The frontend job was pinned to node 16, which is old enough that some of
the packages patched in this branch refuse to install there. tar and
esbuild want node 18 or newer, serialize-javascript wants 20.
Node was also only pinned in the frontend job. The backend,
proto-compile-check and itest jobs all reference matrix.node_version
without declaring it in their matrix, so the expression resolved to an
empty string and setup-node fell back to whatever the runner happened to
ship. Two of those run `yarn install --frozen-lockfile`, so they need a
known version too.
Both are fixed by a NODE_VERSION env var, matching how GO_VERSION is
already handled. It replaces the matrix entry rather than feeding it,
because the env context isn't available inside strategy.matrix.
Mimic `lnd`s cleanup of docker space in CI by adding a new clean-space
job which removes the same docker related artifacts as `lnd` does prior
to running the rest of the docker.yml jobs.
Bumps lnd to v0.21.0-beta, lndclient to v0.21.0-1, and
taproot-assets to v0.8.0 across the root, litrpc, and perms
modules. taprpc uses the proper v1.1.0 tag.
lnd removed the deprecated SendPaymentSync, SendToRouteSync,
SendPayment (streaming), and SendToRoute (streaming) RPCs. The
account interceptor checkers and their tests for these RPCs are
removed since no client can call them anymore. The V2 checkers
already handle account tracking for payments.
The itest harness is updated for lnd v0.21's miner API changes
(SendOutputs -> SendOutput, Miner.Client.Generate -> GenerateBlocks,
waitForNTxsInMempool replaced by Miner.AssertNumTxsInMempool) and
TimeLockDelta bumped from 20 to 40 since lnd v0.21 raised
MinCLTVDelta from 18 to 24.
Apply least-privilege and standard hardening to the CI workflow:
- Set top-level `permissions: contents: read` so `GITHUB_TOKEN` no
longer defaults to broad read/write across the repo.
- Pass `github.base_ref` and `github.repository` via env vars in the
`check-commits` job to prevent shell injection via expression
interpolation in `run:` blocks.
- Pin third-party `jpribyl/action-docker-layer-caching` to a full
commit SHA so a tag retag cannot swap in unreviewed code.
- Bump `actions/checkout@v3` to `@v4` in `sqlc-check` for consistency
with the rest of the workflow.
- Use `yarn install --frozen-lockfile` for all dependency installs so
CI fails on lockfile drift instead of silently resolving new
package versions.
Custom channels integration tests have been fully migrated to the
taproot-assets repository where they run natively via the tapd-integrated
binary without any lightning-terminal dependency. This removes the
duplicate test suite and all supporting infrastructure from LiT.
The LiT-specific itests are unaffected.
When a PR originates from a fork, the PR branch doesn't exist in the
origin remote. This adds a step that uses `gh pr checkout` before
running the Claude action, which properly handles fork PRs by adding
the fork as a remote and fetching the branch from there.
From other repos, we have seen that it can get quite spammy. So removing
for now. Users can instead comment `@claude review this` once the PR is
ready for review.
Prior to this commit, logs were not correctly uploaded on failure as the
logs were being written under itest/.logs, but the workflow zipped only
itest/ **/*.log. Because .logs is a hidden directory, the glob doesn’t
match it, so 7z creates an empty archive.
We also move the logs to a non-hidden directory when being uploaded to
avoid that the logs are downloaded as a hidden directory.
Adds a separate 'build-itest' job that builds the itest binaries prior
to the actual itest jobs being kicked off. With this change we'll
rebuild the itest binaries at most once, instead of at most four times.
The setup-go@v5 action caches GOMODCACHE and GOCACHE by default when
there's a go.sum file present. The cache is immutable, and keys have the
form:
setup-go-{os}-{arch}-{os-version}-go-{version}-{hash}
where 'hash' comes from go.sum. These keys don't take build tags into
account, and whichever job finishes first writes to the cache.
Consider the 'main' workflow, in which a bunch of jobs are kicked off to
run concurrently. A job like 'lint', which runs quickly, gets privileges
to write to the cache, but an issue is that its artifacts are built with
different tags than are e.g. the itest jobs. Thus, when an itest job
later gets a cache hit, the cached entry doesn't actually contain the Go
archive files that the itest needs.
The changes introduced in this commit use the existing 'key-prefix'
argument to avoid this problem. Setting 'key-prefix' bypasses the
default setup-go cache, using a separate cache with keys that depend
on the supplied prefix.
The full keys in this case are:
{key_prefix}-go-{os}-{arch}-{go-version}-{hash}
For the itest jobs, key-prefix is simply set to 'itest', so itest
artifacts will be cached with keys prefixed by 'itest' that won't be
preempted with irrelevant entries from faster-running jobs like 'lint'.
Currently the Docker image build regularly fails with "no space left on
disk". We try to delete additional files and docker images to try to
avoid that error.
This takes over two more settings we have in the lnd repo. The first is
to cancel existing CI runs for the same PR if it is pushed again before
the previous run has completed.
The second is just for consistency, to make sure all shells are bash
shells.
This attempts to fix the following error that sometimes occurs on the
GitHub runners:
go: github.com/lightninglabs/lightning-terminal imports
github.com/lightningnetwork/lnd/kvdb imports
github.com/lightningnetwork/lnd/kvdb/etcd imports
go.etcd.io/etcd/server/v3/embed: mkdir /home/runner/go/pkg/mod/cache/download/go.etcd.io/etcd/server: permission denied
The suspicion is that the lint step that runs as root within docker
changes the permissions of some of the module cache directories.
So by simply changing the order of operations, this should be fixed.
Later on we will want to run the unit tests against different backends.
When that is the case, we can just add a new unit_type to this matrix
instead of needing to repeat all the same set-up steps.
To fix the issue that currently prevents the second image (with the /lit
path prefix) to be built and pushed (both for releases and nightly
builds), we clear the build cache between builds.
Added a daily schedule to the Docker workflow to automate builds and
pushes of the `daily-testing` image. This change introduces a new cron
job that runs every day at midnight (UTC) and triggers the workflow.
The linter was disabled before due to a bug. Since the bug was likely
caused by an issue with a go module in a dependency project which was
updated in the meantime, we attempt to re-enable the linter in the CI
now.
