-
Notifications
You must be signed in to change notification settings - Fork 861
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into build-version
- Loading branch information
Showing
185 changed files
with
7,626 additions
and
2,842 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| --- | ||
| name: Release Checklist | ||
| about: items to be completed for each release | ||
| title: '' | ||
| labels: '' | ||
| assignees: '' | ||
|
|
||
| --- | ||
|
|
||
| - [ ] Confirm anything outstanding for release with other maintainers on #besu-release in Discord | ||
| - [ ] Notify maintainers about updating changelog for in-flight PRs | ||
| - [ ] Update changelog if necessary, and merge a PR for it to main | ||
| - [ ] Optional: for hotfixes, create a release branch and cherry-pick, e.g. `release-<version>-hotfix` | ||
| - [ ] Optional: create a PR into main from the hotfix branch to see the CI checks pass | ||
| - [ ] On the appropriate branch/commit, create a calver tag for the release candidate, format example: `24.4.0-RC2` | ||
| - [ ] Sign-off with team; confirm tag is correct in #besu-release in Discord | ||
| - [ ] Consensys staff start burn-in using the proposed release <version-RCX> tag | ||
| - [ ] Sign off burn-in; convey burn-in results in #besu-release in Discord | ||
| - [ ] Using the same git sha, create a calver tag for the FULL RELEASE, example format `24.4.0` | ||
| - [ ] Using the FULL RELEASE tag, create a release in github to trigger the workflows. Once published: | ||
| - makes the release "latest" in github | ||
| - this is now public and notifies subscribed users | ||
| - publishes artefacts and version-specific docker tags | ||
| - publishes the docker `latest` tag variants | ||
| - [ ] Draft homebrew PR | ||
| - [ ] Draft documentation release | ||
| - [ ] Ensure binary SHAs are correct on the release page | ||
| - [ ] Docker release startup test: | ||
| - `docker run hyperledger/besu:<version>` | ||
| - `docker run hyperledger/besu:<version>-arm64` | ||
| - `docker run --platform linux/amd64 hyperledger/besu:<version>-amd64` | ||
| - `docker run --pull=always hyperledger/besu:latest` (check version is <version>) | ||
| - [ ] Merge homebrew PR | ||
| - [ ] Publish Docs Release | ||
| - [ ] Social announcements |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| #!/bin/bash | ||
| ## | ||
| ## Copyright contributors to Hyperledger Besu. | ||
| ## | ||
| ## Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with | ||
| ## the License. You may obtain a copy of the License at | ||
| ## | ||
| ## http://www.apache.org/licenses/LICENSE-2.0 | ||
| ## | ||
| ## Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on | ||
| ## an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the | ||
| ## specific language governing permissions and limitations under the License. | ||
| ## | ||
| ## SPDX-License-Identifier: Apache-2.0 | ||
| ## | ||
|
|
||
| CONTAINER_NAME=${CONTAINER_NAME:-besu} | ||
| VERSION=${VERSION} | ||
| TAG=${TAG} | ||
| CHECK_LATEST=${CHECK_LATEST} | ||
| RETRY=${RETRY:-10} | ||
| SLEEP=${SLEEP:-5} | ||
|
|
||
| # Helper function to throw error | ||
| log_error() { | ||
| echo "::error $1" | ||
| exit 1 | ||
| } | ||
|
|
||
| # Check container is in running state | ||
| _RUN_STATE=$(docker inspect --type=container -f={{.State.Status}} ${CONTAINER_NAME}) | ||
| if [[ "${_RUN_STATE}" != "running" ]] | ||
| then | ||
| log_error "container is not running" | ||
| fi | ||
|
|
||
| # Check for specific log message in container logs to verify besu started | ||
| _SUCCESS=false | ||
| while [[ ${_SUCCESS} != "true" && $RETRY -gt 0 ]] | ||
| do | ||
| docker logs ${CONTAINER_NAME} | grep -q "Ethereum main loop is up" && { | ||
| _SUCCESS=true | ||
| continue | ||
| } | ||
| echo "Waiting for the besu to start. Remaining retries $RETRY ..." | ||
| RETRY=$(expr $RETRY - 1) | ||
| sleep $SLEEP | ||
| done | ||
|
|
||
| # Log entry does not present after all retries, fail the script with a message | ||
| if [[ ${_SUCCESS} != "true" ]] | ||
| then | ||
| docker logs --tail=100 ${CONTAINER_NAME} | ||
| log_error "could not find the log message 'Ethereum main loop is up'" | ||
| else | ||
| echo "Besu container started and entered main loop" | ||
| fi | ||
|
|
||
| # For the latest tag check the version match | ||
| if [[ ${TAG} == "latest" && ${CHECK_LATEST} == "true" ]] | ||
| then | ||
| _VERSION_IN_LOG=$(docker logs ${CONTAINER_NAME} | grep "#" | grep "Besu version" | cut -d " " -f 4 | sed 's/\s//g') | ||
| echo "Extracted version from logs [$_VERSION_IN_LOG]" | ||
| if [[ "$_VERSION_IN_LOG" != "${VERSION}" ]] | ||
| then | ||
| log_error "version [$_VERSION_IN_LOG] extracted from container logs does not match the expected version [${VERSION}]" | ||
| else | ||
| echo "Latest Besu container version matches" | ||
| fi | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| name: container security scan | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| tag: | ||
| description: 'Container image tag' | ||
| required: false | ||
| default: 'develop' | ||
| schedule: | ||
| # Start of the hour is the busy time. Scheule it to run 8:17am UTC | ||
| - cron: '17 8 * * *' | ||
|
|
||
| jobs: | ||
| scan-sarif: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| security-events: write | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
|
|
||
| # Shell parameter expansion does not support directly on a step | ||
| # Adding a separate step to set the image tag. This allows running | ||
| # this workflow with a schedule as well as manual | ||
| - name: Set image tag | ||
| id: tag | ||
| run: | | ||
| echo "TAG=${INPUT_TAG:-develop}" >> "$GITHUB_OUTPUT" | ||
| env: | ||
| INPUT_TAG: ${{ inputs.tag }} | ||
|
|
||
| - name: Vulnerability scanner | ||
| id: trivy | ||
| uses: aquasecurity/trivy-action@595be6a0f6560a0a8fc419ddf630567fc623531d | ||
| with: | ||
| image-ref: hyperledger/besu:${{ steps.tag.outputs.TAG }} | ||
| format: sarif | ||
| output: 'trivy-results.sarif' | ||
|
|
||
| # Check the vulnerabilities via GitHub security tab | ||
| - name: Upload results | ||
| uses: github/codeql-action/upload-sarif@23acc5c183826b7a8a97bce3cecc52db901f8251 | ||
| with: | ||
| sarif_file: 'trivy-results.sarif' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| name: container verify | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| version: | ||
| description: 'Besu version' | ||
| required: true | ||
| verify-latest-version: | ||
| description: 'Check latest container version' | ||
| required: false | ||
| type: choice | ||
| default: "true" | ||
| options: | ||
| - "true" | ||
| - "false" | ||
|
|
||
| jobs: | ||
| verify: | ||
| timeout-minutes: 4 | ||
| strategy: | ||
| matrix: | ||
| combination: | ||
| - tag: ${{ inputs.version }} | ||
| platform: '' | ||
| runner: ubuntu-latest | ||
| - tag: ${{ inputs.version }}-amd64 | ||
| platform: 'linux/amd64' | ||
| runner: ubuntu-latest | ||
| - tag: latest | ||
| platform: '' | ||
| runner: ubuntu-latest | ||
| - tag: ${{ inputs.version }}-arm64 | ||
| platform: '' | ||
| runner: besu-arm64 | ||
| runs-on: ${{ matrix.combination.runner }} | ||
| env: | ||
| CONTAINER_NAME: besu-check | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
|
|
||
| - name: Start container | ||
| run: | | ||
| PLATFORM_OPT="" | ||
| [[ x${{ matrix.combination.platform }} != 'x' ]] && PLATFORM_OPT="--platform ${{ matrix.combination.platform }}" | ||
| docker run -d $PLATFORM_OPT --name ${{ env.CONTAINER_NAME }} hyperledger/besu:${{ matrix.combination.tag }} | ||
| - name: Verify besu container | ||
| run: bash .github/workflows/BesuContainerVerify.sh | ||
| env: | ||
| TAG: ${{ matrix.combination.tag }} | ||
| VERSION: ${{ inputs.version }} | ||
| CHECK_LATEST: ${{ inputs.verify-latest-version }} | ||
|
|
||
| - name: Stop container | ||
| run: docker stop ${{ env.CONTAINER_NAME }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.