fix: add nil safety guards and missing JWT validation

base-consensus-entrypoint

@@ -42,6 +42,11 @@ else
 fi
 export BASE_NODE_P2P_ADVERTISE_IP=$PUBLIC_IP
 
+if [[ -z "${BASE_NODE_L2_ENGINE_AUTH_RAW:-}" ]]; then
+  echo "Expected BASE_NODE_L2_ENGINE_AUTH_RAW to be set" 1>&2
+  exit 1
+fi
+
 echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 
 if [[ -n "${BASE_NODE_SOURCE_L2_RPC:-}" ]]; then

dependency_updater/dependency_updater.go

@@ -269,6 +269,10 @@ func getVersionAndCommit(ctx context.Context, client *github.Client, dependencie
 		}
 
 		// Get commit SHA from the tag
+		if selectedTag.Commit == nil || selectedTag.Commit.SHA == nil {
+			log.Printf("Tag %s has no commit object, skipping", *selectedTag.Name)
+			return currentTag, dependencies[dependencyType].Commit, VersionUpdateInfo{}, nil
+		}
 		commit = *selectedTag.Commit.SHA
 	}
 
@@ -293,6 +297,10 @@ func getVersionAndCommit(ctx context.Context, client *github.Client, dependencie
 		if err != nil {
 			return "", "", VersionUpdateInfo{}, fmt.Errorf("error listing commits for "+dependencyType+": %s", err)
 		}
+		if len(branchCommit) == 0 {
+			log.Printf("No commits found for branch %s, keeping current version", dependencies[dependencyType].Branch)
+			return dependencies[dependencyType].Tag, dependencies[dependencyType].Commit, VersionUpdateInfo{}, nil
+		}
 		commit = *branchCommit[0].SHA
 		if dependencies[dependencyType].Commit != commit {
 			from, to := dependencies[dependencyType].Commit, commit

geth/Dockerfile

@@ -29,7 +29,7 @@ FROM ubuntu:24.04
 
 RUN apt-get update && \
     apt-get install -y jq curl supervisor && \
-    rm -rf /var/lib/apt/lists
+    rm -rf /var/lib/apt/lists/*
 RUN mkdir -p /var/log/supervisor
 
 WORKDIR /app

op-node-entrypoint

@@ -43,6 +43,11 @@ fi
 export OP_NODE_P2P_ADVERTISE_IP=$PUBLIC_IP
 
 
+if [[ -z "${BASE_NODE_L2_ENGINE_AUTH_RAW:-}" ]]; then
+  echo "Expected BASE_NODE_L2_ENGINE_AUTH_RAW to be set" 1>&2
+  exit 1
+fi
+
 echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 export OP_NODE_L2_ENGINE_AUTH=$BASE_NODE_L2_ENGINE_AUTH
 

reth/reth-entrypoint

@@ -128,6 +128,10 @@ fi
 
 mkdir -p "$RETH_DATA_DIR"
 echo "Starting reth with additional args: $ADDITIONAL_ARGS"
+if [[ -z "${BASE_NODE_L2_ENGINE_AUTH_RAW:-}" ]]; then
+    echo "Expected BASE_NODE_L2_ENGINE_AUTH_RAW to be set" 1>&2
+    exit 1
+fi
 echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
 
 exec "$BINARY" node \