From 0d1ebc6e3eb2a719137aa7236e7e8b6dd01502d8 Mon Sep 17 00:00:00 2001
From: Davide Grilli <davide.grilli@outlook.com>
Date: Thu, 22 Oct 2026 15:48:10 +0200
Subject: [PATCH] CI: run on main, add a docker job, drop upstream-specific
 steps

The workflow only triggered on master. New job builds the image and runs
contrib/docker-smoke-test.sh, which checks the SSL handling of the entrypoint.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml     | 24 ++++++++++++------
 .gitignore                   |  3 +++
 contrib/docker-smoke-test.sh | 49 ++++++++++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+), 7 deletions(-)
 create mode 100755 contrib/docker-smoke-test.sh

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2d16c58..bc1dedb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [master]
+    branches: [main]
   pull_request:
-    branches: [master]
+    branches: [main]
   workflow_dispatch:  # https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manually-run-a-workflow
 
 concurrency:
@@ -31,10 +31,8 @@ jobs:
           cache: 'pip'
           cache-dependency-path: 'pyproject.toml'
 
-      - name: Log Python version and Git tag
-        run: |
-          python3 --version
-          git tag
+      - name: Log Python version
+        run: python3 --version
 
       - name: Install Python deps
         run: |
@@ -73,7 +71,6 @@ jobs:
   build_docs:
     # note: this build task is not related to read-the-docs; it is only here to sanity-check the docs can be built.
     #       For the read-the-docs build, see .readthedocs.yml
-    #       and the webhook set up in https://github.com/spesmilo/electrumx/settings/hooks
     name: build_docs
     runs-on: ubuntu-24.04
     env:
@@ -94,3 +91,16 @@ jobs:
         run: |
           cd docs
           make html
+
+  docker:
+    # builds the image and checks the SSL handling of its entrypoint (contrib/docker-smoke-test.sh)
+    name: docker
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Build image
+        run: docker build -t plm-electrumx .
+
+      - name: Smoke test
+        run: contrib/docker-smoke-test.sh plm-electrumx
diff --git a/.gitignore b/.gitignore
index 2b16e53..4d017aa 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,6 @@
 /e_x.egg-info/
 
 .env
+
+.coverage
+/htmlcov/
diff --git a/contrib/docker-smoke-test.sh b/contrib/docker-smoke-test.sh
new file mode 100755
index 0000000..12c8329
--- /dev/null
+++ b/contrib/docker-smoke-test.sh
@@ -0,0 +1,49 @@
+#!/bin/sh
+# Checks the SSL handling of docker-entrypoint.sh in the image (no node needed).
+# Usage: docker build -t plm-electrumx . && contrib/docker-smoke-test.sh [image]
+set -eu
+IMAGE="${1:-plm-electrumx}"
+ENTRYPOINT=/usr/local/bin/docker-entrypoint.sh
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT
+mkdir -p "$tmp/db" "$tmp/ssl"
+
+run() {  # extra docker args..., then the entrypoint is run with "echo ok"
+    docker run --rm --user "$(id -u):$(id -g)" \
+        -v "$tmp/db:/var/lib/electrumx" -v "$tmp/ssl:/var/lib/electrumx-ssl" \
+        "$@" --entrypoint "$ENTRYPOINT" "$IMAGE" echo ok 2>&1
+}
+fingerprint() { openssl x509 -in "$tmp/ssl/server.crt" -noout -fingerprint -sha256; }
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+echo "1. first start generates a certificate and sets SERVICES"
+out="$(run)"
+echo "$out" | grep -q "generating a self-signed" || fail "no certificate generated: $out"
+echo "$out" | grep -q "SERVICES=tcp://:50001,ssl://:50002" || fail "wrong SERVICES: $out"
+[ -s "$tmp/ssl/server.key" ] || fail "no key"
+first="$(fingerprint)"
+
+echo "2. second start reuses it"
+out="$(run)"
+echo "$out" | grep -q "using the existing SSL certificate" || fail "not reused: $out"
+[ "$(fingerprint)" = "$first" ] || fail "certificate changed"
+
+echo "3. only one of the two files is an error, and nothing is overwritten"
+rm "$tmp/ssl/server.key"
+run | grep -q "ERROR: only one of" || fail "no error with a missing key"
+[ ! -e "$tmp/ssl/server.key" ] || fail "key was recreated"
+
+echo "4. SSL disabled"
+run -e SSL_ENABLED=false | grep -q "SERVICES=tcp://:50001$" || fail "SSL not disabled"
+
+echo "5. only SSL_CERTFILE is an error"
+run -e SSL_CERTFILE=/nope.pem | grep -q "set both SSL_CERTFILE and SSL_KEYFILE" || fail "no error"
+
+echo "6. a non-writable data directory is an error"
+chmod 555 "$tmp/db"
+if [ "$(id -u)" != 0 ]; then
+    run | grep -q "is not writable" || fail "no error for a non-writable directory"
+fi
+chmod 755 "$tmp/db"
+
+echo "OK"