fix(docker): improve tooling reliability and deployment safety

.github/scripts/check_math_usage.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Prints every Java file that uses java.lang.Math: bare `Math.` calls, fully
+# qualified `java.lang.Math.` calls (including static imports) and
+# `import java.lang.Math`. No output means no forbidden usage.
+# StrictMathWrapper.java and MathWrapper.java are exempt. String literals, char
+# literals and comments are stripped before matching, so `StrictMath.` and
+# mentions in text are not reported.
+# Used by .github/workflows/math-check.yml; run it locally from any directory.
+set -euo pipefail
+
+cd "$(dirname "$0")/../.."
+
+find . -type f -name '*.java' -not -path '*/build/*' | while IFS= read -r file; do
+  case "$(basename "$file")" in
+    StrictMathWrapper.java|MathWrapper.java) continue ;;
+  esac
+
+  perl -0777 -ne '
+    s/"([^"\\]|\\.)*"//g;
+    s/'\''([^'\''\\]|\\.)*'\''//g;
+    s!/\*([^*]|\*[^/])*\*/!!g;
+    s!//[^\n]*!!g;
+    $hasMath = 0;
+    $hasMath = 1 if /^[\s]*import[\s]+java\.lang\.Math\b/m;
+    $hasMath = 1 if /\bjava\s*\.\s*lang\s*\.\s*Math\s*\./;
+    $hasMath = 1 if /(?<![\w\.])(?<!Strict)Math\s*\./;
+    print "$ARGV\n" if $hasMath;
+  ' "$file"
+done | sort -u

.github/workflows/codeql.yml

@@ -34,6 +34,9 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@v5
 
+    - name: Validate Gradle wrapper
+      uses: gradle/actions/wrapper-validation@v6
+
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v4

.github/workflows/docker-check.yml

@@ -0,0 +1,56 @@
+name: Docker Check
+
+on:
+  push:
+    branches: [ 'master', 'release_**' ]
+    paths:
+      - 'docker/docker.sh'
+      - 'docker/Dockerfile'
+      - 'docker/arm64/Dockerfile'
+      - '.github/workflows/docker-check.yml'
+  pull_request:
+    branches: [ 'master', 'develop', 'release_**' ]
+    paths:
+      - 'docker/docker.sh'
+      - 'docker/Dockerfile'
+      - 'docker/arm64/Dockerfile'
+      - '.github/workflows/docker-check.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  docker-check:
+    name: Docker Static Check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Check shell syntax
+        run: bash -n docker/docker.sh
+
+      - name: Run ShellCheck
+        run: shellcheck docker/docker.sh
+
+      - name: Check amd64 Dockerfile
+        run: >
+          docker buildx build
+          --check
+          --platform linux/amd64
+          --file docker/Dockerfile
+          docker
+
+      - name: Check ARM64 Dockerfile
+        run: >
+          docker buildx build
+          --check
+          --platform linux/arm64
+          --file docker/arm64/Dockerfile
+          docker

.github/workflows/integration-test-single-node.yml

@@ -25,6 +25,9 @@ jobs:
       - name: Checkout java-tron
         uses: actions/checkout@v5
 
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@v6
+
       - name: Set up JDK 8
         uses: actions/setup-java@v5
         with:

.github/workflows/math-check.yml

@@ -19,30 +19,9 @@ jobs:
         shell: bash
         run: |
           echo "Checking for java.lang.Math usage..."
-          
-          touch math_usage.txt
-          
-          while IFS= read -r file; do
-            filename=$(basename "$file")
-            if [[ "$filename" == "StrictMathWrapper.java" || "$filename" == "MathWrapper.java" ]]; then
-              continue
-            fi
-          
-            perl -0777 -ne '
-              s/"([^"\\]|\\.)*"//g;
-              s/'\''([^'\''\\]|\\.)*'\''//g;
-              s!/\*([^*]|\*[^/])*\*/!!g;
-              s!//[^\n]*!!g;
-              $hasMath = 0;
-              $hasMath = 1 if /^[\s]*import[\s]+java\.lang\.Math\b/m;
-              $hasMath = 1 if /\bjava\s*\.\s*lang\s*\.\s*Math\s*\./;
-              $hasMath = 1 if /(?<![\w\.])(?<!Strict)Math\s*\./;
-              print "$ARGV\n" if $hasMath;
-            ' "$file" >> math_usage.txt
-          done < <(find . -type f -name "*.java")
-          
-          sort -u math_usage.txt -o math_usage.txt
-          
+
+          bash .github/scripts/check_math_usage.sh > math_usage.txt
+
           if [ -s math_usage.txt ]; then
             echo "❌ Error: Forbidden Math usage found in the following files:"
             cat math_usage.txt

.github/workflows/pr-build.yml

@@ -36,6 +36,9 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@v6
+
       - name: Set up JDK ${{ matrix.java }}
         uses: actions/setup-java@v5
         with:
@@ -72,6 +75,9 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@v6
+
       - name: Set up JDK 17
         uses: actions/setup-java@v5
         with:
@@ -126,6 +132,9 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@v6
+
       - name: Check Java version
         run: java -version
 
@@ -183,6 +192,9 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@v6
+
       - name: Check Java version
         run: java -version
 
@@ -197,7 +209,7 @@ jobs:
             debian11-x86_64-gradle-
 
       - name: Build
-        run: ./gradlew clean build --no-daemon --no-build-cache
+        run: ./gradlew clean build --no-daemon
 
       - name: Toolkit jar smoke test
         run: |
@@ -209,7 +221,7 @@ jobs:
           java -jar "$JAR" keystore --help
 
       - name: Test with RocksDB engine
-        run: ./gradlew :framework:testWithRocksDb --no-daemon --no-build-cache
+        run: ./gradlew :framework:testWithRocksDb --no-daemon
 
       - name: Generate module coverage reports
         run: ./gradlew jacocoTestReport --no-daemon
@@ -249,6 +261,9 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.base.sha }}
 
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@v6
+
       - name: Cache Gradle packages
         uses: actions/cache@v5
         with:
@@ -265,11 +280,11 @@ jobs:
         # this PR.  The only output we need from this job is the jacoco XML for
         # coverage diffing, so we must not let a stale test failure block it.
         continue-on-error: true
-        run: ./gradlew clean build --no-daemon --no-build-cache
+        run: ./gradlew clean build --no-daemon
 
       - name: Test with RocksDB engine (base)
         continue-on-error: true
-        run: ./gradlew :framework:testWithRocksDb --no-daemon --no-build-cache
+        run: ./gradlew :framework:testWithRocksDb --no-daemon
 
       - name: Generate module coverage reports (base)
         run: ./gradlew jacocoTestReport --no-daemon

.github/workflows/pr-check.yml

@@ -43,9 +43,16 @@ jobs:
               errors.push(`PR title is too long (${title.length}/72 characters).`);
             }
 
-            // 2. Conventional format check
-            const conventionalRegex = /^(feat|fix|refactor|docs|style|test|chore|ci|perf|build|revert)(\([^)]+\))?:\s\S.*/;
-            if (title && !conventionalRegex.test(title)) {
+            // 2. Conventional format check (require a space after the colon)
+            const titlePrefix = '(?:feat|fix|refactor|docs|style|test|chore|ci|perf|build|revert)(?:[(][^)]+[)])?';
+            const missingSpaceAfterColonRegex = new RegExp(`^${titlePrefix}:[^ ]`);
+            const conventionalRegex = new RegExp(`^${titlePrefix}: [^ ].*`);
+            if (title && missingSpaceAfterColonRegex.test(title)) {
+              errors.push(
+                'PR title must include a space after the colon.\n' +
+                '  Example: `feat(tvm): add blob opcodes`'
+              );
+            } else if (title && !conventionalRegex.test(title)) {
               errors.push(
                 'PR title must follow conventional format: `type(scope): description`\n' +
                 '  Allowed types: ' + allowedTypes.map(t => `\`${t}\``).join(', ') + '\n' +
@@ -60,7 +67,7 @@ jobs:
 
             // 4. Description part should not start with a capital letter
             if (title) {
-              const descMatch = title.match(/^\w+(?:\([^)]+\))?:\s*(.+)/);
+              const descMatch = title.match(/^\w+(?:\([^)]+\))?: (.+)/);
               if (descMatch) {
                 const desc = descMatch[1];
                 if (/^[A-Z]/.test(desc)) {
@@ -103,6 +110,9 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@v6
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:

.github/workflows/pr-reviewer.yml

@@ -59,13 +59,23 @@ jobs:
             const normalize = s => s.toLowerCase().replace(/[\s\-_]/g, '');
 
             // ── Extract scope from conventional commit title ──────────
-            // Format: type(scope): description
+            // Formats documented by CONTRIBUTING.md:
+            //   type(scope): description
+            //   type: description
             // Also supports: type(scope1,scope2): description
+            // Only bare "ci" currently has an equivalent reviewer scope.
             const scopeMatch = title.match(/^\w+\(([^)]+)\):/);
-            const rawScope = scopeMatch ? scopeMatch[1] : null;
+            const bareTypeMatch = title.match(/^(\w+):/);
+            const inferredScope = !scopeMatch && bareTypeMatch?.[1].toLowerCase() === 'ci'
+              ? 'ci'
+              : null;
+            const rawScope = scopeMatch ? scopeMatch[1] : inferredScope;
 
             core.info(`PR title : ${title}`);
             core.info(`Raw scope: ${rawScope || '(none)'}`);
+            if (inferredScope) {
+              core.info('Inferred scope "ci" from bare "ci" PR title type.');
+            }
 
             // ── Skip if reviewers already assigned ──────────────────
             const pr = await github.rest.pulls.get({

.github/workflows/release-build.yml

@@ -54,6 +54,9 @@ jobs:
         with:
           ref: ${{ github.sha }}
 
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@v6
+
       - name: Cache Gradle packages
         uses: actions/cache@v5
         with:
@@ -121,6 +124,9 @@ jobs:
         with:
           ref: ${{ github.sha }}
 
+      - name: Validate Gradle wrapper
+        uses: gradle/actions/wrapper-validation@v6
+
       - name: Set up Temurin 17
         uses: actions/setup-java@v5
         with: