feat: separate pruner

[songwongtp]

Summary by CodeRabbit

• New Features

  • Added a standalone pruner service with a runnable CLI, container image, Helm chart, and local env example for pruning and backups.
  • Deployment pipeline now builds and publishes the pruner image as part of unified deployments.

• Refactor

  • Removed pruner functionality from the event-indexer and split it into the independent pruner service.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

💤 Files selected but had no reviewable changes (1)

• pruner/go.mod

⛔ Files ignored due to path filters (1)

• pruner/go.sum is excluded by !**/*.sum

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 68569a09-12af-4f85-ae12-a0b3f354c716

📥 Commits

Reviewing files that changed from the base of the PR and between 2472c5a and 618f3d6.

⛔ Files ignored due to path filters (1)

• pruner/go.sum is excluded by !**/*.sum

📒 Files selected for processing (1)

• pruner/go.mod

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Pruner is extracted into a standalone service: new Go module, CLI entrypoint, main, runner script, Dockerfile, Helm chart, and CI matrix entry added. Pruner-related registration and run tasks removed from event-indexer. API/command names changed (Prune → Run, PruneCmd → RunCmd).

Changes

Event-indexer cleanup

Layer / File(s)	Summary
CLI wiring removal event-indexer/cmd/root.go	Removed prunner import and removed prunner.PruneCmd() from root command registration.
Shell runner cleanup event-indexer/run.sh	Deleted help__prune and task__prune(); help discovery and other tasks remain unchanged.

Pruner CLI & entrypoint

Layer / File(s)	Summary
Command implementation pruner/cmd/pruner/cmd.go	Renamed exported Cobra constructor from PruneCmd() → RunCmd(), changed command Use to "run", updated imports/aliases, and call from p.Prune() → p.Run().
Root CLI pruner/cmd/root.go	Added Execute() to create pruner root command and register pruner.RunCmd().
Program entrypoint pruner/main.go	Added main() which invokes cmd.Execute().
Shell runner pruner/run.sh	Added task__run(chain) to build and run the binary with env and flags; added list_all_helps() and top-level task dispatch logic.

Pruner core rename & lifecycle

Layer / File(s)	Summary
Struct change pruner/pruner/pruner.go	Added once sync.Once field to Prunner.
Method rename & init pruner/pruner/pruner.go	Renamed Prune() → Run() and moved one-time signal/context/goroutine setup to p.once.Do(...) using the new struct field.

Module, env, and examples

Layer / File(s)	Summary
Go module pruner/go.mod	Introduced new Go module github.com/initia-labs/core-indexer/pruner, set go 1.25.0, and added direct/indirect dependency listings.
Env example pruner/.env.example	Added example .env with exported placeholders: PRUNING_KEEP_BLOCK, PRUNING_INTERVAL, BACKUP_BUCKET_NAME, BACKUP_FILE_PREFIX, DB_CONNECTION_STRING.

Build & deployment

Layer / File(s)	Summary
Dockerfile (build & runtime) dockerfiles/Dockerfile.pruner	Added multi-stage Dockerfile: Go builder compiles pruner, runtime uses ubuntu:22.04, installs ca-certificates/wget, detects arch, downloads libmovevm/libcompiler for mapped arch, and sets CMD ["/pruner"].
Helm chart metadata charts/pruner/Chart.yaml	Added new Helm chart manifest (apiVersion: v2, name: pruner, version: 0.1.0, type: application).
Helm deployment template charts/pruner/templates/deployment.yaml	Added Deployment template with labels, optional annotations, replicas, Recreate strategy, optional serviceAccountName/imagePullSecrets, single pruner container (image, /pruner run), env/envFrom, resources, non-root securityContext, read-only root fs.
Helm defaults charts/pruner/values.yaml	Added values: default image ghcr.io/initia-labs/pruner:main, replicas 1, null imagePullPolicy/secret, empty env/envFrom, CPU/memory requests/limits, annotations, serviceAccountName.
CI matrix .github/workflows/unified-deployment.yml	Added pruner entry to Docker job matrix (strategy.matrix.service) referencing dockerfiles/Dockerfile.pruner so CI builds/pushes the pruner image alongside existing services.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐇 I hop from indexer to a brand new run,
I compile in builder, then bask in the sun,
Charts tuck me in, CI nudges my start,
I prune and back up with a steady heart,
Tiny paws, big tasks — a rabbit’s art.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'feat: separate pruner' accurately describes the main objective: extracting the pruner functionality into a separate component with its own Docker image, Helm charts, CLI entry point, and module structure.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/separate-pruner

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 7

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

pruner/pruner/pruner.go (1)

230-243: ⚠️ Potential issue | 🟠 Major

Make Run() idempotent across calls (current sync.Once scope is ineffective).

once is a local variable, so each Run() call gets a fresh sync.Once, defeating the “avoid multiple prunner instances” intent. Move the guard to Prunner (or package-level) so multiple invocations don’t spawn parallel pruning loops.

🔧 Proposed fix

 type Prunner struct {
 	dbClient      *gorm.DB
 	storageClient storage.Client
 	config        *PrunnerConfig
+	once          sync.Once
 }
 
 func (p *Prunner) Run() {
 	// Mutex to avoid multiple prunner instances
-	var once sync.Once
-	once.Do(func() {
+	p.once.Do(func() {
 		ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 		defer stop()
 
 		go p.StartPruning(ctx)
@@
 		logger.Info().Msgf("Stopping prunner ...")
 		p.close()
 	})
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pruner/pruner/pruner.go` around lines 230 - 243, The sync.Once used in
Prunner.Run is local and thus ineffective; make the guard a field on the Prunner
struct (e.g., add once sync.Once to Prunner) and change the method to call
p.once.Do(...) instead of a local once so multiple Run() calls are idempotent
and only a single pruning goroutine is started; inside the p.once.Do closure
keep the existing signal.NotifyContext, go p.StartPruning(ctx), the <-ctx.Done()
wait and p.close() call so shutdown behavior is preserved.

🧹 Nitpick comments (2)

pruner/run.sh (1)

24-28: Prefer env-configurable defaults for pruning/backup settings.
The script loads .env but ignores PRUNING_* and BACKUP_* values, which can surprise local users.

♻️ Suggested tweak

-  ./pruner run --db $DB_CONNECTION_STRING \
-    --backup-bucket-name ${chain}-local-core-event-data-backup \
-    --backup-file-prefix events \
-    --pruning-keep-block 10 \
-    --pruning-interval 1 \
+  ./pruner run --db "$DB_CONNECTION_STRING" \
+    --backup-bucket-name "${BACKUP_BUCKET_NAME:-${chain}-local-core-event-data-backup}" \
+    --backup-file-prefix "${BACKUP_FILE_PREFIX:-events}" \
+    --pruning-keep-block "${PRUNING_KEEP_BLOCK:-10}" \
+    --pruning-interval "${PRUNING_INTERVAL:-1}" \

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pruner/run.sh` around lines 24 - 28, The pruner invocation is hardcoding
pruning and backup flags instead of using environment-configurable defaults;
update the script so the pruner run command uses environment variables (e.g.,
PRUNING_KEEP_BLOCK, PRUNING_INTERVAL, BACKUP_BUCKET_NAME, BACKUP_FILE_PREFIX)
with sensible fallbacks if unset, for the flags --pruning-keep-block,
--pruning-interval, --backup-bucket-name and --backup-file-prefix (still use
DB_CONNECTION_STRING and the existing chain variable), so local users can
override these values via .env or environment without changing the script.

charts/pruner/templates/deployment.yaml (1)

28-65: Add a pod-level securityContext to satisfy KSV-0118 and harden defaults.

Even with container-level settings, scanners typically expect pod defaults to prevent any future sidecar/initContainer from running as root.

🛡️ Suggested hardening

   template:
     metadata:
       labels:
         app: {{ quote .Release.Name }}
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
       {{- if .Values.serviceAccountName }}
       serviceAccountName: {{ quote .Values.serviceAccountName }}
       {{- end }}
@@
         - name: pruner
           image: {{ quote .Values.image }}
@@
           securityContext:
             readOnlyRootFilesystem: true
             runAsNonRoot: true
             runAsUser: 1000
             runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@charts/pruner/templates/deployment.yaml` around lines 28 - 65, Add a
pod-level securityContext under spec (alongside the existing containers block)
to enforce non-root defaults for any sidecars/initContainers: create a
spec.securityContext with runAsNonRoot: true, runAsUser: 1000, runAsGroup: 1000
and fsGroup: 1000 so pod-wide defaults align with the container-level
securityContext already set for the pruner container; reference the existing
spec, containers, and the per-container securityContext for placement and
consistent values.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@dockerfiles/Dockerfile.pruner`:
- Around line 3-5: The Dockerfile uses COPY with parent paths (COPY ../pruner,
COPY ../pkg) which are outside the build context and will fail; update the COPY
instructions in the Dockerfile.pruner to reference files/dirs inside the build
context (or adjust the build step to set the correct context) so that the
sources being copied (pruner and pkg) are available from the context, keeping
WORKDIR /build unchanged and ensuring the COPY targets remain /build/pruner and
/build/pkg.
- Around line 9-18: The image runs as root; create a non-root user and switch to
it after installing packages and copying the binary by adding user creation and
chown steps for the /app directory and the /pruner binary (referencing the COPY
--from=builder /pruner-binary /pruner and WORKDIR /app entries), then add USER
<username> before the container is started so runtime processes do not run as
root; ensure the new user has a home or minimal shell and ownership of /pruner
and /app is set to that user.
- Around line 19-30: The Dockerfile currently downloads MoveVM artifacts
(referenced by MOVEVM_VERSION and MOVEVM_ARCH) with wget without integrity
checks; update the RUN block to also fetch the corresponding checksum files
(e.g., .sha256 or .sha256sum) for /lib/libmovevm.${MOVEVM_ARCH}.so and
/lib/libcompiler.${MOVEVM_ARCH}.so, verify them using sha256sum -c (or echo
<checksum> | sha256sum -c) and fail the build on mismatch, and only move the
verified artifacts into /lib; ensure the verification step uses the same
MOVEVM_VERSION and MOVEVM_ARCH variables and exits non‑zero if verification
fails.

In `@pruner/go.mod`:
- Line 58: Update the indirect dependency versions in go.mod to remediate the
reported vulnerabilities: change github.com/dvsekhvalnov/jose2go to v1.7.0 or
later and golang.org/x/oauth2 to v0.27.0 or later, then run `go get`/`go mod
tidy` (or your repo's dependency update command) to update go.sum and ensure the
new versions are resolved; verify there are no breaking changes by running the
test suite and CI.
- Line 3: The Dockerfile.pruner base image and the Go toolchain version in
pruner/go.mod are mismatched; update Dockerfile.pruner to use the same Go
version declared in pruner/go.mod by changing the FROM line to use golang:1.25
so the build container matches Go 1.25.0 (alternatively, if you prefer to keep
the image older, modify the pruner/go.mod go directive to 1.24 or 1.23 to match
the rest of the repo), ensuring the unique artifacts affected are
Dockerfile.pruner and pruner/go.mod.

In `@pruner/run.sh`:
- Line 8: The current ARGS assignment uses ARGS=${@:2} which flattens/loses
quoting; change it to capture positional arguments as an array with ARGS=(
"${@:2}" ) and wherever ARGS is expanded (the later invocation around the
existing uses at lines referenced in the comment) replace plain $ARGS with
"${ARGS[@]}" so each original argument and quoting is preserved.
- Around line 5-22: The script computes SCRIPT_DIR but never uses it, so
task__run() may build the wrong Go module; modify task__run (in run.sh) to
change directory into SCRIPT_DIR before running go build and sourcing .env
(e.g., cd "$SCRIPT_DIR" or pushd "$SCRIPT_DIR" then popd after), ensuring go
build -o pruner . and source .env execute from the script directory rather than
the caller's CWD.

---

Outside diff comments:
In `@pruner/pruner/pruner.go`:
- Around line 230-243: The sync.Once used in Prunner.Run is local and thus
ineffective; make the guard a field on the Prunner struct (e.g., add once
sync.Once to Prunner) and change the method to call p.once.Do(...) instead of a
local once so multiple Run() calls are idempotent and only a single pruning
goroutine is started; inside the p.once.Do closure keep the existing
signal.NotifyContext, go p.StartPruning(ctx), the <-ctx.Done() wait and
p.close() call so shutdown behavior is preserved.

---

Nitpick comments:
In `@charts/pruner/templates/deployment.yaml`:
- Around line 28-65: Add a pod-level securityContext under spec (alongside the
existing containers block) to enforce non-root defaults for any
sidecars/initContainers: create a spec.securityContext with runAsNonRoot: true,
runAsUser: 1000, runAsGroup: 1000 and fsGroup: 1000 so pod-wide defaults align
with the container-level securityContext already set for the pruner container;
reference the existing spec, containers, and the per-container securityContext
for placement and consistent values.

In `@pruner/run.sh`:
- Around line 24-28: The pruner invocation is hardcoding pruning and backup
flags instead of using environment-configurable defaults; update the script so
the pruner run command uses environment variables (e.g., PRUNING_KEEP_BLOCK,
PRUNING_INTERVAL, BACKUP_BUCKET_NAME, BACKUP_FILE_PREFIX) with sensible
fallbacks if unset, for the flags --pruning-keep-block, --pruning-interval,
--backup-bucket-name and --backup-file-prefix (still use DB_CONNECTION_STRING
and the existing chain variable), so local users can override these values via
.env or environment without changing the script.

[coderabbitai]

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@dockerfiles/Dockerfile.pruner`:
- Around line 19-30: The RUN block that computes MOVEVM_ARCH and uses wget to
fetch libmovevm.${MOVEVM_ARCH}.so and libcompiler.${MOVEVM_ARCH}.so must verify
integrity: update the Dockerfile's RUN sequence to also download the
corresponding checksum file (or a .sha256 file) for the given MOVEVM_VERSION and
MOVEVM_ARCH, compute the local checksum (e.g., sha256sum) and compare it to the
expected value before moving files into /lib, failing the build on mismatch;
alternatively fetch and verify a signed checksum using gpg if available (ensure
to reference MOVEVM_VERSION, MOVEVM_ARCH, and the two target filenames
libmovevm.${MOVEVM_ARCH}.so and libcompiler.${MOVEVM_ARCH}.so in the same RUN
block so verification happens immediately after wget and before using the
files).
- Around line 3-5: The Dockerfile uses invalid COPY sources ("COPY ../pruner"
and "COPY ../pkg") which reference files outside the build context; update the
COPY commands to use paths available inside the build context (e.g., "COPY
pruner /build/pruner" and "COPY pkg /build/pkg") or alternatively move
Dockerfile.pruner into the repository root or change your docker build context
to the parent directory so WORKDIR /build and the COPY targets resolve
correctly; adjust the Dockerfile entries referencing WORKDIR /build, COPY
../pruner, and COPY ../pkg accordingly.
- Around line 9-17: The Dockerfile (Dockerfile.pruner) currently installs
packages with `apt-get install -y` and leaves the container running as root;
update the RUN instruction that contains `apt-get update && apt-get install -y
ca-certificates wget` to include `--no-install-recommends` and cleanup (apt-get
clean && rm -rf /var/lib/apt/lists/*) and add steps to create a non-root user
(e.g., adduser or groupadd/useradd), chown the copied binary (`/pruner`) to that
user, and switch to it with a `USER` instruction after the `COPY --from=builder
/pruner-binary /pruner` line so the final image does not run as root.

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

pruner/pruner/pruner.go (2)

231-243: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

p.close() races with the StartPruning goroutine — no graceful drain before DB shutdown.

Run() calls p.close() (closes the DB connection) immediately after <-ctx.Done() returns, without waiting for the StartPruning goroutine to finish its current pruning cycle. If the goroutine is mid-way through pruningTable (inside streamBackupToGCS or pruneRows) when the DB is closed, it will hit "sql: database is closed" errors on in-flight operations.

Additionally, StartPruning uses a plain time.Sleep(pruningInterval) (up to 24 hours) rather than a context-aware select, so the goroutine cannot respond promptly to cancellation during the sleep phase.

Suggested fix:

🛠️ Proposed fix for graceful shutdown

+func (p *Prunner) Run() {
+	p.once.Do(func() {
+		ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+		defer stop()
+
+		var wg sync.WaitGroup
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			p.StartPruning(ctx)
+		}()
+
+		<-ctx.Done()
+
+		wg.Wait() // drain the current pruning cycle before closing
+		logger.Info().Msgf("Stopping prunner ...")
+		p.close()
+	})
+}

And replace time.Sleep in StartPruning with a context-aware sleep:

-		time.Sleep(pruningInterval)
+		select {
+		case <-signalCtx.Done():
+			return
+		case <-time.After(pruningInterval):
+		}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pruner/pruner/pruner.go` around lines 231 - 243, The Run method currently
calls p.close() right after signaling cancel which can race with the
StartPruning goroutine (which may be inside
pruningTable/streamBackupToGCS/pruneRows); update Run to wait for StartPruning
to finish before closing the DB (e.g., add a sync.WaitGroup or a done channel on
the Prunner struct, have StartPruning signal done when it exits, and only call
p.close() after waiting). Also make StartPruning responsive to cancellation by
replacing time.Sleep(pruningInterval) with a context-aware wait (select between
time.After(pruningInterval) and ctx.Done()) so the goroutine wakes promptly on
shutdown and drains in-flight work before Run closes the DB.

---

44-44: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Logger component name "event-indexer-prunner" is misleading for a standalone service.

Since the pruner is now its own binary/service, the component label in structured logs should reflect that rather than inheriting the old event-indexer name.

✏️ Proposed fix

-logger = zerolog.Ctx(log.With().Str("component", "event-indexer-prunner").Str("chain", config.Chain)...
+logger = zerolog.Ctx(log.With().Str("component", "pruner").Str("chain", config.Chain)...

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pruner/pruner/pruner.go` at line 44, The structured logger assignment sets
the component label to "event-indexer-prunner", which is misleading for this
standalone service; update the logger initialization (the logger variable
assignment that uses zerolog.Ctx and
config.Chain/config.Environment/config.CommitSHA) to use a correct component
name such as "pruner" (or another agreed service name) instead of
"event-indexer-prunner" so logs correctly identify this binary.

♻️ Duplicate comments (5)

pruner/run.sh (2)

5-5: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

SCRIPT_DIR is computed but never used; go build and source .env run from the caller's working directory.

If run.sh is invoked from the repo root, go build will build the wrong module and source .env will look for .env in the wrong place.

Also applies to: 20-22

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pruner/run.sh` at line 5, The SCRIPT_DIR variable is computed but never used,
so go build and source .env run from the caller's CWD; update run.sh to use
SCRIPT_DIR by either changing to that directory before executing commands or
running commands with SCRIPT_DIR as their working dir (e.g., cd "$SCRIPT_DIR" &&
go build ... and source "$SCRIPT_DIR/.env"), and apply the same change to the
other occurrences on lines 20-22 so all go build and source invocations operate
relative to SCRIPT_DIR.

---

8-8: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

ARGS=${@:2} flattens the argument array; arguments with spaces will be split incorrectly.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pruner/run.sh` at line 8, The ARGS assignment uses ARGS=${@:2}, which
collapses positional parameters into a single word and will split arguments
containing spaces; change ARGS to be an array capturing the leftover positional
parameters (use shell array assignment from "${@:2}") and whenever ARGS is
passed to commands expand it with the array form (use "${ARGS[@]}") so quoted
arguments are preserved; update the assignment for ARGS and any subsequent usage
(e.g., command invocations) that currently expand ARGS plain to the array-safe
forms.

pruner/go.mod (1)

58-58: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

OSV vulnerabilities previously flagged — still unresolved.

The past review already identified these indirect dependencies as needing upgrades:

• github.com/dvsekhvalnov/jose2go v1.6.0 (line 77): upgrade to v1.7.0+ (CVE-2025-63811 / GHSA-9mj6-hxhv-w67j — DoS via JWT bomb).
• golang.org/x/oauth2 v0.24.0 (line 200): upgrade to v0.27.0+ (GO-2025-3488 / GHSA-6v2p-p543-phr9 — memory exhaustion).
• github.com/cometbft/cometbft v0.38.19 (line 58): previously considered patched, but two new high-severity advisories have since been published (GO-2025-3442 — node stuck in blocksync; GO-2026-4361 — block time derivation inconsistency). A newer patch release is required.

Also applies to: 77-77, 200-200

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pruner/go.mod` at line 58, Update the indirect vulnerable dependencies in
go.mod by bumping the module versions: change github.com/dvsekhvalnov/jose2go to
v1.7.0+ (use the latest patch >= v1.7.0), golang.org/x/oauth2 to v0.27.0+, and
upgrade github.com/cometbft/cometbft to the latest patched release addressing
GO-2025-3442/GO-2026-4361; perform the changes by running go get
github.com/dvsekhvalnov/jose2go@v1.7.0 golang.org/x/oauth2@v0.27.0
github.com/cometbft/cometbft@<latest-patch>, then run go mod tidy and run the
test suite to ensure nothing breaks.

dockerfiles/Dockerfile.pruner (2)

4-5: ⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

COPY ../pruner and COPY ../pkg reference paths outside the build context — build will fail.

Docker forbids COPY sources that traverse above the build context. These paths are still invalid.

🛠️ Proposed fix

-COPY ../pruner /build/pruner
-COPY ../pkg /build/pkg
+COPY pruner /build/pruner
+COPY pkg /build/pkg

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@dockerfiles/Dockerfile.pruner` around lines 4 - 5, The Dockerfile.pruner uses
invalid sources COPY ../pruner and COPY ../pkg which reference files outside the
build context and will fail; change the Dockerfile to COPY pruner /build/pruner
and COPY pkg /build/pkg (or otherwise remove the leading ../) and ensure the
docker build is executed with a build context that includes those directories
(e.g., run docker build from the repository root or update CI build context) so
the paths in Dockerfile.pruner resolve correctly.

---

9-30: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Three previously flagged hardening issues remain unresolved.

1. Running as root (no USER instruction): Add a non-root user and switch to it before CMD.
2. apt-get without --no-install-recommends: Inflates image size unnecessarily.
3. No checksum verification on MoveVM libraries: Downloads are trusted without integrity checks — a supply-chain risk.

🔐 Combined fix sketch

-RUN apt-get update && apt-get install -y ca-certificates wget
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates wget \
+    && rm -rf /var/lib/apt/lists/*

 RUN ARCH=$(dpkg --print-architecture) && \
     ... \
-    wget -O /lib/libmovevm.${MOVEVM_ARCH}.so \
-        https://github.com/initia-labs/movevm/releases/download/${MOVEVM_VERSION}/libmovevm.${MOVEVM_ARCH}.so && \
-    wget -O /lib/libcompiler.${MOVEVM_ARCH}.so \
-        https://github.com/initia-labs/movevm/releases/download/${MOVEVM_VERSION}/libcompiler.${MOVEVM_ARCH}.so
+    wget -O /tmp/libmovevm.${MOVEVM_ARCH}.so \
+        https://github.com/initia-labs/movevm/releases/download/${MOVEVM_VERSION}/libmovevm.${MOVEVM_ARCH}.so && \
+    wget -O /tmp/libcompiler.${MOVEVM_ARCH}.so \
+        https://github.com/initia-labs/movevm/releases/download/${MOVEVM_VERSION}/libcompiler.${MOVEVM_ARCH}.so && \
+    wget -O /tmp/checksums.txt \
+        https://github.com/initia-labs/movevm/releases/download/${MOVEVM_VERSION}/checksums.txt && \
+    sha256sum -c /tmp/checksums.txt --ignore-missing && \
+    mv /tmp/libmovevm.${MOVEVM_ARCH}.so /lib/ && \
+    mv /tmp/libcompiler.${MOVEVM_ARCH}.so /lib/

+RUN useradd -r -u 10001 pruner && chown 10001:10001 /pruner
+USER 10001

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@dockerfiles/Dockerfile.pruner` around lines 9 - 30, The Dockerfile currently
installs packages as root, uses apt-get without --no-install-recommends, and
downloads MoveVM libraries without integrity checks; update the Dockerfile to
(1) install packages with apt-get update && apt-get install -y
--no-install-recommends ca-certificates wget (and clean apt caches in the same
RUN), (2) add a non-root user (e.g., create user/group and chown /app and
binaries) and include a USER instruction so the image does not run as root
before CMD, and (3) verify MoveVM library integrity by fetching and validating a
checksum/signature before trusting the wget downloads for
libmovevm.${MOVEVM_ARCH}.so and libcompiler.${MOVEVM_ARCH}.so (use the
MOVEVM_VERSION variable to locate the checksum file and validate via sha256sum
or signature check, failing the build on mismatch). Ensure permissions for the
non-root user allow execution of /pruner and the libraries.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/pruner/templates/deployment.yaml`:
- Around line 13-16: Deployment-level annotations are being rendered from
.Values.annotations under the Deployment metadata but pod-level annotations must
live under spec.template.metadata; add support for a separate
.Values.podAnnotations used in the pod template (rendered under
spec.template.metadata via toYaml | nindent) while keeping .Values.annotations
for Deployment metadata, and update values.yaml to document/define
podAnnotations; locate the annotations block in the Deployment template (the
current annotations rendering) and add a similar conditional block inside
spec.template.metadata for podAnnotations (e.g., check .Values.podAnnotations
and render it).

In `@pruner/go.mod`:
- Line 133: Update the indirect dependencies in go.mod to the patched versions
to address the listed OSV advisories: bump github.com/jackc/pgx/v5 to v5.9.2 (or
at least v5.9.2+), google.golang.org/grpc to v1.79.3+, and
go.opentelemetry.io/otel/sdk to v1.43.0+; run the suggested command (go get
github.com/jackc/pgx/v5@v5.9.2 google.golang.org/grpc@v1.79.3
go.opentelemetry.io/otel/sdk@v1.43.0 && go mod tidy) to update go.mod/go.sum and
ensure the fixes for GHSA-j88v-2chj-qfwx, GHSA-9jj7-4m8r-rfcm,
GHSA-p77j-4mvh-x3m3, GHSA-9h8m-3fm2-qjrq and GHSA-hfvc-g4fc-pqhx are applied.

In `@pruner/run.sh`:
- Line 11: The help string for the run command is a copy-paste artifact — update
the variable help__run in run.sh so it contains a meaningful description instead
of "run run"; replace the value of help__run with a concise, accurate message
(e.g., describing that it executes the pruner or runs the pruning job and
accepts additional args) so users see a helpful usage line.

---

Outside diff comments:
In `@pruner/pruner/pruner.go`:
- Around line 231-243: The Run method currently calls p.close() right after
signaling cancel which can race with the StartPruning goroutine (which may be
inside pruningTable/streamBackupToGCS/pruneRows); update Run to wait for
StartPruning to finish before closing the DB (e.g., add a sync.WaitGroup or a
done channel on the Prunner struct, have StartPruning signal done when it exits,
and only call p.close() after waiting). Also make StartPruning responsive to
cancellation by replacing time.Sleep(pruningInterval) with a context-aware wait
(select between time.After(pruningInterval) and ctx.Done()) so the goroutine
wakes promptly on shutdown and drains in-flight work before Run closes the DB.
- Line 44: The structured logger assignment sets the component label to
"event-indexer-prunner", which is misleading for this standalone service; update
the logger initialization (the logger variable assignment that uses zerolog.Ctx
and config.Chain/config.Environment/config.CommitSHA) to use a correct component
name such as "pruner" (or another agreed service name) instead of
"event-indexer-prunner" so logs correctly identify this binary.

---

Duplicate comments:
In `@dockerfiles/Dockerfile.pruner`:
- Around line 4-5: The Dockerfile.pruner uses invalid sources COPY ../pruner and
COPY ../pkg which reference files outside the build context and will fail;
change the Dockerfile to COPY pruner /build/pruner and COPY pkg /build/pkg (or
otherwise remove the leading ../) and ensure the docker build is executed with a
build context that includes those directories (e.g., run docker build from the
repository root or update CI build context) so the paths in Dockerfile.pruner
resolve correctly.
- Around line 9-30: The Dockerfile currently installs packages as root, uses
apt-get without --no-install-recommends, and downloads MoveVM libraries without
integrity checks; update the Dockerfile to (1) install packages with apt-get
update && apt-get install -y --no-install-recommends ca-certificates wget (and
clean apt caches in the same RUN), (2) add a non-root user (e.g., create
user/group and chown /app and binaries) and include a USER instruction so the
image does not run as root before CMD, and (3) verify MoveVM library integrity
by fetching and validating a checksum/signature before trusting the wget
downloads for libmovevm.${MOVEVM_ARCH}.so and libcompiler.${MOVEVM_ARCH}.so (use
the MOVEVM_VERSION variable to locate the checksum file and validate via
sha256sum or signature check, failing the build on mismatch). Ensure permissions
for the non-root user allow execution of /pruner and the libraries.

In `@pruner/go.mod`:
- Line 58: Update the indirect vulnerable dependencies in go.mod by bumping the
module versions: change github.com/dvsekhvalnov/jose2go to v1.7.0+ (use the
latest patch >= v1.7.0), golang.org/x/oauth2 to v0.27.0+, and upgrade
github.com/cometbft/cometbft to the latest patched release addressing
GO-2025-3442/GO-2026-4361; perform the changes by running go get
github.com/dvsekhvalnov/jose2go@v1.7.0 golang.org/x/oauth2@v0.27.0
github.com/cometbft/cometbft@<latest-patch>, then run go mod tidy and run the
test suite to ensure nothing breaks.

In `@pruner/run.sh`:
- Line 5: The SCRIPT_DIR variable is computed but never used, so go build and
source .env run from the caller's CWD; update run.sh to use SCRIPT_DIR by either
changing to that directory before executing commands or running commands with
SCRIPT_DIR as their working dir (e.g., cd "$SCRIPT_DIR" && go build ... and
source "$SCRIPT_DIR/.env"), and apply the same change to the other occurrences
on lines 20-22 so all go build and source invocations operate relative to
SCRIPT_DIR.
- Line 8: The ARGS assignment uses ARGS=${@:2}, which collapses positional
parameters into a single word and will split arguments containing spaces; change
ARGS to be an array capturing the leftover positional parameters (use shell
array assignment from "${@:2}") and whenever ARGS is passed to commands expand
it with the array form (use "${ARGS[@]}") so quoted arguments are preserved;
update the assignment for ARGS and any subsequent usage (e.g., command
invocations) that currently expand ARGS plain to the array-safe forms.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 426c1bf3-4112-4cf0-8b7e-19b258e75b56

📥 Commits

Reviewing files that changed from the base of the PR and between 2ae5828 and 2472c5a.

⛔ Files ignored due to path filters (1)

• pruner/go.sum is excluded by !**/*.sum

📒 Files selected for processing (14)

• .github/workflows/unified-deployment.yml
• charts/pruner/Chart.yaml
• charts/pruner/templates/deployment.yaml
• charts/pruner/values.yaml
• dockerfiles/Dockerfile.pruner
• event-indexer/cmd/root.go
• event-indexer/run.sh
• pruner/.env.example
• pruner/cmd/pruner/cmd.go
• pruner/cmd/root.go
• pruner/go.mod
• pruner/main.go
• pruner/pruner/pruner.go
• pruner/run.sh

💤 Files with no reviewable changes (2)

• event-indexer/run.sh
• event-indexer/cmd/root.go

✅ Files skipped from review due to trivial changes (4)

• .github/workflows/unified-deployment.yml
• charts/pruner/values.yaml
• charts/pruner/Chart.yaml
• pruner/main.go

🚧 Files skipped from review as they are similar to previous changes (1)

• pruner/cmd/root.go

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Deployment-level annotations will not apply to pods — consider adding a separate pod template annotations block.

.Values.annotations is rendered under the Deployment's own metadata, not under spec.template.metadata. Annotations commonly expected on pods (Prometheus scraping, Datadog agent configuration, etc.) must be on the pod template to take effect. If this values key is intended only for Deployment-level annotations, the naming is fine; if pod annotations are also needed, a separate podAnnotations value is required.

✏️ Proposed fix (add pod-level annotations support)

   template:
     metadata:
       labels:
         app: {{ quote .Release.Name }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
     spec:

And add to values.yaml:

+podAnnotations: {}

Also applies to: 24-27

🧰 Tools

🪛 YAMLlint (1.38.0)

[error] 14-14: syntax error: could not find expected ':'

(syntax)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/pruner/templates/deployment.yaml` around lines 13 - 16,
Deployment-level annotations are being rendered from .Values.annotations under
the Deployment metadata but pod-level annotations must live under
spec.template.metadata; add support for a separate .Values.podAnnotations used
in the pod template (rendered under spec.template.metadata via toYaml | nindent)
while keeping .Values.annotations for Deployment metadata, and update
values.yaml to document/define podAnnotations; locate the annotations block in
the Deployment template (the current annotations rendering) and add a similar
conditional block inside spec.template.metadata for podAnnotations (e.g., check
.Values.podAnnotations and render it).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Help string "run run" appears to be a copy-paste artifact.

The description just reads "run run" instead of describing the task.

✏️ Proposed fix

-help__run="run <..args> : run run"
+help__run="run <chain> : build and run the pruner for the given chain"

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	help__run="run <..args> : run run"
	help__run="run <chain> : build and run the pruner for the given chain"

🧰 Tools

🪛 Shellcheck (0.11.0)

[warning] 11-11: help__run appears unused. Verify use (or export if used externally).

(SC2034)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pruner/run.sh` at line 11, The help string for the run command is a
copy-paste artifact — update the variable help__run in run.sh so it contains a
meaningful description instead of "run run"; replace the value of help__run with
a concise, accurate message (e.g., describing that it executes the pruner or
runs the pruning job and accepts additional args) so users see a helpful usage
line.