ci: deterministic capnp codegen via pinned Docker image + drift check

.github/workflows/ci.yaml

@@ -8,6 +8,10 @@ on:
     branches:
       - main
 
+# All jobs only read the repo (build/test/lint/package/codegen-check/fuzz).
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -70,6 +74,32 @@ jobs:
           cargo package -p hypersync-net-types
           cargo package -p hypersync-client
 
+  check_capnp_generated:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      # The capnpc plugin and the `capnp` runtime are released in lockstep, so
+      # the Dockerfile's pinned capnpc must match every `capnp` Cargo dependency.
+      - name: Check capnpc version matches the capnp dependency
+        run: |
+          expected=$(sed -nE 's/^ARG CAPNPC_VERSION=([0-9]+\.[0-9]+).*/\1/p' hypersync-net-types/capnp-codegen.Dockerfile)
+          status=0
+          for f in $(grep -rl -E '^capnp = "' --include=Cargo.toml .); do
+            ver=$(sed -nE 's/^capnp = "([0-9]+\.[0-9]+).*/\1/p' "$f")
+            if [ "$ver" != "$expected" ]; then
+              echo "::error file=$f::capnp = \"$ver\" does not match the pinned capnpc $expected in capnp-codegen.Dockerfile"
+              status=1
+            fi
+          done
+          [ "$status" -eq 0 ] && echo "capnp/capnpc versions aligned ($expected)"
+          exit $status
+      - name: Regenerate capnp code
+        run: make -C hypersync-net-types generate_capnp_types
+      - name: Verify committed capnp code is up to date
+        run: |
+          git diff --exit-code -- hypersync-net-types/src/__generated__ \
+            || (echo "::error::Committed capnp code is out of date. Run 'make -C hypersync-net-types generate_capnp_types' and commit the result." && exit 1)
+
   lint:
     runs-on: ubuntu-latest
     steps:

hypersync-net-types/.dockerignore

@@ -0,0 +1,4 @@
+# Keep the build context minimal: only the schema is needed for codegen.
+# If the schema ever `import`s another .capnp file, un-ignore it here too.
+*
+!hypersync_net_types.capnp

hypersync-net-types/Makefile

@@ -1,8 +1,8 @@
 .PHONY: generate_capnp_types clean_generated_capnp_types
 
 generate_capnp_types:
-	capnp compile hypersync_net_types.capnp -o rust:./src/__generated__
-	rustfmt src/__generated__/hypersync_net_types_capnp.rs
+	DOCKER_BUILDKIT=1 docker build -f capnp-codegen.Dockerfile --target export \
+		--output type=local,dest=src/__generated__ .
 
 clean_generated_capnp_types:
 	rm -f src/__generated__/hypersync_net_types_capnp.rs

hypersync-net-types/capnp-codegen.Dockerfile

@@ -0,0 +1,25 @@
+# Pinned toolchain for deterministic Cap'n Proto code generation. Generating
+# inside this image keeps the committed output byte-for-byte reproducible across
+# developer machines and CI, regardless of the host's capnp/rustfmt versions.
+FROM rust:1.94-slim-trixie@sha256:cf09adf8c3ebaba10779e5c23ff7fe4df4cccdab8a91f199b0c142c53fef3e1a AS codegen
+
+# Must stay compatible with the `capnp` runtime dependency in Cargo.toml.
+ARG CAPNPC_VERSION=0.23.2
+# The capnp compiler version affects the generated schema blobs, so pin it too.
+ARG CAPNPROTO_VERSION=1.1.0-2
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends "capnproto=${CAPNPROTO_VERSION}" \
+    && rm -rf /var/lib/apt/lists/*
+RUN rustup component add rustfmt
+RUN cargo install capnpc --version "=${CAPNPC_VERSION}" --locked
+
+WORKDIR /work
+COPY hypersync_net_types.capnp .
+RUN mkdir -p out \
+    && capnp compile hypersync_net_types.capnp -o rust:out \
+    && rustfmt out/hypersync_net_types_capnp.rs
+
+# Minimal stage so `docker build --output` exports only the generated file.
+FROM scratch AS export
+COPY --from=codegen /work/out/hypersync_net_types_capnp.rs /