Skip to content

Commit 71506d3

Browse files
cosmir17cosmir17
committed
fix: add GHCR auth, environments, and update component versions
Add preview/preprod/node-dev-01 environments with configs from midnight-node, update postgres to 17.2, cardano-db-sync to 13.6.0.5, and sync pc-chain-config files.
1 parent 109d5f1 commit 71506d3

File tree

13 files changed

+494
-102
lines changed

13 files changed

+494
-102
lines changed

‎.envrc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,6 @@ export NODE_KEY="$(cat ./midnight-node.privatekey)"
5252
# Partner chains config:
5353
#
5454
export CARDANO_NETWORK=preview
55-
export CARDANO_IMAGE="ghcr.io/intersectmbo/cardano-node:10.2.1"
55+
export CARDANO_IMAGE="ghcr.io/intersectmbo/cardano-node:10.5.3"
5656
export CARDANO_DATA_DIR=./cardano-data
5757
export CARDANO_CONFIG_DIR=./cardano-config/${CARDANO_NETWORK}

‎.envrc.node-dev-01‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# shellcheck shell=bash
2+
# overrides for node-dev-01
3+
export MIDNIGHT_NODE_IMAGE="ghcr.io/midnight-ntwrk/midnight-node:0.18.0-rc.7"
4+
5+
# Well known addresses of network that allow discovery of all other nodes.
6+
# TODO: Update with actual node-dev-01 bootnode addresses
7+
export BOOTNODES="/dns/boot-node.node-dev-01.dev.midnight.network/tcp/30333/ws/p2p/12D3KooWPLACEHOLDER"

‎.envrc.preprod‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# shellcheck shell=bash
2+
# overrides for preprod
3+
export MIDNIGHT_NODE_IMAGE="ghcr.io/midnight-ntwrk/midnight-node:0.18.0-rc.6"
4+
5+
# Well known addresses of network that allow discovery of all other nodes.
6+
# TODO: Update with actual preprod bootnode addresses
7+
export BOOTNODES="/dns/boot-node-7.preprod.midnight.network/tcp/30333/ws/p2p/12D3KooWPLACEHOLDER"

‎.envrc.preview‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# shellcheck shell=bash
2+
# overrides for preview
3+
export MIDNIGHT_NODE_IMAGE="ghcr.io/midnight-ntwrk/midnight-node:0.18.0-rc.7"
4+
5+
# Well known addresses of network that allow discovery of all other nodes.
6+
# TODO: Update with actual preview bootnode addresses
7+
export BOOTNODES="/dns/boot-node-7.previewcluster.preview.midnight.network/tcp/30333/ws/p2p/12D3KooWK66i7dtGVNSwDh9tTeqov1q6LSdWsRLJvTyzTCaywYgK"

‎.envrc.qanet‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# overrides for qanet
2-
export MIDNIGHT_NODE_IMAGE="ghcr.io/midnight-ntwrk/midnight-node:0.12.0-rc.3"
2+
export MIDNIGHT_NODE_IMAGE="ghcr.io/midnight-ntwrk/midnight-node:0.18.0-rc.7"
33

44
# Well known addresses of network that allow discovery of all other nodes.
55
export BOOTNODES="/dns/boot-node-01.qanet.dev.midnight.network/tcp/30333/ws/p2p/12D3KooWEyoppNCUx8Yx66oV9fJnriXwCcXwDDUA2kj6vnc6iDEp \

‎.envrc.testnet-02‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# overrides for testnet-02
2-
export MIDNIGHT_NODE_IMAGE="midnightnetwork/midnight-node:0.12.0"
2+
export MIDNIGHT_NODE_IMAGE="ghcr.io/midnight-ntwrk/midnight-node:0.12.1"
33

44
# These are well known addresses of a network that allow you to discover all the other nodes.
55
export BOOTNODES="/dns/boot-node-01.testnet-02.midnight.network/tcp/30333/ws/p2p/12D3KooWMjUq13USCvQR9Y6yFzYNYgTQBLNAcmc8psAuPx2UUdnB \

‎.github/scan.sh‎

Lines changed: 70 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,22 @@
11
#!/usr/bin/env bash
2+
set -euo pipefail
3+
IFS=$'\n\t'
24

35
source "./.envrc"
46

57
docker compose -f ./compose.yml -f ./compose-partner-chains.yml build
68

79
scan_image() {
8-
local image SAFE_NAME SARIF_FILE
10+
local image SAFE_NAME SARIF_FILE scan_exit_code
911
image="$1"
12+
echo "=========================================="
1013
echo "Scanning $image..."
14+
echo "=========================================="
1115
SAFE_NAME=$(echo "$image" | sed 's/[\/:]/-/g')
1216
SARIF_FILE="${SAFE_NAME}.sarif"
1317

18+
# Run Trivy scan and capture exit code
19+
scan_exit_code=0
1420
time docker run --rm \
1521
-v /var/run/docker.sock:/var/run/docker.sock \
1622
-v trivy-cache:/root/.cache \
@@ -20,17 +26,78 @@ scan_image() {
2026
--ignore-unfixed \
2127
--no-progress \
2228
--output "/output/$SARIF_FILE" \
23-
"$image"
29+
"$image" || scan_exit_code=$?
30+
31+
# Check if scan succeeded and SARIF file was created
32+
if [[ $scan_exit_code -ne 0 ]]; then
33+
echo "::warning::Trivy scan failed for $image (exit code: $scan_exit_code)"
34+
# Create minimal valid SARIF to avoid breaking the upload
35+
cat > "$SARIF_FILE" <<EOF
36+
{
37+
"\$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
38+
"version": "2.1.0",
39+
"runs": [{
40+
"tool": {
41+
"driver": {
42+
"name": "Trivy",
43+
"version": "0.67.2",
44+
"informationUri": "https://github.com/aquasecurity/trivy"
45+
}
46+
},
47+
"results": [],
48+
"automationDetails": {
49+
"id": "trivy/$image",
50+
"description": {"text": "Trivy scan failed for $image - image may not be accessible"}
51+
}
52+
}]
53+
}
54+
EOF
55+
echo "Created placeholder SARIF for failed scan: $SARIF_FILE"
56+
# Record failure but continue
57+
echo "$image" >> /tmp/failed_scans.txt
58+
fi
59+
60+
# Validate SARIF file exists and is valid JSON
61+
if [[ ! -f "$SARIF_FILE" ]]; then
62+
echo "::error::SARIF file not created for $image"
63+
return 1
64+
fi
65+
66+
if ! jq empty "$SARIF_FILE" 2>/dev/null; then
67+
echo "::error::Invalid SARIF JSON for $image"
68+
return 1
69+
fi
70+
71+
# Add automation details and move to scan_reports
2472
jq --arg image "$image" \
2573
'.runs[0].automationDetails = {
2674
id: "trivy/\($image)",
2775
description: {text: "Trivy scan for \($image)"}
2876
}' "$SARIF_FILE" > "./scan_reports/${SARIF_FILE}"
77+
2978
echo "Completed $SARIF_FILE"
3079
}
3180
export -f scan_image
3281

33-
mkdir scan_reports
82+
mkdir -p scan_reports
3483

84+
# Clear any previous failed scans record
85+
rm -f /tmp/failed_scans.txt
86+
87+
# Scan all images from compose config
3588
docker compose -f ./compose.yml -f ./compose-partner-chains.yml config --images | \
3689
xargs -I {} bash -c 'scan_image "$@"' _ {}
90+
91+
# Report summary
92+
echo ""
93+
echo "=========================================="
94+
echo "Scan Summary"
95+
echo "=========================================="
96+
if [[ -f /tmp/failed_scans.txt ]]; then
97+
echo "::warning::The following images failed to scan:"
98+
cat /tmp/failed_scans.txt
99+
echo ""
100+
echo "Placeholder SARIF files were created for failed scans."
101+
else
102+
echo "All images scanned successfully."
103+
fi

‎.github/workflows/scan.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,13 @@ jobs:
4545
name: Build and scan code
4646
runs-on: ubuntu-latest
4747
strategy:
48+
fail-fast: false
4849
matrix:
49-
cfg_preset: ['testnet-02', 'qanet']
50+
cfg_preset: ['testnet-02', 'qanet', 'node-dev-01', 'preview', 'preprod']
5051
permissions:
5152
actions: read
5253
contents: read
54+
packages: read
5355
security-events: write
5456
statuses: write
5557
steps:
@@ -58,6 +60,9 @@ jobs:
5860
with:
5961
fetch-depth: 0
6062

63+
- name: Login to GitHub Container Registry
64+
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
65+
6166
- name: Scan images
6267
env:
6368
CFG_PRESET: ${{ matrix.cfg_preset }}

‎compose-partner-chains.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ services:
3535
- ${CARDANO_DATA_DIR}:/data
3636

3737
postgres:
38-
image: postgres:15.3
38+
image: postgres:17.2
3939
platform: linux/amd64
4040
container_name: db-sync-postgres
4141
environment:
@@ -53,7 +53,7 @@ services:
5353
retries: 5
5454

5555
cardano-db-sync:
56-
image: ghcr.io/intersectmbo/cardano-db-sync:13.6.0.4
56+
image: ghcr.io/intersectmbo/cardano-db-sync:13.6.0.5
5757
platform: linux/amd64
5858
container_name: cardano-db-sync
5959
restart: unless-stopped

‎envs/node-dev-01/pc-chain-config.json‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
{
2+
"bootnodes": [
3+
"/dns/midnight-node-boot-01/tcp/30333/p2p/12D3KooWEyoppNCUx8Yx66oV9fJnriXwCcXwDDUA2kj6vnc6iDEp"
4+
],
5+
"chain_parameters": {
6+
"genesis_utxo": "826fb99b43ab5bad1022f78774038d4c0f8f588d4c0a538f357a57fc2cb667ec#0"
7+
},
8+
"initial_governance": {
9+
"authorities": [
10+
"0x5eb21f015fbc7e6025a6518f953a221d79907e97712f31a469585216"
11+
],
12+
"threshold": 1
13+
},
14+
"cardano": {
15+
"security_parameter": 432,
16+
"active_slots_coeff": 0.05,
17+
"first_epoch_number": 0,
18+
"first_slot_number": 0,
19+
"epoch_duration_millis": 86400000,
20+
"first_epoch_timestamp_millis": 1666656000000,
21+
"slot_duration_millis": 1000
22+
},
23+
"cardano_addresses": {
24+
"committee_candidates_address": "addr_test1wrahchgp7x6l8c3lamt4egk7dcwhjdvz3npdwq8mz4q9tecylsqww",
25+
"d_parameter_policy_id": "0x907345b2b1e61424d83af0d0d3b32de8d67882fcb1a6d45f28a8714c",
26+
"permissioned_candidates_policy_id": "0xf06e34dcab3daedbe041cd8586c3e8555e7350f9c5cef1980d3365c3",
27+
"bridge": {
28+
"illiquid_circulation_supply_validator_address": "addr_test1wzue5jtnfjqg6adr25d9vsjnqm3hhnpdgam5tfm0e3qqpdce0appd",
29+
"asset": {
30+
"policy_id": "0x00000000000000000000000000000000000000000000000000000000",
31+
"asset_name": "0x"
32+
}
33+
},
34+
"governed_map": {
35+
"validator_address": "addr_test1wr7faeyz8mqekzcppspsrs5y6rdlnfnllt8l0cpfs6m9gng78tg6z",
36+
"policy_id": "0x9d3a19404df5a19fc1d58bd6d924c4bac3ad1fba48b85fc0a43ba789"
37+
}
38+
},
39+
"initial_permissioned_candidates": [
40+
{
41+
"sidechain_pub_key": "0x020a617391de0e0291310bf7792bb41d9573e8a054b686205da5553e08fac6d0b8",
42+
"aura_pub_key": "0x1254f7017f0b8347ce7ab14f96d818802e7e9e0c0d1b7c9acb3c726b080e7a03",
43+
"grandpa_pub_key": "0x5079bcd20fd97d7d2f752c4607012600b401950260a91821f73e692071c82bf5",
44+
"beefy_pub_key": "0x020a617391de0e0291310bf7792bb41d9573e8a054b686205da5553e08fac6d0b8"
45+
},
46+
{
47+
"sidechain_pub_key": "0x0287aa09f21089003413b37602a3f6909f8695901c70a28175cafd99d5976a202a",
48+
"aura_pub_key": "0xb0521e374b0586d6829dad320753c62cdc6ef5edbd37ffdd36da0ae97c521819",
49+
"grandpa_pub_key": "0x3f7f2fc8829c649501a0fb72a79abf885aa89e6c4ee2d00c6041dfa85e320980",
50+
"beefy_pub_key": "0x0287aa09f21089003413b37602a3f6909f8695901c70a28175cafd99d5976a202a"
51+
},
52+
{
53+
"sidechain_pub_key": "0x0291f1217d5a04cb83312ee3d88a6e6b33284e053e6ccfc3a90339a0299d12967c",
54+
"aura_pub_key": "0x1cbd2d43530a44705ad088af313e18f80b53ef16b36177cd4b77b846f2a5f07c",
55+
"grandpa_pub_key": "0x568cb4a574c6d178feb39c27dfc8b3f789e5f5423e19c71633c748b9acf086b5",
56+
"beefy_pub_key": "0x0291f1217d5a04cb83312ee3d88a6e6b33284e053e6ccfc3a90339a0299d12967c"
57+
},
58+
{
59+
"sidechain_pub_key": "0x02b8beaa492309f2332dd5445e20b8f74e26336c226daecf63cc4cd95a1ef3b140",
60+
"aura_pub_key": "0x4017e17f10cc5a98731de9f020dbb37986f6e575789152d7fadae2b32eea6c13",
61+
"grandpa_pub_key": "0x98bf054a827193b21d7127e4ee53ba9a4992aa09c0acced93cf5ca5da1ff7468",
62+
"beefy_pub_key": "0x02b8beaa492309f2332dd5445e20b8f74e26336c226daecf63cc4cd95a1ef3b140"
63+
},
64+
{
65+
"sidechain_pub_key": "0x031d10105e323c4afce225208f71a6441ee327a65b9e646e772500c74d31f669aa",
66+
"aura_pub_key": "0xe659a7a1628cdd93febc04a4e0646ea20e9f5f0ce097d9a05290d4a9e054df4e",
67+
"grandpa_pub_key": "0x1dfe3e22cc0d45c70779c1095f7489a8ef3cf52d62fbd8c2fa38c9f1723502b5",
68+
"beefy_pub_key": "0x031d10105e323c4afce225208f71a6441ee327a65b9e646e772500c74d31f669aa"
69+
},
70+
{
71+
"sidechain_pub_key": "0x035d35454a9671ccf959def176822d38e9e9aa5bbcfe50a7cbe69834dde9147ce5",
72+
"aura_pub_key": "0x1880104772db7b947f3f8ccdcab3650d7179c44551d22dd0cca5dc852a140563",
73+
"grandpa_pub_key": "0x11e6cb467a7528e861732c473b3a66c6701f38d35b894da8a1337f68708aa0eb",
74+
"beefy_pub_key": "0x035d35454a9671ccf959def176822d38e9e9aa5bbcfe50a7cbe69834dde9147ce5"
75+
},
76+
{
77+
"sidechain_pub_key": "0x036c6ae73d36d0c02b54d7877a57b1734b8e096134bd2c1b829431aa38f18bcce1",
78+
"aura_pub_key": "0xac859f8a216eeb1b320b4c76d118da3d7407fa523484d0a980126d3b4d0d220a",
79+
"grandpa_pub_key": "0x16f97016bbea8f7b45ae6757b49efc1080accc175d8f018f9ba719b60b0815e4",
80+
"beefy_pub_key": "0x036c6ae73d36d0c02b54d7877a57b1734b8e096134bd2c1b829431aa38f18bcce1"
81+
},
82+
{
83+
"sidechain_pub_key": "0x0389411795514af1627765eceffcbd002719f031604fadd7d188e2dc585b4e1afb",
84+
"aura_pub_key": "0x90b5ab205c6974c9ea841be688864633dc9ca8a357843eeacf2314649965fe22",
85+
"grandpa_pub_key": "0x439660b36c6c03afafca027b910b4fecf99801834c62a5e6006f27d978de234f",
86+
"beefy_pub_key": "0x0389411795514af1627765eceffcbd002719f031604fadd7d188e2dc585b4e1afb"
87+
},
88+
{
89+
"sidechain_pub_key": "0x0390084fdbf27d2b79d26a4f13f0ccd982cb755a661969143c37cbc49ef5b91f27",
90+
"aura_pub_key": "0x8eaf04151687736326c9fea17e25fc5287613693c912909cb226aa4794f26a48",
91+
"grandpa_pub_key": "0xd17c2d7823ebf260fd138f2d7e27d114c0145d968b5ff5006125f2414fadae69",
92+
"beefy_pub_key": "0x0390084fdbf27d2b79d26a4f13f0ccd982cb755a661969143c37cbc49ef5b91f27"
93+
}
94+
]
95+
}
96+

0 commit comments

Comments
 (0)