Skip to content

Commit a540369

Browse files
authored
Merge branch 'main' into request_sharig_clone_impl_fix
2 parents 991d7a6 + 3dfea2a commit a540369

39 files changed

Lines changed: 1364 additions & 301 deletions

File tree

.devcontainer/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM mcr.microsoft.com/devcontainers/base:bullseye
1+
FROM mcr.microsoft.com/devcontainers/base:bookworm
22

33
RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
44
# Remove imagemagick due to https://security-tracker.debian.org/tracker/CVE-2019-10131

.devcontainer/devcontainer.json

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
},
1717
"ghcr.io/devcontainers/features/rust:1": {},
1818
"ghcr.io/devcontainers/features/git:1": {},
19-
"ghcr.io/nlordell/features/foundry": {},
19+
"ghcr.io/nlordell/features/foundry": { "version": "v1.7.1" },
2020
"ghcr.io/devcontainers/features/docker-in-docker:2": {
2121
"dockerDashComposeVersion": "v2"
2222
},
@@ -33,6 +33,17 @@
3333
"seccomp=unconfined"
3434
],
3535

36+
"containerEnv": {
37+
"PGHOST": "localhost",
38+
"PGPORT": "5432",
39+
"PGUSER": "vscode",
40+
"PGDATABASE": "vscode",
41+
// Drop debug info from dev/test builds: the e2e test binary's debug info
42+
// is large enough to get the linker OOM-killed on a stock setup.
43+
"CARGO_PROFILE_DEV_DEBUG": "0",
44+
"CARGO_PROFILE_TEST_DEBUG": "0"
45+
},
46+
3647
"customizations": {
3748
"vscode": {
3849
"settings": {
@@ -51,7 +62,10 @@
5162

5263
// Use 'postCreateCommand' to run commands after the container is created.
5364
// "postCreateCommand": "rustc --version",
54-
"postCreateCommand": "rustup toolchain install nightly && cargo install flamegraph",
65+
"postCreateCommand": "rustup toolchain install nightly --component rustfmt && cargo install flamegraph && cargo install cargo-nextest --locked && cargo install just --locked && bash .devcontainer/setup-e2e.sh",
66+
67+
// (Re)start the local Postgres cluster on every container start.
68+
"postStartCommand": "bash .devcontainer/start-postgres.sh",
5569

5670
// Set `remoteUser` to `root` to connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
5771
"remoteUser": "vscode"

.devcontainer/setup-e2e.sh

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Provisions the one thing the e2e test suite needs but the base image can't
4+
# provide out of the box:
5+
#
6+
# * Postgres server – we run a native server (rather than the docker-compose
7+
# one) so it survives container restarts and is up before any test
8+
# runs, then apply the flyway migrations the harness expects to
9+
# already exist.
10+
#
11+
# anvil/forge come from the foundry devcontainer feature; their prebuilt binaries
12+
# run directly on the bookworm base image (glibc >= 2.32), so nothing to do here.
13+
#
14+
# Runs as `postCreateCommand` (once, when the container is created).
15+
set -euo pipefail
16+
17+
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
18+
19+
# -----------------------------------------------------------------------------
20+
echo "==> postgres"
21+
# Install a server only if no cluster exists yet (fresh container). Reuse whatever
22+
# version is already present otherwise, so this is safe to re-run.
23+
if ! ls -d /etc/postgresql/*/main >/dev/null 2>&1; then
24+
echo " installing postgresql-16..."
25+
sudo apt-get update -qq
26+
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq postgresql-16
27+
fi
28+
PG_VERSION="$(ls /etc/postgresql | sort -n | tail -1)"
29+
echo " using cluster ${PG_VERSION}/main"
30+
31+
# Start the cluster (shared with postStart so the two can't drift).
32+
bash "$REPO_ROOT/.devcontainer/start-postgres.sh"
33+
34+
# Trust auth for local connections (development container only).
35+
HBA="/etc/postgresql/${PG_VERSION}/main/pg_hba.conf"
36+
sudo tee "$HBA" >/dev/null <<'EOF'
37+
local all all trust
38+
host all all 127.0.0.1/32 trust
39+
host all all ::1/128 trust
40+
EOF
41+
sudo pg_ctlcluster "$PG_VERSION" main reload
42+
43+
# The e2e harness connects with the bare url `postgresql://`, which resolves to a
44+
# role and database named after $PGUSER/$PGDATABASE (see containerEnv in
45+
# devcontainer.json and DatabasePoolConfig::test_default).
46+
psql -h 127.0.0.1 -U postgres -d postgres -tAc \
47+
"SELECT 1 FROM pg_roles WHERE rolname='${PGUSER}'" | grep -q 1 \
48+
|| psql -h 127.0.0.1 -U postgres -d postgres -c \
49+
"CREATE ROLE \"${PGUSER}\" LOGIN SUPERUSER;"
50+
psql -h 127.0.0.1 -U postgres -d postgres -tAc \
51+
"SELECT 1 FROM pg_database WHERE datname='${PGDATABASE}'" | grep -q 1 \
52+
|| psql -h 127.0.0.1 -U postgres -d postgres -c \
53+
"CREATE DATABASE \"${PGDATABASE}\" OWNER \"${PGUSER}\";"
54+
55+
# Apply the migrations with the same flyway image the rest of the repo uses
56+
# (see docker-compose.yaml). Flyway tracks what it has already applied, so this is
57+
# incremental and idempotent: re-running only applies new migrations and fails
58+
# loudly if one is incompatible with the current schema. The native server runs
59+
# on the host network namespace, so `--network=host` lets flyway reach it on
60+
# 127.0.0.1:${PGPORT}.
61+
echo " applying flyway migrations..."
62+
docker run --rm --network=host \
63+
-v "$REPO_ROOT/database/sql:/flyway/sql:ro" \
64+
-v "$REPO_ROOT/database/conf:/flyway/conf:ro" \
65+
flyway/flyway:10.7.1 \
66+
-url="jdbc:postgresql://127.0.0.1:${PGPORT}/${PGDATABASE}?user=${PGUSER}&password=" \
67+
migrate
68+
69+
echo "==> e2e environment ready (postgres)"

.devcontainer/start-postgres.sh

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Starts the local Postgres cluster on every container start. There is no init
4+
# system in the container, so the cluster does not come up on its own after a
5+
# stop/start. Provisioning (install, role, db, migrations) is done once by
6+
# setup-e2e.sh; this only (re)starts what already exists.
7+
#
8+
# Runs as `postStartCommand`.
9+
set -euo pipefail
10+
11+
PG_VERSION="$(ls /etc/postgresql | sort -n | tail -1)"
12+
13+
# `start` errors if the cluster is already running, so only start it when it
14+
# isn't online; a genuine start failure then surfaces instead of being swallowed.
15+
if ! pg_lsclusters -h "$PG_VERSION" main | grep -q online; then
16+
sudo pg_ctlcluster "$PG_VERSION" main start
17+
fi

.github/CODEOWNERS

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
* @cowprotocol/backend
2-
2+
.github/workflows/ @cowprotocol/devops @cowprotocol/backend

.github/renovate.json5

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
// This file follows JSON5 syntax, to make it
2+
// easier to maintain.
3+
{
4+
$schema: "https://docs.renovatebot.com/renovate-schema.json",
5+
// Disable every built-in manager (npm, dockerfile, ...) except github-actions.
6+
enabledManagers: ["github-actions"],
7+
// PR titles use Conventional Commits: `deps(<action>): ...`
8+
semanticCommits: "enabled",
9+
semanticCommitType: "deps",
10+
packageRules: [
11+
// GitHub Actions updates: run weekly, skip releases newer than 2 weeks
12+
// to avoid picking up freshly published versions that may be unstable or
13+
// compromised, and pin to full commit SHAs (with the version as a
14+
// trailing comment) rather than mutable tags.
15+
// When both major and minor releases exist, propose only the latest bump
16+
// (typically major) instead of a separate minor PR.
17+
{
18+
matchManagers: ["github-actions"],
19+
schedule: ["on monday"],
20+
minimumReleaseAge: "14 days",
21+
pinDigests: true,
22+
separateMajorMinor: false,
23+
semanticCommitScope: "{{depName}}",
24+
commitMessageTopic: "{{depName}}",
25+
},
26+
],
27+
}

.github/workflows/add-to-project.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
name: Add issue to project
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
13+
- uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
1414
with:
1515
project-url: https://github.com/orgs/cowprotocol/projects/8
1616
github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/claude-review.yml

Lines changed: 3 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,6 @@ on:
44
types: [opened, ready_for_review]
55
issue_comment:
66
types: [created]
7-
# Manual trigger so workflow changes can be exercised from a feature branch
8-
# without merging. Pick the feature branch in the Actions UI and pass the
9-
# PR number to review.
10-
workflow_dispatch:
11-
inputs:
12-
pr_number:
13-
description: "PR number to review"
14-
required: true
15-
type: string
16-
17-
# Cancel an in-flight review if another trigger fires on the same PR (e.g.
18-
# back-to-back `@claude` comments, or a draft→ready transition while an
19-
# earlier run is still going). Note: `synchronize` is not in the trigger
20-
# list, so plain pushes do not trigger or cancel anything.
21-
concurrency:
22-
group: claude-review-${{ github.event.pull_request.number || github.event.issue.number || inputs.pr_number }}
23-
cancel-in-progress: true
247

258
jobs:
269
review:
@@ -43,7 +26,7 @@ jobs:
4326
github.event.issue.pull_request != null &&
4427
contains(github.event.comment.body, '@claude') &&
4528
contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association)
46-
) || github.event_name == 'workflow_dispatch'
29+
)
4730
runs-on: ubuntu-latest
4831
timeout-minutes: 30
4932
permissions:
@@ -53,7 +36,7 @@ jobs:
5336
id-token: write
5437
actions: read
5538
steps:
56-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
39+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
5740
with:
5841
# Full history lets the action compute an accurate diff vs the base
5942
# branch instead of just the latest commit.
@@ -67,5 +50,4 @@ jobs:
6750
claude_args: |
6851
--model claude-opus-4-7
6952
--max-turns 30
70-
prompt: |
71-
${{ github.event_name == 'workflow_dispatch' && format('Review PR #{0}. ', inputs.pr_number) || 'Review this PR.' }} Use the pr-review skill if available.
53+
prompt: "Review this PR. Use the pr-review skill if available."

.github/workflows/codeql.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,16 +26,16 @@ jobs:
2626
build-mode: none
2727
steps:
2828
- name: Checkout repository
29-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3030

3131
- name: Initialize CodeQL
32-
uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
32+
uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
3333
with:
3434
languages: ${{ matrix.language }}
3535
build-mode: ${{ matrix.build-mode }}
3636
config-file: .github/codeql/codeql-config.yml
3737

3838
- name: Perform CodeQL Analysis
39-
uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
39+
uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
4040
with:
4141
category: "/language:${{matrix.language}}"

.github/workflows/deploy.yaml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,13 @@ jobs:
2828
packages: write
2929

3030
steps:
31-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
31+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3232
with:
3333
# Without this the fetch depth defaults to 1, which only includes the most recent commit. We want to know the full history so that `git describe` can give more information when it is invoked in the orderbook's crate build script.
3434
fetch-depth: '0'
3535
persist-credentials: false
3636

37-
- uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
37+
- uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
3838
with:
3939
registry: ghcr.io
4040
username: ${{ github.actor }}
@@ -69,7 +69,7 @@ jobs:
6969
7070
- name: Services image metadata
7171
id: meta_services
72-
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
72+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
7373
with:
7474
images: ghcr.io/${{ github.repository }}
7575
tags: |
@@ -79,7 +79,7 @@ jobs:
7979
labels: |
8080
org.opencontainers.image.licenses=GPL-3.0-or-later
8181
- name: Services image build
82-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
82+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
8383
with:
8484
context: .
8585
file: Dockerfile
@@ -92,7 +92,7 @@ jobs:
9292
9393
- name: Migration image metadata
9494
id: meta_migration
95-
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
95+
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
9696
with:
9797
images: ghcr.io/${{ github.repository }}-migration
9898
tags: |
@@ -102,7 +102,7 @@ jobs:
102102
labels: |
103103
org.opencontainers.image.licenses=GPL-3.0-or-later
104104
- name: Migration image build
105-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
105+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
106106
with:
107107
context: .
108108
file: Dockerfile

0 commit comments

Comments
 (0)