ci: add container build workflow for fork

We cannot depend on the upstream `informalsystems/hermes` repo for CI
deployments, because we need the forked Hermes code for compatiblity
with Penumbra chains. Added a new workflow that will publish as
`ghcr.io/penumbra-zone/hermes`, and removed the informalsystems one.

.dockerignore

@@ -1,10 +1,5 @@
-/.changelog/
-/.git/
-/.gitignore
-/.github
-/ci/
-/docs/
-/e2e/
-/guide/
-/scripts/
-/target/
+**
+!crates/
+!tools/
+!Cargo.*
+!.cargo/config.toml

.github/workflows/container.yml

@@ -0,0 +1,71 @@
+---
+name: Build container image
+on:
+  workflow_call:
+  workflow_dispatch:
+    inputs:
+      penumbra_version:
+        description: 'Git ref (e.g. branch or tag) of Penumbra repo for building'
+        default: "main"
+        required: true
+  # Support triggering builds from penumbra-zone/penumbra CI.
+  repository_dispatch:
+    types:
+      - container-build
+    inputs:
+      penumbra_version:
+        description: 'Git ref (e.g. branch or tag) of Penumbra repo for building'
+        default: "main"
+        required: true
+  push:
+    branches:
+      - main
+    tags:
+      - '**'
+jobs:
+  hermes:
+    runs-on: buildjet-16vcpu-ubuntu-2004
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to the Docker Hub container registry (for pulls)
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Log in to the GitHub container registry (for pushes)
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: ghcr.io/penumbra-zone/hermes
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          platforms: linux/amd64
+          file: ci/release/Containerfile
+          push: true
+          # We include a tag with the associated Penumbra, e.g. `penumbra-v0.61.0`.
+          # This is important to maintain compatibility with a long-running testnet.
+          tags: ${{ steps.meta.outputs.tags }},ghcr.io/penumbra-zone/hermes:penumbra-${{ github.event.inputs.penumbra_version || 'main' }}
+          build-args: |
+            PENUMBRA_VERSION=${{ github.event.inputs.penumbra_version || 'main' }}
+          # We disable layer caching to ensure that the most recent penumbra repo is used.
+          # Otherwise, the static git url for the repo will always result in a cache hit.
+          # TODO: update with dynamic build-args using e.g. current date to bust cache.
+          no-cache: true
+          labels: ${{ steps.meta.outputs.labels }}

ci/release/Containerfile

@@ -0,0 +1,37 @@
+FROM docker.io/rust:1-bookworm AS builder
+COPY . /usr/src/hermes
+WORKDIR /usr/src/hermes
+
+# Install build dependencies. These packages should match what's recommended on
+# https://guide.penumbra.zone/main/pcli/install.html
+RUN apt-get update && apt-get install -y \
+	git-lfs \
+        build-essential \
+        pkg-config \
+        libssl-dev \
+        clang
+
+# Support building from a specific git dependency of the upstream Penumbra repo.
+# N.B. As of 2024-04, the Hermes fork only builds against v0.68.1 of Penumbra,
+# so we'll hardcode that version for now. Once we have the deps up to date,
+# we should support overrides like "main" to predict breaking changes.
+# ARG PENUMBRA_VERSION=main
+ARG PENUMBRA_VERSION="v0.68.1"
+
+# ARG PENUMBRA_VERSION=v0.61.0
+# Set the desired PENUMBRA_VERSION in the Cargo.toml file prior to building.
+# RUN sed -i -e "s/^\(penumbra-.*\)\(tag = \".*\"\)\(.*\)$/\1branch = \"${PENUMBRA_VERSION}\"\3/" ./crates/relayer/Cargo.toml \
+#     && cat ./crates/relayer/Cargo.toml
+RUN cargo build --release
+
+# Runtime container, with binary and normal user account.
+FROM docker.io/debian:bookworm-slim
+LABEL maintainer="team@penumbralabs.xyz"
+
+COPY --from=builder /usr/src/hermes/target/release/hermes /usr/bin/hermes
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates
+RUN groupadd --gid 1000 hermes \
+        && useradd -m -d /home/hermes -g 1000 -u 1000 hermes
+WORKDIR /home/hermes
+USER hermes
+ENTRYPOINT ["/usr/bin/hermes"]