ci: publish prebuilt summit binaries as GitHub releases - #463
Merged
Merged
Conversation
The summit binary linked the host's OpenSSL through native-tls, so it ran only where libssl.so.3 was installed. The release workflow that follows downloads it onto machines we do not control, where the only host library it should need is glibc. OpenSSL entered by three routes, all of them ours to close. The workspace `reqwest` had default features, i.e. native-tls; it now selects rustls-tls. The `alloy` meta crate's default `reqwest` feature does the same one level down; it and the workspace `alloy-provider` now select `reqwest-rustls-tls` with defaults off, and the node crate's private `alloy-provider` line, which still had native-tls on, uses the workspace entry. The third route was alloy-transport-http's `hyper` feature, which hard-wires `hyper-tls`: nothing here uses alloy's hyper transport (the engine API is over IPC, and `jwt-auth` only exists to layer a token onto that transport), so `hyper` and `jwt-auth` were enabled by this workspace alone and are dropped, with the unused alloy-transport-http entry. openssl-sys and native-tls are gone from Cargo.lock under every feature, `cargo check --workspace --all-features --all-targets` passes, and `ldd` on the Linux binary lists libc, libm and libgcc_s only. rustls was already in the graph through jsonrpsee, so the TLS stack did not grow; the one runtime TLS use, the external-IP probe in node/src/nat.rs, now verifies against rustls's bundled webpki roots instead of the host's CA store, which is one less thing the host has to provide. Cryptography in the binary is now three statically linked backends: ring (rustls, ethereum_hashing), aws-lc-rs (commonware's handshake cipher and secp256r1) and blst (BLS). rustls could be built on the aws-lc-rs provider instead of ring, dropping one backend; reqwest, hyper-rustls and jsonrpsee select ring through their default features, so that is feature surgery for a modest size win and is left for a follow-up. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Add .github/workflows/release.yml. Every push to main publishes a prerelease tagged main-<sha> at the built commit, so each merge has a permanent download URL that follows from the commit alone. Pushing a vX.Y.Z tag publishes a versioned release, marked as a GitHub prerelease only when the version carries a semver suffix such as -rc.1. The tag must equal the workspace version in Cargo.toml and be higher than every version already released, both checked before the build: GitHub's "Latest" and anything listing releases for the current one take the newest by creation date, and the notes' baseline is the previous release only while releases are in order, so an out-of-order version is refused and the answer is the next version, never a rerun of an old one (versionsort with `suffix=-`, so v0.2.0-rc.1 sorts below v0.2.0). A version publishes only from its tag's push event. A manual dispatch on main republishes the main prerelease; on any other ref, a version tag included, it only builds, as a dry run, so no button can rebuild a live release whose checksum and attestation people verified against. The header documents recovery from a failed release run: re-run for a transient failure, fix and move the tag when nothing was ever downloadable, the next version when it was. Each release ships summit_<tag>_linux_amd64.tar.gz, the summit binary built with --features prom as the node image builds it, beside a build provenance attestation (gh attestation verify summit --repo SeismicSystems/summit). Release notes list the merges since the previous release of the same kind. The runner is pinned to ubuntu-22.04, the oldest offered, so the binary's glibc floor is 2.35 (Ubuntu 22.04, Debian 12 and later) and moves only when this file does; the release notes say so. Nothing else is linked from the host: TLS is rustls (see the previous commit), and the build step lists the binary's dynamic libraries and fails if libssl or libcrypto is among them, so a dependency that brings native-tls back fails here rather than on an operator's box. The shape follows seismic-reth's release workflow (https://github.com/SeismicSystems/seismic-reth/blob/seismic/.github/workflows/seismic-release.yml), with a few departures: the tag is created by the release itself at publish time, so a failed build leaves no dangling tag; only the publish job holds contents: write; release notes come from git log rather than a changelog action; and there is no rolling tag. seismic-reth also prunes old prereleases and opens an issue when a run fails. Both are left out for now, GitHub has no cap on releases and pruning would break main-<sha> URLs, and can be revisited if the releases page gets unwieldy. summit has no --version yet, so the workflow smoke-tests the binary with --help; SEI-560 tracks adding it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
samlaf
force-pushed
the
sl/release-ci
branch
from
September 18, 2026 15:51
60fe6f8 to
5ee8550
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebase merging so see each individual commit's msg.
basically first got native-ssl out of summit so that we never depend on openssl versions being installed on machines.
Then built a release workflow.