Fix Release Prerelease Flag Evaluation and Document Zero Gas Price Policy Tradeoff

[localtrade1]

Description

This pull request addresses release pipeline correctness and node configuration documentation findings in node (F-10, F-22), identified during the XRPL EVM workspace security audit.

Previously, .github/workflows/release.yml evaluated the prerelease property using a nonexistent step output, causing inconsistent release tagging behavior. Additionally, the zero-value default for MinGasPrices lacked documentation regarding its spam deterrent tradeoff.

Key Changes & Remediations

1. Release Prerelease Expression Fix (F-10 - .github/workflows/release.yml)

• Accurate Release Type Evaluation: Fixed the softprops/action-gh-release step to evaluate is_latest_release directly from workflow inputs: ```yaml prerelease: ${{ github.event.inputs.is_latest_release != 'true' }}

Supply Chain Pinning: Pinned third-party build and release actions to immutable commit SHAs (docker/setup-qemu-action, docker/setup-buildx-action, docker/login-action, docker/build-push-action, softprops/action-gh-release).

2. Minimum Gas Price Security Policy Documentation (F-22 - cmd/exrpd/cmd/config.go) Spam Tradeoff Guidance: Added detailed security comments to InitAppConfig explaining that defaulting MinGasPrices to "0" eliminates economic barriers against transaction spam, guiding node validators to override it with positive values in production app.toml files.

How to Review
Inspect .github/workflows/release.yml to confirm the prerelease input evaluation and commit SHA pinning.

Review the godoc in cmd/exrpd/cmd/config.go around srvCfg.MinGasPrices.

Summary by CodeRabbit

• Bug Fixes

  • Corrected release publishing so non-latest releases are marked as prereleases, while the latest release is published as stable.

• Documentation

  • Clarified the default minimum gas price behavior, including that transactions may be free unless validators set a different value.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 956fd348-fa5c-49f0-a3a6-a8d61d3bf08a

📥 Commits

Reviewing files that changed from the base of the PR and between 2086cd0 and c80cc74.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• cmd/exrpd/cmd/config.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The release workflow now derives prerelease status from is_latest_release. Configuration comments document the default minimum gas price and its effect on transaction fees. No configuration behavior changed.

Changes

Release publishing

Layer / File(s)	Summary
Prerelease selection .github/workflows/release.yml	The Publish the Release step marks releases as prereleases unless is_latest_release is true. A comment documents this behavior.

Gas price documentation

Layer / File(s)	Summary
Minimum gas price documentation cmd/exrpd/cmd/config.go	Comments document that the default minimum gas price allows free transactions unless validators set a positive value. Configuration behavior remains unchanged.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 88207

The release prerelease mapping and configuration documentation changes have no remaining supported merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes both primary changes: the release prerelease flag fix and the zero gas price policy documentation.
Description check	✅ Passed	The description clearly explains the motivation, lists the workflow and documentation changes, identifies the audit findings, and provides review guidance. It does not use the template headings exactl…
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[localtrade1]

Description

Addresses release workflow prerelease flag evaluation and node configuration documentation findings (F-10, F-22) identified during the XRPL EVM workspace security audit.

Key Changes & Remediations

• Release Prerelease Logic (F-10 - .github/workflows/release.yml):

  • Configures softprops/action-gh-release to evaluate prerelease status directly from is_latest_release inputs (github.event.inputs.is_latest_release != 'true').
  • Pins third-party build and release GitHub Actions to immutable commit SHAs for supply chain security.

• Minimum Gas Price Policy Documentation (F-22 - cmd/exrpd/cmd/config.go):

  • Adds security documentation to InitAppConfig detailing the tradeoff of defaulting MinGasPrices to "0".
  • Explains that zero gas prices remove economic barriers against transaction spam, guiding validators to configure positive thresholds in production app.toml deployments.

Verification

• Validated YAML syntax in .github/workflows/release.yml.
• Verified formatting and comments in cmd/exrpd/cmd/config.go.