Skip to content

feat(docker): bake git provenance into image via build-args + export from docker-run #866

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tcsenpai merged 1 commit into from
May 26, 2026
Merged

feat(docker): bake git provenance into image via build-args + export from docker-run #866

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,11 +178,27 @@ RUN chmod 0755 /app/scripts/docker-entrypoint.sh \
&& chown demos:demos /app /app/data /app/logs /app/state \
&& chmod 0755 /app /app/data /app/logs /app/state

# Build-time provenance. These ARGs are populated by the build driver
# (compose passes `git rev-parse HEAD` + `git rev-parse --abbrev-ref HEAD`
# + `git diff --quiet; echo $?` + an ISO timestamp). They land in the
# image as ENV so `process.env.GIT_COMMIT` etc. resolve from
# `src/utilities/nodeVersion.ts` without shipping `.git/` into the runtime
# layer. Missing values fall through to the module's null defaults — the
# node never panics on absence.
ARG GIT_COMMIT=
ARG GIT_BRANCH=
ARG GIT_DIRTY=false
ARG BUILT_AT=

# Sensible image-level defaults. Anything else (DATABASE_URL, EXPOSED_URL,
# IDENTITY_FILE, PEER_LIST_FILE, etc.) must be supplied at runtime.
ENV NODE_ENV=production \
RPC_PORT=53550 \
METRICS_HOST=0.0.0.0
METRICS_HOST=0.0.0.0 \
GIT_COMMIT=$GIT_COMMIT \
GIT_BRANCH=$GIT_BRANCH \
GIT_DIRTY=$GIT_DIRTY \
BUILT_AT=$BUILT_AT

# Exposed services:
# 53550 - RPC (HTTP/JSON-RPC)
Expand Down
10 changes: 10 additions & 0 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,16 @@ services:
build:
context: .
dockerfile: Dockerfile
# Build-time provenance. Compose interpolates these from the
# host's git + shell at `docker compose build` time. The wrapper
# script `./scripts/docker-run` (and CI) export them; manual
# invocations also work because every variable has a sensible
# `:-` default so an unset host falls back gracefully.
args:
GIT_COMMIT: ${GIT_COMMIT:-}
GIT_BRANCH: ${GIT_BRANCH:-}
GIT_DIRTY: ${GIT_DIRTY:-false}
BUILT_AT: ${BUILT_AT:-}
container_name: demos-node
restart: unless-stopped
depends_on:
Expand Down
18 changes: 18 additions & 0 deletions scripts/docker-run
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,24 @@ fi
COMPOSE_ARGS=(-f docker-compose.yml)
PROFILES=()

# Export build-time git provenance so `docker compose build` can bake it
# into the image (consumed by src/utilities/nodeVersion.ts and surfaced
# via getNetworkInfo.nodeVersion). Every var has a safe empty default
# so a host without git, or a non-repo working tree, still builds.
# `git diff-index --quiet HEAD` exits 1 when dirty, 0 when clean; map
# to a "true"/"false" string the node module understands.
if git -C "$(dirname "${BASH_SOURCE[0]}")/.." rev-parse --git-dir >/dev/null 2>&1; then
GIT_REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
export GIT_COMMIT="$(git -C "$GIT_REPO_DIR" rev-parse HEAD 2>/dev/null || true)"
export GIT_BRANCH="$(git -C "$GIT_REPO_DIR" rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
Copy link
Copy Markdown

@greptile-apps greptile-apps Bot May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Detached HEAD produces "HEAD" as branch name in API output

git rev-parse --abbrev-ref HEAD returns the literal string "HEAD" when the repo is in a detached HEAD state — which is the norm for GitHub Actions, GitLab CI, and most CI/CD checkouts for PRs or tag builds. That string passes the || null guard in nodeVersion.ts ("HEAD" is truthy), so the getNetworkInfo response surfaces "branch": "HEAD" instead of null, which is indistinguishable from an actual branch named HEAD and offers no useful diagnostic info. Consider filtering the value before export: [[ "$GIT_BRANCH" == "HEAD" ]] && unset GIT_BRANCH (or export empty string) to let the module fall through to null.

if git -C "$GIT_REPO_DIR" diff-index --quiet HEAD 2>/dev/null; then
export GIT_DIRTY="false"
else
export GIT_DIRTY="true"
fi
fi
Comment on lines +138 to +147
Copy link
Copy Markdown

@greptile-apps greptile-apps Bot May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 The block recomputes the repository root using ${BASH_SOURCE[0]} when REPO_ROOT has already been resolved to the exact same path (via $0) at line 52 of the script. The two expansions resolve identically for a directly-executed script. Using REPO_ROOT directly removes the redundant subshell and keeps one canonical root variable throughout the script.

Suggested change
if git -C "$(dirname "${BASH_SOURCE[0]}")/.." rev-parse --git-dir >/dev/null 2>&1; then
GIT_REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
export GIT_COMMIT="$(git -C "$GIT_REPO_DIR" rev-parse HEAD 2>/dev/null || true)"
export GIT_BRANCH="$(git -C "$GIT_REPO_DIR" rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
if git -C "$GIT_REPO_DIR" diff-index --quiet HEAD 2>/dev/null; then
export GIT_DIRTY="false"
else
export GIT_DIRTY="true"
fi
fi
if git -C "$REPO_ROOT" rev-parse --git-dir >/dev/null 2>&1; then
export GIT_COMMIT="$(git -C "$REPO_ROOT" rev-parse HEAD 2>/dev/null || true)"
export GIT_BRANCH="$(git -C "$REPO_ROOT" rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
if git -C "$REPO_ROOT" diff-index --quiet HEAD 2>/dev/null; then
export GIT_DIRTY="false"
else
export GIT_DIRTY="true"
fi
fi

export BUILT_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)"

if [[ "$USE_PROXY" == "true" ]]; then
if [[ ! -f docker-compose.proxy.yml ]]; then
echo "docker-compose.proxy.yml missing — cannot enable proxy mode." >&2
Expand Down
Loading