Track SDK releases instead of a commit pin - #19
Merged
Merged
Conversation
The pin was not protecting anything. Nothing measures or attests the proxy image -- there is no PCR for it, no verify-build script, no point at which anyone checks the running binary against source. The package is trusted because Dappnode publishes it onchain, and both repositories are open source. So the pin bought a provenance record, at the cost of a PR for every SDK change, and the SDK has changed ten times since 17 August. CI now resolves dappnode-nexus-sdk main to a commit and stamps it into the manifest and compose before building. The record survives -- the published package still says exactly which SDK source went into it -- but it is an output rather than something a human copies. Nothing about the build gets weaker. The Dockerfile still demands a full 40-character SHA and re-checks it after fetching, so the build stays content-addressed; only who supplies the value changed. Base images were already pinned by digest. Two things fall out of it: - The NEXUS_SDK_TOKEN machinery goes. dappnode-nexus-sdk is public, the workflow no longer passes the secret, and leaving a dead secret mount in the Dockerfile and compose would just be confusing. This supersedes #14. - The release job gains `needs: build-test`. It had none, so a failing build test did not stop a publish -- open since the 24 August session notes. Verified: the script resolves main, stamps both files, and the image builds from the result with no credentials. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Replaces the hand-maintained SHA with the pattern every other Dappnode package already uses: upstreamVersion names an upstream release, and the bump bot opens the PR. Hermes tracks NousResearch/hermes-agent exactly this way. The SDK had nothing to point at, which is the only reason a SHA was there in the first place; dappnode/dappnode-nexus-sdk#11 makes it cut a release on every merge to main. - upstreamVersion becomes v0.1.0 and the Dockerfile takes a release tag, validating the shape and fetching refs/tags/. - auto_check.yml calls dappnode/workflows bump-upstream, same as Hermes, so a new SDK release arrives as a PR rather than someone noticing. - NEXUS_SDK_TOKEN goes: the SDK is public, so the secret mount in the Dockerfile, the compose secrets block and both workflow env entries were all dead. Supersedes #14. - The release job gains needs: build-test. It had none, so a failing build test did not stop a publish. Open since the 24 August notes. Verified: the tag shape check accepts v0.1.0 and rejects a SHA, a bare branch name and a two-part version; fetching refs/tags/ resolves against a repository that has tags; manifest and compose pass dappmanager validation. The image itself cannot build until the first SDK release exists. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Marketen
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+13
to
+14
| uses: dappnode/workflows/.github/workflows/bump-upstream.yml@master | ||
| secrets: inherit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
upstreamVersionshould name an SDK release, the way every other Dappnode package names its upstream. Hermes tracksNousResearch/hermes-agentatv2026.7.20andtropibotopens the bump PR; there is no reason this package should be different.It carried a commit SHA only because the SDK had no releases to point at. dappnode/dappnode-nexus-sdk#11 fixes that end — a release on every merge to main.
What changes
upstreamVersion219977388b9f…(40-char SHA, hand-edited)v0.1.0vX.Y.Z, fetchesrefs/tags/auto_check.yml→dappnode/workflowsbump-upstreamAlso in here
NEXUS_SDK_TOKENgoes. The SDK is public, so the secret mount in the Dockerfile, thesecrets:block in compose and both workflow env entries were dead. Supersedes Use the public Nexus SDK without repository credentials #14, blocked since 2 September because back then the SDK was still private.needs: build-teston the release job. It had none, so a failing build test did not stop a publish — open since the 24 August session notes.Verified
v0.1.0, rejects a SHA, a bare branch name andv1.2git fetch --depth=1 origin refs/tags/<tag>resolves correctly against a repository that has tagsThe image cannot build until the first SDK release exists, so merge dappnode/dappnode-nexus-sdk#11 first.
Ordering
v0.1.0🤖 Generated with Claude Code