Track SDK releases instead of a commit pin

.github/workflows/auto_check.yml

@@ -0,0 +1,14 @@
+name: Bump upstream version
+
+on:
+  schedule:
+    - cron: "00 */4 * * *"
+  workflow_dispatch:
+  push:
+    branches:
+      - "main"
+
+jobs:
+  bump-upstream:
+    uses: dappnode/workflows/.github/workflows/bump-upstream.yml@master
+    secrets: inherit

.github/workflows/main.yml

@@ -15,14 +15,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - run: npx @dappnode/dappnodesdk build --skip_save
-        env:
-          # Read access to the private dappnode-nexus-sdk repository. The
-          # default GITHUB_TOKEN is scoped to this repository only and cannot
-          # fetch the proxy source.
-          NEXUS_SDK_TOKEN: ${{ secrets.NEXUS_SDK_TOKEN }}
 
   release:
     name: Release
+    needs: build-test
     runs-on: ubuntu-latest
     if: github.event_name == 'push' || github.event_name == 'repository_dispatch'
     steps:
@@ -31,5 +27,4 @@ jobs:
         run: npx @dappnode/dappnodesdk publish patch --dappnode_team_preset --timeout 2h
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NEXUS_SDK_TOKEN: ${{ secrets.NEXUS_SDK_TOKEN }}
           DEVELOPER_ADDRESS: "0xf35960302a07022aba880dffaec2fdd64d5bf1c1"

Dockerfile

@@ -7,23 +7,15 @@ FROM ${GO_IMAGE} AS build
 
 ARG UPSTREAM_VERSION
 RUN test -n "${UPSTREAM_VERSION}" \
-    && test "$(printf '%s' "${UPSTREAM_VERSION}" | wc -c)" -eq 40 \
-    && printf '%s' "${UPSTREAM_VERSION}" | grep -Eq '^[0-9a-f]{40}$'
+    && printf '%s' "${UPSTREAM_VERSION}" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'
 
 RUN apk add --no-cache ca-certificates git
 
 WORKDIR /src
 RUN git init \
     && git remote add origin https://github.com/dappnode/dappnode-nexus-sdk.git
-RUN --mount=type=secret,id=github_token \
-    if test -s /run/secrets/github_token; then \
-      auth_header="$(printf 'x-access-token:%s' "$(cat /run/secrets/github_token)" | base64 | tr -d '\n')"; \
-      git -c http.extraHeader="Authorization: Basic ${auth_header}" fetch --depth=1 origin "${UPSTREAM_VERSION}"; \
-    else \
-      git fetch --depth=1 origin "${UPSTREAM_VERSION}"; \
-    fi \
-    && git checkout --detach FETCH_HEAD \
-    && test "$(git rev-parse HEAD)" = "${UPSTREAM_VERSION}"
+RUN git fetch --depth=1 origin "refs/tags/${UPSTREAM_VERSION}" \
+    && git checkout --detach FETCH_HEAD
 
 RUN go mod download \
     && go mod verify \

dappnode_package.json

@@ -1,7 +1,7 @@
 {
   "name": "nexus-proxy.dnp.dappnode.eth",
   "version": "0.1.0",
-  "upstreamVersion": "219977388b9f26435c2529fc1cd52ff7229e5397",
+  "upstreamVersion": "v0.1.0",
   "upstreamRepo": "dappnode/dappnode-nexus-sdk",
   "upstreamArg": "UPSTREAM_VERSION",
   "shortDescription": "Keep your Nexus prompts private, and verify it yourself",

docker-compose.yml

@@ -6,9 +6,7 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        UPSTREAM_VERSION: 219977388b9f26435c2529fc1cd52ff7229e5397
-      secrets:
-        - github_token
+        UPSTREAM_VERSION: v0.1.0
     image: nexus-proxy.dnp.dappnode.eth:0.1.0
     container_name: DAppNodeCore-nexus-proxy.dnp.dappnode.eth
     restart: unless-stopped
@@ -49,7 +47,3 @@ services:
 
 volumes:
   verification_state: {}
-
-secrets:
-  github_token:
-    environment: NEXUS_SDK_TOKEN