This repository was archived by the owner on Nov 5, 2026. It is now read-only.
Repository navigation
fix(deps): pin @hoprnet/hopr-sdk to a published version - #744
Open
Teebor-Choka wants to merge 1 commit into
Open
Teebor-Choka wants to merge 1 commit into
Teebor-Choka wants to merge 1 commit into
Conversation
4.0.0-rc.0-pr.159 no longer exists on the Artifact Registry, so yarn install --frozen-lockfile fails with a 404. Pin 4.0.0-rc.0-commit.5f06421 instead. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 1 minute. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
|
GitHub Linear Sync Agent⚡ Linear ↔ GitHub sync ℹ️ No Linked Linear Issue FoundThis pull request does not currently link to any Linear issue, and no matching open tickets were found. 🎫 Create an accompanying ticket?Would you like me to create an accompanying Linear ticket for this PR and link it? Reply to this comment with:
I will create a ticket in Linear titled "fix(deps): pin @hoprnet/hopr-sdk to a published version" and link this PR to it with closing semantics. |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
🔎 Trivy Security Report
|
Teebor-Choka
added a commit
to hoprnet/hopr-workflows
that referenced
this pull request
Nov 5, 2026
## What Set `BUILDX_NO_DEFAULT_ATTESTATIONS=1` on the two build steps of `build-docker.yaml` (release and debug image). ## Why `Docker / Multi-Arch` fails for callers with `docker_image_format: docker`: ``` ...:3.4.0-commit.bcbb90e-linux-amd64 is a manifest list ##[error]Process completed with exit code 1. ``` The build log of the failing run shows buildx exporting `attestation manifest` and `manifest list`. `docker push` publishes that list under the per-arch tag, and `docker manifest create --amend` in `multi-arch-manifest` rejects a list. Seen in hoprnet/webapi-hoprnet-org#128 and hoprnet/notification-service#47; the same workflow passed for webapi on 2026-11-04. Callers with `docker_image_format: skopeo` are not affected (hose#24 passes), because skopeo copies a single-platform archive. I did not find which update turned provenance on. The callee tag was unchanged between the passing and failing runs; the repos' flake lock bumps (docker 29.9.1, buildx 0.35.0) are the likely source. ## How verified - The pre-commit hooks pass (actionlint, pinact, commitizen). - Real build: a throwaway PR in webapi-hoprnet-org ran `build-docker` at the v3.4.1 commit plus this change (commit 4ba7435, same two env lines). `Docker / Multi-Arch` passed (run 42030627320). The same code without the change failed with `is a manifest list` (run 42022037289). Main here is 23 commits ahead of v3.4.1, so the test used v3.4.1 as the base, not this branch. - Also seen failing the same way: hoprnet/notification-service#47 and hoprnet/node-admin-ui#744, both `docker_image_format: docker`. ## Trade-off Images lose the default provenance attestation. The workflow already uploads SBOMs to a bucket and scans with Trivy, and nothing in this repo reads the attestation. If provenance is wanted later, `multi-arch-manifest` should switch to `docker buildx imagetools create`, which accepts manifest lists. ## Follow-up - After merge, repin the `build-docker` callers (new release tag). Relates to hoprnet/hopr-devops#372 Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Teebor-Choka
marked this pull request as ready for review
November 6, 2026 12:27
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pin
@hoprnet/hopr-sdkto4.0.0-rc.0-commit.5f06421(was4.0.0-rc.0-pr.159). Changes onlypackage.jsonandyarn.lock.Why
The
4.0.0-rc.0-pr.159pre-release artifact is gone from the Artifact Registry, soyarn --frozen-lockfilefails with a 404 and Build and Docker are red on every PR.hopr-sdk PR #159 ("Hoprd v4") merged as commit 3c1fa8d, which is the
v4.0.0-rc.0tag. Neither4.0.0-rc.0nor any stable 4.x is published to the registry.4.0.0-rc.0-commit.5f06421is the lowest published 4.x version. It differs fromv4.0.0-rc.0only in CI and nix files (GitHub compare: 7 commits, 9 files, all under.github/orflake.*), so it has the same SDK source as PR #159. The newest published 3.x (3.0.8) predates the Hoprd v4 work.How verified
yarn install --frozen-lockfilewith the new lockfile: OK.yarn build(tsc && vite build): OK, no code changes.Note:
-commit.<sha>versions are CI-built pre-releases and could be pruned like the-pr.one. Move to a stable 4.x once one is published.