Skip to content

chore: harden Dockerfiles and add devops CODEOWNERS #535

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RafilxTenfen merged 2 commits into from
Feb 6, 2026
Merged

chore: harden Dockerfiles and add devops CODEOWNERS #535

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9d8a0e7
chore: harden Dockerfiles and add devops CODEOWNERS
mpastecki Feb 5, 2026
e923663
chore: scope CODEOWNERS devops ownership to workflows only
mpastecki Feb 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,7 @@
# CODEOWNERS: https://help.github.com/articles/about-codeowners/

# Primary repo maintainers
* @KonradStaniec @RafilxTenfen @Lazar955 @gitferry @SebastianElvis
* @KonradStaniec @RafilxTenfen @Lazar955 @gitferry @SebastianElvis

# DevOps team owns CI/CD workflows
/.github/workflows/ @babylonlabs-io/devops
15 changes: 7 additions & 8 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ ARG VERSION
# Use muslc for static libs
ARG BUILD_TAGS="muslc"
# hadolint ignore=DL3018
RUN apk add --no-cache --update openssh git make build-base linux-headers libc-dev \
RUN apk add --no-cache openssh git make build-base linux-headers libc-dev \
pkgconfig zeromq-dev musl-dev alpine-sdk libsodium-dev \
libzmq-static libsodium-static gcc && rm -rf /var/cache/apk/*
libzmq-static libsodium-static gcc

# Build
WORKDIR /go/src/github.com/babylonlabs-io/vigilante
Expand All @@ -29,23 +29,22 @@ RUN if [ -n "${VERSION}" ]; then \
# Cosmwasm - Download correct libwasmvm version
SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
RUN WASMVM_VERSION=$(go list -m github.com/CosmWasm/wasmvm/v2 | cut -d ' ' -f 2) && \
wget -q https://github.com/CosmWasm/wasmvm/releases/download/$WASMVM_VERSION/libwasmvm_muslc.$(uname -m).a \
wget -q https://github.com/CosmWasm/wasmvm/releases/download/"$WASMVM_VERSION"/libwasmvm_muslc."$(uname -m)".a \
-O /lib/libwasmvm_muslc."$(uname -m)".a && \
# verify checksum
wget -q https://github.com/CosmWasm/wasmvm/releases/download/$WASMVM_VERSION/checksums.txt -O /tmp/checksums.txt && \
sha256sum /lib/libwasmvm_muslc."$(uname -m)".a | grep $(cat /tmp/checksums.txt | grep libwasmvm_muslc."$(uname -m)" | cut -d ' ' -f 1)
wget -q https://github.com/CosmWasm/wasmvm/releases/download/"$WASMVM_VERSION"/checksums.txt -O /tmp/checksums.txt && \
sha256sum /lib/libwasmvm_muslc."$(uname -m)".a | grep "$(cat /tmp/checksums.txt | grep libwasmvm_muslc."$(uname -m)" | cut -d ' ' -f 1)"

RUN CGO_LDFLAGS="$CGO_LDFLAGS -lstdc++ -lm -lsodium" \
CGO_ENABLED=1 \
BUILD_TAGS=$BUILD_TAGS \
LINK_STATICALLY=true \
make build

FROM alpine:3.20 AS run
FROM alpine:3.21 AS run
# Create a user
RUN addgroup --gid 1138 -S vigilante && adduser --uid 1138 -S vigilante -G vigilante
# hadolint ignore=DL3018
RUN apk --no-cache add bash curl jq && rm -rf /var/cache/apk/*
RUN apk add --no-cache bash=5.2.37-r0 curl=8.14.1-r2 jq=1.7.1-r0

# Label should match your github repo
LABEL org.opencontainers.image.source="https://github.com/babylonlabs-io/vigilante:${VERSION}"
Expand Down
26 changes: 15 additions & 11 deletions proto/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,15 @@
# /dev.Dockerfile
# /make/builder.Dockerfile
# /tools/Dockerfile
FROM golang:1.20.5-buster
FROM golang:1.23-bookworm
Copy link

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Go version in this Dockerfile (1.23) is inconsistent with the project's Go version. The main Dockerfile uses golang:1.25-alpine (line 2 of Dockerfile), go.mod specifies go 1.25.0, and .github/workflows/ci.yml uses go-version: '1.25'. This proto Dockerfile should be updated to golang:1.23-bookworm or golang:1.25-bookworm to match the project's Go version.

Suggested change
FROM golang:1.23-bookworm
FROM golang:1.25-bookworm

Copilot uses AI. Check for mistakes.

RUN apt-get update && apt-get install -y \
git \
protobuf-compiler='3.6.1*' \
clang-format='1:7.0*'
SHELL ["/bin/bash", "-o", "pipefail", "-c"]

RUN apt-get update && apt-get install -y --no-install-recommends \
git=1:2.39.5-0+deb12u3 \
protobuf-compiler=3.21.12-3 \
clang-format=1:14.0-55.7~deb12u1 \
&& rm -rf /var/lib/apt/lists/*

# We don't want any default values for these variables to make sure they're
# explicitly provided by parsing the go.mod file. Otherwise we might forget to
Expand All @@ -21,13 +24,14 @@ ENV PROTOC_GEN_GO_GRPC_VERSION="v1.1.0"
ENV GOCACHE=/tmp/build/.cache
ENV GOMODCACHE=/tmp/build/.modcache

RUN cd /tmp \
&& mkdir -p /tmp/build/.cache \
WORKDIR /tmp

RUN mkdir -p /tmp/build/.cache \
&& mkdir -p /tmp/build/.modcache \
&& go install google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOBUF_VERSION} \
&& go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@${PROTOC_GEN_GO_GRPC_VERSION} \
&& go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@${GRPC_GATEWAY_VERSION} \
&& go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2@${GRPC_GATEWAY_VERSION} \
&& go install "google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOBUF_VERSION}" \
&& go install "google.golang.org/grpc/cmd/protoc-gen-go-grpc@${PROTOC_GEN_GO_GRPC_VERSION}" \
&& go install "github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@${GRPC_GATEWAY_VERSION}" \
&& go install "github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2@${GRPC_GATEWAY_VERSION}" \
&& go install golang.org/x/tools/cmd/goimports@v0.1.7 \
Copy link

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This go install command is missing quotes around the package path with version, which is inconsistent with the quoting pattern applied to lines 31-34 above. For consistency with the hadolint best practice of shell variable quoting being applied throughout this file, this line should be: go install "golang.org/x/tools/cmd/goimports@v0.1.7"

Suggested change
&& go install golang.org/x/tools/cmd/goimports@v0.1.7 \
&& go install "golang.org/x/tools/cmd/goimports@v0.1.7" \

Copilot uses AI. Check for mistakes.
&& chmod -R 777 /tmp/build/

Expand Down
Loading