Advance latest node image on every main update - #3044
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🛡️ AI Review — Skeptic (security review)VERDICT: SAFE VERY HIGH account-age/public-repo scrutiny, mitigated by repository admin permission and substantial merged history; no Gittensor association or commit-author mismatch; fix/onchain-runtime-docker -> main. The publication resolver executes only after checkout of the immutable revision produced by FindingsNo findings. ConclusionNo malicious behavior or security vulnerability was found in the reviewed diff. The stale-publication and privileged pre-checkout execution paths are both guarded in the current head. 🔍 AI Review — Auditor (domain review)VERDICT: 👍 UNKNOWN Gittensor association; despite the account’s recent creation, repository admin permission and substantial merged contributions support established-contributor calibration. The implementation matches the substantive PR description. The current-head check addresses the prior stale-publication concern, while serialization prevents competing Validated with FindingsNo findings. Prior-comment reconciliation
ConclusionThe publication policy is focused, tested, and now prevents stale 📜 Previous run (superseded)
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| run: | | ||
| tag="v${{ needs.check.outputs.spec_version }}" | ||
| gh workflow run docker.yml \ | ||
| --repo "$GITHUB_REPOSITORY" --ref "$tag" -f tag="$tag" | ||
| gh workflow run docker-localnet.yml \ | ||
| --repo "$GITHUB_REPOSITORY" --ref "$tag" -f branch-or-tag="$tag" | ||
|
|
There was a problem hiding this comment.
[MEDIUM] Preserve release-tag publication of the localnet image
This removes both Docker dispatches, but watch-mainnet-docker.yml replaces only docker.yml. The deleted comment documents that GitHub releases created with GITHUB_TOKEN do not trigger either workflow's release event, so docker-localnet.yml now has no reliable path to publish the finalized vN image. Add an equivalent reusable-workflow call or an independent reconciler for the localnet image before deleting this dispatch.
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
188652f to
db5065f
Compare
UnArbosFive
changed the title
| # Docker requires lowercase image names; github.repository is RaoFoundation/subtensor | ||
| echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV | ||
| EVENT_NAME: ${{ github.event_name }} | ||
| run: ./.github/scripts/resolve-node-image.sh |
There was a problem hiding this comment.
[CRITICAL] Checkout the trusted revision before executing its script
This self-hosted job executes a workspace-relative script before actions/checkout establishes ${{ needs.setup.outputs.sha }}. A stale or attacker-controlled workspace can therefore supply this executable, retain control of the publication job, and reach the package credential used later. Move the immutable checkout ahead of this step, then execute the resolver from that checked-out tree.
|
🔄 AI review updated — Skeptic: VULNERABLE |
7f462e8 to
39d0bbd
Compare
| # Main is the only production publication path. A successful main build | ||
| # updates :main and :latest together; release and network tags cannot race it | ||
| # and move :latest backward. | ||
| if [[ "$tag" == main ]]; then |
There was a problem hiding this comment.
[MEDIUM] Prevent stale main runs from rolling back latest
This trusts the tag name without verifying that the checked-out SHA is still the current main head. Re-running an older main push (or dispatching tag=main before main advances) can finish later and overwrite :latest with an older image; a stale push rerun also shares the concurrency group and can cancel a newer in-progress run. Before enabling latest_tag, compare needs.setup.outputs.sha with the current immutable main head as late as practical, and add a test that rejects a stale main SHA.
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
39d0bbd to
077df87
Compare
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👍 |
1 participant
Summary
main.:mainand:latest.vN,devnet,testnet, and feature-ref images from changing:latest.mainpublications and reject a built SHA that is no longer the currentmainhead.Why
The stable image should not depend on runtime-release polling, protected environment approvals, or one workflow dispatching another. A merge to
mainalready runs the production image build, architecture checks, and executable validation. Once those checks pass, that build is the correct default image.This makes the publication rule deterministic: the newest successful
mainbuild is the only workflow allowed to move:latest.The current
mainSHA is checked immediately before the registry push. Older reruns fail instead of rolling the default image backward, while a newer queuedmainbuild runs after the older build exits.Verification
bash -n .github/scripts/resolve-node-image.sh .github/scripts/test-resolve-node-image.sh.github/scripts/test-resolve-node-image.sh.github/workflows/docker.ymland.github/workflows/check-node-image-publication.ymlgit diff --check origin/main...HEAD