chore: merge develop branch into main

.env.example

@@ -1,32 +1,56 @@
+# Grafana Configuration
+GF_SECURITY_ADMIN_PASSWORD=admin
+GF_SECURITY_ADMIN_USER=admin
+GF_INSTALL_PLUGINS=grafana-simple-json-datasource,grafana-worldmap-panel
+
 # Database Configuration
 POSTGRES_DB=jsonrpc_bench
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=postgres
+POSTGRES_HOST=postgres
+POSTGRES_PORT=5432
 
-# Grafana Configuration
-GF_SECURITY_ADMIN_PASSWORD=admin
-GF_SECURITY_ADMIN_USER=admin
+# Webhook URLs for notifications
+WEBHOOK_CI_URL=https://your-ci-system.com/webhook
+DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/your-webhook-url
+SLACK_WEBHOOK_URL=https://hooks.slack.com/services/your-webhook-url
+GITHUB_WEBHOOK_URL=https://api.github.com/repos/your-org/your-repo/issues
+
+# Authentication tokens
+CI_WEBHOOK_TOKEN=your-ci-token
+GITHUB_TOKEN=your-github-token
+GITHUB_WEBHOOK_SECRET=your-webhook-secret
+
+# Email Configuration
+ALERT_EMAIL_ADDRESSES=alerts@your-domain.com,team@your-domain.com
+GF_SMTP_ENABLED=true
+GF_SMTP_HOST=smtp.your-domain.com:587
+GF_SMTP_USER=alerts@your-domain.com
+GF_SMTP_PASSWORD=your-email-password
+GF_SMTP_FROM_ADDRESS=alerts@your-domain.com
+GF_SMTP_FROM_NAME="JSON-RPC Bench Alerts"
+
+# Grafana Server Configuration
+GF_SERVER_HTTP_PORT=3000
 GF_SERVER_DOMAIN=localhost
 GF_SERVER_ROOT_URL=http://localhost:3000/
 
-# Email Configuration (optional)
-GF_SMTP_ENABLED=false
-GF_SMTP_HOST=
-GF_SMTP_USER=
-GF_SMTP_PASSWORD=
-GF_SMTP_FROM_ADDRESS=
-GF_SMTP_FROM_NAME=JSON-RPC Bench Alerts
-
-# Webhook URLs for notifications (optional)
-WEBHOOK_CI_URL=
-DISCORD_WEBHOOK_URL=
-SLACK_WEBHOOK_URL=
-GITHUB_WEBHOOK_URL=
-
-# Authentication tokens (optional)
-CI_WEBHOOK_TOKEN=
-GITHUB_TOKEN=
-GITHUB_WEBHOOK_SECRET=
-
-# Email Configuration (optional)
-ALERT_EMAIL_ADDRESSES=
+# Grafana Database Configuration
+GF_DATABASE_TYPE=postgres
+GF_DATABASE_HOST=postgres:5432
+GF_DATABASE_NAME=grafana
+GF_DATABASE_USER=grafana
+GF_DATABASE_PASSWORD=grafana
+GF_DATABASE_SSL_MODE=disable
+
+# Grafana Alerting Configuration
+GF_ALERTING_ENABLED=true
+GF_ALERTING_EXECUTE_ALERTS=true
+GF_UNIFIED_ALERTING_ENABLED=true
+GF_ALERTING_MIN_INTERVAL_SECONDS=10
+GF_ALERTING_MAX_ATTEMPTS=3
+
+# Grafana Provisioning
+GF_PATHS_PROVISIONING=/etc/grafana/provisioning
+GF_PATHS_PLUGINS=/var/lib/grafana/plugins
+GF_PATHS_DASHBOARDS=/var/lib/grafana/dashboards

.github/workflows/build_docker_image.yml

@@ -13,20 +13,82 @@ on:
     branches: [main]
 
 permissions:
+  contents: read
+  packages: write
   id-token: write
   attestations: write
-  artifact-metadata: write
-  contents: read
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
 
 jobs:
   build_public_image:
-    uses: NethermindEth/github-workflows/.github/workflows/docker-build-push-dockerhub.yaml@main
-    with:
-      repo_name: "nethermindeth"
-      image_name: "jsonrpc-bench-runner"
-      additional_tags: "${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}"
-      push: "${{ github.event_name != 'pull_request' }}"
-      dockerfile_path: "runner/Dockerfile"
-    secrets:
-      dockerhub_username: ${{ secrets.DOCKER_HUB_USERNAME }}
-      dockerhub_password: ${{ secrets.DOCKER_HUB_PASSWORD }}
+    name: Build and publish Docker image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=ref,event=pr
+            type=sha,prefix=sha-,format=short
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=${{ inputs.tag }},enable=${{ github.event_name == 'workflow_dispatch' }}
+
+      - name: Build image locally for scan
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: runner/Dockerfile
+          load: true
+          tags: local/runner:scan-${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Run Trivy vulnerability scan
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: local/runner:scan-${{ github.sha }}
+          format: table
+          severity: CRITICAL,HIGH
+          exit-code: "1"
+          ignore-unfixed: true
+
+      - name: Push image to GHCR
+        id: push
+        if: github.event_name != 'pull_request'
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: runner/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+
+      - name: Attest build provenance
+        if: github.event_name != 'pull_request'
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

.gitignore

@@ -26,6 +26,7 @@ playwright-report/
 coverage/
 *.log
 historic/
+outputs/
 
 # Debug and temporary files
 *.bak
@@ -45,5 +46,6 @@ bin/
 .DS_Store
 Thumbs.db
 
-# Agents
-.claude/
+# Snapshots and data directories
+snapshots/
+json-bench-data/