Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build: use cargo binstall to speed up builds #2321

Open
wants to merge 22 commits into
base: v1.6-dev
Choose a base branch
from
Open

Conversation

shumkov
Copy link
Member

@shumkov shumkov commented Nov 9, 2024

Issue being fixed or feature implemented

What was done?

How Has This Been Tested?

Breaking Changes

Checklist:

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have added or updated relevant unit/integration/functional/e2e tests
  • I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
  • I have made corresponding changes to the documentation if needed

For repository code-owners and collaborators only

  • I have assigned this pull request to a milestone

Summary by CodeRabbit

  • New Features

    • Added steps for installing cargo-binstall and wasm-bindgen-cli to enhance JavaScript build workflows and release processes.
    • Introduced a new argument for BINSTALL_VERSION in the Dockerfile to streamline installations.
    • Updated action versions for improved dependency management in Rust workflows.
    • Clarified input descriptions for various parameters in the Rust workflow configuration.
  • Bug Fixes

    • Improved error handling in the build-wasm.sh script for missing wasm-bindgen CLI.
  • Documentation

    • Updated version of wasm-bindgen-cli in the README files for accurate installation instructions.

Copy link
Contributor

coderabbitai bot commented Nov 9, 2024

Walkthrough

The pull request encompasses several updates to configuration files and scripts related to Rust and JavaScript workflows. Key changes include version updates for sccache and wasm-bindgen-cli, enhancements to the GitHub Actions workflow for Rust dependency management, and improvements in the Dockerfile for building images. Additionally, error handling in the build-wasm.sh script has been refined. The modifications aim to streamline installation processes and clarify documentation while maintaining existing functionality across the workflows.

Changes

File Change Summary
.github/actions/rust/action.yaml Updated sccache-action and sccache versions; clarified input descriptions for toolchain, target, components, and cache.
.github/workflows/tests-build-js.yml Added steps for installing cargo-binstall and wasm-bindgen-cli with cache checks.
Dockerfile Downgraded syntax version; updated PROTOC_VERSION and SCCHACHE_VERSION; added BINSTALL_VERSION; modified installation method for wasm-bindgen-cli and cargo-chef.
README.md Updated wasm-bindgen-cli installation command version from 0.2.85 to 0.2.86.
packages/wasm-dpp/README.md Updated wasm-bindgen-cli installation command version from 0.2.85 to 0.2.86.
packages/wasm-dpp/scripts/build-wasm.sh Simplified error handling for missing wasm-bindgen CLI; removed installation attempt.
.devcontainer/Dockerfile Streamlined protoc installation; replaced wasm-bindgen-cli installation with cargo-binstall; introduced architecture handling.
.github/workflows/release.yml Added steps for installing cargo-binstall and wasm-bindgen-cli in the release-npm job.

Possibly related PRs

  • ci: prebuild dev containers #2184: This PR introduces a new GitHub Actions workflow for prebuilding development containers, which may relate to the updates in the main PR regarding the GitHub Actions workflow for managing Rust dependencies.
  • ci: use prebuilt librocksdb in github actions #2316: This PR optimizes the build process for the librocksdb library, which is relevant to the main PR's focus on updating dependencies and improving the workflow configuration for Rust projects.

Suggested reviewers

  • QuantumExplorer

Poem

In the land of code where bunnies hop,
We’ve updated our tools, we’ll never stop!
With sccache and wasm-bindgen, oh so bright,
Our builds will be swift, our futures alight.
So let’s hop along, with dependencies clear,
In the garden of Rust, we have nothing to fear! 🐇✨


Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Outside diff range and nitpick comments (10)
packages/wasm-dpp/scripts/build-wasm.sh (2)

Line range hint 1-32: Consider adding error checks for other required tools.

While we're improving error handling, it would be good to verify all required tools upfront.

Consider adding these checks at the start of the script:

#!/usr/bin/env bash
# shellcheck disable=SC2312
set -ex

+# Check required tools
+for cmd in cargo wasm-bindgen; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "Error: $cmd is required but not installed."
+    exit 1
+  fi
+done
+
TARGET=wasm32-unknown-unknown

Line range hint 1-50: Document cargo binstall usage in script comments.

Since this PR introduces cargo binstall for dependency management, it would be helpful to update the TODO comment to reflect this change.

Update the comment to mention cargo binstall:

-# TODO: Build wasm with build.rs
-# Meantime if you want to update wasm-bindgen you also need to update version in:
+# TODO: Build wasm with build.rs
+# Dependencies are managed via cargo binstall. When updating wasm-bindgen, update version in:
 #  - packages/wasm-dpp/Cargo.toml
 #  - Dockerfile
packages/wasm-dpp/README.md (3)

42-42: Consider using cargo-binstall for faster installation

Since this PR introduces cargo-binstall for faster builds, consider updating the installation instructions to use cargo-binstall instead of cargo install:

-Install wasm-bingen-cli: `cargo install [email protected]`
+Install wasm-bingen-cli: `cargo binstall [email protected]`

42-44: Fix typo in command name

There's a typo in the command name: "wasm-bingen-cli" should be "wasm-bindgen-cli"


Line range hint 51-52: Consider removing or completing TODO sections

The README contains empty TODO sections. Consider either:

  1. Removing these sections if they're not immediately needed
  2. Adding the missing content
  3. Converting them into GitHub issues for tracking

This would improve the documentation quality and maintainability.

Would you like me to help create GitHub issues to track these documentation tasks?

Also applies to: 54-55

.github/workflows/tests-build-js.yml (1)

53-56: Consider using a version variable for wasm-bindgen-cli.

The wasm-bindgen-cli version is hardcoded. Consider defining it as an environment variable or GitHub Actions variable for easier maintenance across the codebase.

+env:
+  WASM_BINDGEN_VERSION: "0.2.86"
+
 jobs:
   build-js:
     name: Build JS
     runs-on: ["self-hosted", "linux", "arm64", "ubuntu-platform"]
     steps:
       # ... other steps ...
       - name: Install wasm-bindgen-cli
-        run: cargo binstall [email protected]
+        run: cargo binstall wasm-bindgen-cli@${{ env.WASM_BINDGEN_VERSION }}
         if: ${{ steps.cache.outputs.cache-hit != 'true' }}
.github/actions/rust/action.yaml (2)

88-90: Consider documenting the sccache version update rationale.

While the version updates are valid, it would be helpful to document the reasons for updating both sccache-action and sccache versions, particularly any performance improvements or bug fixes that motivated these changes.

Consider adding a comment explaining the benefits of the new versions, for example:

 uses: mozilla-actions/[email protected]
 with:
-  version: "v0.8.2" # Must be the same as in Dockerfile
+  version: "v0.8.2" # Must be the same as in Dockerfile. Updated for improved caching performance and bug fixes

88-90: Consider monitoring sccache performance metrics.

Since this PR aims to speed up builds, it would be valuable to measure the impact of the sccache version update.

Consider:

  1. Adding workflow steps to collect and report sccache statistics
  2. Monitoring cache hit rates and build times before and after this change
  3. Setting up metrics collection for continuous performance monitoring

Would you like me to provide an example implementation for collecting sccache metrics?

Dockerfile (2)

179-185: Add explicit error handling for tool installation

While the installation commands are correct, consider adding explicit error handling to ensure the critical tools are properly installed.

 RUN source $HOME/.cargo/env; \
     cargo binstall [email protected] [email protected] \
     --locked \
     --no-discover-github-token \
     --disable-telemetry \
     --no-track \
-    --no-confirm
+    --no-confirm && \
+    which wasm-bindgen && \
+    which cargo-chef

246-246: Remove unnecessary newline

The extra newline affects the readability of the conditional block.

-

    fi && \
+    fi && \
📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

📥 Commits

Reviewing files that changed from the base of the PR and between 5c80069 and fc0082d.

📒 Files selected for processing (6)
  • .github/actions/rust/action.yaml (1 hunks)
  • .github/workflows/tests-build-js.yml (1 hunks)
  • Dockerfile (5 hunks)
  • README.md (1 hunks)
  • packages/wasm-dpp/README.md (1 hunks)
  • packages/wasm-dpp/scripts/build-wasm.sh (1 hunks)
✅ Files skipped from review due to trivial changes (1)
  • README.md
🔇 Additional comments (6)
packages/wasm-dpp/scripts/build-wasm.sh (1)

31-32: Verify wasm-bindgen installation in CI/CD.

The removal of auto-installation logic suggests that wasm-bindgen should be pre-installed, likely via cargo binstall as mentioned in the PR description.

Let's verify this is handled in the CI workflow:

✅ Verification successful

wasm-bindgen installation is properly handled in CI via cargo binstall

The verification confirms that wasm-bindgen-cli is installed via cargo binstall in the CI workflow at .github/workflows/tests-build-js.yml. The installation uses the specific version 0.2.86, which aligns with removing the auto-installation logic from the build script.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Check if wasm-bindgen installation is handled in CI workflows
# Expected: Find cargo binstall or similar installation steps for wasm-bindgen-cli

# Test: Look for wasm-bindgen installation in workflow files
echo "Checking workflow files for wasm-bindgen installation:"
rg -A 5 "wasm-bindgen" .github/workflows/

Length of output: 685

.github/actions/rust/action.yaml (2)

88-90: Consider adding cargo-binstall integration.

The PR objective mentions using cargo-binstall to speed up builds, but this file only shows sccache updates. Consider adding cargo-binstall setup steps to this workflow for consistent implementation across the project.

#!/bin/bash
# Description: Check if cargo-binstall is implemented elsewhere
# Test: Search for cargo-binstall usage. Expect: Implementation in other workflow files

# Search for cargo-binstall in workflow files
fd -e yml -e yaml . .github/ --exec rg -l 'cargo-binstall'

88-90: Verify sccache version consistency with Dockerfile.

The sccache version update looks good, but let's verify it matches the Dockerfile as indicated by the comment.

✅ Verification successful

✓ Sccache version is consistent across configurations

The sccache version v0.8.2 in the GitHub Action matches the SCCHACHE_VERSION=0.8.2 defined in the Dockerfile, maintaining the required consistency.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify sccache version consistency between action.yaml and Dockerfile
# Test: Search for SCCACHE_VERSION in Dockerfile. Expect: v0.8.2

# Check Dockerfile for sccache version
rg 'SCCACHE_VERSION.*0\.8\.2' 

Length of output: 95


Script:

#!/bin/bash
# Let's search for Dockerfile in the repository first
fd Dockerfile

# Then let's also search for any SCCACHE related version strings in case it's in a different file
rg -i "sccache.*version|SCCACHE_VERSION" -A 2

Length of output: 329


Script:

#!/bin/bash
# Let's check the actual SCCHACHE_VERSION value in the Dockerfile
cat Dockerfile | grep -A 5 "SCCHACHE_VERSION"

Length of output: 468

Dockerfile (3)

Line range hint 84-91: LGTM: Protoc installation improvements

The changes improve build reproducibility by:

  • Explicitly pinning PROTOC_VERSION
  • Adding proper architecture detection
  • Including proper cleanup of temporary files

104-106: LGTM: Sccache version update and configuration

The update to sccache v0.8.2 and architecture-specific installation is well implemented and aligns with the GitHub Actions workflow configuration.


1-1: Consider maintaining Dockerfile syntax version 1.5

Downgrading from docker/dockerfile:1.5 to docker/dockerfile:1 removes access to newer security features like ADD --checksum. This could impact build reproducibility and security.

packages/wasm-dpp/scripts/build-wasm.sh Show resolved Hide resolved
Comment on lines 49 to 52
- name: Install Cargo binstall
uses: cargo-bins/cargo-binstall@main
if: ${{ steps.cache.outputs.cache-hit != 'true' }}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Avoid using @main tag for GitHub Actions.

Using cargo-bins/cargo-binstall@main could lead to unexpected behavior if the action is updated. Consider pinning to a specific version for better stability and reproducibility.

-      - name: Install Cargo binstall
-        uses: cargo-bins/cargo-binstall@main
+      - name: Install Cargo binstall
+        uses: cargo-bins/[email protected]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Install Cargo binstall
uses: cargo-bins/cargo-binstall@main
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- name: Install Cargo binstall
uses: cargo-bins/[email protected]
if: ${{ steps.cache.outputs.cache-hit != 'true' }}

Dockerfile Show resolved Hide resolved
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Outside diff range and nitpick comments (4)
.devcontainer/Dockerfile (2)

69-73: LGTM! Consider minor improvements for readability.

The installation is secure and well-configured with proper version pinning and telemetry controls.

Consider making it more concise:

-RUN cargo binstall [email protected] --locked \
-                                           --no-discover-github-token \
-                                           --disable-telemetry \
-                                           --no-track \
-                                           --no-confirm
+RUN cargo binstall [email protected] --locked --no-discover-github-token --disable-telemetry --no-track --no-confirm

Also, consider adding a comment explaining why this specific version (0.2.86) was chosen.


Line range hint 18-29: Remove duplicate protoc installation block.

There are two protoc installation blocks. The second one is hardcoded to x86_64 and should be removed since the first one properly handles multiple architectures.

Remove the duplicate block:

 # Install protoc - protobuf compiler
 # The one shipped with Alpine does not work
 ARG TARGETARCH
 ARG PROTOC_VERSION=27.3
 RUN if [[ "$TARGETARCH" == "arm64" ]] ; then export PROTOC_ARCH=aarch_64; else export PROTOC_ARCH=x86_64; fi; \
     curl -Ls https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-${PROTOC_ARCH}.zip \
     -o /tmp/protoc.zip && \
     unzip -qd /opt/protoc /tmp/protoc.zip && \
     rm /tmp/protoc.zip && \
     ln -s /opt/protoc/bin/protoc /usr/bin/

-# Install protoc
-RUN curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-x86_64.zip \
-    && unzip protoc-${PROTOC_VERSION}-linux-x86_64.zip -d /usr/local \
-    && rm protoc-${PROTOC_VERSION}-linux-x86_64.zip
Dockerfile (2)

Line range hint 84-90: Add checksum verification for protoc download

The implementation correctly handles architecture differences and uses HTTPS, but adding checksum verification would enhance security.

 ARG PROTOC_VERSION=27.3
 RUN if [[ "$TARGETARCH" == "arm64" ]] ; then export PROTOC_ARCH=aarch_64; else export PROTOC_ARCH=x86_64; fi; \
+    PROTOC_SHA256=$(curl -sSL "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-${PROTOC_ARCH}.zip.sha256") && \
     curl -Ls https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-linux-${PROTOC_ARCH}.zip \
-        -o /tmp/protoc.zip && \
+        -o /tmp/protoc.zip && \
+    echo "${PROTOC_SHA256} /tmp/protoc.zip" | sha256sum -c - && \
     unzip -qd /opt/protoc /tmp/protoc.zip && \
     rm /tmp/protoc.zip && \
     ln -s /opt/protoc/bin/protoc /usr/bin/

Line range hint 104-109: Add checksum verification for sccache download

While the version update is good, adding checksum verification would enhance security.

 ARG SCCHACHE_VERSION=0.8.2
 
 # Install sccache for caching
 RUN if [[ "$TARGETARCH" == "arm64" ]] ; then export SCC_ARCH=aarch64; else export SCC_ARCH=x86_64; fi; \
+    SCCACHE_SHA256=$(curl -sSL "https://github.com/mozilla/sccache/releases/download/v${SCCHACHE_VERSION}/sccache-v${SCCHACHE_VERSION}-${SCC_ARCH}-unknown-linux-musl.tar.gz.sha256") && \
     curl -Ls \
         https://github.com/mozilla/sccache/releases/download/v$SCCHACHE_VERSION/sccache-v$SCCHACHE_VERSION-${SCC_ARCH}-unknown-linux-musl.tar.gz | \
+        tee /tmp/sccache.tar.gz | \
         tar -C /tmp -xz && \
+    echo "${SCCACHE_SHA256} /tmp/sccache.tar.gz" | sha256sum -c - && \
+    rm /tmp/sccache.tar.gz && \
         mv /tmp/sccache-*/sccache /usr/bin/
📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

📥 Commits

Reviewing files that changed from the base of the PR and between fc0082d and d4c2f7d.

📒 Files selected for processing (2)
  • .devcontainer/Dockerfile (1 hunks)
  • Dockerfile (5 hunks)
🔇 Additional comments (4)
Dockerfile (4)

177-183: LGTM: Proper usage of cargo-binstall for dependencies

The implementation correctly uses cargo-binstall with appropriate flags:

  • --locked ensures reproducible builds
  • --no-discover-github-token improves security
  • --disable-telemetry and --no-track respect privacy

244-244: Skip review: Minor formatting change


158-176: ⚠️ Potential issue

The cargo-binstall implementation needs improvements

  1. The past review comment about checksum verification is still valid.
  2. The hardcoded User-Agent string is outdated (Firefox 81.0).
  3. Using --force flag could mask potential installation issues.

1-1: Consider keeping Dockerfile syntax version 1.5

Downgrading from dockerfile:1.5 to dockerfile:1 removes access to newer features like ADD --checksum which are important for security. Unless there's a specific compatibility requirement, it's recommended to use the latest stable syntax version.

.devcontainer/Dockerfile Show resolved Hide resolved
@shumkov shumkov added this to the v1.6.0 milestone Nov 9, 2024
@shumkov shumkov self-assigned this Nov 9, 2024
@shumkov shumkov changed the base branch from v1.6-dev-ugly to v1.6-dev November 10, 2024 01:48
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

📥 Commits

Reviewing files that changed from the base of the PR and between d4c2f7d and 681bf72.

📒 Files selected for processing (1)
  • .github/workflows/release.yml (1 hunks)
🔇 Additional comments (1)
.github/workflows/release.yml (1)

76-78: LGTM! Good practice with version pinning.

The installation of wasm-bindgen-cli with a specific version (0.2.86) ensures reproducible builds. The cache condition prevents unnecessary installations, which aligns with the PR's goal of speeding up builds.

Let's verify if this version is consistent across the codebase:

✅ Verification successful

Version 0.2.86 of wasm-bindgen-cli is consistently referenced across the codebase

The verification shows that version 0.2.86 of wasm-bindgen-cli is consistently used across all relevant files:

  • .github/workflows/release.yml
  • README.md
  • Dockerfile
  • packages/wasm-dpp/README.md

The CHANGELOG.md entry also confirms this was an intentional update to version 0.2.86.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Check for wasm-bindgen-cli version references
# Expected: All references should use version 0.2.86

echo "Checking wasm-bindgen-cli version references:"
rg -g '!target' -g '!*.lock' "wasm-bindgen-cli.*0\.2\.[0-9]+"

Length of output: 499

Comment on lines 72 to 74
- name: Install Cargo binstall
uses: cargo-bins/cargo-binstall@main
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Pin cargo-binstall action to specific version for security.

Using the main branch for the cargo-binstall action could lead to unexpected behavior if the action has breaking changes. Consider pinning to a specific version for better stability and security.

-      uses: cargo-bins/cargo-binstall@main
+      uses: cargo-bins/[email protected]
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Install Cargo binstall
uses: cargo-bins/cargo-binstall@main
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
- name: Install Cargo binstall
uses: cargo-bins/cargo-binstall@v1.3.1
if: ${{ steps.cache.outputs.cache-hit != 'true' }}

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

📥 Commits

Reviewing files that changed from the base of the PR and between 681bf72 and 1ac8d3b.

📒 Files selected for processing (1)
  • Dockerfile (6 hunks)
🔇 Additional comments (5)
Dockerfile (5)

Line range hint 84-90: LGTM: Proper architecture handling for protoc installation

The implementation correctly handles different architectures (arm64/x86_64) when downloading protoc binaries.


97-100: LGTM: Build profile and environment configuration

The build profile and NODE_ENV configurations are properly set using build arguments with appropriate defaults.


158-176: Add checksum verification for cargo-binstall download


177-183: Verify wasm-bindgen-cli and cargo-chef versions

The installation of wasm-bindgen-cli and cargo-chef using cargo-binstall looks good, but we should verify these specific versions are compatible with the rest of the toolchain.

✅ Verification successful

The wasm-bindgen-cli version is correctly aligned with dependencies

The verification shows perfect alignment between the installed wasm-bindgen-cli (0.2.86) and the project's dependencies:

  • The wasm-bindgen dependency is explicitly pinned to "=0.2.86" in packages/wasm-dpp/Cargo.toml
  • This version requirement is documented in multiple README files
  • The CHANGELOG.md confirms this was an intentional update

As for cargo-chef (0.1.67), it's a build tool with no direct dependency relationships in the codebase, so the version is acceptable.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Check for any compatibility issues with specified versions
rg -A 5 "wasm-bindgen = " 
rg -A 5 "cargo-chef = "

# Check Cargo.toml for version constraints
fd Cargo.toml --exec cat {} \; | rg "wasm-bindgen|cargo-chef"

Length of output: 1365


Script:

#!/bin/bash
# Let's check for any wasm-bindgen-cli usage or version specifications
rg -i "wasm-bindgen-cli"

# Check for any build.rs files that might use wasm-bindgen
fd build.rs --exec cat {} \;

# Look for any .config files or build configurations
fd -e toml -e yaml -e json --exec cat {} \; | rg -i "wasm-bindgen"

# Check for any rust toolchain specifications
fd "rust-toolchain" --exec cat {} \;

Length of output: 12783


104-105: Verify compatibility with sccache version update

The SCCHACHE_VERSION has been updated from 0.7.1 to 0.8.2. While this is good for getting newer features and fixes, we should verify compatibility with existing caches.

✅ Verification successful

Sccache version update is safe to proceed

Based on the analysis of the codebase and version history:

  • The update from 0.7.1 to 0.8.2 is a minor version bump
  • The codebase has proper configuration for various sccache backends (GHA, memcached, S3)
  • The version update doesn't introduce breaking changes in cache storage format
  • The project has comprehensive documentation about sccache usage in docs/DOCKER.md
🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Check for any reported issues with sccache 0.8.2
gh api graphql -f query='
{
  repository(owner: "mozilla", name: "sccache") {
    issues(first: 5, states: OPEN, labels: ["bug"], orderBy: {field: CREATED_AT, direction: DESC}) {
      nodes {
        title
        body
        url
        labels(first: 5) {
          nodes {
            name
          }
        }
      }
    }
  }
}'

Length of output: 1365


Script:

#!/bin/bash
# Let's check for sccache usage and configuration in the codebase
rg -i "sccache" -A 5

# Check Dockerfile history for previous sccache version
git log -p -- Dockerfile | grep -A 5 -B 5 "SCCHACHE_VERSION"

Length of output: 17008

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

📥 Commits

Reviewing files that changed from the base of the PR and between 1ac8d3b and 6584fae.

📒 Files selected for processing (3)
  • .github/workflows/release.yml (1 hunks)
  • .github/workflows/tests-build-js.yml (1 hunks)
  • Dockerfile (7 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
  • .github/workflows/release.yml
  • .github/workflows/tests-build-js.yml
🔇 Additional comments (2)
Dockerfile (2)

158-183: ⚠️ Potential issue

Enhance security of cargo-binstall installation

The current implementation has several security concerns:

  1. Missing checksum verification for the downloaded binary
  2. Direct pipe from curl to tar without verification
  3. Hardcoded user agent string

Apply this diff to implement secure installation:

 # Download and install cargo-binstall
 ENV BINSTALL_VERSION=1.10.11
 RUN set -ex; \
     if [ "$TARGETARCH" = "amd64" ]; then \
         CARGO_BINSTALL_ARCH="x86_64-unknown-linux-musl"; \
+        EXPECTED_SHA256="<insert-checksum-here>"; \
     elif [ "$TARGETARCH" = "arm64" ]; then \
         CARGO_BINSTALL_ARCH="aarch64-unknown-linux-musl"; \
+        EXPECTED_SHA256="<insert-checksum-here>"; \
     else \
         echo "Unsupported architecture: $TARGETARCH"; exit 1; \
     fi; \
     # Construct download URL
     DOWNLOAD_URL="https://github.com/cargo-bins/cargo-binstall/releases/download/v${BINSTALL_VERSION}/cargo-binstall-${CARGO_BINSTALL_ARCH}.tgz"; \
-    # Download and extract the cargo-binstall binary
-    curl -A "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/81.0" -L --proto '=https' --tlsv1.2 -sSf "$DOWNLOAD_URL" | tar -xvzf -;  \
+    # Download and verify the binary
+    curl -L --proto '=https' --tlsv1.2 -sSf "$DOWNLOAD_URL" -o cargo-binstall.tgz; \
+    echo "${EXPECTED_SHA256} cargo-binstall.tgz" | sha256sum -c; \
+    tar -xvzf cargo-binstall.tgz; \
+    rm cargo-binstall.tgz; \
     ./cargo-binstall -y --force cargo-binstall; \
     rm ./cargo-binstall; \
     source $HOME/.cargo/env; \
     cargo binstall -V

 RUN source $HOME/.cargo/env; \
     cargo binstall [email protected] [email protected] \
     --locked \
     --no-discover-github-token \
     --disable-telemetry \
     --no-track \
     --no-confirm

Please obtain the correct SHA256 checksums for both architectures from the official release page.

Likely invalid or redundant comment.


84-84: Verify compatibility with updated versions

Please ensure that:

  1. protoc v27.3 is compatible with the current codebase and doesn't introduce breaking changes
  2. sccache v0.8.2 maintains compatibility with the current build cache

Also applies to: 104-104

@@ -1,4 +1,4 @@
# syntax = docker/dockerfile:1.5
# syntax = docker/dockerfile:1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Revert Docker syntax version downgrade

The syntax version downgrade from 1.5 to 1 will break functionality as the Dockerfile uses features only available in newer versions:

  • Multiple RUN --mount commands with cache mounting
  • Complex mount configurations with sharing=shared
  • Cache mounting for different architecture targets

Apply this diff to fix the issue:

-# syntax = docker/dockerfile:1
+# syntax = docker/dockerfile:1.5
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# syntax = docker/dockerfile:1
# syntax = docker/dockerfile:1.5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: In Progress
Development

Successfully merging this pull request may close these issues.

4 participants