Skip to content

feat: update CI, etc #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
k-matsuzawa merged 1 commit into from
Nov 26, 2025
Merged

feat: update CI, etc #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,7 @@ updates:
- '.github/**/*'
schedule:
interval: weekly
groups:
dependencies:
patterns:
- "*"
2 changes: 1 addition & 1 deletion .github/workflows/create-docker-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ env:

jobs:
upload-image:
runs-on: ubuntu-22.04
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read
Expand Down
16 changes: 13 additions & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM --platform=$TARGETPLATFORM python:3.11.3-slim-bullseye
FROM --platform=$TARGETPLATFORM python:3.11.14-slim-bookworm

# NOTE: nodedir has used by cmake-js.
RUN mkdir /var/.npm \
Expand Down Expand Up @@ -31,11 +31,11 @@
RUN python -V && node -v && npm -v

WORKDIR /tmp
ENV GPG_KEY_SERVER hkps://keyserver.ubuntu.com

Check warning on line 34 in Dockerfile

View workflow job for this annotation

GitHub Actions / upload-image

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "GPG_KEY_SERVER")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 34 in Dockerfile

View workflow job for this annotation

GitHub Actions / upload-image

Legacy key/value format with whitespace separator should not be used 

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format
More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/
# setup bitcoin
ARG BITCOIN_VERSION=24.1
ENV BITCOIN_URL_BASE https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}
ENV BITCOIN_PGP_KEY 152812300785C96444D3334D17565732E08E5E41 0AD83877C1F0CD1EE9BD660AD7CC770B81FD22A8 590B7292695AFFA5B672CBB2E13FC145CD3F4304 28F5900B1BB5D1A4B6B6D1A9ED357015286A333D 637DB1E23370F84AFF88CCE03152347D07DA627C CFB16E21C950F67FA95E558F2EEB9F5CC09526C1 F4FC70F07310028424EFC20A8E4256593F177720 D1DBF2C4B96F2DEBF4C16654410108112E7EA81F 287AE4CA1187C68C08B49CB2D11BD4F33F1DB499 F9A8737BF4FF5C89C903DF31DD78544CF91B1514 9DEAE0DC7063249FB05474681E4AED62986CD25D E463A93F5F3117EEDE6C7316BD02942421F4889F 9D3CC86A72F8494342EA5FD10A41BDC3F4FAFF1C 4DAF18FE948E7A965B30F9457E296D555E7F63A7 28E72909F1717FE9607754F8A7BEB2621678D37D 74E2DEF5D77260B98BC19438099BAD163C70FBFA

Check warning on line 38 in Dockerfile

View workflow job for this annotation

GitHub Actions / upload-image

Legacy key/value format with whitespace separator should not be used 

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format
More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/
RUN ARCH=`uname -m` \
&& echo "ARCH=$ARCH" \
&& if test "$ARCH" = "aarch64" || test "$ARCH" = "arm64"; then \
Expand All @@ -53,23 +53,29 @@
&& gpg --verify SHA256SUMS.asc 2>&1 | grep "using ECDSA key" | tr -s ' ' | cut -d ' ' -f5 \
&& echo "dump key" \
&& gpg --verify SHA256SUMS.asc 2>&1 | grep "using " | tr -s ' ' | cut -d ' ' -f5 \
&& echo "gpg keyserver 1" \
&& gpg -v --keyserver ${GPG_KEY_SERVER} --recv-keys ${BITCOIN_PGP_KEY} \
&& echo "gpg keyserver 2" \
&& gpg -v --keyserver hkps://keys.openpgp.org --recv-keys 82921A4B88FD454B7EB8CE3C796C4109063D4EAF \
&& gpg -v --keyserver hkps://keys.openpgp.org --recv-keys C388F6961FB972A95678E327F62711DBDCA8AE56 \
&& echo "verify checksum" \
&& sha256sum --ignore-missing --check SHA256SUMS \
&& tar -xzvf ${BITCOIN_TARBALL} --directory=/opt/ \
&& ln -sfn /opt/bitcoin-${BITCOIN_VERSION}/bin/* /usr/bin \
&& rm -f ${BITCOIN_TARBALL} SHA256SUMS.asc

#20220427: ignore gpg verify (for C388F6961FB972A95678E327F62711DBDCA8AE56)
# 20220427: ignore gpg verify (for C388F6961FB972A95678E327F62711DBDCA8AE56)
# && gpg --verify -v SHA256SUMS.asc \
# && sha256sum --ignore-missing --check SHA256SUMS \

# 20251126: ignore import key
# && echo "gpg keyserver 3" \
# && gpg -v --keyserver hkps://keys.openpgp.org --recv-keys C388F6961FB972A95678E327F62711DBDCA8AE56 \


# setup elements
ARG ELEMENTS_VERSION=22.1.1
ENV ELEMENTS_URL_BASE https://github.com/ElementsProject/elements/releases/download/elements-${ELEMENTS_VERSION}

Check warning on line 77 in Dockerfile

View workflow job for this annotation

GitHub Actions / upload-image

Legacy key/value format with whitespace separator should not be used 

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format
More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/
ENV ELEMENTS_PGP_KEY DE10E82629A8CAD55B700B972F2A88D7F8D68E87 BD0F3062F87842410B06A0432F656B0610604482

Check warning on line 78 in Dockerfile

View workflow job for this annotation

GitHub Actions / upload-image

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "ELEMENTS_PGP_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
RUN ARCH=`uname -m` \
&& echo "ARCH=$ARCH" \
&& if test "$ARCH" = "aarch64" || test "$ARCH" = "arm64"; then \
Expand All @@ -81,7 +87,9 @@
&& wget -qO ${ELEMENTS_TARBALL} ${ELEMENTS_URL_BASE}/${ELEMENTS_TARBALL} \
&& gpg -v --keyserver ${GPG_KEY_SERVER} --recv-keys ${ELEMENTS_PGP_KEY} \
&& wget -qO SHA256SUMS.asc ${ELEMENTS_URL_BASE}/SHA256SUMS.asc \
&& echo "verify gpg" \
&& gpg --verify SHA256SUMS.asc \
&& echo "verify checksum" \
&& sha256sum --ignore-missing --check SHA256SUMS.asc \
&& tar -xzvf ${ELEMENTS_TARBALL} --directory=/opt/ \
&& ln -sfn /opt/elements-${ELEMENTS_VERSION}/bin/* /usr/bin \
Expand All @@ -93,8 +101,8 @@

# setup cmake
ENV CMAKE_VERSION 3.26.4
ENV CMAKE_URL_BASE https://github.com/Kitware/CMake/releases/download/v${CMAKE_VERSION}

Check warning on line 104 in Dockerfile

View workflow job for this annotation

GitHub Actions / upload-image

Legacy key/value format with whitespace separator should not be used 

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format
More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/
ENV CMAKE_PGP_KEY 2D2CEF1034921684

Check warning on line 105 in Dockerfile

View workflow job for this annotation

GitHub Actions / upload-image

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "CMAKE_PGP_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check warning on line 105 in Dockerfile

View workflow job for this annotation

GitHub Actions / upload-image

Legacy key/value format with whitespace separator should not be used 

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format
More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/
RUN ARCH=`uname -m` \
&& echo "ARCH=$ARCH" \
&& if test "$ARCH" = "aarch64" || test "$ARCH" = "arm64"; then \
Expand All @@ -109,7 +117,9 @@
&& gpg --keyserver ${GPG_KEY_SERVER} --recv-keys ${CMAKE_PGP_KEY} \
&& wget -qO cmake-SHA-256.txt ${CMAKE_URL_BASE}/cmake-${CMAKE_VERSION}-SHA-256.txt \
&& wget -qO cmake-SHA-256.txt.asc ${CMAKE_URL_BASE}/cmake-${CMAKE_VERSION}-SHA-256.txt.asc \
&& echo "verify gpg" \
&& gpg --verify cmake-SHA-256.txt.asc \
&& echo "verify checksum" \
&& sha256sum --ignore-missing --check cmake-SHA-256.txt \
&& tar -xzvf ${CMAKE_TARBALL} --directory=/opt/ \
&& mv /opt/${CMAKE_DIR_NAME} /opt/cmake-${CMAKE_VERSION}-linux \
Expand All @@ -121,7 +131,7 @@
COPY ./script/check.sh /usr/local/bin/check.sh
RUN chmod +x /usr/local/bin/check.sh

ENV USER_NAME testuser

Check warning on line 134 in Dockerfile

View workflow job for this annotation

GitHub Actions / upload-image

Legacy key/value format with whitespace separator should not be used 

LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format
More info: https://docs.docker.com/go/dockerfile/rule/legacy-key-value-format/
RUN useradd --user-group --create-home --shell /bin/false ${USER_NAME} \
&& mkdir /github \
&& mkdir /workspace \
Expand All @@ -142,7 +152,7 @@

RUN cmake --version

CMD bitcoin-cli --version && elements-cli --version \

Check warning on line 155 in Dockerfile

View workflow job for this annotation

GitHub Actions / upload-image

JSON arguments recommended for ENTRYPOINT/CMD to prevent unintended behavior related to OS signals 

JSONArgsRecommended: JSON arguments recommended for CMD to prevent unintended behavior related to OS signals
More info: https://docs.docker.com/go/dockerfile/rule/json-args-recommended/
&& python -V && echo "node version" && node -v && echo "npm version" && npm -v \
&& cmake --version && env

Expand Down
10 changes: 5 additions & 5 deletions Taskfile.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@ tasks:
- task: :hadolint
gha-lint:
vars:
PINACT_VERSION: v2.2.1
ACTIONLINT_VERSION: v1.7.7
GHALINT_VERSION: v1.3.0
PINACT_VERSION: v3.4.4
ACTIONLINT_VERSION: v1.7.8
GHALINT_VERSION: v1.5.3
cmds:
- go run github.com/suzuki-shunsuke/pinact/v2/cmd/pinact@{{.PINACT_VERSION}} run
- go run github.com/suzuki-shunsuke/pinact/v3/cmd/pinact@{{.PINACT_VERSION}} run
- go run github.com/rhysd/actionlint/cmd/actionlint@{{.ACTIONLINT_VERSION}}
- go run github.com/suzuki-shunsuke/ghalint/cmd/ghalint@{{.GHALINT_VERSION}} run
hadolint:
Expand All @@ -19,6 +19,6 @@ tasks:
- docker run --rm -i -v {{.TASK_DIR}}/.hadolint.yml:/.config/hadolint.yaml ghcr.io/hadolint/hadolint < arm64.dockerfile
format:
vars:
YAMLFMT_VERSION: v0.15.0
YAMLFMT_VERSION: v0.20.0
cmds:
- go run github.com/google/yamlfmt/cmd/yamlfmt@{{.YAMLFMT_VERSION}}
14 changes: 12 additions & 2 deletions amd64.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM python:3.11.3-slim-bullseye
FROM python:3.11.14-slim-bookworm

# NOTE: nodedir has used by cmake-js.
RUN mkdir /var/.npm \
Expand Down Expand Up @@ -48,9 +48,11 @@ RUN BITCOIN_TARBALL=bitcoin-${BITCOIN_VERSION}-x86_64-linux-gnu.tar.gz \
&& gpg --verify SHA256SUMS.asc 2>&1 | grep "using ECDSA key" | tr -s ' ' | cut -d ' ' -f5 \
&& echo "dump key" \
&& gpg --verify SHA256SUMS.asc 2>&1 | grep "using " | tr -s ' ' | cut -d ' ' -f5 \
&& echo "gpg keyserver 1" \
&& gpg -v --keyserver ${GPG_KEY_SERVER} --recv-keys ${BITCOIN_PGP_KEY} \
&& echo "gpg keyserver 2" \
&& gpg -v --keyserver hkps://keys.openpgp.org --recv-keys 82921A4B88FD454B7EB8CE3C796C4109063D4EAF \
&& gpg -v --keyserver hkps://keys.openpgp.org --recv-keys C388F6961FB972A95678E327F62711DBDCA8AE56 \
&& echo "verify checksum" \
&& sha256sum --ignore-missing --check SHA256SUMS \
&& tar -xzvf ${BITCOIN_TARBALL} --directory=/opt/ \
&& ln -sfn /opt/bitcoin-${BITCOIN_VERSION}/bin/* /usr/bin \
Expand All @@ -60,6 +62,10 @@ RUN BITCOIN_TARBALL=bitcoin-${BITCOIN_VERSION}-x86_64-linux-gnu.tar.gz \
# && gpg --verify -v SHA256SUMS.asc \
# && sha256sum --ignore-missing --check SHA256SUMS \

# 20251126: ignore import key
# && echo "gpg keyserver 3" \
# && gpg -v --keyserver hkps://keys.openpgp.org --recv-keys C388F6961FB972A95678E327F62711DBDCA8AE56 \


# setup elements
ARG ELEMENTS_VERSION=22.1.1
Expand All @@ -70,7 +76,9 @@ RUN ELEMENTS_TARBALL=elements-${ELEMENTS_VERSION}-x86_64-linux-gnu.tar.gz \
&& wget -qO ${ELEMENTS_TARBALL} ${ELEMENTS_URL_BASE}/${ELEMENTS_TARBALL} \
&& gpg -v --keyserver ${GPG_KEY_SERVER} --recv-keys ${ELEMENTS_PGP_KEY} \
&& wget -qO SHA256SUMS.asc ${ELEMENTS_URL_BASE}/SHA256SUMS.asc \
&& echo "verify gpg" \
&& gpg --verify SHA256SUMS.asc \
&& echo "verify checksum" \
&& sha256sum --ignore-missing --check SHA256SUMS.asc \
&& tar -xzvf ${ELEMENTS_TARBALL} --directory=/opt/ \
&& ln -sfn /opt/elements-${ELEMENTS_VERSION}/bin/* /usr/bin \
Expand All @@ -90,7 +98,9 @@ RUN CMAKE_TARBALL=cmake-${CMAKE_VERSION}-linux-x86_64.tar.gz \
&& gpg --keyserver ${GPG_KEY_SERVER} --recv-keys ${CMAKE_PGP_KEY} \
&& wget -qO cmake-SHA-256.txt ${CMAKE_URL_BASE}/cmake-${CMAKE_VERSION}-SHA-256.txt \
&& wget -qO cmake-SHA-256.txt.asc ${CMAKE_URL_BASE}/cmake-${CMAKE_VERSION}-SHA-256.txt.asc \
&& echo "verify gpg" \
&& gpg --verify cmake-SHA-256.txt.asc \
&& echo "verify checksum" \
&& sha256sum --ignore-missing --check cmake-SHA-256.txt \
&& tar -xzvf ${CMAKE_TARBALL} --directory=/opt/ \
&& ln -sfn /opt/cmake-${CMAKE_VERSION}-linux-x86_64/bin/* /usr/bin \
Expand Down
14 changes: 12 additions & 2 deletions arm64.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM python:3.11.3-slim-bullseye
FROM python:3.11.14-slim-bookworm

# NOTE: nodedir has used by cmake-js.
RUN mkdir /var/.npm \
Expand Down Expand Up @@ -48,9 +48,11 @@ RUN BITCOIN_TARBALL=bitcoin-${BITCOIN_VERSION}-aarch64-linux-gnu.tar.gz \
&& gpg --verify SHA256SUMS.asc 2>&1 | grep "using ECDSA key" | tr -s ' ' | cut -d ' ' -f5 \
&& echo "dump key" \
&& gpg --verify SHA256SUMS.asc 2>&1 | grep "using " | tr -s ' ' | cut -d ' ' -f5 \
&& echo "gpg keyserver 1" \
&& gpg -v --keyserver ${GPG_KEY_SERVER} --recv-keys ${BITCOIN_PGP_KEY} \
&& echo "gpg keyserver 2" \
&& gpg -v --keyserver hkps://keys.openpgp.org --recv-keys 82921A4B88FD454B7EB8CE3C796C4109063D4EAF \
&& gpg -v --keyserver hkps://keys.openpgp.org --recv-keys C388F6961FB972A95678E327F62711DBDCA8AE56 \
&& echo "verify checksum" \
&& sha256sum --ignore-missing --check SHA256SUMS \
&& tar -xzvf ${BITCOIN_TARBALL} --directory=/opt/ \
&& ln -sfn /opt/bitcoin-${BITCOIN_VERSION}/bin/* /usr/bin \
Expand All @@ -60,6 +62,10 @@ RUN BITCOIN_TARBALL=bitcoin-${BITCOIN_VERSION}-aarch64-linux-gnu.tar.gz \
# && gpg --verify -v SHA256SUMS.asc \
# && sha256sum --ignore-missing --check SHA256SUMS \

# 20251126: ignore import key
# && echo "gpg keyserver 3" \
# && gpg -v --keyserver hkps://keys.openpgp.org --recv-keys C388F6961FB972A95678E327F62711DBDCA8AE56 \


# setup elements
ARG ELEMENTS_VERSION=22.1.1
Expand All @@ -70,7 +76,9 @@ RUN ELEMENTS_TARBALL=elements-${ELEMENTS_VERSION}-aarch64-linux-gnu.tar.gz \
&& wget -qO ${ELEMENTS_TARBALL} ${ELEMENTS_URL_BASE}/${ELEMENTS_TARBALL} \
&& gpg -v --keyserver ${GPG_KEY_SERVER} --recv-keys ${ELEMENTS_PGP_KEY} \
&& wget -qO SHA256SUMS.asc ${ELEMENTS_URL_BASE}/SHA256SUMS.asc \
&& echo "verify gpg" \
&& gpg --verify SHA256SUMS.asc \
&& echo "verify checksum" \
&& sha256sum --ignore-missing --check SHA256SUMS.asc \
&& tar -xzvf ${ELEMENTS_TARBALL} --directory=/opt/ \
&& ln -sfn /opt/elements-${ELEMENTS_VERSION}/bin/* /usr/bin \
Expand All @@ -90,7 +98,9 @@ RUN CMAKE_TARBALL=cmake-${CMAKE_VERSION}-linux-aarch64.tar.gz \
&& gpg --keyserver ${GPG_KEY_SERVER} --recv-keys ${CMAKE_PGP_KEY} \
&& wget -qO cmake-SHA-256.txt ${CMAKE_URL_BASE}/cmake-${CMAKE_VERSION}-SHA-256.txt \
&& wget -qO cmake-SHA-256.txt.asc ${CMAKE_URL_BASE}/cmake-${CMAKE_VERSION}-SHA-256.txt.asc \
&& echo "verify gpg" \
&& gpg --verify cmake-SHA-256.txt.asc \
&& echo "verify checksum" \
&& sha256sum --ignore-missing --check cmake-SHA-256.txt \
&& tar -xzvf ${CMAKE_TARBALL} --directory=/opt/ \
&& ln -sfn /opt/cmake-${CMAKE_VERSION}-linux-aarch64/bin/* /usr/bin \
Expand Down