fix(docker): improve tooling reliability and deployment safety

.dockerignore

@@ -1,3 +1 @@
 ./*
-!docker-entrypoint.sh
-

.github/workflows/docker-check.yml

@@ -0,0 +1,56 @@
+name: Docker Check
+
+on:
+  push:
+    branches: [ 'master', 'release_**' ]
+    paths:
+      - 'docker/docker.sh'
+      - 'docker/Dockerfile'
+      - 'docker/arm64/Dockerfile'
+      - '.github/workflows/docker-check.yml'
+  pull_request:
+    branches: [ 'master', 'develop', 'release_**' ]
+    paths:
+      - 'docker/docker.sh'
+      - 'docker/Dockerfile'
+      - 'docker/arm64/Dockerfile'
+      - '.github/workflows/docker-check.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  docker-check:
+    name: Docker Static Check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Check shell syntax
+        run: bash -n docker/docker.sh
+
+      - name: Run ShellCheck
+        run: shellcheck docker/docker.sh
+
+      - name: Check amd64 Dockerfile
+        run: >
+          docker buildx build
+          --check
+          --platform linux/amd64
+          --file docker/Dockerfile
+          docker
+
+      - name: Check ARM64 Dockerfile
+        run: >
+          docker buildx build
+          --check
+          --platform linux/arm64
+          --file docker/arm64/Dockerfile
+          docker

.github/workflows/pr-build.yml

@@ -197,7 +197,7 @@ jobs:
             debian11-x86_64-gradle-
 
       - name: Build
-        run: ./gradlew clean build --no-daemon --no-build-cache
+        run: ./gradlew clean build --no-daemon
 
       - name: Toolkit jar smoke test
         run: |
@@ -209,7 +209,7 @@ jobs:
           java -jar "$JAR" keystore --help
 
       - name: Test with RocksDB engine
-        run: ./gradlew :framework:testWithRocksDb --no-daemon --no-build-cache
+        run: ./gradlew :framework:testWithRocksDb --no-daemon
 
       - name: Generate module coverage reports
         run: ./gradlew jacocoTestReport --no-daemon
@@ -265,11 +265,11 @@ jobs:
         # this PR.  The only output we need from this job is the jacoco XML for
         # coverage diffing, so we must not let a stale test failure block it.
         continue-on-error: true
-        run: ./gradlew clean build --no-daemon --no-build-cache
+        run: ./gradlew clean build --no-daemon
 
       - name: Test with RocksDB engine (base)
         continue-on-error: true
-        run: ./gradlew :framework:testWithRocksDb --no-daemon --no-build-cache
+        run: ./gradlew :framework:testWithRocksDb --no-daemon
 
       - name: Generate module coverage reports (base)
         run: ./gradlew jacocoTestReport --no-daemon

.github/workflows/pr-check.yml

@@ -43,9 +43,16 @@ jobs:
               errors.push(`PR title is too long (${title.length}/72 characters).`);
             }
 
-            // 2. Conventional format check
-            const conventionalRegex = /^(feat|fix|refactor|docs|style|test|chore|ci|perf|build|revert)(\([^)]+\))?:\s\S.*/;
-            if (title && !conventionalRegex.test(title)) {
+            // 2. Conventional format check (require a space after the colon)
+            const titlePrefix = '(?:feat|fix|refactor|docs|style|test|chore|ci|perf|build|revert)(?:[(][^)]+[)])?';
+            const missingSpaceAfterColonRegex = new RegExp(`^${titlePrefix}:[^ ]`);
+            const conventionalRegex = new RegExp(`^${titlePrefix}: [^ ].*`);
+            if (title && missingSpaceAfterColonRegex.test(title)) {
+              errors.push(
+                'PR title must include a space after the colon.\n' +
+                '  Example: `feat(tvm): add blob opcodes`'
+              );
+            } else if (title && !conventionalRegex.test(title)) {
               errors.push(
                 'PR title must follow conventional format: `type(scope): description`\n' +
                 '  Allowed types: ' + allowedTypes.map(t => `\`${t}\``).join(', ') + '\n' +
@@ -60,7 +67,7 @@ jobs:
 
             // 4. Description part should not start with a capital letter
             if (title) {
-              const descMatch = title.match(/^\w+(?:\([^)]+\))?:\s*(.+)/);
+              const descMatch = title.match(/^\w+(?:\([^)]+\))?: (.+)/);
               if (descMatch) {
                 const desc = descMatch[1];
                 if (/^[A-Z]/.test(desc)) {

.github/workflows/pr-reviewer.yml

@@ -59,13 +59,23 @@ jobs:
             const normalize = s => s.toLowerCase().replace(/[\s\-_]/g, '');
 
             // ── Extract scope from conventional commit title ──────────
-            // Format: type(scope): description
+            // Formats documented by CONTRIBUTING.md:
+            //   type(scope): description
+            //   type: description
             // Also supports: type(scope1,scope2): description
+            // Only bare "ci" currently has an equivalent reviewer scope.
             const scopeMatch = title.match(/^\w+\(([^)]+)\):/);
-            const rawScope = scopeMatch ? scopeMatch[1] : null;
+            const bareTypeMatch = title.match(/^(\w+):/);
+            const inferredScope = !scopeMatch && bareTypeMatch?.[1].toLowerCase() === 'ci'
+              ? 'ci'
+              : null;
+            const rawScope = scopeMatch ? scopeMatch[1] : inferredScope;
 
             core.info(`PR title : ${title}`);
             core.info(`Raw scope: ${rawScope || '(none)'}`);
+            if (inferredScope) {
+              core.info('Inferred scope "ci" from bare "ci" PR title type.');
+            }
 
             // ── Skip if reviewers already assigned ──────────────────
             const pr = await github.rest.pulls.get({

actuator/src/main/java/org/tron/core/vm/repository/RepositoryImpl.java

@@ -949,7 +949,6 @@ private long increase(long lastUsage, long usage, long lastTime, long now, long
     }
 
     if (lastTime != now) {
-      assert now > lastTime;
       if (lastTime + windowSize > now) {
         long delta = now - lastTime;
         double decay = (windowSize - delta) / (double) windowSize;
@@ -998,8 +997,6 @@ public long calculateGlobalEnergyLimit(AccountCapsule accountCapsule) {
     long totalEnergyLimit = getDynamicPropertiesStore().getTotalEnergyCurrentLimit();
     long totalEnergyWeight = getDynamicPropertiesStore().getTotalEnergyWeight();
 
-    assert totalEnergyWeight > 0;
-
     if (hardenResourceCalculation()) {
       return BigInteger.valueOf(energyWeight)
           .multiply(BigInteger.valueOf(totalEnergyLimit))

build.gradle

@@ -6,7 +6,7 @@ plugins {
 }
 
 ext {
-    grpcVersion = "1.83.0"
+    grpcVersion = "1.83.1"
 }
 
 allprojects {
@@ -91,16 +91,14 @@ subprojects {
     }
 
     dependencies {
-        implementation group: 'org.slf4j', name: 'slf4j-api', version: '1.7.36'
-        implementation group: 'org.slf4j', name: 'jcl-over-slf4j', version: '1.7.36'
-        implementation group: 'org.slf4j', name: 'jul-to-slf4j', version: '1.7.36'
-        implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.13'
+        implementation group: 'org.slf4j', name: 'slf4j-api', version: '2.0.17'
+        implementation group: 'org.slf4j', name: 'jcl-over-slf4j', version: '2.0.17'
+        implementation group: 'org.slf4j', name: 'jul-to-slf4j', version: '2.0.17'
+        implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.3.16'
         implementation "com.google.code.findbugs:jsr305:3.0.0"
         implementation group: 'org.springframework', name: 'spring-context', version: "${springVersion}"
-        implementation "org.apache.commons:commons-lang3:3.4"
-        implementation group: 'org.apache.commons', name: 'commons-math', version: '2.2'
-        implementation "org.apache.commons:commons-collections4:4.1"
-        implementation group: 'joda-time', name: 'joda-time', version: '2.3'
+        implementation "org.apache.commons:commons-lang3:3.20.0"
+        implementation "org.apache.commons:commons-collections4:4.6.0"
         implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.84'
 
         compileOnly 'org.projectlombok:lombok:1.18.34'

chainbase/src/main/java/org/tron/common/zksnark/MerklePath.java

@@ -75,7 +75,6 @@ private static long convertVectorToLong(List<Boolean> v) throws ZksnarkException
   }
 
   public byte[] encode() throws ZksnarkException {
-    assert (authenticationPath.size() == index.size());
     List<List<Byte>> pathByteList = Lists.newArrayList();
     long indexLong; // 64
     for (int i = 0; i < authenticationPath.size(); i++) {

chainbase/src/main/java/org/tron/core/db/EnergyProcessor.java

@@ -155,8 +155,6 @@ public long calculateGlobalEnergyLimit(AccountCapsule accountCapsule) {
     long totalEnergyWeight = dynamicPropertiesStore.getTotalEnergyWeight();
     if (dynamicPropertiesStore.allowNewReward() && totalEnergyWeight <= 0) {
       return 0;
-    } else {
-      assert totalEnergyWeight > 0;
     }
     if (hardenCalculation()) {
       return calculateGlobalLimitV1(frozeBalance, totalEnergyLimit, totalEnergyWeight);
@@ -205,4 +203,3 @@ private long scaleByRate(long value, long numerator, long denominator) {
   }
 }
 
-

chainbase/src/main/java/org/tron/core/db/ResourceProcessor.java

@@ -63,7 +63,6 @@ protected long increase(long lastUsage, long usage, long lastTime, long now, lon
     }
 
     if (lastTime != now) {
-      assert now > lastTime;
       if (lastTime + windowSize > now) {
         long delta = now - lastTime;
         double decay = (windowSize - delta) / (double) windowSize;

chainbase/src/main/java/org/tron/core/store/DynamicPropertiesStore.java

@@ -12,13 +12,13 @@
 import java.util.stream.IntStream;
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
-import org.joda.time.DateTime;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 import org.tron.common.parameter.CommonParameter;
 import org.tron.common.utils.ByteArray;
 import org.tron.common.utils.Sha256Hash;
+import org.tron.common.utils.Time;
 import org.tron.core.capsule.BytesCapsule;
 import org.tron.core.config.Parameter.ChainConstant;
 import org.tron.core.db.TronStoreWithRevoking;
@@ -2261,8 +2261,8 @@ public void updateNextMaintenanceTime(long blockTime) {
     logger.info(
         "Do update nextMaintenanceTime, currentMaintenanceTime: {}, blockTime: {}, "
             + "nextMaintenanceTime: {}.",
-        new DateTime(currentMaintenanceTime), new DateTime(blockTime),
-        new DateTime(nextMaintenanceTime)
+        Time.getIsoTimeString(currentMaintenanceTime), Time.getIsoTimeString(blockTime),
+        Time.getIsoTimeString(nextMaintenanceTime)
     );
   }
 

common/build.gradle

@@ -8,7 +8,9 @@ sourceCompatibility = 1.8
 
 
 dependencies {
-    api group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.18.6' // https://github.com/FasterXML/jackson-databind/issues/3627
+    // avoid x.y.z.w micro-patches, they may ship broken Gradle module metadata:
+    // https://github.com/FasterXML/jackson-databind/issues/3627
+    api group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.18.10'
     api "com.cedarsoftware:java-util:3.2.0"
     api group: 'org.apache.httpcomponents', name: 'httpasyncclient', version: '4.1.1'
     api group: 'commons-codec', name: 'commons-codec', version: '1.11'

common/src/main/java/org/tron/common/entity/NodeInfo.java

@@ -146,7 +146,7 @@ public Protocol.NodeInfo transferToProtoEntity() {
       peerInfoBuilder.setLastBlockUpdateTime(peerInfo.getLastBlockUpdateTime());
       peerInfoBuilder.setSyncFlag(peerInfo.isSyncFlag());
       peerInfoBuilder.setHeadBlockTimeWeBothHave(peerInfo.getHeadBlockTimeWeBothHave());
-      peerInfoBuilder.setNeedSyncFromPeer(peerInfo.isSyncFlag());
+      peerInfoBuilder.setNeedSyncFromPeer(peerInfo.isNeedSyncFromPeer());
       peerInfoBuilder.setNeedSyncFromUs(peerInfo.isNeedSyncFromUs());
       peerInfoBuilder.setHost(peerInfo.getHost());
       peerInfoBuilder.setPort(peerInfo.getPort());

common/src/main/java/org/tron/common/setting/RocksDbSettings.java

@@ -6,7 +6,6 @@
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
 import org.rocksdb.BlockBasedTableConfig;
-import org.rocksdb.BloomFilter;
 import org.rocksdb.ComparatorOptions;
 import org.rocksdb.InfoLogLevel;
 import org.rocksdb.LRUCache;
@@ -211,13 +210,7 @@ protected void log(InfoLogLevel infoLogLevel, String logMsg) {
     options.setTargetFileSizeBase(settings.getTargetFileSizeBase());
 
     // table options
-    final BlockBasedTableConfig tableCfg;
-    options.setTableFormatConfig(tableCfg = new BlockBasedTableConfig());
-    tableCfg.setBlockSize(settings.getBlockSize());
-    tableCfg.setBlockCache(RocksDbSettings.getCache());
-    tableCfg.setCacheIndexAndFilterBlocks(true);
-    tableCfg.setPinL0FilterAndIndexBlocksInCache(true);
-    tableCfg.setFilter(new BloomFilter(10, false));
+    options.setTableFormatConfig(new BlockBasedTableConfig());
     if (Constant.MARKET_PAIR_PRICE_TO_ORDER.equals(dbName)) {
       ComparatorOptions comparatorOptions = new ComparatorOptions();
       options.setComparator(new MarketOrderPriceComparatorForRocksDB(comparatorOptions));

common/src/main/java/org/tron/common/utils/Time.java

@@ -1,14 +1,26 @@
 package org.tron.common.utils;
 
 import java.sql.Timestamp;
+import java.time.Instant;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
 
 public class Time {
 
+  // Matches joda-time's DateTime.toString() output, byte for byte: fixed
+  // 3-digit millis, offset as +08:00, and Z when the system zone is UTC.
+  private static final DateTimeFormatter ISO_MILLIS_FORMAT =
+      DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSSXXX");
+
   public static long getCurrentMillis() {
     return System.currentTimeMillis();
   }
 
   public static String getTimeString(long time) {
     return new Timestamp(time).toString();
   }
+
+  public static String getIsoTimeString(long time) {
+    return Instant.ofEpochMilli(time).atZone(ZoneId.systemDefault()).format(ISO_MILLIS_FORMAT);
+  }
 }

common/src/main/java/org/tron/core/config/args/CommitteeConfig.java

@@ -1,11 +1,14 @@
 package org.tron.core.config.args;
 
+import static org.tron.core.exception.TronError.ErrCode.PARAMETER_INIT;
+
 import com.typesafe.config.Config;
 import com.typesafe.config.ConfigBeanFactory;
 import com.typesafe.config.ConfigValue;
 import lombok.Getter;
 import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
+import org.tron.core.exception.TronError;
 
 /**
  * Committee (governance) configuration bean.
@@ -160,11 +163,11 @@ private void postProcess() {
     // cross-field: allowOldRewardOpt requires at least one reward/vote flag
     if (allowOldRewardOpt == 1 && allowNewRewardAlgorithm != 1
         && allowNewReward != 1 && allowTvmVote != 1) {
-      throw new IllegalArgumentException(
+      throw new TronError(
           "At least one of the following proposals is required to be opened first: "
               + "committee.allowNewRewardAlgorithm = 1"
               + " or committee.allowNewReward = 1"
-              + " or committee.allowTvmVote = 1.");
+              + " or committee.allowTvmVote = 1.", PARAMETER_INIT);
     }
   }
 }

common/src/main/resources/reference.conf

@@ -108,7 +108,7 @@ storage {
   dbSettings = {
     levelNumber = 7             // Number of RocksDB levels.
     compactThreads = 0          // 0 = auto: max(availableProcessors, 1)
-    blocksize = 16              // n * KB
+    blocksize = 16              // n * KB. Currently retained for compatibility but not applied to native RocksDB table options.
     maxBytesForLevelBase = 256  // n * MB
     maxBytesForLevelMultiplier = 10 // Level size multiplier.
     level0FileNumCompactionTrigger = 2 // L0 files that trigger compaction.