Fix determinism

Author: nolag

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version: 1.3.12
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -78,7 +78,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: latest
+          bun-version: 1.3.12
 
       - name: Cache Bun dependencies
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
@@ -94,7 +94,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ~/.cache/javy
-          key: ${{ runner.os }}-cre-plugin-v8.1.0-${{ hashFiles('packages/cre-sdk-javy-plugin/src/javy_chainlink_sdk/Cargo.lock', 'packages/cre-sdk-javy-plugin/src/javy_chainlink_sdk/rust-toolchain.toml', 'packages/cre-sdk-javy-plugin/scripts/build-plugin-local.sh', 'packages/cre-sdk-javy-plugin/scripts/print-javy-path-for-build.ts', 'packages/cre-sdk-javy-plugin/scripts/ensure-javy.ts', 'packages/cre-sdk-javy-plugin/Dockerfile') }}
+          key: ${{ runner.os }}-cre-plugin-v8.1.0-${{ hashFiles('packages/cre-sdk-javy-plugin/src/javy_chainlink_sdk/Cargo.lock', 'packages/cre-sdk-javy-plugin/src/cre_generated_host.Cargo.lock', 'packages/cre-sdk-javy-plugin/src/javy_chainlink_sdk/rust-toolchain.toml', 'packages/cre-sdk-javy-plugin/scripts/build-plugin-local.sh', 'packages/cre-sdk-javy-plugin/scripts/print-javy-path-for-build.ts', 'packages/cre-sdk-javy-plugin/scripts/ensure-javy.ts', 'packages/cre-sdk-javy-plugin/Dockerfile') }}
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

packages/cre-sdk-javy-plugin/Dockerfile

@@ -6,7 +6,7 @@
 #   ./scripts/build-plugin-docker.sh
 
 # --- Javy CLI + host crate generation (same code path as user builds) ---
-FROM oven/bun:slim AS javy-cli
+FROM oven/bun:slim@sha256:1848dc9f700b93aa7b47f496355f4edd9015ad54db5f5ca03661c56b7ddcb72a AS javy-cli
 
 ARG CRE_JAVY_VERSION=v8.1.0
 ENV CRE_JAVY_VERSION=${CRE_JAVY_VERSION}
@@ -46,10 +46,11 @@ COPY src/javy_chainlink_sdk/rust-toolchain.toml src/javy_chainlink_sdk/Cargo.tom
 RUN mkdir -p /build/src/javy_chainlink_sdk/src && echo '' > /build/src/javy_chainlink_sdk/src/lib.rs
 
 COPY --from=javy-cli /build/cre_generated_host /build/cre_generated_host
+COPY src/cre_generated_host.Cargo.lock /build/cre_generated_host/Cargo.lock
 
 WORKDIR /build/cre_generated_host
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
-	cargo build --target wasm32-wasip1 --release 2>/dev/null || true
+	cargo build --locked --target wasm32-wasip1 --release 2>/dev/null || true
 
 COPY src/cre_wasm_exports/src /build/src/cre_wasm_exports/src
 RUN touch /build/src/cre_wasm_exports/src/lib.rs
@@ -58,7 +59,7 @@ COPY src/javy_chainlink_sdk/src /build/src/javy_chainlink_sdk/src
 RUN touch /build/src/javy_chainlink_sdk/src/lib.rs
 
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
-	cargo build --target wasm32-wasip1 --release
+	cargo build --locked --target wasm32-wasip1 --release
 
 RUN javy init-plugin --deterministic \
 	target/wasm32-wasip1/release/cre_generated_host.wasm \

packages/cre-sdk-javy-plugin/bin/compile-workflow.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { existsSync, mkdtempSync, rmSync } from 'node:fs'
+import { copyFileSync, existsSync, mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -23,14 +23,15 @@ function findBuiltWasm(targetDir: string): string {
 
 async function main() {
 	const argv = process.argv.slice(2)
-	const { creExports, plugin: pluginArg, rest } = parseCompileFlags(argv)
+	const { creExports, plugin: pluginArg, lockfile: lockfileArg, rest } = parseCompileFlags(argv)
 
 	if (rest.length < 2) {
 		console.error(
-			'Usage: compile-workflow.ts [--plugin <path>] [--cre-exports <crate-dir>]... <input.js> <output.wasm>',
+			'Usage: compile-workflow.ts [--plugin <path>] [--cre-exports <crate-dir>]... [--lockfile <path>] <input.js> <output.wasm>',
 		)
 		console.error('  --plugin: use pre-built .plugin.wasm (mutually exclusive with --cre-exports)')
 		console.error('  --cre-exports: path to a Rust extension crate directory (repeat for multiple)')
+		console.error('  --lockfile: Cargo.lock to use for reproducible builds')
 		console.error('  If neither given, uses default pre-built plugin from dist/')
 		process.exit(1)
 	}
@@ -64,15 +65,21 @@ async function main() {
 		const tmpDir = mkdtempSync(join(tmpdir(), 'cre-host-'))
 		const sharedTargetDir = resolve(pluginDir, '.cargo-target')
 		try {
-			const extensions = resolveExtensions(creExports)
-			generateHostCrate(tmpDir, pluginDir, extensions)
-
-			const [, javyPath] = await Promise.all([
-				run('cargo', ['build', '--target', 'wasm32-wasip1', '--release'], tmpDir, {
-					CARGO_TARGET_DIR: sharedTargetDir,
-				}),
-				ensureJavy({ version: JAVY_VERSION }),
-			])
+		const extensions = resolveExtensions(creExports)
+		generateHostCrate(tmpDir, pluginDir, extensions)
+
+		const cargoArgs = ['build', '--target', 'wasm32-wasip1', '--release']
+		if (lockfileArg) {
+			copyFileSync(resolve(lockfileArg), join(tmpDir, 'Cargo.lock'))
+			cargoArgs.splice(1, 0, '--locked')
+		}
+
+		const [, javyPath] = await Promise.all([
+			run('cargo', cargoArgs, tmpDir, {
+				CARGO_TARGET_DIR: sharedTargetDir,
+			}),
+			ensureJavy({ version: JAVY_VERSION }),
+		])
 
 			const builtWasm = findBuiltWasm(sharedTargetDir)
 			pluginPath = resolve(tmpDir, 'cre.plugin.wasm')

packages/cre-sdk-javy-plugin/dist/javy-chainlink-sdk.plugin.wasm

@@ -7,7 +7,7 @@
 		"cre-compile-workflow": "bin/compile-workflow.ts"
 	},
 	"scripts": {
-		"build": "bun run clean && bun scripts/compile-javy-sdk-plugin.ts",
+		"build": "bun run clean && bun scripts/compile-javy-sdk-plugin.ts --lockfile src/cre_generated_host.Cargo.lock",
 		"build:plugin-wasm": "./scripts/build-plugin-docker.sh",
 		"clean": "rm -rf dist",
 		"check": "biome check --write ${BIOME_PATHS:-.}",

packages/cre-sdk-javy-plugin/package.json

@@ -3,7 +3,7 @@
  * Builds a Javy plugin .plugin.wasm from extension crates.
  * Used by examples that need a pre-built plugin (e.g. lib_alpha).
  */
-import { existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs'
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import path, { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -27,17 +27,23 @@ async function main() {
 	const argv = process.argv.slice(2)
 	const creExports: string[] = []
 	let outputPath: string | null = null
+	let lockfilePath: string | null = null
 	for (let i = 0; i < argv.length; i++) {
 		if (argv[i] === '--cre-exports' && i + 1 < argv.length) {
 			creExports.push(argv[i + 1])
 			i++
 		} else if (argv[i] === '-o' && i + 1 < argv.length) {
 			outputPath = argv[i + 1]
 			i++
+		} else if (argv[i] === '--lockfile' && i + 1 < argv.length) {
+			lockfilePath = resolve(argv[i + 1])
+			i++
 		}
 	}
 	if (creExports.length === 0 || outputPath === null) {
-		console.error('Usage: build-plugin.ts --cre-exports <path>... -o <output.plugin.wasm>')
+		console.error(
+			'Usage: build-plugin.ts --cre-exports <path>... -o <output.plugin.wasm> [--lockfile <path>]',
+		)
 		process.exit(1)
 	}
 
@@ -47,8 +53,14 @@ async function main() {
 		const extensions = resolveExtensions(creExports)
 		generateHostCrate(tmpDir, pluginDir, extensions)
 
+		const cargoArgs = ['build', '--target', 'wasm32-wasip1', '--release']
+		if (lockfilePath) {
+			copyFileSync(lockfilePath, join(tmpDir, 'Cargo.lock'))
+			cargoArgs.splice(1, 0, '--locked')
+		}
+
 		const [, javyPath] = await Promise.all([
-			run('cargo', ['build', '--target', 'wasm32-wasip1', '--release'], tmpDir, {
+			run('cargo', cargoArgs, tmpDir, {
 				CARGO_TARGET_DIR: sharedTargetDir,
 			}),
 			ensureJavy({ version: JAVY_VERSION }),

packages/cre-sdk-javy-plugin/scripts/build-plugin.ts

@@ -21,17 +21,34 @@ function findBuiltWasm(targetDir: string): string {
 	throw new Error(`Build succeeded but WASM not found in ${releaseDir}`)
 }
 
+function parseLockfileArg(): string | null {
+	const argv = process.argv.slice(2)
+	for (let i = 0; i < argv.length; i++) {
+		if (argv[i] === '--lockfile' && i + 1 < argv.length) {
+			return resolve(argv[i + 1])
+		}
+	}
+	return null
+}
+
 export const main = async () => {
 	console.info('\n\n---> Compiling Chainlink SDK Javy plugin (Rust) \n\n')
 
+	const lockfilePath = parseLockfileArg()
 	const tmpDir = mkdtempSync(join(tmpdir(), 'cre-plugin-'))
 	const sharedTargetDir = resolve(pluginDir, '.cargo-target')
 
 	try {
 		generateHostCrate(tmpDir, pluginDir, [])
 
+		const cargoArgs = ['build', '--target', 'wasm32-wasip1', '--release']
+		if (lockfilePath) {
+			copyFileSync(lockfilePath, join(tmpDir, 'Cargo.lock'))
+			cargoArgs.splice(1, 0, '--locked')
+		}
+
 		const [, javyPath] = await Promise.all([
-			run('cargo', ['build', '--target', 'wasm32-wasip1', '--release'], tmpDir, {
+			run('cargo', cargoArgs, tmpDir, {
 				CARGO_TARGET_DIR: sharedTargetDir,
 			}),
 			ensureJavy({ version: JAVY_VERSION }),

packages/cre-sdk-javy-plugin/scripts/compile-javy-sdk-plugin.ts

@@ -1,10 +1,12 @@
 export function parseCompileFlags(argv: string[]): {
 	creExports: string[]
 	plugin: string | null
+	lockfile: string | null
 	rest: string[]
 } {
 	const creExports: string[] = []
 	let plugin: string | null = null
+	let lockfile: string | null = null
 	const rest: string[] = []
 	for (let i = 0; i < argv.length; i++) {
 		if (argv[i] === '--cre-exports' && i + 1 < argv.length) {
@@ -13,9 +15,12 @@ export function parseCompileFlags(argv: string[]): {
 		} else if (argv[i] === '--plugin' && i + 1 < argv.length) {
 			plugin = argv[i + 1]
 			i++
+		} else if (argv[i] === '--lockfile' && i + 1 < argv.length) {
+			lockfile = argv[i + 1]
+			i++
 		} else {
 			rest.push(argv[i])
 		}
 	}
-	return { creExports, plugin, rest }
+	return { creExports, plugin, lockfile, rest }
 }