Skip to content

Commit a7c7cff

Browse files
nolagnolag
committed
Merge branch 'capabilities-development' into rtinianov_teeRuntime
2 parents baf7045 + c26b561 commit a7c7cff

74 files changed

Lines changed: 2342 additions & 276 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/breaking-changes.yml‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
name: Breaking changes
2+
3+
permissions:
4+
contents: read
5+
6+
concurrency:
7+
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
8+
cancel-in-progress: true
9+
10+
on:
11+
pull_request:
12+
branches: [main]
13+
# Re-run when override labels are added or removed
14+
types: [opened, synchronize, reopened, labeled, unlabeled]
15+
16+
jobs:
17+
proto-breaking:
18+
runs-on: ubuntu-latest
19+
env:
20+
SKIP: ${{ contains(github.event.pull_request.labels.*.name, 'breaking-change:proto') || contains(github.event.pull_request.labels.*.name, 'breaking-change:approved') }}
21+
steps:
22+
- name: Skipped — intentional breaking change (label override)
23+
if: env.SKIP == 'true'
24+
run: |
25+
echo "::notice title=Proto breaking check skipped::This PR has label breaking-change:proto or breaking-change:approved. A maintainer acknowledged an intentional proto break. Remove the label to re-enable buf breaking."
26+
27+
- name: Checkout code
28+
if: env.SKIP != 'true'
29+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
30+
with:
31+
fetch-depth: 0
32+
submodules: recursive
33+
token: ${{ secrets.GITHUB_TOKEN }}
34+
35+
- name: Setup Bun
36+
if: env.SKIP != 'true'
37+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
38+
with:
39+
bun-version: 1.3.12
40+
41+
- name: Install dependencies
42+
if: env.SKIP != 'true'
43+
run: bun install --frozen-lockfile
44+
45+
# cre-sdk's buf.yaml points at ../../submodules/chainlink-protos/cre, which buf rejects when
46+
# --against uses subdir=packages/cre-sdk (module path escapes the context). Run breaking on
47+
# the chainlink-protos workspace instead, comparing HEAD to the submodule commit pinned on main.
48+
- name: Buf breaking (proto)
49+
if: env.SKIP != 'true'
50+
run: |
51+
set -euo pipefail
52+
REPO="${{ github.workspace }}"
53+
SUBMODULE="${REPO}/submodules/chainlink-protos"
54+
BASE_COMMIT=$(git -C "$REPO" rev-parse origin/main:submodules/chainlink-protos)
55+
BASE_DIR="${RUNNER_TEMP}/chainlink-protos-baseline"
56+
if ! git -C "$SUBMODULE" cat-file -e "${BASE_COMMIT}^{commit}" 2>/dev/null; then
57+
git -C "$SUBMODULE" fetch --no-tags origin "${BASE_COMMIT}"
58+
fi
59+
git -C "$SUBMODULE" worktree add "${BASE_DIR}" "${BASE_COMMIT}" --detach
60+
cleanup() {
61+
git -C "$SUBMODULE" worktree remove "${BASE_DIR}" --force || true
62+
}
63+
trap cleanup EXIT
64+
(cd "$SUBMODULE" && bun x @bufbuild/buf breaking cre --against "${BASE_DIR}/cre" --error-format github-actions)
65+
66+
ts-api-surface:
67+
runs-on: ubuntu-latest
68+
env:
69+
SKIP: ${{ contains(github.event.pull_request.labels.*.name, 'breaking-change:typescript-api') || contains(github.event.pull_request.labels.*.name, 'breaking-change:approved') }}
70+
steps:
71+
- name: Skipped — intentional breaking change (label override)
72+
if: env.SKIP == 'true'
73+
run: |
74+
echo "::notice title=TypeScript API check skipped::This PR has label breaking-change:typescript-api or breaking-change:approved. Commit an updated api-baseline.d.ts when appropriate; this label only bypasses CI."
75+
76+
- name: Checkout code
77+
if: env.SKIP != 'true'
78+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
79+
with:
80+
submodules: recursive
81+
token: ${{ secrets.GITHUB_TOKEN }}
82+
83+
- name: Setup Bun
84+
if: env.SKIP != 'true'
85+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
86+
with:
87+
bun-version: 1.3.12
88+
89+
- name: Install dependencies
90+
if: env.SKIP != 'true'
91+
run: bun install --frozen-lockfile
92+
93+
- name: Diff TypeScript public API vs baseline
94+
if: env.SKIP != 'true'
95+
working-directory: packages/cre-sdk
96+
run: |
97+
bun run update-api-baseline
98+
99+
if ! git diff --exit-code api-baseline.d.ts; then
100+
echo "::error::TypeScript public API surface changed. Run 'bun run update-api-baseline' locally and commit the updated api-baseline.d.ts."
101+
exit 1
102+
fi
103+
104+
host-bindings:
105+
runs-on: ubuntu-latest
106+
env:
107+
SKIP: ${{ contains(github.event.pull_request.labels.*.name, 'breaking-change:host-bindings') || contains(github.event.pull_request.labels.*.name, 'breaking-change:approved') }}
108+
steps:
109+
- name: Skipped — intentional breaking change (label override)
110+
if: env.SKIP == 'true'
111+
run: |
112+
echo "::notice title=Host bindings check skipped::This PR has label breaking-change:host-bindings or breaking-change:approved. Update snapshots and host-imports-baseline.txt when appropriate; this label only bypasses CI."
113+
114+
- name: Checkout code
115+
if: env.SKIP != 'true'
116+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
117+
with:
118+
submodules: recursive
119+
token: ${{ secrets.GITHUB_TOKEN }}
120+
121+
- name: Setup Bun
122+
if: env.SKIP != 'true'
123+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
124+
with:
125+
bun-version: 1.3.12
126+
127+
- name: Install dependencies
128+
if: env.SKIP != 'true'
129+
run: bun install --frozen-lockfile
130+
131+
- name: JS host bindings snapshot test
132+
if: env.SKIP != 'true'
133+
working-directory: packages/cre-sdk
134+
run: bun test src/sdk/wasm/host-bindings-contract.test.ts
135+
136+
- name: Diff Rust host imports vs baseline
137+
if: env.SKIP != 'true'
138+
run: |
139+
grep -E '^\s+fn [a-z_]+\(' \
140+
packages/cre-sdk-javy-plugin/src/javy_chainlink_sdk/src/lib.rs \
141+
| grep -v '{$' > /tmp/current-imports.txt
142+
143+
if ! diff packages/cre-sdk-javy-plugin/src/javy_chainlink_sdk/host-imports-baseline.txt \
144+
/tmp/current-imports.txt; then
145+
echo "::error::Rust host import signatures changed. Update host-imports-baseline.txt if intentional."
146+
exit 1
147+
fi

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,8 @@ jobs:
110110
echo ""
111111
echo "=========================================="
112112
echo "Uncommitted file changes detected after full-checks!"
113+
echo "Changed files:"
114+
git diff --name-only
113115
echo "Run 'bun full-checks' locally and commit the resulting changes."
114116
echo "=========================================="
115117
exit 1

‎.github/workflows/template-compatibility-comment.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Template Compatibility Comment
2+
3+
# Triggered when the unprivileged "Template Compatibility Check" workflow
4+
# completes. This workflow has pull-requests: write so it can post PR comments.
5+
# It checks out the default branch (only) to load scripts/template-compatibility-comment.js,
6+
# then reads the artifact produced by the check workflow.
7+
#
8+
# SECURITY: workflow_run always runs on the default branch, so this workflow
9+
# definition and checked-out script cannot be tampered with by a PR contributor.
10+
# Artifact contents are treated as untrusted strings and sanitized before use.
11+
12+
on:
13+
workflow_run:
14+
workflows: ["Template Compatibility Check"]
15+
types: [completed]
16+
17+
permissions:
18+
contents: read
19+
pull-requests: write
20+
actions: read # required to download artifacts from another workflow run
21+
22+
jobs:
23+
post-comment:
24+
runs-on: ubuntu-latest
25+
26+
steps:
27+
- name: Checkout repository
28+
uses: actions/checkout@v6
29+
30+
- name: Download results artifact
31+
uses: actions/download-artifact@v8
32+
with:
33+
name: template-compat-results
34+
path: /tmp/compat-results
35+
run-id: ${{ github.event.workflow_run.id }}
36+
github-token: ${{ secrets.GITHUB_TOKEN }}
37+
38+
- name: Post or remove PR comment
39+
uses: actions/github-script@v8
40+
with:
41+
script: |
42+
const path = require('path');
43+
const run = require(path.join(process.env.GITHUB_WORKSPACE, 'scripts', 'template-compatibility-comment.cjs'));
44+
await run({ github, context });

‎.github/workflows/template-compatibility.yml‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
name: Template Compatibility Check
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened]
6+
7+
concurrency:
8+
group: template-compat-${{ github.head_ref || github.ref }}
9+
cancel-in-progress: true
10+
11+
# This job is informational — it is intentionally NOT a required status check
12+
# so that breaking SDK changes (major version bumps) can still be merged.
13+
# When templates break, a comment is posted on the PR with details.
14+
# For intentional breaking changes, create a matching branch in cre-templates
15+
# named compat/<your-sdk-branch-name> with the template fixes applied.
16+
# The job will automatically detect and test against that branch.
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
template-compatibility:
23+
runs-on: ubuntu-latest
24+
timeout-minutes: 20
25+
26+
defaults:
27+
run:
28+
shell: bash {0}
29+
30+
env:
31+
TEMPLATES_REPO: smartcontractkit/cre-templates
32+
33+
steps:
34+
- name: Checkout SDK
35+
uses: actions/checkout@v6
36+
with:
37+
submodules: recursive
38+
39+
- name: Setup Rust (1.85.0) with wasm target
40+
uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
41+
with:
42+
toolchain: 1.85.0
43+
target: wasm32-wasip1
44+
override: true
45+
46+
- name: Setup Bun
47+
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
48+
with:
49+
bun-version: 1.3.12
50+
51+
- name: Cache Bun dependencies
52+
uses: actions/cache@v5
53+
with:
54+
path: ~/.bun/install/cache
55+
key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
56+
57+
- name: Cache cargo + Javy
58+
uses: actions/cache@v5
59+
with:
60+
path: |
61+
~/.cargo/registry
62+
~/.cargo/git
63+
~/.cache/javy
64+
key: ${{ runner.os }}-cre-plugin-v8.1.0-${{ hashFiles('packages/cre-sdk-javy-plugin/src/javy_chainlink_sdk/Cargo.lock', 'packages/cre-sdk-javy-plugin/src/cre_generated_host.Cargo.lock') }}
65+
66+
- name: Install SDK dependencies
67+
run: bun install --frozen-lockfile
68+
69+
# Detect whether a matching compat branch exists in cre-templates.
70+
# If it does, we test against it (coordinated breaking change).
71+
# If not, we fall back to main.
72+
- name: Detect cre-templates ref to test against
73+
id: detect-ref
74+
env:
75+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
76+
HEAD_REF: ${{ github.head_ref }}
77+
run: |
78+
SAFE_HEAD_REF="${HEAD_REF//[^a-zA-Z0-9._\/-]/}"
79+
COMPAT_BRANCH="compat/$SAFE_HEAD_REF"
80+
81+
if gh api "repos/$TEMPLATES_REPO/branches/$COMPAT_BRANCH" &>/dev/null; then
82+
echo "ref=$COMPAT_BRANCH" >> "$GITHUB_OUTPUT"
83+
echo "Using compat branch: $COMPAT_BRANCH"
84+
else
85+
echo "ref=main" >> "$GITHUB_OUTPUT"
86+
echo "No compat branch found, using: main"
87+
fi
88+
89+
- name: Checkout cre-templates (${{ steps.detect-ref.outputs.ref }})
90+
uses: actions/checkout@v6
91+
with:
92+
repository: ${{ env.TEMPLATES_REPO }}
93+
ref: ${{ steps.detect-ref.outputs.ref }}
94+
path: cre-templates
95+
token: ${{ secrets.GITHUB_TOKEN }}
96+
97+
- name: Setup Node (for npm)
98+
uses: actions/setup-node@v6
99+
with:
100+
node-version: '24'
101+
102+
- name: Run template compatibility check
103+
id: template-check
104+
env:
105+
TEMPLATES_DIR: cre-templates
106+
run: |
107+
set +e
108+
OUTPUT=$(./scripts/test-templates.sh 2>&1)
109+
EXIT_CODE=$?
110+
set -e
111+
112+
echo "$OUTPUT" > /tmp/template-check-output.txt
113+
114+
# Surface it in the action log regardless
115+
echo "$OUTPUT"
116+
117+
echo "exit_code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
118+
119+
# Bundle everything the comment workflow needs into an artifact.
120+
# The comment workflow runs with pull-requests: write but must never
121+
# execute external code — it only reads these files.
122+
- name: Save results for comment workflow
123+
if: always()
124+
env:
125+
PR_NUMBER: ${{ github.event.pull_request.number }}
126+
TEMPLATES_REF: ${{ steps.detect-ref.outputs.ref }}
127+
HEAD_REF: ${{ github.head_ref }}
128+
EXIT_CODE: ${{ steps.template-check.outputs.exit_code }}
129+
run: |
130+
mkdir -p /tmp/compat-results
131+
printf '%s' "$PR_NUMBER" > /tmp/compat-results/pr-number.txt
132+
printf '%s' "$TEMPLATES_REF" > /tmp/compat-results/templates-ref.txt
133+
printf '%s' "$HEAD_REF" > /tmp/compat-results/head-ref.txt
134+
printf '%s' "$EXIT_CODE" > /tmp/compat-results/exit-code.txt
135+
if [ -f /tmp/template-check-output.txt ]; then
136+
cp /tmp/template-check-output.txt /tmp/compat-results/output.txt
137+
fi
138+
139+
- name: Upload results artifact
140+
if: always()
141+
uses: actions/upload-artifact@v7
142+
with:
143+
name: template-compat-results
144+
path: /tmp/compat-results/
145+
retention-days: 7
146+
147+
# Always exit 0 — this job is informational, not a merge gate
148+
- name: Report result (non-blocking)
149+
if: always()
150+
run: |
151+
EXIT_CODE="${{ steps.template-check.outputs.exit_code }}"
152+
if [ "$EXIT_CODE" = "0" ]; then
153+
echo "✅ All templates are compatible with this SDK change."
154+
else
155+
echo "⚠️ Some templates failed — see PR comment for details."
156+
echo "This check is informational and does not block merging."
157+
fi
158+
exit 0

‎PUBLISHING.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,12 @@ There are 2 possible scenarios that you might encounter:
2323

2424
Below ale the steps for two scenarios.
2525

26+
> **Breaking changes:** If the release includes any intentional breaking changes to the
27+
> TypeScript API surface, JS host bindings, or Rust host imports, the corresponding baseline
28+
> files (`api-baseline.d.ts`, `__snapshots__/host-bindings-contract.test.ts.snap`,
29+
> `host-imports-baseline.txt`) must already be committed on the release branch before
30+
> tagging. The `breaking-changes` CI job must be green before publishing.
31+
2632
### 1. Both packages need an update
2733

2834
1. Create a new branch from `main` with the name `release-candidate-vx.y.z` (for example `release-candidate-v1.0.8`).

0 commit comments

Comments
 (0)