test(d14n): bump xmtpd test images to the #2020 build (XIP-83 QueryApi.Subscribe bidi)

[tylerhawkes]

What

Bump the d14n test stack images (dev/docker/docker-compose-d14n.yml) from v1.3.0 to the #2020 build:

image	before	after
ghcr.io/xmtp/xmtpd	v1.3.0	sha-ac17e82
ghcr.io/xmtp/xmtpd-gateway	v1.3.0	sha-ac17e82
ghcr.io/xmtp/xmtpd-cli	v1.3.0	sha-ac17e82

Why

v1.3.0 was cut Mar 2026 — months before xmtpd #2020 (XIP-83 d14n QueryApi.Subscribe bidi streaming, merged 2026-06-26). So the d14n test containers had no bidi-streaming RPC, which blocks the upcoming d14n client integration tests. Pinning to the #2020 build gives them the capability.

Why a SHA, not :main: there is no tagged release with the RPC yet (latest is v1.3.0). sha-ac17e82 is the #2020 merge commit, so it's a frozen, reproducible pin — it won't drift when unrelated xmtpd main changes land, matching this compose's existing fixed-pin philosophy. Swap to a release tag once one ships with the RPC.

Verification

• Image revision label = ac17e820b8d997e92c8006f69fc94049ffd3bdad — exactly the mock db #2020 merge commit, so the binary contains QueryApi.Subscribe by construction.
• docker compose -f dev/docker/docker-compose-d14n.yml config validates; all three images pull.

Note on v3

The v3 stack (docker-compose.yml) uses ghcr.io/xmtp/node-go:main, which has carried the bidi RPC since node-go #562 — no change needed there (a stale local cache just needs a re-pull).

🤖 Generated with Claude Code

Note

Bump xmtpd test images to build sha-ac17e82 for XIP-83 QueryApi.Subscribe bidi

Updates docker-compose-d14n.yml to pin xmtpd, xmtpd-gateway, and xmtpd-cli images from v1.3.0 to sha-ac17e82, a specific merge commit that includes the XIP-83 QueryApi.Subscribe bidirectional streaming support needed for d14n tests.

^{Macroscope summarized 7fe1ecb.}

[claude]

Claude finished @tylerhawkes's task —— View job

---

PR Review - 2026-06-26 20:01 UTC

Tasks

• Read changed file
• Analyze Docker image version strategy
• Review for security and best practices
• Post feedback

---

Review

✅ Approved — The changes are clean, well-documented, and follow best practices for Docker compose pinning.

Highlights

1. Excellent inline documentation (dev/docker/docker-compose-d14n.yml:1-3) — The top-of-file comment clearly explains why a SHA pin is used instead of a release tag, and explicitly notes to "bump to a release tag once one ships with the RPC." This prevents future confusion.

2. Appropriate pinning strategy — Using sha-ac17e82 (the mock db #2020 merge commit) instead of :main ensures reproducible builds and prevents drift from unrelated upstream changes. This is the correct approach for a test environment that needs a specific, unreleased feature.

3. Consistent changes — All three related images (xmtpd, xmtpd-gateway, xmtpd-cli) are updated to the same commit SHA, maintaining version consistency across the stack.

4. Scope is appropriate — The v3 stack (docker-compose.yml) uses ghcr.io/xmtp/node-go:main, which already has the bidi RPC from node-go fix: bump GH actions versions #562. No changes needed there, as noted in the PR description.

No issues found

• Security: SHA pinning is more secure than :latest or :main tags (prevents unexpected upstream changes)
• Code quality: YAML syntax is correct; anchor variables (&x-xmtpd-*-image) properly defined
• Performance: No impact — image size/runtime unchanged, only version bump
• Test coverage: Not applicable — this is infrastructure config, not application code

Optional future improvement

Consider adding the full 40-character commit SHA to the comment (lines 1-3) for extra clarity:

# Pinned to the xmtpd #2020 merge commit (ac17e820b8d997e92c8006f69fc94049ffd3bdad)

This matches the verification mentioned in the PR description and provides an unambiguous reference, though the short SHA ac17e82 is already sufficient for Docker tag resolution.

---

[macroscopeapp]

Approvability

Verdict: Approved

Test infrastructure change bumping Docker image versions in a dev-only docker-compose file. The author owns this file, and the change has no production runtime impact.

^{You can customize Macroscope's approvability policy. Learn more.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.40%. Comparing base (82a7c3b) to head (7fe1ecb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3787   +/-   ##
=======================================
  Coverage   84.40%   84.40%           
=======================================
  Files         409      409           
  Lines       60138    60138           
=======================================
  Hits        50759    50759           
  Misses       9379     9379           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.