Skip to content

WIRE-419: recover batch operator startup when outposts are unavailable #679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
huangminghuang merged 6 commits into from
Oct 24, 2026
+665 −6,680
Merged

WIRE-419: recover batch operator startup when outposts are unavailable #679

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
01025e4
Fix WIRE-419 outpost startup and interrupted-state recovery
huangminghuang Oct 14, 2026
e985557
Address review feedback and split persistence recovery into WIRE-420
huangminghuang Oct 15, 2026
d894f69
Merge master and preserve deferred Ethereum recovery
huangminghuang Oct 16, 2026
7689737
Address PR review: fix npm publishing and pin AWS SDK clients
huangminghuang Oct 20, 2026
ad1983c
Merge master into fix/wire-419-batch-operator-startup
huangminghuang Oct 21, 2026
4f673a0
Merge master into WIRE-419 startup fix
huangminghuang Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 18 additions & 14 deletions .github/workflows/dependency-audits.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ name: "Dependency audits"
on:
workflow_dispatch:
schedule:
# Weekly coverage for unchanged lockfiles; scheduled workflows run from the default branch.
# Weekly dependency resolution checks; scheduled workflows run from the default branch.
- cron: "0 9 * * 1"

permissions:
Expand All @@ -20,16 +20,17 @@ jobs:
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # actions/checkout@v5

- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # actions/setup-node@v4
with:
node-version: "24"
- name: Setup pnpm
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # pnpm/action-setup@v4
- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
package_json_file: package.json
node-version: 24
registry-url: https://registry.npmjs.org

- name: Validate root pnpm lockfile
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Install root Node tooling
run: pnpm install --no-frozen-lockfile --ignore-scripts

- name: Load plop generators
run: |
Expand All @@ -55,15 +56,18 @@ jobs:
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # actions/checkout@v5

- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # actions/setup-node@v4
- name: Setup pnpm
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
with:
node-version: "24"
package_json_file: libraries/opp/tools/package.json

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # pnpm/action-setup@v4
- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
package_json_file: libraries/opp/tools/package.json
node-version: 24
registry-url: https://registry.npmjs.org

- name: Validate OPP tools pnpm lockfile
- name: Install OPP tools
run: |
cd ./libraries/opp/tools
pnpm install --frozen-lockfile --ignore-scripts
pnpm install --no-frozen-lockfile --ignore-scripts
26 changes: 19 additions & 7 deletions .github/workflows/linux_amd64_build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,16 +39,17 @@ jobs:
- name: Validate coredump isolation policy
run: python3 .github/scripts/check-coredump-policy.py

- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # actions/setup-node@v4
with:
node-version: "24"
- name: Setup pnpm
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # pnpm/action-setup@v4
- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
package_json_file: package.json
node-version: 24
registry-url: https://registry.npmjs.org

- name: Validate root pnpm lockfile
run: pnpm install --frozen-lockfile --ignore-scripts
- name: Install root Node tooling
run: pnpm install --no-frozen-lockfile --ignore-scripts

- name: Load plop generators
run: |
Expand Down Expand Up @@ -132,6 +133,17 @@ jobs:
with:
submodules: recursive

# Native RPC tests allocate ports through the published platform bind registry.
- name: Setup pnpm
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 24
registry-url: https://registry.npmjs.org
- name: Install native RPC test dependencies
run: pnpm install --no-frozen-lockfile --ignore-scripts

# Split restore/save (not the monolithic actions/cache): the post-job save of
# the monolithic action runs BEFORE the vcpkg-binary-cache directory has been
# fully populated on a partial-restore run, so the freshly built binaries were
Expand Down
12 changes: 12 additions & 0 deletions .github/workflows/macos_arm64_build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ on:
- "unittests/**"
- "tests/**"
- "CMakeLists.txt"
- "package.json"
- "vcpkg.json"
- "vcpkg-configuration.json"

Expand All @@ -58,6 +59,17 @@ jobs:
with:
submodules: recursive

# Native RPC tests allocate ports through the published platform bind registry.
- name: Setup pnpm
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: 24
registry-url: https://registry.npmjs.org
- name: Install native RPC test dependencies
run: pnpm install --no-frozen-lockfile --ignore-scripts

- name: Install host tools
run: |
# openjdk runs the ANTLR parser generator of the query engine plugin at build time. Homebrew
Expand Down
24 changes: 11 additions & 13 deletions .github/workflows/opp-bundles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,20 +52,23 @@ jobs:
steps:
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # actions/checkout@v5

- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # actions/setup-node@v4
- name: Setup pnpm
uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
with:
node-version: "24"
package_json_file: libraries/opp/tools/package.json

- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # pnpm/action-setup@v4
- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
package_json_file: libraries/opp/tools/package.json
node-version: 24
registry-url: https://registry.npmjs.org

@heifner heifner Oct 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This breaks the npm publish. With registry-url, setup-node writes $RUNNER_TEMP/.npmrc with _authToken=${NODE_AUTH_TOKEN}, points NPM_CONFIG_USERCONFIG at it, and sets NODE_AUTH_TOKEN to a placeholder. npm then ignores ~/.npmrc, so the token the publish step writes there is never used. The push run on merge (this PR touches libraries/opp/**) would fail the npm publishes, and tag releases waiting on a successful OPP Bundles run would block. PR CI doesn't run the publish step, so it can't catch this.

Fix: set NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} on the publish step, as wire-tools-ts does, and drop the ~/.npmrc line. Or remove registry-url here.

@huangminghuang huangminghuang Oct 22, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 7689737 (retained in the current PR). The gated publish step now receives NODE_AUTH_TOKEN from secrets.NPM_TOKEN and uses setup-node’s registry configuration; the ~/.npmrc write is removed. A local dummy registry test reproduced the previous authentication failure and verified the corrected token setup. No package was published during validation.


- name: Install deps
run: |
# PR validation must not expose the npm publish token to dependency
# install lifecycle scripts; publishing is scoped to the push-only step.
cd ./libraries/opp/tools
pnpm install --frozen-lockfile --ignore-scripts
pnpm install --no-frozen-lockfile --ignore-scripts

- name: Configure AWS credentials (CodeArtifact cargo publish)
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
Expand Down Expand Up @@ -104,17 +107,12 @@ jobs:
- name: Generate & Publish OPP Bundles
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
env:
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
CHANNEL: ${{ inputs.channel }}
PACKAGE_VERSION: ${{ inputs.package-version }}
run: |
# `npm publish` (invoked by wire-protobuf-bundler --publish) does NOT read a
# bare $NPM_TOKEN env var — it needs an _authToken line in .npmrc. Without
# this the publish fails ENEEDAUTH (regression from SEC-41, which scoped the
# token to this step but dropped the auth wiring). Writing ~/.npmrc here keeps
# the token confined to the push/dispatch publish step — it is never present
# during pull_request validation or the dependency install step.
echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> ~/.npmrc
# setup-node's registry configuration reads NODE_AUTH_TOKEN. Supply the
# secret only to this push/dispatch step, never to PR validation or the earlier install step.
args=(--publish)
# `channel` only exists on the dispatch path (empty on push); 'none'
# keeps the legacy no-channel behavior byte-identical.
Expand Down
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,7 @@ CMakeLists.txt.user

node_modules
package-lock.json
pnpm-lock.yaml

/snapshot*
/test
Expand Down
Loading
Loading