Opus's fixes to the fixes

Author: OisinKyne

.github/workflows/docker-publish-x402.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - feat/secure-enclave-inference
     tags:
       - 'v*'
     paths:

.github/workflows/lint-test.yaml

@@ -1,8 +1,6 @@
 name: Lint and Test Charts
 
 on:
-  push:
-    branches: [ main ]
   pull_request:
     branches: [ main ]
 

cmd/obol/sell.go

@@ -50,6 +50,7 @@ func sellCommand(cfg *config.Config) *cli.Command {
 			sellStatusCommand(cfg),
 			sellTestCommand(cfg),
 			sellStopCommand(cfg),
+			sellUpdateCommand(cfg),
 			sellDeleteCommand(cfg),
 			sellPricingCommand(cfg),
 			sellRegisterCommand(cfg),
@@ -1334,6 +1335,137 @@ func sellStopCommand(cfg *config.Config) *cli.Command {
 	}
 }
 
+// ---------------------------------------------------------------------------
+// sell update
+// ---------------------------------------------------------------------------
+
+func sellUpdateCommand(cfg *config.Config) *cli.Command {
+	return &cli.Command{
+		Name:      "update",
+		Usage:     "Update pricing or wallet on an existing ServiceOffer in place",
+		ArgsUsage: "<name>",
+		Description: `Patches a live ServiceOffer without deleting it. Only the fields you pass
+are changed; everything else is preserved. The serviceoffer-controller will
+reconcile the new payment config automatically.
+
+Switching price models (e.g. per-request → per-mtok) nulls the previous keys
+so the controller picks up the new model.
+
+Examples:
+  obol sell update my-api -n llm --per-request 0.002
+  obol sell update my-api -n llm --per-mtok 5.0
+  obol sell update my-api -n llm --wallet 0xNew... --chain base`,
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:     "namespace",
+				Aliases:  []string{"n"},
+				Usage:    "Namespace of the ServiceOffer",
+				Required: true,
+			},
+			&cli.StringFlag{
+				Name:    "wallet",
+				Aliases: []string{"w"},
+				Usage:   "New USDC recipient wallet address",
+			},
+			&cli.StringFlag{
+				Name:  "chain",
+				Usage: "New payment chain (base, base-sepolia, ethereum)",
+			},
+			&cli.StringFlag{
+				Name:  "price",
+				Usage: "New per-request price in USDC (alias for --per-request)",
+			},
+			&cli.StringFlag{
+				Name:  "per-request",
+				Usage: "New per-request price in USDC",
+			},
+			&cli.StringFlag{
+				Name:  "per-mtok",
+				Usage: "New per-million-tokens price in USDC",
+			},
+			&cli.StringFlag{
+				Name:  "per-hour",
+				Usage: "New per-compute-hour price in USDC",
+			},
+		},
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			u := getUI(cmd)
+			if cmd.NArg() == 0 {
+				return errors.New("name required: obol sell update <name> -n <ns> [--per-request N | --per-mtok N | --per-hour N] [--wallet 0x...] [--chain base]")
+			}
+
+			name := cmd.Args().First()
+			if err := validate.Name(name); err != nil {
+				return err
+			}
+			ns := cmd.String("namespace")
+
+			if _, err := kubectlOutput(cfg, "get", "serviceoffers.obol.org", name, "-n", ns, "-o", "name"); err != nil {
+				return fmt.Errorf("ServiceOffer %s/%s not found: %w", ns, name, err)
+			}
+
+			payment := map[string]any{}
+
+			if wallet := strings.TrimSpace(cmd.String("wallet")); wallet != "" {
+				if err := x402verifier.ValidateWallet(wallet); err != nil {
+					return err
+				}
+				payment["payTo"] = wallet
+			}
+
+			if chain := strings.TrimSpace(cmd.String("chain")); chain != "" {
+				payment["network"] = chain
+			}
+
+			priceSet := cmd.String("price") != "" || cmd.String("per-request") != "" || cmd.String("per-mtok") != "" || cmd.String("per-hour") != ""
+			if priceSet {
+				priceTable, err := resolvePriceTable(cmd, true)
+				if err != nil {
+					return err
+				}
+
+				price := map[string]any{
+					"perRequest": nil,
+					"perMTok":    nil,
+					"perHour":    nil,
+				}
+				switch {
+				case priceTable.PerRequest != "":
+					price["perRequest"] = priceTable.PerRequest
+				case priceTable.PerMTok != "":
+					price["perMTok"] = priceTable.PerMTok
+				case priceTable.PerHour != "":
+					price["perHour"] = priceTable.PerHour
+				}
+				payment["price"] = price
+			}
+
+			if len(payment) == 0 {
+				return errors.New("nothing to update: pass at least one of --per-request / --per-mtok / --per-hour / --wallet / --chain")
+			}
+
+			patch := map[string]any{
+				"spec": map[string]any{
+					"payment": payment,
+				},
+			}
+			patchBytes, err := json.Marshal(patch)
+			if err != nil {
+				return fmt.Errorf("marshal patch: %w", err)
+			}
+
+			if err := kubectlRun(cfg, "patch", "serviceoffers.obol.org", name, "-n", ns, "--type=merge", "-p", string(patchBytes)); err != nil {
+				return fmt.Errorf("failed to patch serviceoffer: %w", err)
+			}
+
+			u.Successf("ServiceOffer %s/%s updated", ns, name)
+			u.Info("The controller will reconcile the new payment config.")
+			u.Infof("Check status: obol sell status %s -n %s", name, ns)
+			return nil
+		},
+	}
+}
+
 // ---------------------------------------------------------------------------
 // sell delete
 // ---------------------------------------------------------------------------

internal/embed/infrastructure/values/monitoring.yaml.gotmpl

@@ -48,6 +48,15 @@ nodeExporter:
   enabled: true
 
 prometheus-node-exporter:
+  # Pin to v1.11.0 — upstream v1.10.2 ships a multi-arch manifest that fails the
+  # containerd image-integrity check on Apple Silicon (digest mismatch →
+  # ImagePullBackOff). v1.11.0 pulls cleanly on both arm64 and amd64. Digest
+  # pin defends against a re-tag landing a bad arm64 layer again.
+  image:
+    registry: quay.io
+    repository: prometheus/node-exporter
+    tag: v1.11.0
+    digest: sha256:2f0cc335ef9ea15d6c96e1c0d693d8b57c0b794d0244b22313a6c162bd1cb1b8
   resources:
     requests:
       cpu: 10m