Repository navigation
feat: support mainnet and publish Docker Hub images - #23
Merged
Thegaram merged 6 commits intoOct 29, 2026
Merged
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The README references an unavailable chart README without an external link, leaving operators unable to find the required bootstrap and secret-provisioning instructions.
1 open issue
What changed in this PR
Adds Scroll mainnet support to the RPC proxy while preserving gas-free defaults, and introduces ECR image publishing separate from deployment promotion.
Changes:
- Makes upstream gas-price forwarding configurable and returns explicit errors when withdrawal proofs are unavailable.
- Adds tests for gas-price modes and missing withdrawal services.
- Publishes full-SHA images on pushes to main, with a manual bootstrap tag, and documents mainnet deployment considerations.
| File | Description |
|---|---|
src/proxy/server.rs |
Implements optional proof-service access and gas-price forwarding, with tests. |
src/main.rs |
Passes the new configuration options into RPC proxy instances. |
src/config.rs |
Adds gas-price and withdrawal-service options and conditional URL validation. |
README.md |
Documents mainnet behavior, replica constraints, and image promotion. |
.github/workflows/ecr.yml |
Adds OIDC-authenticated ECR publishing for main and manual bootstrap runs. |
Review effort: Balanced
|
|
||
| The mainnet instance is deliberately limited to one replica: SIWE nonces are stored in process memory. A restart invalidates outstanding nonces. RPC access still requires the method's usual proxy authorization in addition to Cloudflare Access. | ||
|
|
||
| Every push to main publishes an immutable ECR image tagged with the full commit SHA; deployment is a separate reviewed Helm tag update. See the Helm chart README for the one-time bootstrap and secret provisioning steps. |
Contributor
|
Fixed clippy in #22 |
kchangn
changed the title
kchangn
changed the title
kchangn
changed the title
Thegaram
approved these changes
Oct 29, 2026
Comment on lines
3
to
6
| on: | ||
| push: | ||
| branches: [main] | ||
| workflow_dispatch: |
Contributor
There was a problem hiding this comment.
Might be an overkill to build on every merge, but works for now.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supports Scroll mainnet while preserving the existing gas-free validium defaults: gas-price RPCs can be forwarded upstream, and withdrawal-proof RPCs return an explicit error when no proof service is configured. Extends the existing Docker Hub workflow to publish
scrolltech/cloak-rpc-auth-proxywith an eight-character commit-SHA tag on pushes to main, while preserving manual builds and the existing Docker Hub credentials.The mainnet chart enables these options and uses one replica because SIWE nonces are in memory. Cloudflare Access and the proxy's existing RPC authorization both remain in effect. Deployment is a separate reviewed chart change; Docker Hub tags can be overwritten.
Validation:
actionlint .github/workflows/docker.yml,cargo +1.90 fmt --all --check,cargo +1.90 clippy --all --all-targets --locked -- -D warnings, andcargo +1.90 test --all --all-targets --locked(9 tests) passed. Current main's dependency updates and transaction hardening are preserved.Related: Cloudflare Access, Helm chart, Argo application. After merging this PR, verify the image publication and set its commit-SHA tag in the Helm chart before merging that chart; provision the mainnet secret and verify Cloudflare Access is applied before merging the Argo application.