Merge branch 'develop' into feature/PLEX-2611-cre-don2don-accept-ocr-attestatin

# Conflicts:
#	core/scripts/go.mod
#	core/scripts/go.sum
#	deployment/go.mod
#	deployment/go.sum
#	go.mod
#	go.sum
#	integration-tests/go.mod
#	integration-tests/go.sum
#	integration-tests/load/go.mod
#	integration-tests/load/go.sum
#	system-tests/lib/go.mod
#	system-tests/lib/go.sum
#	system-tests/tests/go.mod
#	system-tests/tests/go.sum

Author: dhaidashenko

.changeset/confidential-workflow-execution.md

@@ -38,10 +38,6 @@
 /core/services/webhook/ @smartcontractkit/foundations @smartcontractkit/bix-framework @smartcontractkit/core
 /core/services/llo/ @smartcontractkit/data-streams-engineers @smartcontractkit/core
 
-# CCIP
-/core/services/ccip/ @smartcontractkit/ccip
-/core/services/ocr2/plugins/ccip/ @smartcontractkit/ccip
-
 # VRF-related services
 /core/services/vrf/ @smartcontractkit/dev-services @smartcontractkit/core
 /core/services/blockhashstore/ @smartcontractkit/dev-services @smartcontractkit/core

.changeset/cw-fetcher-and-system-tests.md

@@ -0,0 +1,10 @@
+# See https://github.com/rhysd/actionlint/blob/main/docs/config.md
+
+paths:
+  .github/workflows/**/*.{yml,yaml}:
+    ignore:
+      # ignore unknown runner labels, as we have fully custom runners
+      - 'label ".*" is unknown. available labels are .*'
+      # https://www.shellcheck.net/wiki/SC2129
+      - '.*SC2129:style:1:1:.*'
+

.changeset/gold-kites-bake.md

@@ -44,7 +44,9 @@ jobs:
 
       - name: Detect prerelease phase
         id: detect-prerelease-phase
-        if: ${{ steps.release-tag-check.outputs.is-pre-release == 'true' && (contains(github.ref_name, '-beta.') || contains(github.ref_name, '-rc.')) }}
+        if: ${{ steps.release-tag-check.outputs.is-pre-release == 'true' &&
+          (contains(github.ref_name, '-beta.') || contains(github.ref_name,
+          '-rc.')) }}
         shell: bash
         env:
           GIT_TAG: ${{ github.ref_name }}
@@ -89,7 +91,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
   docker-core:
-    needs: [checks]
+    needs: [ checks ]
     # No need to build the final image as we promote the last RC to use the final tag
     # so we only run the builds for pre-releases.
     if: needs.checks.outputs.is-pre-release == 'true'
@@ -111,7 +113,8 @@ jobs:
       docker-cache-behaviour: "disable"
       docker-manifest-sign: true
       docker-registry-url-override: public.ecr.aws/chainlink
-      github-runner-arm64: ${{ github.repository != 'smartcontractkit/chainlink' && 'ubuntu-24.04-4cores-16GB-ARM' || 'ubuntu-24.04-arm' }}
+      github-runner-arm64: ${{ github.repository != 'smartcontractkit/chainlink' &&
+        'ubuntu-24.04-4cores-16GB-ARM' || 'ubuntu-24.04-arm' }}
       docker-image-tag-strip-prefix: v # strip out the "v" prefix from the git tag for the image tag.
       git-sha: ${{ github.sha }}
       github-event-name: ${{ github.event_name }}
@@ -125,7 +128,7 @@ jobs:
       AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_INFRA_RELENG_TOKEN_ISSUER_LAMBDA_URL }}
 
   docker-ccip:
-    needs: [checks]
+    needs: [ checks ]
     # No need to build the final image as we promote the last RC to use the final tag
     # so we only run the builds for pre-releases.
     if: needs.checks.outputs.is-pre-release == 'true'
@@ -150,7 +153,8 @@ jobs:
       docker-cache-behaviour: "disable"
       docker-manifest-sign: true
       docker-registry-url-override: public.ecr.aws/chainlink
-      github-runner-arm64: ${{ github.repository != 'smartcontractkit/chainlink' && 'ubuntu-24.04-4cores-16GB-ARM' || 'ubuntu-24.04-arm' }}
+      github-runner-arm64: ${{ github.repository != 'smartcontractkit/chainlink' &&
+        'ubuntu-24.04-4cores-16GB-ARM' || 'ubuntu-24.04-arm' }}
       docker-image-tag-override: ${{ needs.checks.outputs.ccip-image-tag }}
       git-sha: ${{ github.sha }}
       github-event-name: ${{ github.event_name }}
@@ -165,9 +169,10 @@ jobs:
 
   deploy:
     name: "Deploy"
-    needs: [checks, docker-ccip]
+    needs: [ checks, docker-ccip ]
     # We are only deploying CCIP pre-releases and skipping hotfix deployments for now.
-    if: needs.checks.outputs.is-pre-release == 'true' && needs.checks.outputs.is-hotfix == 'false'
+    if: needs.checks.outputs.is-pre-release == 'true' &&
+      needs.checks.outputs.is-hotfix == 'false'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -207,28 +212,41 @@ jobs:
           products: |
             ccip-prereleases-prod-testnet
 
-  post-build:
-    needs: [docker-core, docker-ccip]
-    name: Post-Build Actions
-    uses: ./.github/workflows/post-build.yml
-    secrets: inherit
+  emit-pre-release-image-published-event:
+    name: Emit pre-release image published event
+    needs: [ docker-core ]
+    runs-on: ubuntu-latest
     permissions:
-      actions: read
-      checks: write
-      id-token: write
-      contents: read
-    with:
-      chainlink_core_full_image: ${{ needs.docker-core.result == 'success' && format('public.ecr.aws/chainlink/chainlink:{0}|{1}', needs.docker-core.outputs.docker-manifest-tag, needs.docker-core.outputs.docker-manifest-digest) || '' }}
-      chainlink_ccip_full_image: ${{ needs.docker-ccip.result == 'success' && format('public.ecr.aws/chainlink/ccip:{0}|{1}', needs.docker-ccip.outputs.docker-manifest-tag, needs.docker-ccip.outputs.docker-manifest-digest) || '' }}
-      chainlink_version: ${{ github.ref_name }}
+      contents: write
+    steps:
+      - name: Emit pre-release image published event
+        env:
+          DOCKER_MANIFEST_TAG: ${{ needs.docker-core.outputs.docker-manifest-tag }}
+          GITHUB_REF_NAME: ${{ github.ref_name }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api \
+            --method POST \
+            -H "Accept: application/vnd.github+json" \
+            "/repos/${GITHUB_REPOSITORY}/dispatches" \
+            --input - <<JSON
+          {
+            "event_type": "pre-release-image-published",
+            "client_payload": {
+              "chainlink_image_tag": "${DOCKER_MANIFEST_TAG}",
+              "chainlink_version": "${GITHUB_REF_NAME}"
+            }
+          }
+          JSON
 
   # Notify Slack channel for new git tags associated with pre-releases.
   # Final release notifications originate from the release coordinator repo.
   slack-notify:
     permissions:
       contents: read
-    if: always() && (needs.docker-core.result == 'success' || needs.docker-ccip.result == 'success')
-    needs: [checks, docker-core, docker-ccip]
+    if: always() && (needs.docker-core.result == 'success' ||
+      needs.docker-ccip.result == 'success')
+    needs: [ checks, docker-core, docker-ccip ]
     uses: ./.github/workflows/release-notifications.yml
     secrets: inherit
     with:

.changeset/minor-bump-1776191418.md .changeset/minor-bump-1776807784.md.changeset/minor-bump-1776191418.md renamed to .changeset/minor-bump-1776807784.md

@@ -73,6 +73,7 @@ on:
 
 jobs:
   compatibility:
+    name: Upgrade Compatibility Test
     permissions:
       id-token: write
       contents: read

.changeset/remove-binary-url-resolver.md

@@ -48,8 +48,10 @@ jobs:
         id: runner-labels
         shell: bash
         env:
-          SH_RUNNER_LABEL_ARM64: runs-on=${{ github.run_id }}/cpu=8/ram=16/family=c7g/volume=80gb/spot=false/image=ubuntu24-full-arm64
-          SH_RUNNER_LABEL_AMD64: runs-on=${{ github.run_id }}/cpu=8/ram=16/family=c7a/volume=80gb/spot=false/image=ubuntu24-full-x64
+          SH_RUNNER_LABEL_ARM64: runs-on=${{ github.run_id
+            }}/cpu=8/ram=16/family=c7g/volume=80gb/spot=false/image=ubuntu24-full-arm64
+          SH_RUNNER_LABEL_AMD64: runs-on=${{ github.run_id
+            }}/cpu=8/ram=16/family=c7a/volume=80gb/spot=false/image=ubuntu24-full-x64
           GH_RUNNER_LABEL_ARM64: ubuntu-24.04-arm
           GH_RUNNER_LABEL_AMD64: ubuntu-24.04
         run: |
@@ -81,7 +83,7 @@ jobs:
           echo "version-tag=${version_tag}" | tee -a "$GITHUB_OUTPUT"
 
   docker-core:
-    needs: [init]
+    needs: [ init ]
     if: ${{ needs.init.outputs.should-run == 'true' }}
     permissions:
       contents: read
@@ -113,7 +115,7 @@ jobs:
       AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_INFRA_RELENG_TOKEN_ISSUER_LAMBDA_URL }}
 
   docker-core-plugins:
-    needs: [init]
+    needs: [ init ]
     if: ${{ needs.init.outputs.should-run == 'true' }}
     permissions:
       contents: read
@@ -147,7 +149,7 @@ jobs:
       AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_INFRA_RELENG_TOKEN_ISSUER_LAMBDA_URL }}
 
   docker-core-plugins-testing:
-    needs: [init]
+    needs: [ init ]
     if: ${{ needs.init.outputs.should-run == 'true' }}
     permissions:
       contents: read
@@ -182,7 +184,7 @@ jobs:
       AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_INFRA_RELENG_TOKEN_ISSUER_LAMBDA_URL }}
 
   docker-ccip:
-    needs: [init]
+    needs: [ init ]
     if: ${{ needs.init.outputs.should-run == 'true' }}
     permissions:
       contents: read
@@ -217,7 +219,7 @@ jobs:
       AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_INFRA_RELENG_TOKEN_ISSUER_LAMBDA_URL }}
 
   docker-ccip-plugins:
-    needs: [init]
+    needs: [ init ]
     if: ${{ needs.init.outputs.should-run == 'true' }}
     permissions:
       contents: read
@@ -252,8 +254,9 @@ jobs:
       AWS_LAMBDA_GATI_URL: ${{ secrets.AWS_INFRA_RELENG_TOKEN_ISSUER_LAMBDA_URL }}
 
   call-post-docker-build:
-    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-    needs: [init, docker-core]
+    if: ${{ github.event_name == 'schedule' || github.event_name ==
+      'workflow_dispatch' }}
+    needs: [ init, docker-core ]
     uses: ./.github/workflows/post-docker-build.yml
     permissions:
       actions: read
@@ -268,7 +271,7 @@ jobs:
     if: false
     # temporarily disabled
     # if: ${{ github.event_name == 'schedule' }}
-    needs: [docker-core]
+    needs: [ docker-core ]
     permissions:
       contents: read
       id-token: write
@@ -283,14 +286,15 @@ jobs:
           aws-region: ${{ secrets.AWS_REGION }}
           repo-destination: ${{ secrets.REPO_K8S_DEPLOY }}
           oci-image-tag: ${{ needs.docker-core.outputs.docker-manifest-tag }}
-          oci-repository-url: ${{ format('{0}.dkr.ecr.{1}.amazonaws.com/chainlink', secrets.AWS_ACCOUNT_ID_SDLC, secrets.AWS_REGION) }}
+          oci-repository-url: ${{ format('{0}.dkr.ecr.{1}.amazonaws.com/chainlink',
+            secrets.AWS_ACCOUNT_ID_SDLC, secrets.AWS_REGION) }}
           pr-close-enabled: false
           products: |
             cre
 
   deploy-nightly-ccip:
     if: ${{ github.event_name == 'schedule' }}
-    needs: [docker-ccip]
+    needs: [ docker-ccip ]
     permissions:
       contents: read
       id-token: write
@@ -305,7 +309,8 @@ jobs:
           aws-region: ${{ secrets.AWS_REGION }}
           repo-destination: ${{ secrets.REPO_K8S_DEPLOY }}
           oci-image-tag: ${{ needs.docker-ccip.outputs.docker-manifest-tag }}
-          oci-repository-url: ${{ format('{0}.dkr.ecr.{1}.amazonaws.com/ccip', secrets.AWS_ACCOUNT_ID_SDLC, secrets.AWS_REGION) }}
+          oci-repository-url: ${{ format('{0}.dkr.ecr.{1}.amazonaws.com/ccip',
+            secrets.AWS_ACCOUNT_ID_SDLC, secrets.AWS_REGION) }}
           pr-close-enabled: false
           products: |
             ccip-nightlies