Unified binary (#12)

* Started merging service binaries

* Started refactoring handle_docker_init()

* More refactoring of handle_docker_init

* Fixed some tests

* Reverted to multiple Docker images, merged CLI binary into CB

* Updated justfile

* Updated release workflow

* Updated docs for unified binary

* Clippy fix

* Added integration tests to ensure the CLI commands work

* one-click kurtosis support

* More doc changes to use new binary

* Remove panic!() and unwrap() from docker_init.rs and improve test
coverage for these flows

* Add cmds for test coverage + regroup kurtosis commands for easier
viewing in `just -l`

* Add criterion microbenchmark test for get_header with Justfile cmds

* Add binary signing to GitHub releases (Commit-Boost#433)

Co-authored-by: Jason Vranek <jasonvranek@gmail.com>

* Fix for code scanning alert no. 21: Code injection

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* prevent cmd injection and pin sigstore version

* fmt code

---------

Co-authored-by: Joe Clapis <jclapis@outlook.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: 3 people

.github/workflows/release-gate.yml

@@ -0,0 +1,96 @@
+name: Release Gate
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+jobs:
+  release-gate:
+    name: Tag and update release branches
+    runs-on: ubuntu-latest
+    # Only run when a release/ branch is merged (not just closed)
+    if: |
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.head.ref, 'release/v')
+
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          # Full history required for version comparison against existing tags
+          # and for the fast-forward push to stable/beta.
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Extract and validate version
+        id: version
+        env:
+          BRANCH_REF: ${{ github.event.pull_request.head.ref }}
+        run: |
+          BRANCH="$BRANCH_REF"
+          NEW_VERSION="${BRANCH#release/}"
+          echo "new=${NEW_VERSION}" >> $GITHUB_OUTPUT
+
+          # Determine if this is an RC
+          if echo "$NEW_VERSION" | grep -qE '\-rc[0-9]+$'; then
+            echo "is_rc=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_rc=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Validate version is strictly increasing
+        env:
+          NEW_VERSION: ${{ steps.version.outputs.new }}
+        run: |
+          # Get the latest tag; if none exist yet, skip the comparison
+          LATEST_TAG=$(git tag --list 'v*' --sort=-version:refname | head -n1)
+          if [ -z "$LATEST_TAG" ]; then
+            echo "No existing tags found — skipping version comparison"
+            exit 0
+          fi
+
+          LATEST_VERSION="${LATEST_TAG#v}"
+
+          python3 - <<EOF
+          import sys
+          from packaging.version import Version
+
+          def normalize(v):
+              # Convert vX.Y.Z-rcQ → X.Y.ZrcQ (PEP 440)
+              return v.replace("-rc", "rc")
+
+          new    = Version(normalize("$NEW_VERSION"))
+          latest = Version(normalize("$LATEST_VERSION"))
+
+          print(f"Latest tag : {latest}")
+          print(f"New version: {new}")
+
+          if new <= latest:
+              print(f"\n❌ {new} is not strictly greater than current {latest}")
+              sys.exit(1)
+
+          print(f"\n✅ Version order is valid")
+          EOF
+
+      - name: Configure git
+        run: |
+          git config user.name  "commit-boost-release-bot[bot]"
+          git config user.email "commit-boost-release-bot[bot]@users.noreply.github.com"
+
+      - name: Create and push tag
+        env:
+          VERSION: ${{ steps.version.outputs.new }}
+        run: |
+          git tag "$VERSION" HEAD
+          git push origin "$VERSION"
+          # Branch fast-forwarding happens in release.yml after all artifacts
+          # are successfully built. stable/beta are never touched if the build fails.

.github/workflows/release.yml

@@ -8,30 +8,25 @@ on:
 permissions:
   contents: write
   packages: write
+  id-token: write
 
 jobs:
-  # Builds the x64 and arm64 binaries for Linux, for all 3 crates, via the Docker builder
+  # Builds the x64 and arm64 binary for Linux via the Docker builder
   build-binaries-linux:
     strategy:
       matrix:
         target:
           - amd64
           - arm64
         name:
-          - commit-boost-cli
-          - commit-boost-pbs
-          - commit-boost-signer
+          - commit-boost
         include:
           - target: amd64
             package-suffix: x86-64
           - target: arm64
             package-suffix: arm64
-          - name: commit-boost-cli
-            target-crate: cli
-          - name: commit-boost-pbs
-            target-crate: pbs
-          - name: commit-boost-signer
-            target-crate: signer
+          - name: commit-boost
+            target-crate: commit-boost
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -44,6 +39,9 @@ jobs:
         run: |
           echo "Releasing commit: $(git rev-parse HEAD)"
 
+      - name: Set lowercase owner
+        run: echo "OWNER=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
@@ -63,8 +61,8 @@ jobs:
           context: .
           push: false
           platforms: linux/amd64,linux/arm64
-          cache-from: type=registry,ref=ghcr.io/commit-boost/buildcache:${{ matrix.target-crate}}
-          cache-to: type=registry,ref=ghcr.io/commit-boost/buildcache:${{ matrix.target-crate }},mode=max
+          cache-from: type=registry,ref=ghcr.io/${{ env.OWNER }}/buildcache:${{ matrix.target-crate}}
+          cache-to: type=registry,ref=ghcr.io/${{ env.OWNER }}/buildcache:${{ matrix.target-crate }},mode=max
           file: provisioning/build.Dockerfile
           outputs: type=local,dest=build
           build-args: |
@@ -83,7 +81,7 @@ jobs:
           path: |
             ${{ matrix.name }}-${{ github.ref_name }}-linux_${{ matrix.package-suffix }}.tar.gz
 
-  # Builds the arm64 binaries for Darwin, for all 3 crates, natively
+  # Builds the arm64 binary for Darwin natively
   build-binaries-darwin:
     strategy:
       matrix:
@@ -92,9 +90,7 @@ jobs:
           # - x86_64-apple-darwin
           - aarch64-apple-darwin
         name:
-          - commit-boost-cli
-          - commit-boost-pbs
-          - commit-boost-signer
+          - commit-boost
         include:
           # - target: x86_64-apple-darwin
           #   os: macos-latest-large
@@ -158,6 +154,31 @@ jobs:
           path: |
             ${{ matrix.name }}-${{ github.ref_name }}-darwin_${{ matrix.package-suffix }}.tar.gz
 
+  # Signs the binaries
+  sign-binaries:
+    needs:
+      - build-binaries-linux
+      - build-binaries-darwin
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: ./artifacts
+          pattern: "commit-boost*"
+
+      - name: Sign binaries
+        uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d #v3.2.0
+        with:
+          inputs: ./artifacts/**/*.tar.gz
+
+      - name: Upload signatures
+        uses: actions/upload-artifact@v4
+        with:
+          name: signatures-${{ github.ref_name }}
+          path: |
+            ./artifacts/**/*.sigstore.json
+
   # Builds the PBS Docker image
   build-and-push-pbs-docker:
     needs: [build-binaries-linux]
@@ -173,16 +194,19 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           path: ./artifacts
-          pattern: "commit-boost-*"
+          pattern: "commit-boost*"
 
       - name: Extract binaries
         run: |
           mkdir -p ./artifacts/bin/linux_amd64
           mkdir -p ./artifacts/bin/linux_arm64
-          tar -xzf ./artifacts/commit-boost-pbs-${{ github.ref_name }}-linux_x86-64/commit-boost-pbs-${{ github.ref_name }}-linux_x86-64.tar.gz -C ./artifacts/bin
-          mv ./artifacts/bin/commit-boost-pbs ./artifacts/bin/linux_amd64/commit-boost-pbs
-          tar -xzf ./artifacts/commit-boost-pbs-${{ github.ref_name }}-linux_arm64/commit-boost-pbs-${{ github.ref_name }}-linux_arm64.tar.gz -C ./artifacts/bin
-          mv ./artifacts/bin/commit-boost-pbs ./artifacts/bin/linux_arm64/commit-boost-pbs
+          tar -xzf ./artifacts/commit-boost-${{ github.ref_name }}-linux_x86-64/commit-boost-${{ github.ref_name }}-linux_x86-64.tar.gz -C ./artifacts/bin
+          mv ./artifacts/bin/commit-boost ./artifacts/bin/linux_amd64/commit-boost
+          tar -xzf ./artifacts/commit-boost-${{ github.ref_name }}-linux_arm64/commit-boost-${{ github.ref_name }}-linux_arm64.tar.gz -C ./artifacts/bin
+          mv ./artifacts/bin/commit-boost ./artifacts/bin/linux_arm64/commit-boost
+
+      - name: Set lowercase owner
+        run: echo "OWNER=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -206,8 +230,8 @@ jobs:
           build-args: |
             BINARIES_PATH=./artifacts/bin
           tags: |
-            ghcr.io/commit-boost/pbs:${{ github.ref_name }}
-            ${{ !contains(github.ref_name, 'rc') && 'ghcr.io/commit-boost/pbs:latest' || '' }}
+            ghcr.io/${{ env.OWNER }}/pbs:${{ github.ref_name }}
+            ${{ !contains(github.ref_name, 'rc') && format('ghcr.io/{0}/pbs:latest', env.OWNER) || '' }}
           file: provisioning/pbs.Dockerfile
 
   # Builds the Signer Docker image
@@ -225,16 +249,19 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           path: ./artifacts
-          pattern: "commit-boost-*"
+          pattern: "commit-boost*"
 
       - name: Extract binaries
         run: |
           mkdir -p ./artifacts/bin/linux_amd64
           mkdir -p ./artifacts/bin/linux_arm64
-          tar -xzf ./artifacts/commit-boost-signer-${{ github.ref_name }}-linux_x86-64/commit-boost-signer-${{ github.ref_name }}-linux_x86-64.tar.gz -C ./artifacts/bin
-          mv ./artifacts/bin/commit-boost-signer ./artifacts/bin/linux_amd64/commit-boost-signer
-          tar -xzf ./artifacts/commit-boost-signer-${{ github.ref_name }}-linux_arm64/commit-boost-signer-${{ github.ref_name }}-linux_arm64.tar.gz -C ./artifacts/bin
-          mv ./artifacts/bin/commit-boost-signer ./artifacts/bin/linux_arm64/commit-boost-signer
+          tar -xzf ./artifacts/commit-boost-${{ github.ref_name }}-linux_x86-64/commit-boost-${{ github.ref_name }}-linux_x86-64.tar.gz -C ./artifacts/bin
+          mv ./artifacts/bin/commit-boost ./artifacts/bin/linux_amd64/commit-boost
+          tar -xzf ./artifacts/commit-boost-${{ github.ref_name }}-linux_arm64/commit-boost-${{ github.ref_name }}-linux_arm64.tar.gz -C ./artifacts/bin
+          mv ./artifacts/bin/commit-boost ./artifacts/bin/linux_arm64/commit-boost
+
+      - name: Set lowercase owner
+        run: echo "OWNER=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -258,32 +285,110 @@ jobs:
           build-args: |
             BINARIES_PATH=./artifacts/bin
           tags: |
-            ghcr.io/commit-boost/signer:${{ github.ref_name }}
-            ${{ !contains(github.ref_name, 'rc') && 'ghcr.io/commit-boost/signer:latest' || '' }}
+            ghcr.io/${{ env.OWNER }}/signer:${{ github.ref_name }}
+            ${{ !contains(github.ref_name, 'rc') && format('ghcr.io/{0}/signer:latest', env.OWNER) || '' }}
           file: provisioning/signer.Dockerfile
 
   # Creates a draft release on GitHub with the binaries
   finalize-release:
     needs:
       - build-binaries-linux
       - build-binaries-darwin
+      - sign-binaries
       - build-and-push-pbs-docker
       - build-and-push-signer-docker
     runs-on: ubuntu-latest
     steps:
-      - name: Download artifacts
+      - name: Download binaries
+        uses: actions/download-artifact@v4
+        with:
+          path: ./artifacts
+          pattern: "commit-boost*"
+
+      - name: Download signatures
         uses: actions/download-artifact@v4
         with:
           path: ./artifacts
-          pattern: "commit-boost-*"
+          pattern: "signatures-${{ github.ref_name }}*"
 
       - name: Finalize Release
         uses: softprops/action-gh-release@v2
         with:
           files: ./artifacts/**/*
           draft: true
-          prerelease: false
+          prerelease: ${{ contains(github.ref_name, '-rc') }}
           tag_name: ${{ github.ref_name }}
           name: ${{ github.ref_name }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # Fast-forwards stable (full release) or beta (RC) to the new tag.
+  # Runs after all artifacts are built and the draft release is created,
+  # so stable/beta are never touched if any part of the pipeline fails.
+  fast-forward-branch:
+    needs:
+      - finalize-release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Configure git
+        run: |
+          git config user.name  "commit-boost-release-bot[bot]"
+          git config user.email "commit-boost-release-bot[bot]@users.noreply.github.com"
+
+      - name: Fast-forward beta branch (RC releases)
+        if: contains(github.ref_name, '-rc')
+        run: |
+          git checkout beta
+          git merge --ff-only "${{ github.ref_name }}"
+          git push origin beta
+
+      - name: Fast-forward stable branch (full releases)
+        if: "!contains(github.ref_name, '-rc')"
+        run: |
+          git checkout stable
+          git merge --ff-only "${{ github.ref_name }}"
+          git push origin stable
+
+  # Deletes the tag if any job in the release pipeline fails.
+  # This keeps the tag and release artifacts in sync — a tag should only
+  # exist if the full pipeline completed successfully.
+  # stable/beta are never touched on failure since fast-forward-branch
+  # only runs after finalize-release succeeds.
+  #
+  # Note: if finalize-release specifically fails, a draft release may already
+  # exist on GitHub pointing at the now-deleted tag and will need manual cleanup.
+  cleanup-on-failure:
+    needs:
+      - build-binaries-linux
+      - build-binaries-darwin
+      - sign-binaries
+      - build-and-push-pbs-docker
+      - build-and-push-signer-docker
+      - finalize-release
+      - fast-forward-branch
+    runs-on: ubuntu-latest
+    if: failure()
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Delete tag
+        run: git push origin --delete ${{ github.ref_name }}

.gitignore

@@ -24,3 +24,6 @@ devenv.*
 devenv.lock
 .devenv.flake.nix
 .envrc
+
+# Generated from testnet
+kurtosis-dump