From cc20c2ad7ba96c8803c5be723073c9cca7c0bfce Mon Sep 17 00:00:00 2001 From: bdchatham Date: Tue, 15 Sep 2026 14:38:02 +0200 Subject: [PATCH 1/4] ci(giga-1): publish a seid image on every push to giga-1 nightly-ecr.yml checks out a hardcoded `ref: main`, so it can never build this branch. This builds the pushed commit and publishes one vanilla image as giga1--, consumed by harbor's giga-testnet chain through Flux image automation (sei-protocol/platform#PR). Timestamp, not a date: this builds on push, so more than one image shares a day and the platform ImagePolicy's numerical order cannot break a tie. The giga1- prefix keeps these images out of the three anchored nightly policies. The tag only exists once `seid version` has run in the built image, so Flux cannot deploy a binary that never started. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/giga1-ecr.yml | 124 ++++++++++++++++++++++++++++++++ 1 file changed, 124 insertions(+) create mode 100644 .github/workflows/giga1-ecr.yml diff --git a/.github/workflows/giga1-ecr.yml b/.github/workflows/giga1-ecr.yml new file mode 100644 index 0000000000..45abe9ae4c --- /dev/null +++ b/.github/workflows/giga1-ecr.yml @@ -0,0 +1,124 @@ +name: Giga-1 ECR + +# Publishes one vanilla seid image per push to giga-1, consumed by harbor's +# giga-testnet chain through Flux image automation +# (sei-protocol/platform clusters/harbor/giga-testnet/). +# +# Tag shape giga1--. The timestamp, not a date: this +# builds on push, so several images share a day and the platform ImagePolicy's +# numerical order cannot break a tie. The giga1- prefix keeps these images out +# of the nightly policies, whose patterns are anchored on nightly-, mock-nightly- +# and mock_chain_validation-mock_balances-nightly-. Changing the shape here +# means changing that ImagePolicy and its bump guard's setter_re together. +# +# Distinct from nightly-ecr.yml, which builds main HEAD on a cron and publishes +# four build-tag variants. Only the vanilla build is published here: +# giga-testnet submits no transactions, so no sender needs funding, and +# mock_balances would mask the state-machine regressions this chain exists to +# catch. +on: + push: + branches: + - giga-1 + # A docs-only commit produces an identical binary under a new sha7, and a + # new tag rolls all four giga-testnet validators, stopping block production + # for the restart window. Not worth it. + paths-ignore: + - '**/*.md' + - 'docs/**' + workflow_dispatch: + +# Newest commit wins: a push during a build cancels it, so the published tag is +# always the newest commit that finished building, and at most one build runs. +concurrency: + group: giga1-ecr + cancel-in-progress: true + +jobs: + publish: + name: Publish giga-1 container + runs-on: ubuntu-latest + permissions: + id-token: write + contents: read + steps: + # workflow_dispatch takes no branch filter, so a dispatch from another ref + # would publish a giga1- tag built from that ref and Flux would deploy it + # to giga-testnet. Asserted rather than an `if:`, which would skip green. + - name: Refuse a ref that is not giga-1 + run: | + set -euo pipefail + [ "$GITHUB_REF" = "refs/heads/giga-1" ] || { + echo "::error::giga1-ecr publishes giga-1 only; got $GITHUB_REF" + exit 1 + } + + - name: Checkout the pushed commit + # See: https://github.com/actions/checkout/releases/tag/v7.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + + - name: Compute tag components + id: tag + run: | + set -euo pipefail + SHA=$(git rev-parse HEAD) + SHA7=$(git rev-parse --short=7 HEAD) + TS=$(date -u +%Y%m%d%H%M%S) + echo "sha=${SHA}" >> "$GITHUB_OUTPUT" + echo "giga1=giga1-${TS}-${SHA7}" >> "$GITHUB_OUTPUT" + + - name: AWS Login + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-region: us-east-2 + role-to-assume: arn:aws:iam::189176372795:role/common/gha + role-duration-seconds: 7200 + + - name: Login to Amazon ECR + id: login-ecr + uses: aws-actions/amazon-ecr-login@v2 + + - name: Set up Docker Buildx + # See: https://github.com/docker/setup-buildx-action/releases/tag/v4.1.0 + uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 + + # load, not push: the tag must not exist until the smoke below passes, or + # Flux can deploy an image that never ran. One build, so the bytes smoked + # are the bytes published. + - name: Build giga-1 image + uses: docker/build-push-action@v6 + with: + context: '.' + platforms: linux/amd64 + load: true + push: false + tags: ${{ steps.login-ecr.outputs.registry }}/sei/sei-chain:${{ steps.tag.outputs.giga1 }} + cache-from: type=registry,ref=${{ steps.login-ecr.outputs.registry }}/sei/build-cache:giga1 + cache-to: type=registry,ref=${{ steps.login-ecr.outputs.registry }}/sei/build-cache:giga1,mode=max + build-args: | + SEI_CHAIN_REF=${{ steps.tag.outputs.sha }} + + # The cheapest gate that is worth having: it catches a binary that cannot + # start at all — a missing libwasmvm, a bad entrypoint — before four + # validators try to run it. It does not prove the chain reaches consensus. + - name: Smoke the binary before publishing + env: + IMAGE: ${{ steps.login-ecr.outputs.registry }}/sei/sei-chain:${{ steps.tag.outputs.giga1 }} + run: docker run --rm "$IMAGE" version + + - name: Push giga-1 image + env: + IMAGE: ${{ steps.login-ecr.outputs.registry }}/sei/sei-chain:${{ steps.tag.outputs.giga1 }} + run: docker push "$IMAGE" + + - name: Summary + env: + TAG: ${{ steps.tag.outputs.giga1 }} + run: | + { + echo "### Giga-1 ECR publish" + echo "" + echo "| Tag | Variant | Consumer |" + echo "|-----|---------|----------|" + echo "| \`${TAG}\` | vanilla | harbor giga-testnet (Flux) |" + } >> "$GITHUB_STEP_SUMMARY" From 1425d89a3af83740c6370956a19ad3f953b1b24a Mon Sep 17 00:00:00 2001 From: bdchatham Date: Tue, 15 Sep 2026 14:43:34 +0200 Subject: [PATCH 2/4] style(ci): drop the comments from giga1-ecr Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/giga1-ecr.yml | 32 -------------------------------- 1 file changed, 32 deletions(-) diff --git a/.github/workflows/giga1-ecr.yml b/.github/workflows/giga1-ecr.yml index 45abe9ae4c..94eb9cb900 100644 --- a/.github/workflows/giga1-ecr.yml +++ b/.github/workflows/giga1-ecr.yml @@ -1,35 +1,14 @@ name: Giga-1 ECR -# Publishes one vanilla seid image per push to giga-1, consumed by harbor's -# giga-testnet chain through Flux image automation -# (sei-protocol/platform clusters/harbor/giga-testnet/). -# -# Tag shape giga1--. The timestamp, not a date: this -# builds on push, so several images share a day and the platform ImagePolicy's -# numerical order cannot break a tie. The giga1- prefix keeps these images out -# of the nightly policies, whose patterns are anchored on nightly-, mock-nightly- -# and mock_chain_validation-mock_balances-nightly-. Changing the shape here -# means changing that ImagePolicy and its bump guard's setter_re together. -# -# Distinct from nightly-ecr.yml, which builds main HEAD on a cron and publishes -# four build-tag variants. Only the vanilla build is published here: -# giga-testnet submits no transactions, so no sender needs funding, and -# mock_balances would mask the state-machine regressions this chain exists to -# catch. on: push: branches: - giga-1 - # A docs-only commit produces an identical binary under a new sha7, and a - # new tag rolls all four giga-testnet validators, stopping block production - # for the restart window. Not worth it. paths-ignore: - '**/*.md' - 'docs/**' workflow_dispatch: -# Newest commit wins: a push during a build cancels it, so the published tag is -# always the newest commit that finished building, and at most one build runs. concurrency: group: giga1-ecr cancel-in-progress: true @@ -42,9 +21,6 @@ jobs: id-token: write contents: read steps: - # workflow_dispatch takes no branch filter, so a dispatch from another ref - # would publish a giga1- tag built from that ref and Flux would deploy it - # to giga-testnet. Asserted rather than an `if:`, which would skip green. - name: Refuse a ref that is not giga-1 run: | set -euo pipefail @@ -54,7 +30,6 @@ jobs: } - name: Checkout the pushed commit - # See: https://github.com/actions/checkout/releases/tag/v7.0.0 uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Compute tag components @@ -79,12 +54,8 @@ jobs: uses: aws-actions/amazon-ecr-login@v2 - name: Set up Docker Buildx - # See: https://github.com/docker/setup-buildx-action/releases/tag/v4.1.0 uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 - # load, not push: the tag must not exist until the smoke below passes, or - # Flux can deploy an image that never ran. One build, so the bytes smoked - # are the bytes published. - name: Build giga-1 image uses: docker/build-push-action@v6 with: @@ -98,9 +69,6 @@ jobs: build-args: | SEI_CHAIN_REF=${{ steps.tag.outputs.sha }} - # The cheapest gate that is worth having: it catches a binary that cannot - # start at all — a missing libwasmvm, a bad entrypoint — before four - # validators try to run it. It does not prove the chain reaches consensus. - name: Smoke the binary before publishing env: IMAGE: ${{ steps.login-ecr.outputs.registry }}/sei/sei-chain:${{ steps.tag.outputs.giga1 }} From d307165d06616607c8c8615a0bc4cbc72daab6ac Mon Sep 17 00:00:00 2001 From: bdchatham Date: Tue, 15 Sep 2026 15:03:37 +0200 Subject: [PATCH 3/4] fix(ci): derive the giga1 tag timestamp from the commit, widen the md filter Review findings. Wall-clock tagging broke the ordering invariant on a re-run: a re-run of an older commit executes date -u again and mints a tag that sorts above everything published since, so the numerical ImagePolicy rolls giga-testnet back onto the older binary. cancel-in-progress makes a cancelled older run the likeliest re-run target. The committer date makes the tag a pure function of the commit, so a re-run recomputes the same tag. '**/*.md' cannot match root-level markdown: ** matches zero characters, leaving a pattern that needs a leading slash. AGENTS.md and README.md are what this repo churns, so docs-only commits were still publishing and rolling all four validators. '**.md' is the documented idiom and a strict superset. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/giga1-ecr.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/giga1-ecr.yml b/.github/workflows/giga1-ecr.yml index 94eb9cb900..24b3677cb9 100644 --- a/.github/workflows/giga1-ecr.yml +++ b/.github/workflows/giga1-ecr.yml @@ -5,7 +5,7 @@ on: branches: - giga-1 paths-ignore: - - '**/*.md' + - '**.md' - 'docs/**' workflow_dispatch: @@ -38,7 +38,7 @@ jobs: set -euo pipefail SHA=$(git rev-parse HEAD) SHA7=$(git rev-parse --short=7 HEAD) - TS=$(date -u +%Y%m%d%H%M%S) + TS=$(TZ=UTC0 git show -s --format=%cd --date=format-local:%Y%m%d%H%M%S HEAD) echo "sha=${SHA}" >> "$GITHUB_OUTPUT" echo "giga1=giga1-${TS}-${SHA7}" >> "$GITHUB_OUTPUT" From bff1e31369baab39bf8865b4e36602c2a75ca08d Mon Sep 17 00:00:00 2001 From: bdchatham Date: Wed, 16 Sep 2026 14:13:32 +0200 Subject: [PATCH 4/4] ci(giga-1): publish a mock_balances image alongside the vanilla one giga1-ecr published one variant with no build tags, so it produced the vanilla binary. harbor's giga-testnet needs mock_balances: that build credits every account, which is what lets a load generator skip a funding step for hundreds of thousands of accounts. A matrix variant rather than a second workflow, matching the shape giga-ecr already uses. The tag takes a mock- prefix, so the timestamped ordering the Flux numerical policy needs works for both: giga1-- and mock-giga1--. The build cache is keyed per variant. The build tags change the compiled output, so one shared cache would miss on every run and evict the other variant. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/giga1-ecr.yml | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/.github/workflows/giga1-ecr.yml b/.github/workflows/giga1-ecr.yml index 24b3677cb9..fe11c45ed4 100644 --- a/.github/workflows/giga1-ecr.yml +++ b/.github/workflows/giga1-ecr.yml @@ -15,11 +15,23 @@ concurrency: jobs: publish: - name: Publish giga-1 container + name: Publish giga-1 container (${{ matrix.variant.name }}) runs-on: ubuntu-latest permissions: id-token: write contents: read + strategy: + fail-fast: false + matrix: + variant: + # mock_balances credits every account, so a load generator needs no + # funding step. harbor's giga-testnet consumes that variant. + - name: vanilla + tag_prefix: '' + build_tags: '' + - name: mock_balances + tag_prefix: 'mock-' + build_tags: 'mock_balances' steps: - name: Refuse a ref that is not giga-1 run: | @@ -34,13 +46,15 @@ jobs: - name: Compute tag components id: tag + env: + TAG_PREFIX: ${{ matrix.variant.tag_prefix }} run: | set -euo pipefail SHA=$(git rev-parse HEAD) SHA7=$(git rev-parse --short=7 HEAD) TS=$(TZ=UTC0 git show -s --format=%cd --date=format-local:%Y%m%d%H%M%S HEAD) echo "sha=${SHA}" >> "$GITHUB_OUTPUT" - echo "giga1=giga1-${TS}-${SHA7}" >> "$GITHUB_OUTPUT" + echo "giga1=${TAG_PREFIX}giga1-${TS}-${SHA7}" >> "$GITHUB_OUTPUT" - name: AWS Login uses: aws-actions/configure-aws-credentials@v4 @@ -64,10 +78,13 @@ jobs: load: true push: false tags: ${{ steps.login-ecr.outputs.registry }}/sei/sei-chain:${{ steps.tag.outputs.giga1 }} - cache-from: type=registry,ref=${{ steps.login-ecr.outputs.registry }}/sei/build-cache:giga1 - cache-to: type=registry,ref=${{ steps.login-ecr.outputs.registry }}/sei/build-cache:giga1,mode=max + # Cache per variant. The build tags change the compiled output, so a + # shared cache would miss every run and evict the other variant. + cache-from: type=registry,ref=${{ steps.login-ecr.outputs.registry }}/sei/build-cache:giga1-${{ matrix.variant.name }} + cache-to: type=registry,ref=${{ steps.login-ecr.outputs.registry }}/sei/build-cache:giga1-${{ matrix.variant.name }},mode=max build-args: | SEI_CHAIN_REF=${{ steps.tag.outputs.sha }} + GO_BUILD_TAGS=${{ matrix.variant.build_tags }} - name: Smoke the binary before publishing env: @@ -82,11 +99,12 @@ jobs: - name: Summary env: TAG: ${{ steps.tag.outputs.giga1 }} + VARIANT: ${{ matrix.variant.name }} run: | { - echo "### Giga-1 ECR publish" + echo "### Giga-1 ECR publish (${VARIANT})" echo "" echo "| Tag | Variant | Consumer |" echo "|-----|---------|----------|" - echo "| \`${TAG}\` | vanilla | harbor giga-testnet (Flux) |" + echo "| \`${TAG}\` | ${VARIANT} | harbor giga-testnet (Flux) |" } >> "$GITHUB_STEP_SUMMARY"