
|
|
|
- name: Install dependencies
|
|
run: yarn install --immutable
|
|
|
|
- name: Generate types
|
|
run: ./node_modules/.bin/subql codegen pezkuwi.yaml
|
|
|
|
- name: Build
|
|
run: ./node_modules/.bin/subql build pezkuwi.yaml
|
|
|
|
# The noter and payout bots ship as their own images (docker-compose.prod.yml)
|
|
# and nothing else here builds or runs them. Build each image as production
|
|
# does, then run inside it: the crypto stack must be the locked one and sign
|
|
# with every key type, and the bot must load its whole module graph and stop
|
|
# only where it reads the mnemonic that CI does not have.
|
|
bots:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- bot: noter
|
|
mode: esm
|
|
expect: 'No noter mnemonic found'
|
|
- bot: payout-bot
|
|
mode: cjs
|
|
expect: "ENOENT: no such file or directory, open '/run/secrets/payout_mnemonic'"
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Build the image
|
|
run: docker build -t bot ${{ matrix.bot }}
|
|
|
|
- name: Crypto stack
|
|
run: docker run --rm -v "$PWD/scripts/bot-smoke.mjs:/app/bot-smoke.mjs:ro" bot node bot-smoke.mjs ${{ matrix.mode }}
|
|
|
|
- name: The bot loads and stops at its missing mnemonic
|
|
env:
|
|
EXPECT: ${{ matrix.expect }}
|
|
run: |
|
|
set +e
|
|
out=$(timeout 60 docker run --rm bot 2>&1)
|
|
code=$?
|
|
set -e
|
|
echo "$out"
|
|
[ "$code" -ne 0 ] && [ "$code" -ne 124 ] || { echo "expected the bot to exit with an error, got $code"; exit 1; }
|
|
grep -qF "$EXPECT" <<<"$out" || { echo "expected: $EXPECT"; exit 1; }
|