ci: bring the reproducibility ci to main - #2110
Merged
Merged
Conversation
Add .github/workflows/build-android.yml triggered via workflow_dispatch. The runner is pinned to ubuntu-24.04 (no Rosetta, no QEMU) so the Dart VM EINTR crash we hit locally on Apple Silicon via Rosetta doesn't reproduce. Installs podman 5+ (over the preinstalled 4.9.3) and shadows /usr/bin/docker with a symlink so the makefile's docker calls route to podman without conflicting with the preinstalled docker-ce. Inputs: - mode: release | debug (default release) - verify: optional rebuild + hash compare (off by default, doubles build time) Output APK is uploaded as a workflow artifact with 30-day retention.
chore: sync develop with main
…irectly Align the container build layout with the conventions established in the bull-sdk migration PR (#2032) so this branch and that one share the same Containerfile structure and makefile targets. We deliberately skip the bull_sdk consolidation from #2032 — only the container/build infrastructure is borrowed here; the FRB plugin migration is out of scope for this branch. Replace single Dockerfile + Dockerfile.apk with two Containerfiles: - Containerfile.tools: debian:trixie + Rust stable + Flutter + Android SDK/NDK. Adds EXPECTED_RUST_VERSION build-arg guard from #2032 (cargokit forces stable regardless of what we install, so reproducibility is enforced by verifying the version, not by pinning rustup default). Keeps the git hardlink shim from this branch that works around CVE-2024-32020 on overlayfs — #2032 doesn't have it and would fail to rebuild today. - Containerfile.app: FROM bull-tools. Adds USERNAME-remap logic from #2032 so the devcontainer can pass USERNAME=$USER and have file ownership and home paths line up. Source + pub get + build_runner + gen-l10n + gradle config. No final build RUN — building inside a committed layer was failing on the runner (buildah/podman couldn't persist multi-GB build outputs) and is unnecessary. - makefile: container-tools and container-app targets matching #2032. apk target runs the flutter build via `podman run` against bull-app, extracts the APK with `podman cp`, then removes the container. No layer commit for the build output. Uses podman directly instead of docker. Inlines the build env (SOURCE_DATE_EPOCH, CARGO_*) rather than calling #2032's build_and_manifest.sh — manifest generation can be a follow-up. - .devcontainer/devcontainer.json: points at ../Containerfile.app per #2032 and drops postCreateCommand since telemetry-disable is baked into Containerfile.tools. - .github/workflows/build-android.yml: drops the docker->podman symlink shim since the makefile now invokes podman directly.
…tighten ignores
Follow-up to the Containerfile split that closes regressions and a
couple of pre-existing makefile gaps.
- Containerfile.tools: restore explicit RUST_VERSION="1.95.0" and
`--default-toolchain ${RUST_VERSION}` install. The prior commit
followed PR #2032's "install stable, verify with EXPECTED_RUST_VERSION"
pattern, but that loses the explicit pin we rely on (and that's
recorded in cargokit.yaml in the ark-wallet-dart and boltz-dart
forks). Keep EXPECTED_RUST_VERSION as belt-and-suspenders, not a
replacement.
- makefile: parameterize the container runtime via CONTAINER ?= podman
so scripts that detect podman-or-docker can pass their choice. Fix
the long-standing FORMAT=aab gap: extract the output path and flutter
build subcommand into FORMAT-aware variables (CONTAINER_OUTPUT,
HOST_OUTPUT, FLUTTER_BUILD) so `make apk release FORMAT=aab` now
copies the AAB from bundle/release/ instead of failing on a
hard-coded flutter-apk/*.apk cp path.
- reproducibility/verify_build.sh: was still referencing Dockerfile.apk
and doing its own podman build + create + cp dance. Switch to
`make apk release` and read the resulting host-side artifact. Pass
CONTAINER through.
- reproducibility/test.sh: was creating containers from the now-gone
`bull-mobile-apk` image tag. Switch to reading the APK that
`make apk` writes to the repo root. Pass CONTAINER through.
- reproducibility/README.md: update "How it works" to reflect
Containerfile.tools + Containerfile.app + `make apk release`.
- android/gradle.properties: comment now points at Containerfile.tools.
- .dockerignore: exclude .fvm/ (1+ GB host Flutter cache), built
APK/AAB, IDE dirs, and reproducibility scratch dirs.
- .gitignore: ignore /app-*.apk and /app-*.aab written by `make apk`
into the repo root, plus reproducibility verification scratch dirs.
ci(reproducibility): split into Containerfile.tools + .app, use podman directly
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.