chore: Update actions/docker images/xrpld files (#3204)

Note: some files are taken exactly as they are in rippled, so changing something here wouldn't be great (because they will drift)
2026-09-27 23:48:08 +00:00 · 2026-09-11 00:03:46 +01:00
parent 1a421b4145
commit 4af9e2f71f
17 changed files with 79 additions and 50 deletions
--- a/.github/scripts/conan/generate_matrix.py
+++ b/.github/scripts/conan/generate_matrix.py
@@ -3,7 +3,7 @@ import itertools
 import json

 LINUX_OS = ["heavy", "heavy-arm64"]
-LINUX_CONTAINERS = ['{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }']
+LINUX_CONTAINERS = ['{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }']
 LINUX_COMPILERS = ["gcc", "clang"]

 MACOS_OS = ["macos-26-apple-clang-21"]
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -47,7 +47,7 @@ jobs:
        os: [heavy]
        compiler: [gcc, clang]
        build_type: [Release, Debug]
-        container: ['{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }']
+        container: ['{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }']

        include:
          - os: macos-26-apple-clang-21
@@ -73,7 +73,7 @@ jobs:
    uses: ./.github/workflows/reusable-build.yml
    with:
      runs_on: heavy
-      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
      compiler: gcc
      build_type: Debug
      download_ccache: true
@@ -90,7 +90,7 @@ jobs:
    needs: build-and-test
    runs-on: heavy
    container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
--- a/.github/workflows/check-libxrpl.yml
+++ b/.github/workflows/check-libxrpl.yml
@@ -21,7 +21,7 @@ jobs:
    name: Build Clio / `libXRPL ${{ github.event.client_payload.version }}`
    runs-on: heavy
    container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -29,7 +29,7 @@ jobs:
          fetch-depth: 0

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

@@ -76,7 +76,7 @@ jobs:
    needs: build
    runs-on: heavy
    container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e

    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
--- a/.github/workflows/clang-tidy.yml
+++ b/.github/workflows/clang-tidy.yml
@@ -52,7 +52,7 @@ jobs:
    if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
    runs-on: heavy
    container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e

    permissions:
      contents: write
@@ -63,7 +63,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -30,7 +30,7 @@ jobs:
  build:
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e

    steps:
      - name: Checkout
@@ -39,7 +39,7 @@ jobs:
          lfs: true

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -53,16 +53,16 @@ jobs:
          - os: heavy
            compiler: gcc
            build_type: Release
-            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
          - os: heavy
            compiler: gcc
            build_type: Debug
-            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
          - os: heavy
            compiler: gcc
            sanitizers: undefinedbehavior
            build_type: Release
-            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'

    uses: ./.github/workflows/reusable-build-test.yml
    with:
@@ -85,7 +85,7 @@ jobs:
    uses: ./.github/workflows/reusable-build.yml
    with:
      runs_on: heavy
-      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
      compiler: gcc
      build_type: Release
      download_ccache: false
@@ -107,7 +107,7 @@ jobs:
        include:
          - os: heavy
            compiler: clang
-            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
          - os: macos-26-apple-clang-21
            compiler: apple-clang
            container: ""
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -8,7 +8,7 @@ on:

 jobs:
  run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@f1952595d212e86169935135efc66294b4574131
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
    with:
      runs_on: heavy
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-3e54e7d" }'
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
          - os: heavy
            compiler: gcc
            build_type: Release
-            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+            container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'

    uses: ./.github/workflows/reusable-build-test.yml
    with:
@@ -60,7 +60,7 @@ jobs:
    uses: ./.github/workflows/reusable-build.yml
    with:
      runs_on: heavy
-      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
      compiler: gcc
      build_type: Release
      download_ccache: false
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -96,7 +96,7 @@ jobs:
          fetch-depth: 0

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: ${{ inputs.download_ccache }}

--- a/.github/workflows/reusable-publish-package.yml
+++ b/.github/workflows/reusable-publish-package.yml
@@ -29,7 +29,7 @@ jobs:
    name: Publish debian package
    runs-on: heavy
    container:
-      image: ghcr.io/xrplf/xrpld/packaging-debian:sha-b6a8995
+      image: ghcr.io/xrplf/xrpld/packaging-debian:sha-3e54e7d

    permissions:
      contents: read
--- a/.github/workflows/reusable-release.yml
+++ b/.github/workflows/reusable-release.yml
@@ -46,7 +46,7 @@ jobs:
  release:
    runs-on: heavy
    container:
-      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+      image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
    env:
      GH_REPO: ${{ github.repository }}
      GH_TOKEN: ${{ github.token }}
@@ -60,7 +60,7 @@ jobs:
          fetch-depth: 0

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

--- a/.github/workflows/sanitizers.yml
+++ b/.github/workflows/sanitizers.yml
@@ -42,7 +42,7 @@ jobs:
    uses: ./.github/workflows/reusable-build-test.yml
    with:
      runs_on: heavy
-      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e" }'
      download_ccache: false
      upload_ccache: false
      compiler: ${{ matrix.compiler }}
--- a/.github/workflows/upload-conan-deps.yml
+++ b/.github/workflows/upload-conan-deps.yml
@@ -75,7 +75,7 @@ jobs:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
        with:
          enable_ccache: false

--- a/conan/init.sh
+++ b/conan/init.sh
@@ -1,25 +1,21 @@
-#!/bin/bash
+#!/usr/bin/env bash
+# Install our Conan configuration, profiles and the xrplf remote into CONAN_HOME.
+# Safe to re-run; never deletes the Conan home.

-set -ex
+set -euo pipefail

-CURRENT_DIR="$(cd "$(dirname "$0")" && pwd)"
-PROFILES_SRC_DIR="$CURRENT_DIR/profiles"
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+CONAN_DIR="$(conan config home)"

-CONAN_DIR="${CONAN_HOME:-$HOME/.conan2}"
-PROFILES_DIR="$CONAN_DIR/profiles"
-
-rm -rf "$CONAN_DIR"
+echo "Installing Conan configuration into ${CONAN_DIR}"
+conan config install "${SCRIPT_DIR}/global.conf"
+conan config install "${SCRIPT_DIR}/profiles" -tf "${CONAN_DIR}/profiles"
+# This script manages these files, so make them read-only - Conan does not
+# preserve the source mode. Only the files: the directories must stay writable
+# for `conan config install` to replace them.
+chmod a-w "${CONAN_DIR}/global.conf"
+find "${CONAN_DIR}/profiles" -type f -exec chmod a-w {} +

+echo "Adding the xrplf Conan remote"
+# --index 0: our patched recipes must win over Conan Center.
 conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
-
-cp "$CURRENT_DIR/global.conf" "$CONAN_DIR/global.conf"
-
-mkdir -p "$PROFILES_DIR"
-
-# The compiler is selected via the `CC`/`CXX` environment variables (see
-# `.github/actions/set-compiler-env`) and the sanitizers via the `SANITIZERS`
-# environment variable. Builds always use the `ci` profile, which includes
-# `sanitizers` and `default`.
-cp "$PROFILES_SRC_DIR/default" "$PROFILES_DIR/default"
-cp "$PROFILES_SRC_DIR/ci" "$PROFILES_DIR/ci"
-cp "$PROFILES_SRC_DIR/sanitizers" "$PROFILES_DIR/sanitizers"
--- a/conan/profiles/default
+++ b/conan/profiles/default
@@ -1,9 +1,13 @@
 {% set os = detect_api.detect_os() %}
 {% set arch = detect_api.detect_arch() %}
 {% set compiler, version, compiler_exe = detect_api.detect_default_compiler() %}
-{% set compiler_version = version %}
-{% if os == "Linux" %}
 {% set compiler_version = detect_api.default_compiler_version(compiler, version) %}
+{% if os == "Macos" %}
+{# Minimum macOS the dependencies target. #}
+{# Without this, Conan builds each dependency against the (possibly newer) host SDK, so the #}
+{# dependency objects target a newer macOS than the binary and the linker warns. #}
+{# Keep at or below CMAKE_OSX_DEPLOYMENT_TARGET in CMakeLists.txt. #}
+{% set min_macos_version = "15.0" %}
 {% endif %}

 [settings]
@@ -18,10 +22,39 @@ compiler.runtime=static
 {% else %}
 compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
 {% endif %}
+{% if os == "Macos" %}
+os.version={{ min_macos_version }}
+{% endif %}

 [conf]
+{# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
+{# Instead it hand-rolls the compiler for user-config.jam, #}
+{# and its fallback probes a version-suffixed binary (e.g. `g++-15`) before plain `g++`. #}
+{# Inside the Nix shell the wrapper only provides `g++`/`gcc` (no `-15` suffix), #}
+{# so on a host that also has a system `g++-15` the probe escapes Nix #}
+{# and picks the system compiler, which is mismatched with the Nix libraries #}
+{# and breaks the build (e.g. Boost.Stacktrace link checks fail). #}
+{# Pinning the executables here short-circuits that probe so Boost (and the rest of the toolchain) #}
+{# resolve the same compiler. #}
+{# Not part of the package ID, so binaries stay shareable. #}
+{% if os != "Windows" %}
+{% set cc_exe  = {"gcc": "gcc",  "clang": "clang",   "apple-clang": "clang"}.get(compiler) %}
+{% set cxx_exe = {"gcc": "g++",  "clang": "clang++", "apple-clang": "clang++"}.get(compiler) %}
+tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
+{% endif %}
+
 {# By default, Conan tries to reuse binaries built with different cppstd versions. #}
 {# We want to avoid that to improve reproduceability, so we add the cppstd version to the package ID. #}
 {# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
+
+{% if os == "Macos" %}
+[buildenv]
+{# os.version adds -mmacosx-version-min to compiler command lines, #}
+{# but Boost.Context's b2 assembly (.S) rule ignores it, #}
+{# so those objects keep the host SDK version and still warn at link time. #}
+{# clang's assembler honors this env var regardless, pinning them. #}
+{# Scoped to boost/* since it is the only gap. #}
+boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
+{% endif %}
--- a/docker/develop/compose.yaml
+++ b/docker/develop/compose.yaml
@@ -1,6 +1,6 @@
 services:
  clio_develop:
-    image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+    image: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
    volumes:
      - clio_develop_conan_data:/root/.conan2/p
      - clio_develop_ccache:/root/.ccache
--- a/docs/build-clio.md
+++ b/docs/build-clio.md
@@ -175,7 +175,7 @@ Open the `index.html` file in your browser to see the documentation pages.
 It is also possible to build Clio using [Docker](https://www.docker.com/) if you don't want to install all the dependencies on your machine.

 ```sh
-docker run -it ghcr.io/xrplf/xrpld/nix-ubuntu:sha-cb2642b
+docker run -it ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
 git clone https://github.com/XRPLF/clio
 cd clio
 ```