fix(deps): upgrade vulnerable dependencies and add govulncheck CI #1083

Workflow file for this run

.github/workflows/cannon-smoke-test.yaml at d5ab92a

	name: Cannon Smoke Test

	on:
	pull_request:
	paths:
	- '**.go'
	- 'go.mod'
	- 'go.sum'
	- 'Dockerfile'
	- 'docker-compose.yml'
	- 'deploy/**'
	- '.github/cannon/**'
	- '.github/workflows/cannon-smoke-test.yaml'
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true
	jobs:
	cannon-smoke-test:
	timeout-minutes: 20
	runs-on: ubuntu-latest
	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- name: Install dependencies
	run: \|
	# Install clickhouse client
	sudo apt-get install -y apt-transport-https ca-certificates curl gnupg
	curl -fsSL 'https://packages.clickhouse.com/rpm/lts/repodata/repomd.xml.key' \| sudo gpg --dearmor -o /usr/share/keyrings/clickhouse-keyring.gpg
	echo "deb [signed-by=/usr/share/keyrings/clickhouse-keyring.gpg] https://packages.clickhouse.com/deb stable main" \| sudo tee \
	/etc/apt/sources.list.d/clickhouse.list
	sudo apt-get update
	sudo apt-get install -y clickhouse-client
	clickhouse-client --version

	# Install yq for YAML parsing
	sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
	sudo chmod +x /usr/local/bin/yq
	yq --version
	- name: Pull docker compose images in the background
	run: \|
	docker compose pull &
	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
	- name: Build xatu image
	uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
	with:
	context: .
	load: true
	tags: ethpandaops/xatu:local
	cache-from: type=gha
	cache-to: type=gha,mode=max
	- name: Fetch finalized epoch from beacon node
	id: beacon
	run: \|
	# Read config
	BEACON_NODE="https://mainnet-archive-lb-bn.utility.production.platform.ethpandaops.io"
	EPOCH_OFFSET=$(yq '.epoch_offset' .github/cannon/seeding.yaml)
	NETWORK_ID=$(yq '.network.id' .github/cannon/seeding.yaml)
	NETWORK_NAME=$(yq '.network.name' .github/cannon/seeding.yaml)

	echo "Fetching finalized checkpoint from $BEACON_NODE..."
	FINALIZED_RESPONSE=$(curl -s -H "Authorization: ${{ secrets.PLATFORM_UTILITY_NODE_AUTHORIZATION_2 }}" \
	"$BEACON_NODE/eth/v1/beacon/states/finalized/finality_checkpoints")

	FINALIZED_EPOCH=$(echo "$FINALIZED_RESPONSE" \| jq -r '.data.finalized.epoch')

	if [ -z "$FINALIZED_EPOCH" ] \|\| [ "$FINALIZED_EPOCH" == "null" ]; then
	echo "Failed to fetch finalized epoch"
	echo "Response: $FINALIZED_RESPONSE"
	exit 1
	fi

	# Calculate seed epoch (finalized - offset - 1 because cannon processes FROM this epoch ascending)
	SEED_EPOCH=$((FINALIZED_EPOCH - EPOCH_OFFSET - 1))
	# Target epoch is what we expect to see data for
	TARGET_EPOCH=$((FINALIZED_EPOCH - EPOCH_OFFSET))

	echo "Finalized epoch: $FINALIZED_EPOCH"
	echo "Epoch offset: $EPOCH_OFFSET"
	echo "Seed epoch: $SEED_EPOCH"
	echo "Target epoch: $TARGET_EPOCH"
	echo "Network: $NETWORK_NAME (ID: $NETWORK_ID)"

	# Set outputs
	echo "finalized_epoch=$FINALIZED_EPOCH" >> $GITHUB_OUTPUT
	echo "seed_epoch=$SEED_EPOCH" >> $GITHUB_OUTPUT
	echo "target_epoch=$TARGET_EPOCH" >> $GITHUB_OUTPUT
	echo "network_id=$NETWORK_ID" >> $GITHUB_OUTPUT
	echo "network_name=$NETWORK_NAME" >> $GITHUB_OUTPUT
	- name: Run Xatu stack
	timeout-minutes: 10
	shell: bash
	run: \|
	docker compose up --detach --quiet-pull
	- name: Wait for Xatu stack to be ready
	run: \|
	echo "Waiting for xatu-server gRPC to be ready on port 8080..."
	for i in $(seq 1 30); do
	if bash -c 'echo > /dev/tcp/localhost/8080' 2>/dev/null; then
	echo "xatu-server is ready."
	break
	fi
	if [ "$i" -eq 30 ]; then
	echo "::error::xatu-server failed to become ready"
	echo "=== Container status ==="
	docker ps -a --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
	echo "=== xatu-server logs ==="
	docker logs xatu-server 2>&1 \| tail -50
	exit 1
	fi
	echo " attempt $i/30..."
	sleep 2
	done

	echo ""
	echo "=== Container status ==="
	docker ps -a --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
	- name: Seed Postgres with cannon data
	run: \|
	set -e
	NETWORK_ID="${{ steps.beacon.outputs.network_id }}"
	SEED_EPOCH="${{ steps.beacon.outputs.seed_epoch }}"

	# Wait for Postgres to be ready
	echo "Waiting for Postgres to be ready..."
	docker exec xatu-postgres sh -c 'while ! pg_isready; do sleep 1; done'
	echo "Postgres is ready."

	# Wait for the cannon_location table to be created
	echo "Waiting for cannon_location table to be created..."
	until docker exec xatu-postgres psql -U user -d xatu -c "SELECT 1 FROM cannon_location LIMIT 1" &> /dev/null
	do
	echo "Table not ready yet. Waiting 5 seconds..."
	sleep 5
	done
	echo "cannon_location table is now available."

	# Generate and execute seeding commands for each event type
	echo "Seeding cannon_location table..."

	EVENT_TYPES=$(yq '.event_types[].name' .github/cannon/seeding.yaml)

	for TYPE in $EVENT_TYPES; do
	VALUE="{\"backfillingCheckpointMarker\":{\"finalizedEpoch\":\"$SEED_EPOCH\"}}"
	SQL="INSERT INTO cannon_location (network_id, type, value) VALUES ('$NETWORK_ID', '$TYPE', '$VALUE') ON CONFLICT (network_id, type) DO UPDATE SET value = EXCLUDED.value, update_time = now();"
	echo "Seeding $TYPE at epoch $SEED_EPOCH"
	docker exec xatu-postgres psql -U user -d xatu -c "$SQL"
	done

	echo "Seeding completed successfully."
	- name: Show the state of the database
	run: \|
	docker exec xatu-postgres psql -U user -d xatu -c "SELECT * FROM cannon_location;"
	- name: Create Xatu Cannon config
	run: \|
	NETWORK_NAME="${{ steps.beacon.outputs.network_name }}"

	cat <<EOF > /tmp/cannon_config.yaml
	logging: debug
	name: cannon-smoke-test
	labels:
	ethpandaops: rocks

	# Only enable derivers for event types we're testing
	derivers:
	attesterSlashing:
	enabled: false
	blsToExecutionChange:
	enabled: false
	deposit:
	enabled: false
	withdrawal:
	enabled: true
	executionTransaction:
	enabled: true
	proposerSlashing:
	enabled: false
	voluntaryExit:
	enabled: false
	beaconBlock:
	enabled: true
	beaconBlobSidecar:
	enabled: false
	proposerDuty:
	enabled: true
	beaconCommittee:
	enabled: true

	ntpServer: time.google.com

	ethereum:
	beaconNodeAddress: "https://mainnet-archive-lb-bn.utility.production.platform.ethpandaops.io"
	beaconNodeHeaders:
	Authorization: "AUTH_HEADER"
	overrideNetworkName: "$NETWORK_NAME"
	coordinator:
	address: xatu-server:8080

	outputs:
	- name: xatu
	type: xatu
	config:
	address: xatu-server:8080
	tls: false
	maxQueueSize: 51200
	batchTimeout: 1s
	exportTimeout: 30s
	maxExportBatchSize: 512
	EOF
	- name: Show config
	run: \|
	cat /tmp/cannon_config.yaml
	- name: Set authorization header
	run: \|
	sed -i 's/AUTH_HEADER/${{ secrets.PLATFORM_UTILITY_NODE_AUTHORIZATION_2 }}/' /tmp/cannon_config.yaml
	- name: Start Xatu cannon
	run: \|
	docker run -d --network xatu_xatu-net --name xatu-cannon -v /tmp/cannon_config.yaml:/etc/xatu/config.yaml ethpandaops/xatu:local cannon --config /etc/xatu/config.yaml
	- name: Wait for Xatu cannon to start
	run: \|
	sleep 5
	docker logs xatu-cannon
	- name: Verify Clickhouse has data
	timeout-minutes: 15
	env:
	TARGET_EPOCH: ${{ steps.beacon.outputs.target_epoch }}
	NETWORK_NAME: ${{ steps.beacon.outputs.network_name }}
	run: \|
	.github/cannon/assert_clickhouse.sh .github/cannon/seeding.yaml
	- name: Dump diagnostic info on failure
	if: failure() \|\| cancelled()
	run: \|
	echo "=== Container status ==="
	docker ps -a --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'
	echo ""
	echo "=== Docker network ==="
	docker network inspect xatu_xatu-net --format '{{range .Containers}}{{.Name}} {{.IPv4Address}}{{"\n"}}{{end}}' 2>/dev/null \|\| echo "Network not found"
	echo ""
	echo "=== xatu-server logs (last 50) ==="
	docker logs xatu-server 2>&1 \| tail -50 \|\| echo "Container not found"
	echo ""
	echo "=== xatu-cannon logs (last 50) ==="
	docker logs xatu-cannon 2>&1 \| tail -50 \|\| echo "Container not found"
	- name: Collect docker logs on failure
	if: failure() \|\| cancelled()
	uses: jwalton/gh-docker-logs@2741064ab9d7af54b0b1ffb6076cf64c16f0220e # v2.2.2
	with:
	dest: './logs'
	- name: Tar logs
	if: failure() \|\| cancelled()
	run: tar cvzf ./logs.tgz ./logs
	- name: Upload logs to GitHub
	if: failure() \|\| cancelled()
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
	with:
	name: logs.tgz
	path: ./logs.tgz

Navigation Menu

Uh oh!

fix(deps): upgrade vulnerable dependencies and add govulncheck CI #1083

Workflow file

fix(deps): upgrade vulnerable dependencies and add govulncheck CI #1083

Uh oh!

Workflow file for this run