Publish runtime Docker images independently of release approvals - #3044
Publish runtime Docker images independently of release approvals#3044UnArbosFive wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🛡️ AI Review — Skeptic (security review)VERDICT: SAFE VERY HIGH account-age/public-repo scrutiny, mitigated by repository admin permission and substantial merged history; no Gittensor association or commit-author mismatch; fix/onchain-runtime-docker -> main. FindingsNo findings. ConclusionThe package-write path is constrained to a validated release-train commit whose runtime artifact matches finalized on-chain bytes, and no security vulnerability or malicious behavior was found. 🔍 AI Review — Auditor (domain review)VERDICT: 👎 UNKNOWN Gittensor association; very new account, but repository admin permission and substantial merged contribution history support established-contributor calibration. The new watcher correctly decouples production-image publication from protected release approvals, but it drops the existing release-tag publication path for the localnet image. PRs #2994 and #2995 only overlap incidentally with the release workflow and are not duplicate implementations. Findings
ConclusionThe production-image reconciliation is well constrained, but removing the only reliable |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| run: | | ||
| tag="v${{ needs.check.outputs.spec_version }}" | ||
| gh workflow run docker.yml \ | ||
| --repo "$GITHUB_REPOSITORY" --ref "$tag" -f tag="$tag" | ||
| gh workflow run docker-localnet.yml \ | ||
| --repo "$GITHUB_REPOSITORY" --ref "$tag" -f branch-or-tag="$tag" | ||
|
|
There was a problem hiding this comment.
[MEDIUM] Preserve release-tag publication of the localnet image
This removes both Docker dispatches, but watch-mainnet-docker.yml replaces only docker.yml. The deleted comment documents that GitHub releases created with GITHUB_TOKEN do not trigger either workflow's release event, so docker-localnet.yml now has no reliable path to publish the finalized vN image. Add an equivalent reusable-workflow call or an independent reconciler for the localnet image before deleting this dispatch.
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
1 participant
Summary
vNandlatestas terminal publication statemainnetenvironment unchangedRoot cause
watch-mainnet-release.ymlserialized Docker behind a protected-environment release job. A waiting approval held the workflow-wide concurrency lock, preventing the watcher from observing newer on-chain runtimes. Its downstream Docker dispatches also consistently ended instartup_failurewhen triggered bygithub-actions[bot].Verification
.github/scripts/test-check-release-node-image.shbash -n .github/scripts/check-release-node-image.sh .github/scripts/test-check-release-node-image.shpython3 .github/scripts/test_prepare_sdk_dist.py8904435798verified against the on-chain code hashgit diff --check