[3alpha]

Stacked on #481; review after it. Once #481 is merged this PR targets master.

Summary

Adds a stricter package spec, and checks every package against it during build and publish. In this release violations are warnings only: nothing that builds today stops building. The plan is to turn them into errors later.

The spec is in doc/package-spec.md. For each rule it gives why it exists, which repositories break it today, and the rollout. It also lists the tropibot code each rule will make removable.

Rules

24 rules with stable ids:

Group	Rules
Manifest (M01–M09)	One dappnode_package.json per directory; package name format; upstream[] instead of legacy upstreamRepo/Version/Arg; the upstream arg exists in compose build.args and its value equals the upstream version; variant upstream[] keeps the root's positions; only schema fields; repository.url is the package's own repository; exposable services exist in the compose
Templates (T01–T05)	No name/version on a template root; variants only in package_variants/; variant directory names; a single release file in the root or the variant, not both; every variant directory has a manifest
Compose (C01–C05)	docker-compose.yml only (a custom --compose_file_name yields a release DAPPMANAGER cannot install); no container_name outside core packages; pinned external images; no ${VAR} interpolation; build.args as a mapping
Release files (F01–F03)	Recognised file names (lookalikes such as notifications.yml are silently dropped today); size limits; values already of the schema type
Build inputs (B01–B02)	No --skip_compose_validation; no UPSTREAM_VERSION environment override

Behaviour

• Output: findings are printed once after the run, with rule id, file (relative to the repo root), fix and a link to the spec. The "Validate files" step title shows the count.
• GitHub Actions: each finding is also a ::warning annotation on the run and the PR.
• Strict mode: DAPPNODE_SDK_SPEC=error (opt-in) makes validation fail on any violation, so workflows can try strict mode before it is the default. DAPPNODE_SDK_SPEC=off skips the checks.
• No duplicates: each finding is attributed to the file that defines the value, so a root value inherited by every variant is reported once.
• Schema coercions (for example isBanner: "false") are reported as SPEC-F03, replacing the long "Validate files" title from Quality fixes for build, publish and GitHub actions #481.
• The build-result comment marker is unchanged. tropibot parses its JSON with deny_unknown_fields, so findings deliberately stay out of it.

Verification

• The checks were run over all 113 non-archived DAppNodePackage*/DNP_* repositories:
  • 58 of 87 active repositories get at least one warning, mostly SPEC-M03 (legacy upstream fields, 44 active repositories); 37 repositories are already clean.
  • The document lists the affected repositories per rule.
  • These false positives were found and fixed: digest-pinned build args (1.0.0@sha256:…), shorter variant upstream[] lists, valid avatars named like other release files, and container_name on core packages, which the installer relies on.
• Packages created by dappnodesdk init (single and template) produce no findings.
• yarn lint, yarn build and yarn test pass (160 passing, 1 pending). The new tests cover each rule, the no-false-positive cases, annotation escaping, and warn, error and off modes.

[github-actions]

Dappnode bot has built and pinned the built packages to an IPFS node, for commit: 2e53a24

This is a development version and should only be installed for testing purposes.

1. Package dappnodesdk.public.dappnode.eth

Install link

Hash: /ipfs/QmQKTvDwScYokTRAqGuVFigYvicaCdoRQxCoX4FK9pRSxJ

(by dappnodebot/build-action)