CSUB-1102: Refactoring around docker files

.github/workflows/release.yml

@@ -2,6 +2,7 @@ name: Release
 
 on:
   workflow_dispatch:
+  pull_request:
   push:
     branches:
       - "release/*"
@@ -10,7 +11,12 @@ permissions: read-all
 
 jobs:
   ## not sure if having multiple private seeds break image so splitting it up by network still
-  devnet:
+  build-container-image:
+    strategy:
+      fail-fast: false
+      matrix:
+        network: [devnet, testnet, mainnet]
+    name: build-container-image-for-${{ matrix.network }}
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
@@ -27,83 +33,37 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Set up account private key
+      # TODO: unify these 3 steps
+      - name: Set up account private key for devnet
+        if: matrix.network == 'devnet'
         run: |
-          echo "${{ secrets.DEVNET_CRUNCH_PK }}" >> environments/cc3/devnet/.private.seed
+          echo "${{ secrets.DEVNET_CRUNCH_PK }}" >> environments/cc3/${{ matrix.network }}/.private.seed
 
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: docker/devnet.dockerfile
-          push: true
-          tags: gluwa/crunch:devnet-${{github.run_id}}
-
-  testnet:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Set up account private key
+      - name: Set up account private key for testnet
+        if: matrix.network == 'testnet'
         run: |
-          echo "${{ secrets.TESTNET_CRUNCH_PK }}" >> environments/cc3/testnet/.private.seed
+          echo "${{ secrets.TESTNET_CRUNCH_PK }}" >> environments/cc3/${{ matrix.network }}/.private.seed
 
-      - name: Check settings
+      - name: Set up account private key for mainnet
+        if: matrix.network == 'mainnet'
         run: |
-          ls -a environments/cc3/testnet/
+          echo "${{ secrets.MAINNET_CRUNCH_PK }}" >> environments/cc3/${{ matrix.network }}/.private.seed
 
-      - name: Build and push
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: docker/testnet.dockerfile
-          push: true
-          tags: gluwa/crunch:testnet-${{github.run_id}}
-
-  mainnet:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - shell: bash
-        env:
-          CRUNCH_AGENT_PK: ${{ secrets.MAINNET_CRUNCH_PK }}
+      # TODO: is this valid only for mainnet or for all images ?
+      - name: Set up config for mainnet
+        if: matrix.network == 'mainnet'
         run: |
-          touch environments/cc3/mainnet/.private.seed \
-            && echo "$CRUNCH_AGENT_PK" > environments/cc3/mainnet/.private.seed
-      - shell: bash
-        env:
-          CRUNCH_AGENT_CONFIG: ${{ secrets.MAINNET_CRUNCH_CONFIG }}
+          echo "${{ secrets.MAINNET_CRUNCH_CONFIG }}" > environments/cc3/${{ matrix.network }}/.env
+
+      - name: Check settings
         run: |
-          touch environments/cc3/mainnet/.env \
-            && echo "$CRUNCH_AGENT_CONFIG" > environments/cc3/mainnet/.env
+          ls -a environments/cc3/${{ matrix.network }}/
 
       - name: Build and push
         uses: docker/build-push-action@v5
         with:
           context: .
-          file: docker/mainnet.dockerfile
-          push: true
-          tags: gluwa/crunch:mainnet-${{github.run_id}}
+          build-args: |
+            NETWORK=${{ matrix.network }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: gluwa/crunch:${{ matrix.network }}-${{github.run_id}}

Dockerfile

@@ -4,9 +4,9 @@ FROM ubuntu:24.04 AS builder
 ARG PROFILE=release
 
 RUN apt-get update \
-    && apt-get -y --no-install-recommends install build-essential curl libssl-dev pkg-config \
+    && apt-get -y --no-install-recommends install build-essential curl libssl-dev pkg-config ca-certificates \
     && rm -rf /var/lib/apt/lists/*
-RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
 RUN /root/.cargo/bin/rustup update
 
 COPY . /app
@@ -23,10 +23,14 @@ RUN apt-get update \
 ARG PROFILE=release
 COPY --from=builder /app/target/$PROFILE/crunch /usr/local/bin
 
-RUN useradd -u 1000 -U -s /bin/sh crunch
+# Add the credentials needed to run crunch for this environment
+ARG NETWORK=devnet
+COPY --from=builder /app/environments/cc3/$NETWORK/* /
+
+RUN useradd -U -s /bin/sh crunch
 USER crunch
 
-ENV RUST_BACKTRACE 1
+ENV RUST_BACKTRACE=1
 ENV RUST_LOG="info"
 
 RUN /usr/local/bin/crunch --version