Skip to content

deps: bulletin-deploy 0.15.0, and stop hardcoding the .dot TLD - #3

Merged
EnderOfWorlds007 merged 3 commits into
mainfrom
deps/bulletin-deploy-0.15.0
Aug 18, 2026
Merged

deps: bulletin-deploy 0.15.0, and stop hardcoding the .dot TLD#3
EnderOfWorlds007 merged 3 commits into
mainfrom
deps/bulletin-deploy-0.15.0

Conversation

@EnderOfWorlds007

Copy link
Copy Markdown
Collaborator

Two commits. The first is the version bump you'd expect; the second is the breaking change it exposed.

Why the bump was forced

paseo-next-v2 was re-genesised. The POP_RULES contract address pinned in 0.14.2 no longer has code at it, so every deploy died in preflight:

No contract deployed at 0x4909bFb3f4Fd86244abD6430fDfA0Ce5C91aD0c4 (POP_RULES)

0.15.0 carries the refreshed address (0x747B456b…). Both public manifest exports the e2e suite depends on — fetchManifestRoundtrip and parseManifest — still resolve, which is the check e2e/BOOTSTRAP.md requires on any bump.

The breaking change: TLD is now per-environment

0.15.0 added a tld field to each environment. paseo-next-v2 is now paseo; only preview is still dot. We appended .dot unconditionally, so:

Domain "decentralize-ci.dot" ends in ".dot", but this environment uses ".paseo" names.

normaliseDomain no longer appends anything. It strips a trailing .dot if you typed one — so every existing invocation and every documented example still works — and otherwise forwards the label untouched, letting bulletin-deploy apply whichever TLD the target env uses. We stay TLD-agnostic rather than duplicating their table, which matters because --env is a passthrough flag this tool deliberately doesn't parse.

The PopRules rule (exactly 0 or 2 trailing digits) is unchanged.

Also fixed the identical hardcoded suffix in e2e/bootstrap.sh --register, which calls bulletin-deploy directly rather than through the CLI.

Chain state changed under us — BOOTSTRAP.md updated

The re-genesis invalidated three things the runbook asserted. Old claims are kept and marked as history rather than deleted:

  • The worker lost ProofOfPersonhoodFull — preflight now reports NoStatus. BOOTSTRAP.md predicted this exact failure mode as "the single most likely way this design silently stops working". It happened.
  • Deploys are no longer freeOracle price: 10 PAS / Paying: 11 PAS. The 211.1 PAS in the error is a balance floor the signer must hold, not the price.
  • The worker was funded to ~5005 PAS. Worth writing down: bulletin-deploy's auto-top-up "Alice" is the root of the dev mnemonic, which is the worker — and the code skips a source whose address equals the recipient, so the top-up can never rescue it. Funding //Alice (5GrwvaEF…) does nothing.

decentralize-ci.paseo is registered and owned by 0x35Cdb23fF7fc86E8DCcd577CA309bFEA9c978D20.

Verified

  • typecheck clean; npm test 54 passed (51 + 3 additive, none removed or weakened, including cases proving --dot my-app.dot and --dot my-app converge); build clean.
  • npm run test:e2e run for real: 2 passed, two live Paseo deploys, no unhandled errors.

Upstream chunking bug paritytech/bulletin-deploy#1233 is not fixed in 0.15.0 — re-verified and noted on the issue.

paseo-next-v2 was re-genesised and the pinned POP_RULES contract address
(0x4909bFb3...) no longer has code at it, so every deploy failed in
preflight. 0.15.0 carries the refreshed address (0x747B456b...).

Verified on the bump, per e2e/BOOTSTRAP.md: both public manifest exports
the e2e suite depends on (fetchManifestRoundtrip, parseManifest) still
resolve.
bulletin-deploy 0.15.0 made the DotNS TLD per-environment in
assets/environments.json (paseo-next-v2, the default, now registers
under .paseo; only preview still uses .dot), so every deploy was
failing with `Domain "…" ends in ".dot", but this environment uses
".paseo" names.` normaliseDomain no longer appends a suffix: it strips
a trailing .dot typed by the caller (backward compatible with every
existing invocation), and otherwise forwards the label unchanged,
letting bulletin-deploy apply whichever TLD the target --env actually
uses. PopRules validation is unchanged. Verified live: a bare
decentralize-ci against paseo-next-v2 resolved to decentralize-ci.paseo
and registered successfully.

Updates every place that assumed .dot: index.ts/cli.ts docs and error
text, README's Naming/usage sections, package.json's description, the
e2e suite's decentralize-ci.dot -> decentralize-ci.paseo references,
and e2e/bootstrap.sh's direct bulletin-deploy invocation (which had the
identical hardcoded-suffix bug outside decentralize's own code path).

Also updates e2e/BOOTSTRAP.md with facts established during this work:
the pool-fallback worker lost ProofOfPersonhoodFull after a Paseo Next
v2 re-genesis (now NoStatus, ~11 PAS per deploy instead of free), was
refunded to ~5005 PAS via the public faucet, and decentralize-ci.paseo
is registered to the worker's EVM-mapped address. Old claims are kept
and marked as history rather than deleted.
@socket-security

socket-security Bot commented Aug 18, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatedbulletin-deploy@​0.14.2 ⏵ 0.15.069 +5100100 +19670

View full report

The suffix is no longer ours to choose — bulletin-deploy applies the
target environment's TLD. Saying 'with or without .dot' implied .dot was
still the outcome, which is wrong on every environment except preview.
@EnderOfWorlds007
EnderOfWorlds007 merged commit be97549 into main Aug 18, 2026
4 checks passed
@EnderOfWorlds007
EnderOfWorlds007 deleted the deps/bulletin-deploy-0.15.0 branch August 18, 2026 17:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant