system-tests: plumb workflow attributes through RegisterWithContract (#22108)

* system-tests: plumb workflow attributes through RegisterWithContract

The WorkflowRegistryV2 UpsertWorkflow binding accepts an attributes []byte,
but the test-helpers path hard-coded it to nil. Thread an attributes
parameter through WithAttributes option -> WorkflowRegistrationConfig ->
RegisterWithContract -> registerWorkflowV2 -> UpsertWorkflow so tests can
register workflows whose spec.Attributes the CRE syncer's IsConfidential
check will see.

V1 path unchanged. Existing callers pass nil and behave identically.

* WithAttributes: defensively clone input slice

Prevents caller-mutation-after-pass from inadvertently changing the stored
workflow attributes. Raised by Copilot review on #22108.

* reorder RegisterWithContract params: attributes before artifactsDirInContainer

Groups contract-payload parameters (configURL, secretsURL, attributes)
before deployment-specific trailing args (artifactsDirInContainer).
Matches usage in confidential-compute engine tests.

Author: nadahalli

core/scripts/cre/environment/environment/workflow.go

@@ -475,7 +475,7 @@ func deployWorkflow(
 
 	fmt.Printf("\n⚙️ Registering workflow '%s' with the workflow registry\n\n", workflowNameFlag)
 
-	workflowID, registerErr := creworkflow.RegisterWithContract(ctx, sethClient, common.HexToAddress(workflowRegistryAddress), workflowRegistryVersion, uint64(donIDFlag), workflowNameFlag, "file://"+wasmWorkflowFilePathFlag, configPath, secretsPath, &containerTargetDirFlag)
+	workflowID, registerErr := creworkflow.RegisterWithContract(ctx, sethClient, common.HexToAddress(workflowRegistryAddress), workflowRegistryVersion, uint64(donIDFlag), workflowNameFlag, "file://"+wasmWorkflowFilePathFlag, configPath, secretsPath, nil, &containerTargetDirFlag)
 	if registerErr != nil {
 		return errors.Wrapf(registerErr, "❌ failed to register workflow %s", workflowNameFlag)
 	}

system-tests/lib/cre/workflow/workflow.go

@@ -55,6 +55,7 @@ func RegisterWithContract(
 	version *semver.Version,
 	donID uint64, workflowName, binaryURL string,
 	configURL, secretsURL *string,
+	attributes []byte,
 	artifactsDirInContainer *string,
 ) (string, error) {
 	// Download and decode workflow binary
@@ -92,7 +93,7 @@ func RegisterWithContract(
 	// Register workflow based on version
 	switch version.Major() {
 	case 2:
-		if err := registerWorkflowV2(sc, workflowRegistryAddr, version, workflowName, workflowID, binaryURLToUse, configURLToUse); err != nil {
+		if err := registerWorkflowV2(sc, workflowRegistryAddr, version, workflowName, workflowID, binaryURLToUse, configURLToUse, attributes); err != nil {
 			return "", err
 		}
 	default:
@@ -223,6 +224,7 @@ func registerWorkflowV2(
 	workflowRegistryAddr common.Address,
 	version *semver.Version,
 	workflowName, workflowID, binaryURL, configURL string,
+	attributes []byte,
 ) error {
 	registry, err := getRegistryV2Instance(sc, workflowRegistryAddr, version)
 	if err != nil {
@@ -247,7 +249,7 @@ func registerWorkflowV2(
 		contracts.DonFamily,
 		binaryURL,
 		configURL,
-		nil,
+		attributes,
 		false,
 	))
 	if err != nil {

system-tests/tests/test-helpers/t_helpers.go

@@ -336,6 +336,7 @@ type WorkflowRegistrationConfig struct {
 	DonID                   uint64
 	ContainerTargetDir      string
 	SethClient              *seth.Client
+	Attributes              []byte
 }
 
 /*
@@ -644,6 +645,7 @@ func registerWorkflow(ctx context.Context, t *testing.T,
 		binaryURL,
 		configURL,
 		nil, // no secrets yet
+		wfRegCfg.Attributes,
 		containerTargetDir,
 	)
 	require.NoError(t, registerErr, "failed to register workflow '%s'", wfRegCfg.WorkflowName)
@@ -721,6 +723,7 @@ func CompileAndDeployWorkflow[T WorkflowConfig](t *testing.T,
 		DonID:                   testEnv.Dons.MustWorkflowDON().ID,
 		ContainerTargetDir:      creworkflow.DefaultWorkflowTargetDir,
 		SethClient:              testEnv.CreEnvironment.Blockchains[0].(*evm.Blockchain).SethClient,
+		Attributes:              cfg.attributes,
 	}
 	require.IsType(t, &evm.Blockchain{}, testEnv.CreEnvironment.Blockchains[0], "expected EVM blockchain type")
 	workflowID := registerWorkflow(t.Context(), t, workflowRegConfig, testEnv.CreEnvironment.Blockchains[0].(*evm.Blockchain).SethClient, testLogger)
@@ -729,6 +732,7 @@ func CompileAndDeployWorkflow[T WorkflowConfig](t *testing.T,
 
 type compileAndDeployWorkflowCfg struct {
 	artifactCopyDONTypes []cre.CapabilityFlag
+	attributes           []byte
 }
 
 // CompileAndDeployWorkflowOpt customizes workflow compilation/deployment behavior.
@@ -744,6 +748,16 @@ func WithArtifactCopyDONTypes(donTypes ...cre.CapabilityFlag) CompileAndDeployWo
 	}
 }
 
+// WithAttributes sets the workflow attributes byte blob (JSON) written to the
+// WorkflowRegistry contract on upsert. The CRE syncer reads this to decide
+// routing (e.g. confidential execution via ConfidentialModule). The input is
+// cloned so later caller mutations don't affect stored config.
+func WithAttributes(attributes []byte) CompileAndDeployWorkflowOpt {
+	return func(cfg *compileAndDeployWorkflowCfg) {
+		cfg.attributes = slices.Clone(attributes)
+	}
+}
+
 func selectArtifactTargetDONs(testEnv *ttypes.TestEnvironment, donTypes []cre.CapabilityFlag) []*cre.Don {
 	if len(donTypes) == 0 {
 		donTypes = []cre.CapabilityFlag{cre.WorkflowDON}