build: add a ci job for the jade_builder docker image
What the developer wrote
Authored by Jon Griffiths
build: add a ci job for the jade_builder docker image
What changed, and why it matters
This commit adds a new manual CI/CD job that builds and publishes a Docker image for compiling Jade firmware. It is purely a build-pipeline change and does not modify any wallet, firmware, or cryptographic code.
No security action required. As a routine hygiene measure, reviewers may confirm the Docker Hub credentials (`DOCKER_HUB_TOKEN`, `DOCKER_HUB_USER`) are stored as protected CI variables and that the `cloud` runner tag is appropriately restricted.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change introduces a docker_build stage and a gitlab/docker.yml file defining a build_jade_builder job. The job uses Docker-in-Docker (docker:23-dind), builds the blockstream/jade_builder image from the repository Dockerfile, and pushes it to Docker Hub when triggered manually on a branch that changes Dockerfile, requirements.txt, or gitlab/docker.yml. It does not touch source code, signing logic, or device firmware.
Changed components
.gitlab-ci.ymlgitlab/docker.ymlInspect captured patch +34 / −0
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 40a2c71..92c5f9c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -12,6 +12,7 @@ stages:
- flash
- release
- build_diy
+ - docker_build
image: blockstream/verde@sha256:9171360dae48d3fba7c0f36ab5eb45e2529d178a603e89197cb08fb123ca619e
@@ -26,6 +27,7 @@ include:
- gitlab/flash.yml
- gitlab/release.yml
- gitlab/diy_fw.yml
+ - gitlab/docker.yml
#
# Jade FW build template
diff --git a/gitlab/docker.yml b/gitlab/docker.yml
new file mode 100644
index 0000000..0c75415
--- /dev/null
+++ b/gitlab/docker.yml
@@ -0,0 +1,32 @@
+build_jade_builder:
+ stage: docker_build
+ needs: []
+ when: manual
+ variables:
+ DOCKER_HOST: tcp://localhost:2375
+ DOCKER_TLS_CERTDIR: ""
+ DOCKER_BUILDKIT: 1
+ BUILDX_GIT_INFO: false
+ image: docker:23
+ services:
+ - docker:23-dind
+ tags:
+ - cloud
+ retry:
+ max: 2
+ when: [runner_system_failure, unknown_failure, stuck_or_timeout_failure]
+ rules:
+ - if: $CI_COMMIT_BRANCH
+ changes:
+ paths: [Dockerfile, requirements.txt, gitlab/docker.yml]
+ compare_to: master
+ script:
+ - docker build
+ --network=host
+ -t blockstream/jade_builder:${CI_COMMIT_SHA}
+ -t blockstream/jade_builder:latest
+ .
+ --progress=plain
+ - echo "$DOCKER_HUB_TOKEN" | docker login --username "$DOCKER_HUB_USER" --password-stdin
+ - docker push blockstream/jade_builder:${CI_COMMIT_SHA}
+ - if [ ${CI_COMMIT_BRANCH} == "master" ]; then docker push blockstream/jade_builder:latest; fi
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.