Skip to content

Get spec version directly from file #2710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
l0r1s wants to merge 1 commit into
base: devnet-ready
Choose a base branch
from
+6 −14
Open

Get spec version directly from file #2710

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/check-devnet.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,8 +46,9 @@ jobs:
spec_version=$(PATH=$PATH:$HOME/.cargo/.bin substrate-spec-version wss://dev.chain.opentensor.ai:443 | tr -d '\n')
echo "network spec_version: $spec_version"
: ${spec_version:?bad spec version}
local_spec_version=$(cargo run -p subtensor-tools --bin spec-version | tr -d '\n')
local_spec_version=$(sed -n 's/ *spec_version: \([0-9]*\),/\1/p' runtime/src/lib.rs | head -n 1 | tr -d '\n')
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot Jun 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Textual spec_version extraction is spoofable

This now trusts the first textual spec_version: <n>, match anywhere in runtime/src/lib.rs. A future PR can place an earlier matching token in a cfg-disabled item or macro before the real RuntimeVersion; Rust will still compile/use the real VERSION, but this deploy check will compare the fake value and can pass without an actual runtime spec bump. Keep avoiding cargo run from PR code, but make this parser target exactly one enabled #[sp_version::runtime_version] pub const VERSION block and fail on zero/multiple matches or any ambiguity.

echo "local spec_version: $local_spec_version"
echo "network spec_version: $spec_version"
: ${local_spec_version:?bad local spec version}
if (( $(echo "$local_spec_version <= $spec_version" | bc -l) )); then echo "$local_spec_version ≯ $spec_version ❌"; exit 1; fi
echo "$local_spec_version > $spec_version ✅"
3 changes: 2 additions & 1 deletion .github/workflows/check-finney.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,8 +44,9 @@ jobs:
spec_version=$(PATH=$PATH:$HOME/.cargo/.bin substrate-spec-version wss://entrypoint-finney.opentensor.ai:443 | tr -d '\n')
echo "network spec_version: $spec_version"
: ${spec_version:?bad spec version}
local_spec_version=$(cargo run -p subtensor-tools --bin spec-version | tr -d '\n')
local_spec_version=$(sed -n 's/ *spec_version: \([0-9]*\),/\1/p' runtime/src/lib.rs | head -n 1 | tr -d '\n')
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot Jun 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Textual spec_version extraction is spoofable

Same issue as the devnet workflow: the first regex hit in runtime/src/lib.rs controls the gate, not necessarily the real VERSION.spec_version. A future PR can add an earlier cfg-disabled or macro-contained spec_version: 999999, line and make this check pass while the deployed runtime version is unchanged. The workflow should extract from a single unambiguous runtime-version declaration and fail closed on ambiguity.

echo "local spec_version: $local_spec_version"
echo "network spec_version: $spec_version"
: ${local_spec_version:?bad local spec version}
if (( $(echo "$local_spec_version <= $spec_version" | bc -l) )); then echo "$local_spec_version ≯ $spec_version ❌"; exit 1; fi
echo "$local_spec_version > $spec_version ✅"
3 changes: 2 additions & 1 deletion .github/workflows/check-testnet.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,9 @@ jobs:
spec_version=$(PATH=$PATH:$HOME/.cargo/.bin substrate-spec-version wss://test.finney.opentensor.ai:443 | tr -d '\n')
echo "network spec_version: $spec_version"
: ${spec_version:?bad spec version}
local_spec_version=$(cargo run -p subtensor-tools --bin spec-version | tr -d '\n')
local_spec_version=$(sed -n 's/ *spec_version: \([0-9]*\),/\1/p' runtime/src/lib.rs | head -n 1 | tr -d '\n')
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot Jun 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Textual spec_version extraction is spoofable

Same issue as the other deploy checks: this accepts the first textual spec_version field in runtime/src/lib.rs. That lets a future PR spoof the CI comparison with an earlier non-runtime token while leaving the actual VERSION.spec_version unchanged. The check needs to fail closed unless it can identify exactly the real runtime VERSION declaration.

echo "local spec_version: $local_spec_version"
echo "network spec_version: $spec_version"
: ${local_spec_version:?bad local spec version}
if (( $(echo "$local_spec_version <= $spec_version" | bc -l) )); then echo "$local_spec_version ≯ $spec_version ❌"; exit 1; fi
echo "$local_spec_version > $spec_version ✅"
1 change: 0 additions & 1 deletion Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 0 additions & 5 deletions support/tools/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,8 @@ homepage = "https://bittensor.com"
name = "bump-version"
path = "src/bump_version.rs"

[[bin]]
name = "spec-version"
path = "src/spec_version.rs"

[dependencies]
anyhow.workspace = true
clap = { workspace = true, features = ["derive"] }
semver.workspace = true
toml_edit.workspace = true
node-subtensor-runtime = { workspace = true, default-features = true }
5 changes: 0 additions & 5 deletions support/tools/src/spec_version.rs
View file
Open in desktop

This file was deleted.

Loading