From a118f6f5cab7fd4404802b6aef153f4be7d1ce46 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 8 Dec 2025 18:37:31 +0000
Subject: [PATCH 01/21] feat: add standalone ccip-server Docker image and
 workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add Dockerfile for standalone ccip-server image
- Add GitHub Actions workflow to build and push to GCR
- Update helm chart to support both standalone and monorepo images
  - Add `image.standalone` flag to switch between images
  - Document image options in values.yaml

Note: Uses tsc build (not ncc) due to Prisma native binaries
which don't bundle well with ncc.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .github/workflows/ccip-server-docker.yml      | 133 ++++++++++++++++++
 typescript/ccip-server/Dockerfile             |  79 +++++++++++
 .../templates/deployment.yaml                 |  12 +-
 .../helm/offchain-lookup-server/values.yaml   |   6 +-
 4 files changed, 224 insertions(+), 6 deletions(-)
 create mode 100644 .github/workflows/ccip-server-docker.yml
 create mode 100644 typescript/ccip-server/Dockerfile

diff --git a/.github/workflows/ccip-server-docker.yml b/.github/workflows/ccip-server-docker.yml
new file mode 100644
index 00000000000..3e2c37575a3
--- /dev/null
+++ b/.github/workflows/ccip-server-docker.yml
@@ -0,0 +1,133 @@
+name: Build and Push CCIP Server Image to GCR
+on:
+  push:
+    branches: [main]
+    tags:
+      - '**'
+    paths:
+      - 'typescript/ccip-server/**'
+      - 'typescript/sdk/**'
+      - 'typescript/utils/**'
+      - '.github/workflows/ccip-server-docker.yml'
+  pull_request:
+    paths:
+      - 'typescript/ccip-server/**'
+      - 'typescript/sdk/**'
+      - 'typescript/utils/**'
+      - '.github/workflows/ccip-server-docker.yml'
+  workflow_dispatch:
+    inputs:
+      include_arm64:
+        description: 'Include arm64 in the build'
+        required: false
+        default: 'false'
+
+concurrency:
+  group: build-push-ccip-server-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check-env:
+    runs-on: ubuntu-latest
+    outputs:
+      gcloud-service-key: ${{ steps.gcloud-service-key.outputs.defined }}
+    steps:
+      - id: gcloud-service-key
+        env:
+          GCLOUD_SERVICE_KEY: ${{ secrets.GCLOUD_SERVICE_KEY }}
+        if: "${{ env.GCLOUD_SERVICE_KEY != '' }}"
+        run: echo "defined=true" >> $GITHUB_OUTPUT
+
+  build-and-push-to-gcr:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    needs: [check-env]
+    if: needs.check-env.outputs.gcloud-service-key == 'true'
+
+    steps:
+      - name: Generate GitHub App Token
+        id: generate-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.HYPER_GONK_APP_ID }}
+          private-key: ${{ secrets.HYPER_GONK_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          submodules: recursive
+
+      - name: Generate tag data
+        id: taggen
+        run: |
+          echo "TAG_DATE=$(date +'%Y%m%d-%H%M%S')" >> $GITHUB_OUTPUT
+          echo "TAG_SHA=$(echo '${{ github.event.pull_request.head.sha || github.sha }}' | cut -b 1-7)" >> $GITHUB_OUTPUT
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            gcr.io/abacus-labs-dev/hyperlane-offchain-lookup-server
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=raw,value=${{ steps.taggen.outputs.TAG_SHA }}-${{ steps.taggen.outputs.TAG_DATE }}
+
+      - name: Set up Depot CLI
+        uses: depot/setup-action@v1
+
+      - name: Login to GCR
+        uses: docker/login-action@v3
+        with:
+          registry: gcr.io
+          username: _json_key
+          password: ${{ secrets.GCLOUD_SERVICE_KEY }}
+
+      - name: Determine platforms
+        id: determine-platforms
+        run: |
+          if [ "${{ github.event.inputs.include_arm64 }}" == "true" ]; then
+            echo "platforms=linux/amd64,linux/arm64" >> $GITHUB_OUTPUT
+          else
+            echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build and push
+        id: build
+        uses: depot/build-push-action@v1
+        with:
+          project: 3cpjhx94qv
+          context: ./
+          file: ./typescript/ccip-server/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: ${{ steps.determine-platforms.outputs.platforms }}
+
+      - name: Check for ccip-server changes
+        id: check-changes
+        if: github.event_name == 'pull_request'
+        run: |
+          # Only comment if there are explicit changes to ccip-server package
+          if git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -q '^typescript/ccip-server/'; then
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Comment image tags on PR
+        if: github.event_name == 'pull_request' && steps.check-changes.outputs.has_changes == 'true' && always()
+        uses: ./.github/actions/docker-image-comment
+        with:
+          comment_tag: ccip-server-docker-image
+          image_name: CCIP Server Docker Image
+          emoji: 🔗
+          image_tags: ${{ steps.meta.outputs.tags }}
+          pr_number: ${{ github.event.pull_request.number }}
+          github_token: ${{ steps.generate-token.outputs.token }}
+          job_status: ${{ job.status }}
diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
new file mode 100644
index 00000000000..c4912eec897
--- /dev/null
+++ b/typescript/ccip-server/Dockerfile
@@ -0,0 +1,79 @@
+FROM node:20-slim AS builder
+
+WORKDIR /hyperlane-monorepo
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git g++ make python3 python3-pip jq bash curl ca-certificates unzip openssl \
+    && rm -rf /var/lib/apt/lists/* \
+    && yarn set version 4.5.1
+
+# Install Foundry for solidity builds (soldeer)
+RUN curl -L https://foundry.paradigm.xyz | bash
+RUN /root/.foundry/bin/foundryup
+ENV PATH="/root/.foundry/bin:${PATH}"
+
+# Copy package.json and yarn config
+COPY package.json yarn.lock .yarnrc.yml ./
+COPY .yarn/plugins ./.yarn/plugins
+COPY .yarn/releases ./.yarn/releases
+COPY .yarn/patches ./.yarn/patches
+
+# Copy only the packages needed for ccip-server
+COPY typescript/ccip-server/package.json ./typescript/ccip-server/
+COPY typescript/sdk/package.json ./typescript/sdk/
+COPY typescript/utils/package.json ./typescript/utils/
+COPY typescript/cosmos-sdk/package.json ./typescript/cosmos-sdk/
+COPY typescript/cosmos-types/package.json ./typescript/cosmos-types/
+COPY typescript/radix-sdk/package.json ./typescript/radix-sdk/
+COPY typescript/tsconfig/package.json ./typescript/tsconfig/
+COPY typescript/eslint-config/package.json ./typescript/eslint-config/
+COPY solidity/package.json ./solidity/
+COPY solhint-plugin/package.json ./solhint-plugin/
+COPY starknet/package.json ./starknet/
+
+RUN yarn install && yarn cache clean
+
+# Copy source files
+COPY turbo.json ./
+COPY typescript/ccip-server ./typescript/ccip-server
+COPY typescript/sdk ./typescript/sdk
+COPY typescript/utils ./typescript/utils
+COPY typescript/cosmos-sdk ./typescript/cosmos-sdk
+COPY typescript/cosmos-types ./typescript/cosmos-types
+COPY typescript/radix-sdk ./typescript/radix-sdk
+COPY typescript/tsconfig ./typescript/tsconfig
+COPY typescript/eslint-config ./typescript/eslint-config
+COPY solidity ./solidity
+COPY solhint-plugin ./solhint-plugin
+COPY starknet ./starknet
+
+# Build the ccip-server (generates prisma client and compiles TypeScript)
+RUN yarn turbo run build --filter=@hyperlane-xyz/ccip-server
+
+# Production stage - minimal image with built code
+FROM node:20-slim AS runner
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates openssl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy the built application
+COPY --from=builder /hyperlane-monorepo/typescript/ccip-server/dist ./dist
+COPY --from=builder /hyperlane-monorepo/typescript/ccip-server/src/generated ./src/generated
+COPY --from=builder /hyperlane-monorepo/typescript/ccip-server/prisma ./prisma
+COPY --from=builder /hyperlane-monorepo/typescript/ccip-server/package.json ./
+COPY --from=builder /hyperlane-monorepo/typescript/ccip-server/node_modules ./node_modules
+
+# Environment variables
+ENV NODE_ENV=production
+ENV LOG_LEVEL=info
+ENV SERVER_PORT=3000
+
+# Expose ports
+EXPOSE 3000
+EXPOSE 9090
+
+# Run the ccip-server
+CMD ["node", "dist/server.js"]
diff --git a/typescript/infra/helm/offchain-lookup-server/templates/deployment.yaml b/typescript/infra/helm/offchain-lookup-server/templates/deployment.yaml
index d382de40def..65120d1ac2c 100644
--- a/typescript/infra/helm/offchain-lookup-server/templates/deployment.yaml
+++ b/typescript/infra/helm/offchain-lookup-server/templates/deployment.yaml
@@ -1,7 +1,6 @@
 # Container Deployment
-# The offchain-lookup typescript server, started with pnpm.
-# It is used for the ccip-read ISM
-# And can expose multiple endpoints depending on its ENV.
+# The offchain-lookup typescript server (CCIP-read ISM)
+# Can expose multiple endpoints depending on its ENV.
 # The server code can be found in /typescript/ccip-server
 apiVersion: apps/v1
 kind: Deployment
@@ -32,8 +31,15 @@ spec:
             initialDelaySeconds: 5
             periodSeconds: 10
           imagePullPolicy: IfNotPresent
+          {{- if .Values.image.standalone }}
+          # Standalone image runs the server directly
+          command: ["node"]
+          args: ["dist/server.js"]
+          {{- else }}
+          # Monorepo image uses pnpm to start the server
           command: ["pnpm"]
           args: ["-C", "typescript/ccip-server", "run", "start"]
+          {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.port }}
diff --git a/typescript/infra/helm/offchain-lookup-server/values.yaml b/typescript/infra/helm/offchain-lookup-server/values.yaml
index 5404ce85aa9..2c020a2a0f4 100644
--- a/typescript/infra/helm/offchain-lookup-server/values.yaml
+++ b/typescript/infra/helm/offchain-lookup-server/values.yaml
@@ -2,11 +2,11 @@ environment: testnet
 
 # General deployment configuration
 image:
-  repository: gcr.io/abacus-labs-dev/hyperlane-monorepo
+  repository: gcr.io/abacus-labs-dev/hyperlane-offchain-lookup-server
   # Modify this tag to deploy a new revision.
   # Images can be found here:
-  # https://console.cloud.google.com/artifacts/docker/abacus-labs-dev/us/gcr.io/hyperlane-monorepo?inv=1&invt=AbxRMg&project=abacus-labs-dev
-  tag: 8da6852-20251215-172511
+  # https://console.cloud.google.com/artifacts/docker/abacus-labs-dev/us/gcr.io/hyperlane-offchain-lookup-server
+  tag: 57f9d1c-20251215-182854
 
 secrets:
   name: 'offchain-lookup-server'

From bfc23e6ac16986d7494bc7ef91971d8ec165fc2f Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 8 Dec 2025 18:40:15 +0000
Subject: [PATCH 02/21] =?UTF-8?q?chore:=20update=20PR=20comment=20emoji=20?=
 =?UTF-8?q?to=20=F0=9F=94=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/ccip-server-docker.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ccip-server-docker.yml b/.github/workflows/ccip-server-docker.yml
index 3e2c37575a3..278eda2e2c3 100644
--- a/.github/workflows/ccip-server-docker.yml
+++ b/.github/workflows/ccip-server-docker.yml
@@ -126,7 +126,7 @@ jobs:
         with:
           comment_tag: ccip-server-docker-image
           image_name: CCIP Server Docker Image
-          emoji: 🔗
+          emoji: 🔍
           image_tags: ${{ steps.meta.outputs.tags }}
           pr_number: ${{ github.event.pull_request.number }}
           github_token: ${{ steps.generate-token.outputs.token }}

From bc03f33ec916c586d3aad3089a78a0374306e266 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 8 Dec 2025 18:41:14 +0000
Subject: [PATCH 03/21] chore: also comment on PRs when workflow changes

---
 .github/workflows/ccip-server-docker.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ccip-server-docker.yml b/.github/workflows/ccip-server-docker.yml
index 278eda2e2c3..a5a783a59d9 100644
--- a/.github/workflows/ccip-server-docker.yml
+++ b/.github/workflows/ccip-server-docker.yml
@@ -113,8 +113,8 @@ jobs:
         id: check-changes
         if: github.event_name == 'pull_request'
         run: |
-          # Only comment if there are explicit changes to ccip-server package
-          if git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -q '^typescript/ccip-server/'; then
+          # Only comment if there are explicit changes to ccip-server package or this workflow
+          if git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -qE '^typescript/ccip-server/|^\.github/workflows/ccip-server-docker\.yml$'; then
             echo "has_changes=true" >> $GITHUB_OUTPUT
           else
             echo "has_changes=false" >> $GITHUB_OUTPUT

From 892c45311a400f263d67244755036721fbd84031 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 8 Dec 2025 18:48:06 +0000
Subject: [PATCH 04/21] fix: copy prisma schema before yarn install for
 postinstall hook

---
 typescript/ccip-server/Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index c4912eec897..62a40b258bb 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -31,6 +31,9 @@ COPY solidity/package.json ./solidity/
 COPY solhint-plugin/package.json ./solhint-plugin/
 COPY starknet/package.json ./starknet/
 
+# Copy prisma schema before yarn install (needed for postinstall prisma generate)
+COPY typescript/ccip-server/prisma ./typescript/ccip-server/prisma
+
 RUN yarn install && yarn cache clean
 
 # Copy source files

From e0701971b1f0667f1cdb0fefad34fea8a7941205 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 8 Dec 2025 19:13:01 +0000
Subject: [PATCH 05/21] fix: prisma 7 schema, turbo bundle task, workflow
 fetch-depth

---
 .github/workflows/ccip-server-docker.yml    | 3 ++-
 turbo.json                                  | 4 ++++
 typescript/ccip-server/Dockerfile           | 6 +++++-
 typescript/ccip-server/prisma/schema.prisma | 3 ++-
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ccip-server-docker.yml b/.github/workflows/ccip-server-docker.yml
index a5a783a59d9..393de54c427 100644
--- a/.github/workflows/ccip-server-docker.yml
+++ b/.github/workflows/ccip-server-docker.yml
@@ -60,6 +60,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           submodules: recursive
+          fetch-depth: 0
 
       - name: Generate tag data
         id: taggen
@@ -121,7 +122,7 @@ jobs:
           fi
 
       - name: Comment image tags on PR
-        if: github.event_name == 'pull_request' && steps.check-changes.outputs.has_changes == 'true' && always()
+        if: github.event_name == 'pull_request' && steps.check-changes.outputs.has_changes == 'true'
         uses: ./.github/actions/docker-image-comment
         with:
           comment_tag: ccip-server-docker-image
diff --git a/turbo.json b/turbo.json
index dd55c4e1d94..5b5a79cbdda 100644
--- a/turbo.json
+++ b/turbo.json
@@ -26,6 +26,10 @@
     "coverage": {
       "dependsOn": ["build"],
       "outputs": ["coverage/**", "fixtures/**"]
+    },
+    "bundle": {
+      "dependsOn": ["^build"],
+      "outputs": ["*-bundle/**"]
     }
   }
 }
diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index 62a40b258bb..7286b1d46ec 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -34,7 +34,11 @@ COPY starknet/package.json ./starknet/
 # Copy prisma schema before yarn install (needed for postinstall prisma generate)
 COPY typescript/ccip-server/prisma ./typescript/ccip-server/prisma
 
-RUN yarn install && yarn cache clean
+# Skip postinstall scripts during install (--mode=skip-build)
+RUN yarn install --mode=skip-build && yarn cache clean
+
+# Run prisma generate after install (needed to generate Prisma client)
+RUN yarn --cwd typescript/ccip-server prisma generate
 
 # Copy source files
 COPY turbo.json ./
diff --git a/typescript/ccip-server/prisma/schema.prisma b/typescript/ccip-server/prisma/schema.prisma
index 55d8d8f8555..ea86dd0bbd2 100644
--- a/typescript/ccip-server/prisma/schema.prisma
+++ b/typescript/ccip-server/prisma/schema.prisma
@@ -6,9 +6,10 @@ generator client {
   output   = "../src/generated/prisma"
 }
 
+// With engineType = "client" in Prisma 7, connection is handled via driver adapter in code
+// The DATABASE_URL is passed to the pg Pool in db.ts, not here
 datasource db {
   provider = "postgresql"
-  url      = env("DATABASE_URL")
 }
 
 model Commitment {

From c846edae2092ee85dcf14d2ded8689c1963a4831 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 15 Dec 2025 17:17:41 +0000
Subject: [PATCH 06/21] fix: update ccip-server Dockerfile to use pnpm
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 typescript/ccip-server/Dockerfile | 55 ++++++++++++++++++-------------
 1 file changed, 33 insertions(+), 22 deletions(-)

diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index 7286b1d46ec..e4a631b34db 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -3,24 +3,29 @@ FROM node:20-slim AS builder
 WORKDIR /hyperlane-monorepo
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    git g++ make python3 python3-pip jq bash curl ca-certificates unzip openssl \
-    && rm -rf /var/lib/apt/lists/* \
-    && yarn set version 4.5.1
+    git g++ make python3 python3-pip jq bash curl ca-certificates unzip \
+    && rm -rf /var/lib/apt/lists/*
 
 # Install Foundry for solidity builds (soldeer)
 RUN curl -L https://foundry.paradigm.xyz | bash
 RUN /root/.foundry/bin/foundryup
 ENV PATH="/root/.foundry/bin:${PATH}"
 
-# Copy package.json and yarn config
-COPY package.json yarn.lock .yarnrc.yml ./
-COPY .yarn/plugins ./.yarn/plugins
-COPY .yarn/releases ./.yarn/releases
-COPY .yarn/patches ./.yarn/patches
+# Copy package.json first for corepack to read packageManager field
+COPY package.json ./
+RUN corepack enable && corepack install
+
+# Copy pnpm config files
+COPY pnpm-lock.yaml pnpm-workspace.yaml ./
+
+# Copy patches directory (required for pnpm install)
+COPY patches ./patches
 
 # Copy only the packages needed for ccip-server
 COPY typescript/ccip-server/package.json ./typescript/ccip-server/
+COPY typescript/deploy-sdk/package.json ./typescript/deploy-sdk/
 COPY typescript/sdk/package.json ./typescript/sdk/
+COPY typescript/provider-sdk/package.json ./typescript/provider-sdk/
 COPY typescript/utils/package.json ./typescript/utils/
 COPY typescript/cosmos-sdk/package.json ./typescript/cosmos-sdk/
 COPY typescript/cosmos-types/package.json ./typescript/cosmos-types/
@@ -31,19 +36,20 @@ COPY solidity/package.json ./solidity/
 COPY solhint-plugin/package.json ./solhint-plugin/
 COPY starknet/package.json ./starknet/
 
-# Copy prisma schema before yarn install (needed for postinstall prisma generate)
+# Copy prisma schema before install (needed for postinstall prisma generate)
 COPY typescript/ccip-server/prisma ./typescript/ccip-server/prisma
 
-# Skip postinstall scripts during install (--mode=skip-build)
-RUN yarn install --mode=skip-build && yarn cache clean
+RUN pnpm install --frozen-lockfile
 
 # Run prisma generate after install (needed to generate Prisma client)
-RUN yarn --cwd typescript/ccip-server prisma generate
+RUN pnpm --filter @hyperlane-xyz/ccip-server prisma generate
 
 # Copy source files
 COPY turbo.json ./
 COPY typescript/ccip-server ./typescript/ccip-server
+COPY typescript/deploy-sdk ./typescript/deploy-sdk
 COPY typescript/sdk ./typescript/sdk
+COPY typescript/provider-sdk ./typescript/provider-sdk
 COPY typescript/utils ./typescript/utils
 COPY typescript/cosmos-sdk ./typescript/cosmos-sdk
 COPY typescript/cosmos-types ./typescript/cosmos-types
@@ -54,24 +60,29 @@ COPY solidity ./solidity
 COPY solhint-plugin ./solhint-plugin
 COPY starknet ./starknet
 
-# Build the ccip-server (generates prisma client and compiles TypeScript)
-RUN yarn turbo run build --filter=@hyperlane-xyz/ccip-server
+# Build the ccip-server
+RUN pnpm turbo run build --filter=@hyperlane-xyz/ccip-server
+
+# Create standalone deployment with resolved dependencies (no symlinks)
+# --legacy flag required for pnpm v10+ without inject-workspace-packages
+RUN pnpm --filter @hyperlane-xyz/ccip-server deploy --legacy --prod /app
 
-# Production stage - minimal image with built code
+# Copy generated Prisma client to dist (TypeScript doesn't copy non-TS files)
+RUN cp -r /app/src/generated /app/dist/generated
+
+# Production stage - Debian slim for Prisma native binary compatibility
 FROM node:20-slim AS runner
 
 WORKDIR /app
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates openssl \
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy the built application
-COPY --from=builder /hyperlane-monorepo/typescript/ccip-server/dist ./dist
-COPY --from=builder /hyperlane-monorepo/typescript/ccip-server/src/generated ./src/generated
+# Copy the deployed standalone package
+COPY --from=builder /app ./
+
+# Copy prisma schema for migrations
 COPY --from=builder /hyperlane-monorepo/typescript/ccip-server/prisma ./prisma
-COPY --from=builder /hyperlane-monorepo/typescript/ccip-server/package.json ./
-COPY --from=builder /hyperlane-monorepo/typescript/ccip-server/node_modules ./node_modules
 
 # Environment variables
 ENV NODE_ENV=production

From 67fda2392676ac7104bf92d3afc8882a23316958 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 15 Dec 2025 17:19:03 +0000
Subject: [PATCH 07/21] fix: use corepack for pnpm installation in ccip-server
 Dockerfile
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 typescript/ccip-server/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index e4a631b34db..2352608b1cd 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -3,7 +3,7 @@ FROM node:20-slim AS builder
 WORKDIR /hyperlane-monorepo
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    git g++ make python3 python3-pip jq bash curl ca-certificates unzip \
+    git g++ make python3 python3-pip bash curl ca-certificates unzip \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Foundry for solidity builds (soldeer)

From e3af155df0e872dc2626ce3eda4402d3ce277e91 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 15 Dec 2025 17:24:23 +0000
Subject: [PATCH 08/21] fix: add jq for starknet-core build dependency
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The starknet-core package's fetch-contracts-release.sh script requires jq.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 typescript/ccip-server/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index 2352608b1cd..e4a631b34db 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -3,7 +3,7 @@ FROM node:20-slim AS builder
 WORKDIR /hyperlane-monorepo
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    git g++ make python3 python3-pip bash curl ca-certificates unzip \
+    git g++ make python3 python3-pip jq bash curl ca-certificates unzip \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Foundry for solidity builds (soldeer)

From 08514ea1193d77d8aaba23f683dc27222088bae5 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 15 Dec 2025 17:29:35 +0000
Subject: [PATCH 09/21] ci: add provider-sdk to ccip-server workflow triggers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ccip-server Docker build depends on provider-sdk via radix-sdk,
so changes to provider-sdk should trigger a rebuild.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .github/workflows/ccip-server-docker.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ccip-server-docker.yml b/.github/workflows/ccip-server-docker.yml
index 393de54c427..c3f680459ce 100644
--- a/.github/workflows/ccip-server-docker.yml
+++ b/.github/workflows/ccip-server-docker.yml
@@ -7,12 +7,14 @@ on:
     paths:
       - 'typescript/ccip-server/**'
       - 'typescript/sdk/**'
+      - 'typescript/provider-sdk/**'
       - 'typescript/utils/**'
       - '.github/workflows/ccip-server-docker.yml'
   pull_request:
     paths:
       - 'typescript/ccip-server/**'
       - 'typescript/sdk/**'
+      - 'typescript/provider-sdk/**'
       - 'typescript/utils/**'
       - '.github/workflows/ccip-server-docker.yml'
   workflow_dispatch:

From a40fbfb9604836061f8029749568b053116a82a0 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 15 Dec 2025 17:36:08 +0000
Subject: [PATCH 10/21] fix: add missing deploy-sdk dependency for SDK build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SDK imports from @hyperlane-xyz/deploy-sdk which was missing.
Also added deploy-sdk to workflow triggers.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .github/workflows/ccip-server-docker.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ccip-server-docker.yml b/.github/workflows/ccip-server-docker.yml
index c3f680459ce..2da54755db4 100644
--- a/.github/workflows/ccip-server-docker.yml
+++ b/.github/workflows/ccip-server-docker.yml
@@ -6,6 +6,7 @@ on:
       - '**'
     paths:
       - 'typescript/ccip-server/**'
+      - 'typescript/deploy-sdk/**'
       - 'typescript/sdk/**'
       - 'typescript/provider-sdk/**'
       - 'typescript/utils/**'
@@ -13,6 +14,7 @@ on:
   pull_request:
     paths:
       - 'typescript/ccip-server/**'
+      - 'typescript/deploy-sdk/**'
       - 'typescript/sdk/**'
       - 'typescript/provider-sdk/**'
       - 'typescript/utils/**'

From 8c1068aee48bc570cbc4f6a7c8d139d11a4c0059 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 15 Dec 2025 18:00:56 +0000
Subject: [PATCH 11/21] fix: ensure Prisma generated client is copied in pnpm
 deploy

---
 typescript/ccip-server/Dockerfile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index e4a631b34db..0b9d609c2f5 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -70,6 +70,11 @@ RUN pnpm --filter @hyperlane-xyz/ccip-server deploy --legacy --prod /app
 # Copy generated Prisma client to dist (TypeScript doesn't copy non-TS files)
 RUN cp -r /app/src/generated /app/dist/generated
 
+# Copy the generated Prisma client (pnpm deploy may not include .prisma)
+RUN cp -r /hyperlane-monorepo/typescript/ccip-server/node_modules/.prisma /app/node_modules/.prisma 2>/dev/null || \
+    cp -r /hyperlane-monorepo/node_modules/.prisma /app/node_modules/.prisma 2>/dev/null || \
+    echo "Warning: Could not find .prisma directory"
+
 # Production stage - Debian slim for Prisma native binary compatibility
 FROM node:20-slim AS runner
 

From 97e1496b93413dd877054f7bc4f576d9b4f78f94 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 15 Dec 2025 18:19:58 +0000
Subject: [PATCH 12/21] fix: add dist to files field so pnpm deploy includes
 built output

---
 typescript/ccip-server/package.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/typescript/ccip-server/package.json b/typescript/ccip-server/package.json
index fc928819c4e..6636c38dc84 100644
--- a/typescript/ccip-server/package.json
+++ b/typescript/ccip-server/package.json
@@ -6,7 +6,8 @@
   "typedocMain": "src/index.ts",
   "private": true,
   "files": [
-    "src"
+    "src",
+    "dist"
   ],
   "engines": {
     "node": ">=16"

From 94480d4886f02a98061f4056dcf0bbf9b622399c Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 15 Dec 2025 18:55:57 +0000
Subject: [PATCH 13/21] chore: update helm charts for standalone ccip-server
 image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove conditional standalone flag (match rebalancer pattern)
- Update image repository to hyperlane-offchain-lookup-server
- Simplify deployment.yaml by removing command/args (use Dockerfile CMD)

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .../offchain-lookup-server/templates/deployment.yaml     | 9 ---------
 .../helm/offchain-lookup-server/values-mainnet.yaml      | 6 +++---
 .../helm/offchain-lookup-server/values-testnet.yaml      | 6 +++---
 3 files changed, 6 insertions(+), 15 deletions(-)

diff --git a/typescript/infra/helm/offchain-lookup-server/templates/deployment.yaml b/typescript/infra/helm/offchain-lookup-server/templates/deployment.yaml
index 65120d1ac2c..5acb4575452 100644
--- a/typescript/infra/helm/offchain-lookup-server/templates/deployment.yaml
+++ b/typescript/infra/helm/offchain-lookup-server/templates/deployment.yaml
@@ -31,15 +31,6 @@ spec:
             initialDelaySeconds: 5
             periodSeconds: 10
           imagePullPolicy: IfNotPresent
-          {{- if .Values.image.standalone }}
-          # Standalone image runs the server directly
-          command: ["node"]
-          args: ["dist/server.js"]
-          {{- else }}
-          # Monorepo image uses pnpm to start the server
-          command: ["pnpm"]
-          args: ["-C", "typescript/ccip-server", "run", "start"]
-          {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.port }}
diff --git a/typescript/infra/helm/offchain-lookup-server/values-mainnet.yaml b/typescript/infra/helm/offchain-lookup-server/values-mainnet.yaml
index 564c9f08117..eea9625fc9e 100644
--- a/typescript/infra/helm/offchain-lookup-server/values-mainnet.yaml
+++ b/typescript/infra/helm/offchain-lookup-server/values-mainnet.yaml
@@ -2,11 +2,11 @@ environment: mainnet
 
 # General deployment configuration
 image:
-  repository: gcr.io/abacus-labs-dev/hyperlane-monorepo
+  repository: gcr.io/abacus-labs-dev/hyperlane-offchain-lookup-server
   # Modify this tag to deploy a new revision.
   # Images can be found here:
-  # https://console.cloud.google.com/artifacts/docker/abacus-labs-dev/us/gcr.io/hyperlane-monorepo?inv=1&invt=AbxRMg&project=abacus-labs-dev
-  tag: 8da6852-20251215-172511
+  # https://console.cloud.google.com/artifacts/docker/abacus-labs-dev/us/gcr.io/hyperlane-offchain-lookup-server
+  tag: 57f9d1c-20251215-182854
 
 # In Google Cloud Secret Manager, all secrets need to have a certain prefix in order to be accessible by
 # the Cluster Secret Store. For testnet this prefix is "hyperlane-testnet4"
diff --git a/typescript/infra/helm/offchain-lookup-server/values-testnet.yaml b/typescript/infra/helm/offchain-lookup-server/values-testnet.yaml
index 330f938d087..5c09f78d8df 100644
--- a/typescript/infra/helm/offchain-lookup-server/values-testnet.yaml
+++ b/typescript/infra/helm/offchain-lookup-server/values-testnet.yaml
@@ -2,11 +2,11 @@ environment: testnet
 
 # General deployment configuration
 image:
-  repository: gcr.io/abacus-labs-dev/hyperlane-monorepo
+  repository: gcr.io/abacus-labs-dev/hyperlane-offchain-lookup-server
   # Modify this tag to deploy a new revision.
   # Images can be found here:
-  # https://console.cloud.google.com/artifacts/docker/abacus-labs-dev/us/gcr.io/hyperlane-monorepo?inv=1&invt=AbxRMg&project=abacus-labs-dev
-  tag: 8da6852-20251215-172511
+  # https://console.cloud.google.com/artifacts/docker/abacus-labs-dev/us/gcr.io/hyperlane-offchain-lookup-server
+  tag: 57f9d1c-20251215-182854
 
 # In Google Cloud Secret Manager, all secrets need to have a certain prefix in order to be accessible by
 # the Cluster Secret Store. For testnet this prefix is "hyperlane-testnet4"

From 00226b464d37120bfb7d8b70ecf82c376e3e83fd Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 15 Dec 2025 19:47:13 +0000
Subject: [PATCH 14/21] fix: add DATABASE_URL for prisma generate during Docker
 build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prisma 6 requires a url in the datasource block. Add dummy DATABASE_URL
env var during build time for schema validation. Actual URL is provided
at runtime.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 Dockerfile                                  | 3 +++
 typescript/ccip-server/Dockerfile           | 3 +++
 typescript/ccip-server/prisma/schema.prisma | 4 ++--
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index d80e6ac3a9b..ddebd938a4c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -42,6 +42,9 @@ COPY solidity/package.json ./solidity/
 COPY solhint-plugin/package.json ./solhint-plugin/
 COPY starknet/package.json ./starknet/
 
+# Set dummy DATABASE_URL for ccip-server prisma generate during install
+ENV DATABASE_URL="postgresql://placeholder:placeholder@localhost:5432/placeholder"
+
 RUN pnpm install --frozen-lockfile && pnpm store prune
 
 # Copy everything else
diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index 0b9d609c2f5..c2be3a40493 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -39,6 +39,9 @@ COPY starknet/package.json ./starknet/
 # Copy prisma schema before install (needed for postinstall prisma generate)
 COPY typescript/ccip-server/prisma ./typescript/ccip-server/prisma
 
+# Set dummy DATABASE_URL for prisma generate during install (actual URL provided at runtime)
+ENV DATABASE_URL="postgresql://placeholder:placeholder@localhost:5432/placeholder"
+
 RUN pnpm install --frozen-lockfile
 
 # Run prisma generate after install (needed to generate Prisma client)
diff --git a/typescript/ccip-server/prisma/schema.prisma b/typescript/ccip-server/prisma/schema.prisma
index ea86dd0bbd2..5f1da28a49e 100644
--- a/typescript/ccip-server/prisma/schema.prisma
+++ b/typescript/ccip-server/prisma/schema.prisma
@@ -6,10 +6,10 @@ generator client {
   output   = "../src/generated/prisma"
 }
 
-// With engineType = "client" in Prisma 7, connection is handled via driver adapter in code
-// The DATABASE_URL is passed to the pg Pool in db.ts, not here
+// DATABASE_URL is required for prisma generate but actual connection is handled in code
 datasource db {
   provider = "postgresql"
+  url      = env("DATABASE_URL")
 }
 
 model Commitment {

From d79b54dbf428b9dfb5f11d12d36732d86ff803f3 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 22 Dec 2025 16:39:00 +0000
Subject: [PATCH 15/21] only need new image if explicitly changing code, else
 can just manually trigger

---
 .github/workflows/ccip-server-docker.yml | 21 +--------------------
 1 file changed, 1 insertion(+), 20 deletions(-)

diff --git a/.github/workflows/ccip-server-docker.yml b/.github/workflows/ccip-server-docker.yml
index 2da54755db4..b476a33fe3e 100644
--- a/.github/workflows/ccip-server-docker.yml
+++ b/.github/workflows/ccip-server-docker.yml
@@ -6,18 +6,10 @@ on:
       - '**'
     paths:
       - 'typescript/ccip-server/**'
-      - 'typescript/deploy-sdk/**'
-      - 'typescript/sdk/**'
-      - 'typescript/provider-sdk/**'
-      - 'typescript/utils/**'
       - '.github/workflows/ccip-server-docker.yml'
   pull_request:
     paths:
       - 'typescript/ccip-server/**'
-      - 'typescript/deploy-sdk/**'
-      - 'typescript/sdk/**'
-      - 'typescript/provider-sdk/**'
-      - 'typescript/utils/**'
       - '.github/workflows/ccip-server-docker.yml'
   workflow_dispatch:
     inputs:
@@ -114,19 +106,8 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           platforms: ${{ steps.determine-platforms.outputs.platforms }}
 
-      - name: Check for ccip-server changes
-        id: check-changes
-        if: github.event_name == 'pull_request'
-        run: |
-          # Only comment if there are explicit changes to ccip-server package or this workflow
-          if git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -qE '^typescript/ccip-server/|^\.github/workflows/ccip-server-docker\.yml$'; then
-            echo "has_changes=true" >> $GITHUB_OUTPUT
-          else
-            echo "has_changes=false" >> $GITHUB_OUTPUT
-          fi
-
       - name: Comment image tags on PR
-        if: github.event_name == 'pull_request' && steps.check-changes.outputs.has_changes == 'true'
+        if: github.event_name == 'pull_request'
         uses: ./.github/actions/docker-image-comment
         with:
           comment_tag: ccip-server-docker-image

From 97df123eaa48a66731492a0982c1f266b7f6d163 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 22 Dec 2025 16:40:32 +0000
Subject: [PATCH 16/21] CR review

---
 typescript/ccip-server/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index c2be3a40493..21814e989e9 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -75,8 +75,8 @@ RUN cp -r /app/src/generated /app/dist/generated
 
 # Copy the generated Prisma client (pnpm deploy may not include .prisma)
 RUN cp -r /hyperlane-monorepo/typescript/ccip-server/node_modules/.prisma /app/node_modules/.prisma 2>/dev/null || \
-    cp -r /hyperlane-monorepo/node_modules/.prisma /app/node_modules/.prisma 2>/dev/null || \
-    echo "Warning: Could not find .prisma directory"
+    cp -r /hyperlane-monorepo/node_modules/.prisma /app/node_modules/.prisma || \
+    (echo "Error: Could not find .prisma directory - Prisma client will not work" && exit 1)
 
 # Production stage - Debian slim for Prisma native binary compatibility
 FROM node:20-slim AS runner

From 16eab2f11009b7216ec78baeb03389954a51ede6 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 22 Dec 2025 16:47:39 +0000
Subject: [PATCH 17/21] CR fix

---
 typescript/ccip-server/Dockerfile | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index 21814e989e9..205ab082b3b 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -71,13 +71,9 @@ RUN pnpm turbo run build --filter=@hyperlane-xyz/ccip-server
 RUN pnpm --filter @hyperlane-xyz/ccip-server deploy --legacy --prod /app
 
 # Copy generated Prisma client to dist (TypeScript doesn't copy non-TS files)
+# Note: Prisma outputs to src/generated/prisma/ (custom path), not node_modules/.prisma
 RUN cp -r /app/src/generated /app/dist/generated
 
-# Copy the generated Prisma client (pnpm deploy may not include .prisma)
-RUN cp -r /hyperlane-monorepo/typescript/ccip-server/node_modules/.prisma /app/node_modules/.prisma 2>/dev/null || \
-    cp -r /hyperlane-monorepo/node_modules/.prisma /app/node_modules/.prisma || \
-    (echo "Error: Could not find .prisma directory - Prisma client will not work" && exit 1)
-
 # Production stage - Debian slim for Prisma native binary compatibility
 FROM node:20-slim AS runner
 

From 962dbcefde410b1a66d09778fde5f1d02b3d1b88 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 22 Dec 2025 16:57:57 +0000
Subject: [PATCH 18/21] pin foundry version in ccip-server dockerfile
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use pinned Foundry binaries from solidity/.foundryrc instead of curl|bash
installer for reproducibility. Also removes unnecessary .prisma copy step
since Prisma outputs to custom path (src/generated/prisma/).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .github/workflows/ccip-server-docker.yml |  8 ++++++++
 typescript/ccip-server/Dockerfile        | 10 ++++++----
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ccip-server-docker.yml b/.github/workflows/ccip-server-docker.yml
index b476a33fe3e..75fc659d593 100644
--- a/.github/workflows/ccip-server-docker.yml
+++ b/.github/workflows/ccip-server-docker.yml
@@ -94,6 +94,12 @@ jobs:
             echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
           fi
 
+      - name: Get Foundry version
+        id: foundry-version
+        run: |
+          FOUNDRY_VERSION=$(cat solidity/.foundryrc)
+          echo "FOUNDRY_VERSION=$FOUNDRY_VERSION" >> $GITHUB_OUTPUT
+
       - name: Build and push
         id: build
         uses: depot/build-push-action@v1
@@ -105,6 +111,8 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           platforms: ${{ steps.determine-platforms.outputs.platforms }}
+          build-args: |
+            FOUNDRY_VERSION=${{ steps.foundry-version.outputs.FOUNDRY_VERSION }}
 
       - name: Comment image tags on PR
         if: github.event_name == 'pull_request'
diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index 205ab082b3b..a046ed1b44f 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -6,10 +6,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     git g++ make python3 python3-pip jq bash curl ca-certificates unzip \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Foundry for solidity builds (soldeer)
-RUN curl -L https://foundry.paradigm.xyz | bash
-RUN /root/.foundry/bin/foundryup
-ENV PATH="/root/.foundry/bin:${PATH}"
+# Install Foundry (Linux binaries) - pinned version for reproducibility
+ARG FOUNDRY_VERSION
+ARG TARGETARCH
+RUN set -o pipefail && \
+    ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "arm64" || echo "amd64") && \
+    curl --fail -L "https://github.com/foundry-rs/foundry/releases/download/${FOUNDRY_VERSION}/foundry_${FOUNDRY_VERSION}_linux_${ARCH}.tar.gz" | tar -xzC /usr/local/bin forge cast
 
 # Copy package.json first for corepack to read packageManager field
 COPY package.json ./

From 757e260f7fc02c40bee009ed2a8acaa15a1a1cce Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 22 Dec 2025 17:00:06 +0000
Subject: [PATCH 19/21] fix: use bash for pipefail in ccip-server dockerfile
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

node:20-slim uses dash as /bin/sh which doesn't support pipefail.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 typescript/ccip-server/Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/typescript/ccip-server/Dockerfile b/typescript/ccip-server/Dockerfile
index a046ed1b44f..c903a7d3477 100644
--- a/typescript/ccip-server/Dockerfile
+++ b/typescript/ccip-server/Dockerfile
@@ -9,9 +9,11 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Install Foundry (Linux binaries) - pinned version for reproducibility
 ARG FOUNDRY_VERSION
 ARG TARGETARCH
+SHELL ["/bin/bash", "-c"]
 RUN set -o pipefail && \
     ARCH=$([ "$TARGETARCH" = "arm64" ] && echo "arm64" || echo "amd64") && \
     curl --fail -L "https://github.com/foundry-rs/foundry/releases/download/${FOUNDRY_VERSION}/foundry_${FOUNDRY_VERSION}_linux_${ARCH}.tar.gz" | tar -xzC /usr/local/bin forge cast
+SHELL ["/bin/sh", "-c"]
 
 # Copy package.json first for corepack to read packageManager field
 COPY package.json ./

From 8a418865189f1c7148919fe2601f939b5a6d8f34 Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 22 Dec 2025 17:09:10 +0000
Subject: [PATCH 20/21] always build ccip-server on pushes to main
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Match monorepo behavior - build on all main pushes, path filter only for PRs.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 .github/workflows/ccip-server-docker.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/ccip-server-docker.yml b/.github/workflows/ccip-server-docker.yml
index 75fc659d593..c324ad85190 100644
--- a/.github/workflows/ccip-server-docker.yml
+++ b/.github/workflows/ccip-server-docker.yml
@@ -4,9 +4,6 @@ on:
     branches: [main]
     tags:
       - '**'
-    paths:
-      - 'typescript/ccip-server/**'
-      - '.github/workflows/ccip-server-docker.yml'
   pull_request:
     paths:
       - 'typescript/ccip-server/**'

From c93d02ed147f78196498f6aed6133d9adc4b715d Mon Sep 17 00:00:00 2001
From: pbio <10051819+paulbalaji@users.noreply.github.com>
Date: Mon, 22 Dec 2025 17:13:02 +0000
Subject: [PATCH 21/21] update offchain lookup server helm chart defaults

---
 .../infra/helm/offchain-lookup-server/values-mainnet.yaml       | 2 +-
 .../infra/helm/offchain-lookup-server/values-testnet.yaml       | 2 +-
 typescript/infra/helm/offchain-lookup-server/values.yaml        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/typescript/infra/helm/offchain-lookup-server/values-mainnet.yaml b/typescript/infra/helm/offchain-lookup-server/values-mainnet.yaml
index eea9625fc9e..36a766c7380 100644
--- a/typescript/infra/helm/offchain-lookup-server/values-mainnet.yaml
+++ b/typescript/infra/helm/offchain-lookup-server/values-mainnet.yaml
@@ -6,7 +6,7 @@ image:
   # Modify this tag to deploy a new revision.
   # Images can be found here:
   # https://console.cloud.google.com/artifacts/docker/abacus-labs-dev/us/gcr.io/hyperlane-offchain-lookup-server
-  tag: 57f9d1c-20251215-182854
+  tag: 8a41886-20251222-170941
 
 # In Google Cloud Secret Manager, all secrets need to have a certain prefix in order to be accessible by
 # the Cluster Secret Store. For testnet this prefix is "hyperlane-testnet4"
diff --git a/typescript/infra/helm/offchain-lookup-server/values-testnet.yaml b/typescript/infra/helm/offchain-lookup-server/values-testnet.yaml
index 5c09f78d8df..22fc7d84e94 100644
--- a/typescript/infra/helm/offchain-lookup-server/values-testnet.yaml
+++ b/typescript/infra/helm/offchain-lookup-server/values-testnet.yaml
@@ -6,7 +6,7 @@ image:
   # Modify this tag to deploy a new revision.
   # Images can be found here:
   # https://console.cloud.google.com/artifacts/docker/abacus-labs-dev/us/gcr.io/hyperlane-offchain-lookup-server
-  tag: 57f9d1c-20251215-182854
+  tag: 8a41886-20251222-170941
 
 # In Google Cloud Secret Manager, all secrets need to have a certain prefix in order to be accessible by
 # the Cluster Secret Store. For testnet this prefix is "hyperlane-testnet4"
diff --git a/typescript/infra/helm/offchain-lookup-server/values.yaml b/typescript/infra/helm/offchain-lookup-server/values.yaml
index 2c020a2a0f4..cec6b0f7c20 100644
--- a/typescript/infra/helm/offchain-lookup-server/values.yaml
+++ b/typescript/infra/helm/offchain-lookup-server/values.yaml
@@ -6,7 +6,7 @@ image:
   # Modify this tag to deploy a new revision.
   # Images can be found here:
   # https://console.cloud.google.com/artifacts/docker/abacus-labs-dev/us/gcr.io/hyperlane-offchain-lookup-server
-  tag: 57f9d1c-20251215-182854
+  tag: 8a41886-20251222-170941
 
 secrets:
   name: 'offchain-lookup-server'