feat: publish a polycli container image to GHCR on tag#963
Merged
Conversation
Add a Dockerfile and a GitHub Actions workflow that builds and pushes a multi-arch (linux/amd64, linux/arm64) polycli image to ghcr.io/0xPolygon/polygon-cli on every tag, mirroring the panoptichain setup. CGO is enabled (vectorized-poseidon-gold has no pure-Go path); buildx builds each platform natively under QEMU. Runtime is distroless/base (glibc). Enables running `polycli p2p sensor` as a container (e.g. the sensor VMs on Container-Optimized OS), removing the build-from-source/ansible step. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Dockerfile now runs `make build` instead of a bare `go build`, so the image binary is version-stamped the same as a local build (git describe / commit / date) rather than reporting "dev". Requires make in the builder and fetch-depth: 0 in the publish workflow so `git describe --tags` sees the tags. Verified: `docker run <img> version` -> "Polygon CLI Version v0.1.115-9-g...". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
praetoriansentry
previously approved these changes
Jul 20, 2026
- Cross-compile on the native BUILDPLATFORM (mirroring the release `make cross` setup) instead of per-platform QEMU builds, via a new `docker-build` Makefile target that reuses VERSION_FLAGS. Ship the fully static binary on distroless/static (~119MB -> ~59MB). - Own the /data working dir as the nonroot uid (65532) so the sensor can write its nodes.json discovery cache. - Restrict the publish trigger to v* tags so ad-hoc tags can't move `latest`; drop the now-unneeded QEMU setup; share Go build/module cache mounts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
praetoriansentry
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Dockerfile and a GitHub Actions workflow that builds and pushes a multi-arch polycli image to
ghcr.io/0xPolygon/polygon-clion every tag — mirroring the panoptichainbuild_and_publishsetup.Details
distroless/base(glibc). CGO is enabled becausevectorized-poseidon-goldhas no pure-Go path; buildx builds each platform natively under QEMU, so no cross-compilers are needed..github/workflows/build_and_publish.yaml): onpushtags → QEMU + Buildx →docker/build-push-actionfor linux/amd64 + linux/arm64, tags fromdocker/metadata-action(tag ref, semver,latest), plus build-provenance attestation. Uses the built-inGITHUB_TOKEN(packages: write).Motivation
Lets
polycli p2p sensorrun as a container — e.g. the sensor VMs on Container-Optimized OS (polygon-infrastructure#1783) — removing the build-from-source/ansible step.Validation
Built and ran locally (native arch): image is ~119 MB and
docker run … versionprintsPolygon CLI Version …. Multi-arch is exercised in CI.🤖 Generated with Claude Code