build: use nix for building release images#3171
Closed
DSharifi wants to merge 9 commits into
Closed
Conversation
Contributor
Author
|
@claude review |
Pull request overviewReplaces the legacy Changes:
Reviewed changesPer-file summary
FindingsCI is green across Blocking (must fix before merge): None. The flow looks correct and CI confirms it. Non-blocking (nits, follow-ups, suggestions):
✅ Approved |
gilcu3
reviewed
May 8, 2026
gilcu3
left a comment
gilcu3
left a comment
Contributor
There was a problem hiding this comment.
Overall LGTM
I know this is just a draft but as I am not going to be able to review anything next week left some comments/suggestions, hopefully they are useful somehow.
Comment on lines
+48
to
+59
| export NODE_IMAGE_NAME=mpc-node | ||
| ./deployment/build-images.sh --node --push | ||
| set -euo pipefail | ||
|
|
||
| # Tag mirrors the legacy build script: <branch>-<short-sha>, with | ||
| # `/` sanitized to `-`. | ||
| branch="${GITHUB_REF_NAME//\//-}" | ||
| short_sha=$(git rev-parse --short HEAD) | ||
| tag="${branch}-${short_sha}" | ||
| echo "Pushing as tag: ${tag}" | ||
|
|
||
| archive=$(nix build --no-link --print-out-paths .#node-image) | ||
| digest_file=$(nix build --no-link --print-out-paths .#node-image-manifest-digest) | ||
| echo "Manifest digest: $(cat "$digest_file")" | ||
|
|
||
| skopeo copy --preserve-digests \ | ||
| "docker-archive:${archive}" \ | ||
| "docker://docker.io/nearone/${IMAGE_NAME}:${tag}" |
Contributor
There was a problem hiding this comment.
would be much nicer to keep the script ./deployment/build-images.sh and just modify it to run the nix steps. In general it is better to keep the ci workflows as lean as possible
Comment on lines
+41
to
+57
| - name: Install skopeo | ||
| run: | | ||
| sudo apt-get update | ||
| sudo apt-get install -y skopeo | ||
| branch="${GITHUB_REF_NAME//\//-}" | ||
| short_sha=$(git rev-parse --short HEAD) | ||
| tag="${branch}-${short_sha}" | ||
| echo "Pushing as tag: ${tag}" | ||
|
|
||
| - name: Build and push node gcp image | ||
| run: | | ||
| export NODE_GCP_IMAGE_NAME=mpc-node-gcp | ||
| ./deployment/build-images.sh --node-gcp --push | ||
| archive=$(nix build --no-link --print-out-paths .#node-gcp-image) | ||
| digest_file=$(nix build --no-link --print-out-paths .#node-gcp-image-manifest-digest) | ||
| echo "Manifest digest: $(cat "$digest_file")" | ||
|
|
||
| skopeo copy --preserve-digests \ | ||
| "docker-archive:${archive}" \ | ||
| "docker://docker.io/nearone/${IMAGE_NAME}:${tag}" |
Contributor
There was a problem hiding this comment.
same here, we could keep the script and avoid adding logic to the workflows
Comment on lines
+1233
to
+1230
| commit hash: 828f816be36aed6f0d2438e0131b3e9d7d0931ad | ||
| SOURCE_DATE_EPOCH used: 0 | ||
| node binary hash: 86c8f7d8913d6fe37a6992bba165d15a3a1d88fbf6cdff605e4827d5183721bc | ||
| node manifest digest: sha256:331cfec941671ac343c52847e255eb36a280da65535d2a1e4d002c4c64686e19 | ||
| $ nix build .#node-image-manifest-digest && cat result | ||
| sha256:331cfec941671ac343c52847e255eb36a280da65535d2a1e4d002c4c64686e19 |
Contributor
There was a problem hiding this comment.
would be nice to keep printing the same things as before, else debugging might get more complicated.
| @@ -0,0 +1,43 @@ | |||
| { | |||
| runCommand, | |||
| skopeo, | |||
Contributor
There was a problem hiding this comment.
I hoped skopeo would not be needed when moving to full nix. The way we use it is basically a coincidental trick to guarantee the image manifest is compressed deterministically.
Collaborator
|
Closing as stale. |
# Conflicts: # .github/workflows/docker_build_node.yml # .github/workflows/docker_build_node_gcp.yml # .github/workflows/docker_build_rust_launcher.yml # deployment/build-images.sh # docs/reproducible-builds.md # flake.nix # nix/mpc-node.nix # scripts/build-and-verify-rust-launcher-docker-image.sh
The script is kept as the lean entry point for the release workflows per review feedback on #3171. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
build-images.sh now needs nothing but nix and git: skopeo is re-exported from the flake (pinned through flake.lock, the same binary image-dir.nix uses) and invoked with `nix run .#skopeo`. Removes the apt install step from the three docker build workflows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Pull request overviewReplaces the legacy Changes:
Reviewed changesPer-file summary
FindingsCI is green; the prior review's blocking-class concerns have all been resolved:
Blocking (must fix before merge): None. Non-blocking (nits, follow-ups, suggestions):
Note: the PR is currently ✅ Approved |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.