[auricom]

Implements the P3 issues from the optimization roadmap (#53).

Changes

Remove EVMETRICS_DEBUG and stdlib log.Printf from pkg/metrics (#50)

• Deleted isDebugEnabled() and every log.Printf("DEBUG: ...") branch in RecordSubmissionAttempt and RecordSubmissionDaHeight. What those methods record in Prometheus is unchanged.
• The verifier already logs the same events through zerolog, so Metrics did not need a logger.
• --verbose is now the only way to get debug output. The README "Debug Logging" section says so.

Small cleanups (#51)

• RecordSubmissionDaHeight: the duplicated header and data branches are now one code path using a per-type map[string]uint64. Behaviour is unchanged: only header and data are accepted, and only a strictly higher height updates the gauge.
• Removed the unused GetState and GetGenesisDaHeight from the evnode client.
• HealthCheckRequest now measures the duration after the response body is read, as its comment says it should. It also decodes the body and returns an error for a JSON-RPC error object (categorised as rpc_error).
• README: submission_attempts_total and submission_failures_total are counted once per blob type per verification round, not once per RPC attempt.

Docker and CI hardening (#52)

• Dockerfile:
  • Static build: CGO_ENABLED=0, -trimpath, -ldflags="-s -w". gcc, musl-dev and -a -installsuffix cgo are gone.
  • The builder runs on $BUILDPLATFORM and cross-compiles with GOOS/GOARCH=$TARGET*, so the arm64 image is no longer built under QEMU emulation.
  • The runtime image is gcr.io/distroless/static:nonroot, pinned by digest, running as 65532:65532. It includes CA certificates.
  • New .dockerignore.
• make test now runs with -race.
• lint: golangci-lint is pinned to v2.15.0 (it was latest) via golangci-lint-action@v9.
• Node 24: checkout v7, setup-go v7, and in the Docker workflow setup-buildx v4, login v4, metadata v6 and build-push v7. I checked that each tag exists and declares node24 in its action.yml. setup-qemu-action is removed, since the build no longer runs any arm64 binaries.
• New govulncheck workflow (on push to main, on pull requests, and weekly). It fails on any reachable vulnerability except GO-2026-5932 in x/crypto, which has no upstream fix yet. The allowed ID sits in one ALLOWED_VULN env var, with a comment to delete it once a fix ships.

Behaviour changes to watch for

• EVMETRICS_DEBUG no longer does anything. Use --verbose.
• The container runs as UID 65532 instead of root. A deployment that mounts root-owned files or volumes would need adjusting.
• The JSON-RPC health check is stricter. A node that answers 200 with a JSON-RPC error body, or with a body that isn't JSON, is now reported unavailable. It used to count as healthy.
• The distroless digest is pinned, so it must be bumped manually or through Dependabot's docker ecosystem, which isn't configured.

Verification

• Local: make test (with -race), go vet, golangci-lint (0 issues), gofmt and go mod tidy are clean. The static build (CGO_ENABLED=0) works, ldd reports a static binary, and monitor --help lists the new flags.
• govulncheck filter: it passes on the current tree and fails when run against a copy pinned to an older vulnerable gRPC (v1.79.2).
• Not verified locally: Docker isn't installed, so the image build and the multi-platform cross-compile were not run. I also didn't check the final image's CA certificates or UID by inspection. The build-and-push check on this PR is the first real test of those, along with the new govulncheck workflow and the lint action v9 with v2.15.0.

Fixes #50
Fixes #51
Fixes #52

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: dbe3c27e-59e4-45b4-aab0-aa60a227367d

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}