Switch Forge builds to the multi-region Docker repository

.github/actions/run-faucet-tests/action.yaml

@@ -9,7 +9,7 @@ inputs:
     description: "The docker image tag to use for the local testnet if NETWORK=custom."
     required: true
   GCP_DOCKER_ARTIFACT_REPO:
-    description: "The GCP Docker artifact repository."
+    description: "The GCP Docker artifact repository"
     required: true
 
 runs:
@@ -24,7 +24,7 @@ runs:
     - name: Run Redis server
       uses: shogo82148/actions-setup-redis@v1
       with:
-        redis-version: '6.x'
+        redis-version: "6.x"
 
     # Set up Rust for running the integration tests.
     - name: Set up Rust

.github/actions/run-local-testnet/action.yaml

@@ -37,7 +37,6 @@ runs:
 
       shell: bash
 
-
     # Install node + npm.
     - uses: actions/setup-node@v3
       with:

.github/actions/run-ts-sdk-e2e-tests/action.yaml

@@ -68,7 +68,6 @@ runs:
         timeout_minutes: 25
         command: cd ./ecosystem/typescript/sdk && pnpm run test:ci
 
-
     # Run the indexer TS SDK tests.
     - uses: nick-fields/retry@7f8f3d9f0f62fe5925341be21c2e8314fd4f7c7c # pin@v2
       name: ts-sdk-indexer-test

.github/workflows/cli-e2e-tests.yaml

@@ -57,7 +57,7 @@ jobs:
         with:
           max_attempts: 5
           timeout_minutes: 20
-          command: cd ./crates/aptos/e2e && poetry run python main.py -d --base-network devnet --image-repo-with-project ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }} --test-cli-tag ${{ inputs.GIT_SHA }} --working-directory ${{ runner.temp }}/aptos-e2e-tests-devnet
+          command: cd ./crates/aptos/e2e && poetry run python main.py -d --base-network devnet --image-repo-with-project ${{ vars.GCP_DOCKER_ARTIFACT_REPO }} --test-cli-tag ${{ inputs.GIT_SHA }} --working-directory ${{ runner.temp }}/aptos-e2e-tests-devnet
 
       # Run CLI tests against local testnet built from testnet branch.
       - uses: nick-fields/retry@7f8f3d9f0f62fe5925341be21c2e8314fd4f7c7c # pin@v2
@@ -66,7 +66,7 @@ jobs:
         with:
           max_attempts: 5
           timeout_minutes: 20
-          command: cd ./crates/aptos/e2e && poetry run python main.py -d --base-network testnet --image-repo-with-project ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }} --test-cli-tag ${{ inputs.GIT_SHA }} --working-directory ${{ runner.temp }}/aptos-e2e-tests-testnet
+          command: cd ./crates/aptos/e2e && poetry run python main.py -d --base-network testnet --image-repo-with-project ${{ vars.GCP_DOCKER_ARTIFACT_REPO }} --test-cli-tag ${{ inputs.GIT_SHA }} --working-directory ${{ runner.temp }}/aptos-e2e-tests-testnet
 
       # Run CLI tests against local testnet built from mainnet branch.
       - uses: nick-fields/retry@7f8f3d9f0f62fe5925341be21c2e8314fd4f7c7c # pin@v2
@@ -75,7 +75,7 @@ jobs:
         with:
           max_attempts: 5
           timeout_minutes: 20
-          command: cd ./crates/aptos/e2e && poetry run python main.py -d --base-network mainnet --image-repo-with-project ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }} --test-cli-tag ${{ inputs.GIT_SHA }} --working-directory ${{ runner.temp }}/aptos-e2e-tests-mainnet
+          command: cd ./crates/aptos/e2e && poetry run python main.py -d --base-network mainnet --image-repo-with-project ${{ vars.GCP_DOCKER_ARTIFACT_REPO }} --test-cli-tag ${{ inputs.GIT_SHA }} --working-directory ${{ runner.temp }}/aptos-e2e-tests-mainnet
 
       - name: Print local testnet logs on failure
         if: ${{ !inputs.SKIP_JOB && failure() }}

.github/workflows/copy-images-to-dockerhub.yaml

@@ -58,8 +58,7 @@ jobs:
         env:
           FORCE_COLOR: 3 # Force color output as per https://github.com/google/zx#using-github-actions
           GIT_SHA: ${{ inputs.GIT_SHA || github.sha }} # If GIT_SHA is not provided, use the sha of the triggering branch
-          GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
-          GCP_DOCKER_ARTIFACT_REPO_US: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO_US }}
           AWS_ACCOUNT_ID: ${{ secrets.AWS_ECR_ACCOUNT_NUM }}
+          GCP_DOCKER_ARTIFACT_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}
           IMAGE_TAG_PREFIX: ${{ inputs.image_tag_prefix }}
         run: ./docker/release-images.mjs --wait-for-image-seconds=3600

.github/workflows/docker-build-test.yaml

@@ -52,8 +52,6 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
-  GCP_DOCKER_ARTIFACT_REPO_US: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO_US }}
   AWS_ECR_ACCOUNT_NUM: ${{ secrets.ENV_ECR_AWS_ACCOUNT_NUM }}
   # In case of pull_request events by default github actions merges main into the PR branch and then runs the tests etc
   # on the prospective merge result instead of only on the tip of the PR.

.github/workflows/docker-indexer-grpc-test.yaml

@@ -17,9 +17,9 @@ jobs:
       contents: read
       id-token: write
     env:
-      VALIDATOR_IMAGE_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}/validator
-      FAUCET_IMAGE_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}/faucet
-      INDEXER_GRPC_IMAGE_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}/indexer-grpc
+      VALIDATOR_IMAGE_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}/validator
+      FAUCET_IMAGE_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}/faucet
+      INDEXER_GRPC_IMAGE_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}/indexer-grpc
       IMAGE_TAG: ${{ inputs.GIT_SHA || 'devnet' }} # hardcode to a known good build when not running on workflow_call
 
     steps:

.github/workflows/faucet-tests-main.yaml

@@ -71,4 +71,4 @@ jobs:
         with:
           NETWORK: custom
           IMAGE_TAG: ${{ env.IMAGE_TAG }}
-          GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
+          GCP_DOCKER_ARTIFACT_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}

.github/workflows/faucet-tests-prod.yaml

@@ -17,7 +17,7 @@ on:
 
 permissions:
   contents: read
-  id-token: write  # Required for GCP Workload Identity federation which we use to login into Google Artifact Registry
+  id-token: write # Required for GCP Workload Identity federation which we use to login into Google Artifact Registry
 
 jobs:
   # Note on the job-level `if` conditions:
@@ -51,7 +51,7 @@ jobs:
       - uses: ./.github/actions/run-faucet-tests
         with:
           NETWORK: devnet
-          GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
+          GCP_DOCKER_ARTIFACT_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}
 
   # These tests ensure that the faucet works with the nodes running on testnet.
   run-tests-testnet:
@@ -74,4 +74,4 @@ jobs:
       - uses: ./.github/actions/run-faucet-tests
         with:
           NETWORK: testnet
-          GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
+          GCP_DOCKER_ARTIFACT_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}

.github/workflows/indexer-grpc-integration-tests.yaml

@@ -33,9 +33,9 @@ jobs:
     runs-on: high-perf-docker
     env:
       # spin up the local testnet using the latest devnet image
-      VALIDATOR_IMAGE_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}/validator
-      FAUCET_IMAGE_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}/faucet
-      INDEXER_GRPC_IMAGE_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}/indexer-grpc
+      VALIDATOR_IMAGE_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}/validator
+      FAUCET_IMAGE_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}/faucet
+      INDEXER_GRPC_IMAGE_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}/indexer-grpc
       IMAGE_TAG: devnet
 
     steps:

.github/workflows/node-api-compatibility-tests.yaml

@@ -89,15 +89,15 @@ jobs:
         with:
           max_attempts: 3
           timeout_minutes: 20
-          command: docker run --rm --mount=type=bind,source=${{ runner.temp }}/specs,target=/specs ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}/tools:${IMAGE_TAG} aptos-openapi-spec-generator -f yaml -o /specs/spec.yaml
+          command: docker run --rm --mount=type=bind,source=${{ runner.temp }}/specs,target=/specs ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}/tools:${IMAGE_TAG} aptos-openapi-spec-generator -f yaml -o /specs/spec.yaml
 
       - uses: nick-fields/retry@7f8f3d9f0f62fe5925341be21c2e8314fd4f7c7c # pin@v2
         if: ${{ !inputs.SKIP_JOB }}
         name: generate-json-spec
         with:
           max_attempts: 3
           timeout_minutes: 20
-          command: docker run --rm --mount=type=bind,source=${{ runner.temp }}/specs,target=/specs ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}/tools:${IMAGE_TAG} aptos-openapi-spec-generator -f json -o /specs/spec.json
+          command: docker run --rm --mount=type=bind,source=${{ runner.temp }}/specs,target=/specs ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}/tools:${IMAGE_TAG} aptos-openapi-spec-generator -f json -o /specs/spec.json
 
       # Confirm that the specs we built here are the same as those checked in.
       - run: |

.github/workflows/rust-client-tests.yaml

@@ -12,7 +12,7 @@ on:
 
 permissions:
   contents: read
-  id-token: write  # Required for GCP Workload Identity federation which we use to login into Google Artifact Registry
+  id-token: write # Required for GCP Workload Identity federation which we use to login into Google Artifact Registry
 
 jobs:
   # Note on the job-level `if` conditions:
@@ -45,7 +45,7 @@ jobs:
       - uses: ./.github/actions/run-rust-client-tests
         with:
           NETWORK: devnet
-          GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
+          GCP_DOCKER_ARTIFACT_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}
 
   run-tests-testnet:
     if: contains(github.event.pull_request.labels.*.name, 'CICD:non-required-tests')
@@ -64,7 +64,7 @@ jobs:
       - uses: ./.github/actions/run-rust-client-tests
         with:
           NETWORK: testnet
-          GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
+          GCP_DOCKER_ARTIFACT_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}
 
   run-tests-mainnet:
     if: contains(github.event.pull_request.labels.*.name, 'CICD:non-required-tests')
@@ -83,4 +83,4 @@ jobs:
       - uses: ./.github/actions/run-rust-client-tests
         with:
           NETWORK: mainnet
-          GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
+          GCP_DOCKER_ARTIFACT_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}

.github/workflows/test-copy-images-to-dockerhub.yaml

@@ -0,0 +1,28 @@
+name: Test Release Images
+on:
+  pull_request:
+    paths:
+      - "docker/release-images.mjs"
+      - "docker/__tests__/**"
+  push:
+    branches:
+      - main
+    paths:
+      - "docker/release-images.mjs"
+      - "docker/__tests__/**"
+
+permissions:
+  contents: read
+
+jobs:
+  test-copy-images:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version-file: .node-version
+      - uses: pnpm/action-setup@v2
+      - run: pnpm install
+      - name: Test Release Images
+        run: ./docker/test.sh

.github/workflows/ts-sdk-e2e-tests.yaml

@@ -72,6 +72,6 @@ jobs:
         if: needs.file_change_determinator.outputs.only_docs_changed != 'true'
         with:
           BRANCH: main
-          GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
+          GCP_DOCKER_ARTIFACT_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}
       - run: echo "Skipping the tests on the main branch! Unrelated changes detected."
         if: needs.file_change_determinator.outputs.only_docs_changed == 'true'

.github/workflows/workflow-run-docker-rust-build.yaml

@@ -63,9 +63,8 @@ env:
   PROFILE: ${{ inputs.PROFILE }}
   FEATURES: ${{ inputs.FEATURES }}
   BUILD_ADDL_TESTING_IMAGES: ${{ inputs.BUILD_ADDL_TESTING_IMAGES }}
-  GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
-  GCP_DOCKER_ARTIFACT_REPO_US: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO_US }}
   AWS_ECR_ACCOUNT_NUM: ${{ secrets.ENV_ECR_AWS_ACCOUNT_NUM }}
+  GCP_DOCKER_ARTIFACT_REPO: ${{ vars.GCP_DOCKER_ARTIFACT_REPO }}
   TARGET_REGISTRY: ${{ inputs.TARGET_REGISTRY }}
 
 permissions:

.github/workflows/workflow-run-forge.yaml

@@ -79,7 +79,6 @@ env:
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
   GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
   GCP_SERVICE_ACCOUNT_EMAIL: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL }}
-  GCP_DOCKER_ARTIFACT_REPO: ${{ secrets.GCP_DOCKER_ARTIFACT_REPO }}
   AWS_REGION: us-west-2
   IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
   FORGE_IMAGE_TAG: ${{ inputs.FORGE_IMAGE_TAG }}

aptos-node/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "aptos-node"
 description = "Aptos node"
-version = "1.7.0"
+version = "0.0.0-main"
 
 # Workspace inherited keys
 authors = { workspace = true }

docker/__tests__/release-images.test.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env -S pnpm test release-images.test.js
+
+import { assertTagMatchesSourceVersion, getImageReleaseGroupByImageTagPrefix, isReleaseImage } from '../release-images.mjs';
+
+describe('releaseImages', () => {
+    it('gets aptos-node as the default image group', () => {
+        const prefix = 'image-banana';
+        const releaseGroup = getImageReleaseGroupByImageTagPrefix(prefix);
+        expect(releaseGroup).toEqual('aptos-node');
+    });
+    it('gets indexer image group', () => {
+        const prefix = 'aptos-indexer-grpc-vX.Y.Z';
+        const releaseGroup = getImageReleaseGroupByImageTagPrefix(prefix);
+        expect(releaseGroup).toEqual('aptos-indexer-grpc');
+    });
+    it('gets aptos-node as the node image group', () => {
+        const prefix = 'aptos-node-vX.Y.Z';
+        const releaseGroup = getImageReleaseGroupByImageTagPrefix(prefix);
+        expect(releaseGroup).toEqual('aptos-node');
+    });
+    it('determines image is a release image', () => {
+        expect(isReleaseImage("nightly-banana")).toEqual(false);
+        expect(isReleaseImage("aptos-node-v1.2.3")).toEqual(true);
+    });
+    it('asserts version match', () => {
+        // toThrow apparently matches a prefix, so this works but it does actually test against the real config version
+        // Which... hilariously means this would fail if the version was ever 0.0.0
+        expect(() => assertTagMatchesSourceVersion("aptos-node-v0.0.0")).toThrow("image tag does not match cargo version: aptos-node-v0.0.0");
+    });
+});

docker/builder/docker-bake-rust-all.hcl

@@ -22,8 +22,6 @@ variable "BUILT_VIA_BUILDKIT" {}
 
 variable "GCP_DOCKER_ARTIFACT_REPO" {}
 
-variable "GCP_DOCKER_ARTIFACT_REPO_US" {}
-
 variable "AWS_ECR_ACCOUNT_NUM" {}
 
 variable "TARGET_REGISTRY" {
@@ -259,16 +257,12 @@ function "generate_tags" {
   result = TARGET_REGISTRY == "remote-all" ? [
     "${GCP_DOCKER_ARTIFACT_REPO}/${target}:${IMAGE_TAG_PREFIX}${GIT_SHA}",
     "${GCP_DOCKER_ARTIFACT_REPO}/${target}:${IMAGE_TAG_PREFIX}${NORMALIZED_GIT_BRANCH_OR_PR}",
-    "${GCP_DOCKER_ARTIFACT_REPO_US}/${target}:${IMAGE_TAG_PREFIX}${GIT_SHA}",
-    "${GCP_DOCKER_ARTIFACT_REPO_US}/${target}:${IMAGE_TAG_PREFIX}${NORMALIZED_GIT_BRANCH_OR_PR}",
     "${ecr_base}/${target}:${IMAGE_TAG_PREFIX}${GIT_SHA}",
     "${ecr_base}/${target}:${IMAGE_TAG_PREFIX}${NORMALIZED_GIT_BRANCH_OR_PR}",
     ] : (
     TARGET_REGISTRY == "gcp" || TARGET_REGISTRY == "remote" ? [
       "${GCP_DOCKER_ARTIFACT_REPO}/${target}:${IMAGE_TAG_PREFIX}${GIT_SHA}",
       "${GCP_DOCKER_ARTIFACT_REPO}/${target}:${IMAGE_TAG_PREFIX}${NORMALIZED_GIT_BRANCH_OR_PR}",
-      "${GCP_DOCKER_ARTIFACT_REPO_US}/${target}:${IMAGE_TAG_PREFIX}${GIT_SHA}",
-      "${GCP_DOCKER_ARTIFACT_REPO_US}/${target}:${IMAGE_TAG_PREFIX}${NORMALIZED_GIT_BRANCH_OR_PR}",
       ] : [ // "local" or any other value
       "aptos-core/${target}:${IMAGE_TAG_PREFIX}${GIT_SHA}-from-local",
       "aptos-core/${target}:${IMAGE_TAG_PREFIX}from-local",