Sync fork repo #18
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| reth-data/ |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| HOST_DATA_DIR=./reth-data |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,46 +1,55 @@ | ||
| # BASE MAINNET NODE CONFIGURATION | ||
| # ============================== | ||
|
|
||
| # NETWORK CONFIGURATION | ||
| # --------------------- | ||
| RETH_CHAIN=base | ||
| BASE_NODE_NETWORK=base | ||
|
|
||
| # BASE SEQUENCER ENDPOINTS | ||
| # ------------------------ | ||
| RETH_SEQUENCER_HTTP=https://mainnet-sequencer.base.org | ||
|
|
||
| # [REQUIRED] L1 CONFIGURATION | ||
| # --------------------------- | ||
| # Replace these values with your L1 (Ethereum) node endpoints | ||
| BASE_NODE_L1_ETH_RPC=<your-preferred-l1-rpc> | ||
| BASE_NODE_L1_BEACON=<your-preferred-l1-beacon> | ||
| BASE_NODE_L1_TRUST_RPC="false" | ||
|
|
||
| # ENGINE CONFIGURATION | ||
| # -------------------- | ||
| BASE_NODE_L2_ENGINE_RPC=ws://execution:8551 | ||
| BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt | ||
| BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a | ||
|
|
||
| # P2P CONFIGURATION | ||
| # ----------------- | ||
| BASE_NODE_P2P_LISTEN_IP=0.0.0.0 | ||
| BASE_NODE_P2P_ADVERTISE_TCP_PORT=9222 | ||
| BASE_NODE_P2P_ADVERTISE_UDP_PORT=9222 | ||
| BASE_NODE_P2P_BOOTNODES=enr:-J24QNz9lbrKbN4iSmmjtnr7SjUMk4zB7f1krHZcTZx-JRKZd0kA2gjufUROD6T3sOWDVDnFJRvqBBo62zuF-hYCohOGAYiOoEyEgmlkgnY0gmlwhAPniryHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQKNVFlCxh_B-716tTs-h1vMzZkSs1FTu_OYTNjgufplG4N0Y3CCJAaDdWRwgiQG,enr:-J24QH-f1wt99sfpHy4c0QJM-NfmsIfmlLAMMcgZCUEgKG_BBYFc6FwYgaMJMQN5dsRBJApIok0jFn-9CS842lGpLmqGAYiOoDRAgmlkgnY0gmlwhLhIgb2Hb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJ9FTIv8B9myn1MWaC_2lJ-sMoeCDkusCsk4BYHjjCq04N0Y3CCJAaDdWRwgiQG,enr:-J24QDXyyxvQYsd0yfsN0cRr1lZ1N11zGTplMNlW4xNEc7LkPXh0NAJ9iSOVdRO95GPYAIc6xmyoCCG6_0JxdL3a0zaGAYiOoAjFgmlkgnY0gmlwhAPckbGHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJwoS7tzwxqXSyFL7g0JM-KWVbgvjfB8JA__T7yY_cYboN0Y3CCJAaDdWRwgiQG,enr:-J24QHmGyBwUZXIcsGYMaUqGGSl4CFdx9Tozu-vQCn5bHIQbR7On7dZbU61vYvfrJr30t0iahSqhc64J46MnUO2JvQaGAYiOoCKKgmlkgnY0gmlwhAPnCzSHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQINc4fSijfbNIiGhcgvwjsjxVFJHUstK9L1T8OTKUjgloN0Y3CCJAaDdWRwgiQG,enr:-J24QG3ypT4xSu0gjb5PABCmVxZqBjVw9ca7pvsI8jl4KATYAnxBmfkaIuEqy9sKvDHKuNCsy57WwK9wTt2aQgcaDDyGAYiOoGAXgmlkgnY0gmlwhDbGmZaHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQIeAK_--tcLEiu7HvoUlbV52MspE0uCocsx1f_rYvRenIN0Y3CCJAaDdWRwgiQG | ||
|
|
||
| # LOGGING & MONITORING | ||
| # -------------------- | ||
| BASE_NODE_LOG_VERBOSITY=3 | ||
| BASE_NODE_LOG_FORMAT="json" | ||
| BASE_NODE_METRICS_ENABLED="true" | ||
| BASE_NODE_METRICS_ADDR=0.0.0.0 | ||
| BASE_NODE_METRICS_PORT="7300" | ||
| STATSD_ADDRESS="172.17.0.1" | ||
|
|
||
| # OPTIONAL SETTINGS | ||
| # ================= | ||
|
|
||
| # FOLLOW MODE (OPTIONAL - UNCOMMENT TO ENABLE) | ||
| # BASE_NODE_SOURCE_L2_RPC=<source-l2-rpc> | ||
|
|
||
| # FLASHBLOCKS (OPTIONAL - UNCOMMENT TO ENABLE) | ||
| # RETH_FB_WEBSOCKET_URL=wss://mainnet.flashblocks.base.org/ws | ||
|
|
||
| # PRUNING (OPTIONAL - UNCOMMENT TO ENABLE) | ||
| # NOTE: Set to any number of blocks you want, but it should be >10064 | ||
| # NOTE: The node type that was chosen when first running a node cannot be changed after the initial sync. Turning Archive into Pruned, or Pruned into Full is not supported [source](https://reth.rs/run/faq/pruning/). | ||
| # NOTE: The pruned snapshots provided are set with a distance of 1_339_200 (~31 days). | ||
| # RETH_PRUNING_ARGS="--prune.senderrecovery.distance=50000 --prune.transactionlookup.distance=50000 --prune.receipts.distance=50000 --prune.accounthistory.distance=50000 --prune.storagehistory.distance=50000 --prune.bodies.distance=50000" | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,46 +1,55 @@ | ||
| # BASE SEPOLIA TESTNET NODE CONFIGURATION | ||
| # ====================================== | ||
|
|
||
| # NETWORK CONFIGURATION | ||
| # --------------------- | ||
| RETH_CHAIN=base-sepolia | ||
| BASE_NODE_NETWORK=base-sepolia | ||
|
|
||
| # BASE SEQUENCER ENDPOINTS | ||
| # ------------------------ | ||
| RETH_SEQUENCER_HTTP=https://sepolia-sequencer.base.org | ||
|
|
||
| # [REQUIRED] L1 CONFIGURATION | ||
| # --------------------------- | ||
| # Replace these values with your L1 (Ethereum) node endpoints | ||
| BASE_NODE_L1_ETH_RPC=<your-preferred-l1-rpc> | ||
| BASE_NODE_L1_BEACON=<your-preferred-l1-beacon> | ||
| BASE_NODE_L1_TRUST_RPC="false" | ||
|
|
||
| # ENGINE CONFIGURATION | ||
| # -------------------- | ||
| BASE_NODE_L2_ENGINE_RPC=http://execution:8551 | ||
| BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt | ||
| BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a | ||
|
Comment on lines
+22
to
+24
There was a problem hiding this comment. Do not ship a shared engine JWT in source control. This value becomes the auth secret for the engine API. Keeping one real token in a checked-in Suggested fix BASE_NODE_L2_ENGINE_RPC=http://execution:8551
BASE_NODE_L2_ENGINE_AUTH=/tmp/engine-auth-jwt
-BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a
+# Generate a unique 32-byte hex value per deployment.
+BASE_NODE_L2_ENGINE_AUTH_RAW=<generate-unique-32-byte-hex>🧰 Tools🪛 Betterleaks (1.1.2)[high] 45-45: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key) 🪛 dotenv-linter (4.0.0)[warning] 44-44: [UnorderedKey] The BASE_NODE_L2_ENGINE_AUTH key should go before the BASE_NODE_L2_ENGINE_RPC key (UnorderedKey) [warning] 45-45: [UnorderedKey] The BASE_NODE_L2_ENGINE_AUTH_RAW key should go before the BASE_NODE_L2_ENGINE_RPC key (UnorderedKey) 🤖 Prompt for AI Agents |
||
|
|
||
| # P2P CONFIGURATION | ||
| # ----------------- | ||
| BASE_NODE_P2P_LISTEN_IP=0.0.0.0 | ||
| BASE_NODE_P2P_ADVERTISE_TCP_PORT=9222 | ||
| BASE_NODE_P2P_ADVERTISE_UDP_PORT=9222 | ||
| BASE_NODE_P2P_BOOTNODES=enr:-J24QNz9lbrKbN4iSmmjtnr7SjUMk4zB7f1krHZcTZx-JRKZd0kA2gjufUROD6T3sOWDVDnFJRvqBBo62zuF-hYCohOGAYiOoEyEgmlkgnY0gmlwhAPniryHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQKNVFlCxh_B-716tTs-h1vMzZkSs1FTu_OYTNjgufplG4N0Y3CCJAaDdWRwgiQG,enr:-J24QH-f1wt99sfpHy4c0QJM-NfmsIfmlLAMMcgZCUEgKG_BBYFc6FwYgaMJMQN5dsRBJApIok0jFn-9CS842lGpLmqGAYiOoDRAgmlkgnY0gmlwhLhIgb2Hb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJ9FTIv8B9myn1MWaC_2lJ-sMoeCDkusCsk4BYHjjCq04N0Y3CCJAaDdWRwgiQG,enr:-J24QDXyyxvQYsd0yfsN0cRr1lZ1N11zGTplMNlW4xNEc7LkPXh0NAJ9iSOVdRO95GPYAIc6xmyoCCG6_0JxdL3a0zaGAYiOoAjFgmlkgnY0gmlwhAPckbGHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQJwoS7tzwxqXSyFL7g0JM-KWVbgvjfB8JA__T7yY_cYboN0Y3CCJAaDdWRwgiQG,enr:-J24QHmGyBwUZXIcsGYMaUqGGSl4CFdx9Tozu-vQCn5bHIQbR7On7dZbU61vYvfrJr30t0iahSqhc64J46MnUO2JvQaGAYiOoCKKgmlkgnY0gmlwhAPnCzSHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQINc4fSijfbNIiGhcgvwjsjxVFJHUstK9L1T8OTKUjgloN0Y3CCJAaDdWRwgiQG,enr:-J24QG3ypT4xSu0gjb5PABCmVxZqBjVw9ca7pvsI8jl4KATYAnxBmfkaIuEqy9sKvDHKuNCsy57WwK9wTt2aQgcaDDyGAYiOoGAXgmlkgnY0gmlwhDbGmZaHb3BzdGFja4OFQgCJc2VjcDI1NmsxoQIeAK_--tcLEiu7HvoUlbV52MspE0uCocsx1f_rYvRenIN0Y3CCJAaDdWRwgiQG | ||
|
|
||
| # LOGGING & MONITORING | ||
| # -------------------- | ||
| BASE_NODE_LOG_VERBOSITY=3 | ||
| BASE_NODE_LOG_FORMAT="json" | ||
| BASE_NODE_METRICS_ENABLED="true" | ||
| BASE_NODE_METRICS_ADDR=0.0.0.0 | ||
| BASE_NODE_METRICS_PORT="7300" | ||
| STATSD_ADDRESS="172.17.0.1" | ||
|
|
||
| # OPTIONAL SETTINGS | ||
| # ================= | ||
|
|
||
| # FOLLOW MODE (OPTIONAL - UNCOMMENT TO ENABLE) | ||
| # BASE_NODE_SOURCE_L2_RPC=<source-l2-rpc> | ||
|
|
||
| # FLASHBLOCKS (OPTIONAL - UNCOMMENT TO ENABLE) | ||
| # RETH_FB_WEBSOCKET_URL=wss://sepolia.flashblocks.base.org/ws | ||
|
|
||
| # PRUNING (OPTIONAL - UNCOMMENT TO ENABLE) | ||
| # NOTE: Set to any number of blocks you want, but it should be >10064 | ||
| # NOTE: The node type that was chosen when first running a node cannot be changed after the initial sync. Turning Archive into Pruned, or Pruned into Full is not supported [source](https://reth.rs/run/faq/pruning/). | ||
| # NOTE: The pruned snapshots provided are set with a distance of 1_339_200 (~31 days). | ||
| # RETH_PRUNING_ARGS="--prune.senderrecovery.distance=50000 --prune.transactionlookup.distance=50000 --prune.receipts.distance=50000 --prune.accounthistory.distance=50000 --prune.storagehistory.distance=50000 --prune.bodies.distance=50000" | ||
| Original file line number | Diff line number | Diff line change | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -3,42 +3,134 @@ name: Tag Docker image | |||||||||||||||
| on: | ||||||||||||||||
| push: | ||||||||||||||||
| branches: | ||||||||||||||||
| - "main" | ||||||||||||||||
| tags: | ||||||||||||||||
| - "v*" | ||||||||||||||||
| workflow_dispatch: {} | ||||||||||||||||
|
|
||||||||||||||||
| env: | ||||||||||||||||
| REGISTRY: ghcr.io | ||||||||||||||||
| NAMESPACE: ghcr.io/base | ||||||||||||||||
| RETH_IMAGE_NAME: node-reth | ||||||||||||||||
|
|
||||||||||||||||
| permissions: | ||||||||||||||||
| contents: read | ||||||||||||||||
| packages: write | ||||||||||||||||
|
|
||||||||||||||||
| jobs: | ||||||||||||||||
| reth: | ||||||||||||||||
| strategy: | ||||||||||||||||
| matrix: | ||||||||||||||||
| settings: | ||||||||||||||||
| - arch: linux/amd64 | ||||||||||||||||
| runs-on: ubuntu-24.04 | ||||||||||||||||
| features: jemalloc,asm-keccak,optimism | ||||||||||||||||
| - arch: linux/arm64 | ||||||||||||||||
| runs-on: ubuntu-24.04-arm | ||||||||||||||||
| features: jemalloc,optimism | ||||||||||||||||
| runs-on: ${{ matrix.settings.runs-on }} | ||||||||||||||||
| steps: | ||||||||||||||||
| - name: Harden the runner (Audit all outbound calls) | ||||||||||||||||
| uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 | ||||||||||||||||
| with: | ||||||||||||||||
| egress-policy: audit | ||||||||||||||||
|
|
||||||||||||||||
| - name: Checkout | ||||||||||||||||
| uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 | ||||||||||||||||
|
Comment on lines
38
to
+39
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: cat -n .github/workflows/docker.ymlRepository: LiskHQ/lisk-node Length of output: 5513 🌐 Web query:
💡 Result: In the actions/checkout GitHub Action (including version 3.6.0), the persist-credentials parameter is a boolean input used to control whether the authentication token (or SSH key) used for the checkout is stored in the local Git configuration [1][2]. By default, persist-credentials is set to true [1][2]. When enabled, the action configures the authentication credentials in the repository's local Git settings, allowing subsequent steps in the workflow to perform authenticated Git commands (such as git push or git fetch) without needing to re-provide the token [1][2]. The action removes these credentials during the post-job cleanup phase [1][2]. Security Context and Best Practices: Because the default setting persists credentials, sensitive tokens can potentially be exposed if a workflow inadvertently archives or uploads the repository directory as an artifact, or if subsequent malicious steps in the same workflow access the local Git configuration [3][4]. To mitigate this risk, it is a recommended security practice to explicitly set persist-credentials to false if your workflow does not require further authenticated Git operations [4][5]. Note on Evolution: While the core behavior of this parameter has remained consistent across versions, recent updates to actions/checkout have improved how credentials are handled. Specifically, changes implemented after v3.6.0 (such as those in PR Citations:
🌐 Web query:
💡 Result: The term persist-credentials refers to an input setting in the GitHub Actions checkout action (actions/checkout) [1]. When enabled (which is the default behavior), it configures Git to store the authentication token in the local Git configuration, allowing subsequent steps in the workflow to perform authenticated Git operations [1]. The token is automatically removed during post-job cleanup [1]. The specific SHA f43a0e5ff2bd294095638e18286ca9a3d1956744 corresponds to a commit associated with version 3.6.0 of the actions/checkout repository [2][3]. Key points regarding persist-credentials: - Security Context: Setting persist-credentials to true has been a subject of security discussions regarding potential risks of token exposure within workflows [4][5][6]. - Recent Improvements: Recent updates, such as those implemented in PR Citations:
Disable credential persistence in the checkout step.
Suggested fix - name: Checkout
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+ with:
+ persist-credentials: false📝 Committable suggestion
Suggested change
🧰 Tools🪛 zizmor (1.25.2)[warning] 38-39: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI Agents |
||||||||||||||||
|
|
||||||||||||||||
| - name: Log into the Container registry | ||||||||||||||||
| uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 | ||||||||||||||||
| with: | ||||||||||||||||
| registry: ${{ env.REGISTRY }} | ||||||||||||||||
| username: ${{ github.actor }} | ||||||||||||||||
| password: ${{ secrets.GITHUB_TOKEN }} | ||||||||||||||||
|
|
||||||||||||||||
| - name: Extract metadata for the Docker image | ||||||||||||||||
| id: meta | ||||||||||||||||
| uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0 | ||||||||||||||||
| with: | ||||||||||||||||
| images: | | ||||||||||||||||
| ${{ env.NAMESPACE }}/${{ env.RETH_IMAGE_NAME }} | ||||||||||||||||
|
|
||||||||||||||||
| - name: Set up Docker Buildx | ||||||||||||||||
| uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 | ||||||||||||||||
|
|
||||||||||||||||
| - name: Build and push the Docker image | ||||||||||||||||
| id: build | ||||||||||||||||
| uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 | ||||||||||||||||
| with: | ||||||||||||||||
| context: . | ||||||||||||||||
| file: Dockerfile | ||||||||||||||||
| tags: ${{ env.NAMESPACE }}/${{ env.RETH_IMAGE_NAME }} | ||||||||||||||||
| labels: ${{ steps.meta.outputs.labels }} | ||||||||||||||||
| build-args: | | ||||||||||||||||
| FEATURES=${{ matrix.settings.features }} | ||||||||||||||||
| platforms: ${{ matrix.settings.arch }} | ||||||||||||||||
| outputs: type=image,push-by-digest=true,name-canonical=true,push=true | ||||||||||||||||
|
|
||||||||||||||||
| - name: Export digest | ||||||||||||||||
| run: | | ||||||||||||||||
| mkdir -p ${{ runner.temp }}/digests | ||||||||||||||||
| digest="${{ steps.build.outputs.digest }}" | ||||||||||||||||
| touch "${{ runner.temp }}/digests/${digest#sha256:}" | ||||||||||||||||
|
|
||||||||||||||||
| - name: Prepare | ||||||||||||||||
| run: | | ||||||||||||||||
| platform=${{ matrix.settings.arch }} | ||||||||||||||||
| echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV | ||||||||||||||||
|
|
||||||||||||||||
| - name: Upload digest | ||||||||||||||||
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | ||||||||||||||||
| with: | ||||||||||||||||
| name: digests-reth-${{ env.PLATFORM_PAIR }} | ||||||||||||||||
| path: ${{ runner.temp }}/digests/* | ||||||||||||||||
| if-no-files-found: error | ||||||||||||||||
| retention-days: 1 | ||||||||||||||||
|
|
||||||||||||||||
| merge-reth: | ||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||
| needs: | ||||||||||||||||
| - reth | ||||||||||||||||
| steps: | ||||||||||||||||
| - name: Harden the runner (Audit all outbound calls) | ||||||||||||||||
| uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 | ||||||||||||||||
| with: | ||||||||||||||||
| egress-policy: audit | ||||||||||||||||
|
|
||||||||||||||||
| - name: Download digests | ||||||||||||||||
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 | ||||||||||||||||
| with: | ||||||||||||||||
| path: ${{ runner.temp }}/digests | ||||||||||||||||
| pattern: digests-reth-* | ||||||||||||||||
| merge-multiple: true | ||||||||||||||||
|
|
||||||||||||||||
| - name: Log into the Container registry | ||||||||||||||||
| uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 | ||||||||||||||||
| with: | ||||||||||||||||
| registry: ${{ env.REGISTRY }} | ||||||||||||||||
| username: ${{ github.actor }} | ||||||||||||||||
| password: ${{ secrets.GITHUB_TOKEN }} | ||||||||||||||||
|
|
||||||||||||||||
| - name: Set up Docker Buildx | ||||||||||||||||
| uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 | ||||||||||||||||
|
|
||||||||||||||||
| - name: Extract metadata for the Docker image | ||||||||||||||||
| id: meta | ||||||||||||||||
| uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0 | ||||||||||||||||
| with: | ||||||||||||||||
| images: | | ||||||||||||||||
| ${{ env.NAMESPACE }}/${{ env.RETH_IMAGE_NAME }} | ||||||||||||||||
| tags: | | ||||||||||||||||
| type=ref,event=branch | ||||||||||||||||
| type=ref,event=tag | ||||||||||||||||
| type=sha,format=long | ||||||||||||||||
|
|
||||||||||||||||
| - name: Create manifest list and push | ||||||||||||||||
| working-directory: ${{ runner.temp }}/digests | ||||||||||||||||
| run: | | ||||||||||||||||
| docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ | ||||||||||||||||
| $(printf '${{ env.NAMESPACE }}/${{ env.RETH_IMAGE_NAME }}@sha256:%s ' *) | ||||||||||||||||
|
|
||||||||||||||||
| - name: Inspect image | ||||||||||||||||
| run: | | ||||||||||||||||
| docker buildx imagetools inspect ${{ env.NAMESPACE }}/${{ env.RETH_IMAGE_NAME }}:${{ steps.meta.outputs.version }} | ||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do not ship a fixed engine auth secret in the tracked mainnet config.
A checked-in JWT secret makes every deployment share the same engine credential unless operators remember to override it. This weakens the auth boundary for the engine API and is easy to avoid with a per-deployment secret.
Suggested fix
📝 Committable suggestion
🧰 Tools
🪛 Betterleaks (1.1.2)
[high] 45-45: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🪛 dotenv-linter (4.0.0)
[warning] 45-45: [UnorderedKey] The BASE_NODE_L2_ENGINE_AUTH_RAW key should go before the BASE_NODE_L2_ENGINE_RPC key
(UnorderedKey)
🤖 Prompt for AI Agents