Merge branch 'develop' into KS-313-write-capability-wait-for-finalized

.changeset/cuddly-colts-speak.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+Fix for Mercury transmitter decoding reports of a different codec version #internal

.changeset/eighty-bulldogs-smile.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+#added Use ApplyDefaultsAndValidate

.changeset/lemon-apples-explain.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+#internal update ccip chainreader config.

.changeset/metal-pots-lie.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+Registering USDC/CCTP events in the ChainReader during oracle creation #internal

.changeset/moody-trains-grow.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+#added graceful shutdown for ccip oracles

.changeset/orange-humans-laugh.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+Support Zircuit fraud transactions detection and zk overflow detection #added

.changeset/silly-lies-boil.md

@@ -0,0 +1,8 @@
+---
+"chainlink": minor
+---
+
+Make websocket URL `WSURL` for `EVM.Nodes` optional, and apply logic so that:
+* If WS URL was not provided, SubscribeFilterLogs should fail with an explicit error
+* If WS URL was not provided LogBroadcaster should be disabled 
+#nops

.changeset/smooth-queens-dance.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+Add compute capability #internal

.changeset/three-otters-drum.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+Hedera chain type: broadcast transactions only to a single healthy RPC instead of all healthy RPCs to avoid redundant relay fees. #changed

.github/CODEOWNERS

@@ -13,6 +13,7 @@
 /core/services/directrequest @smartcontractkit/keepers
 /core/services/feeds @smartcontractkit/op-core @eutopian @yevshev
 /core/services/synchronization/telem @smartcontractkit/realtime
+/core/capabilities/ @smartcontractkit/keystone
 /core/capabilities/ccip @smartcontractkit/ccip-offchain
 
 # To be deprecated in Chainlink V3
@@ -51,6 +52,12 @@ core/services/relay/evm/functions @smartcontractkit/functions
 core/scripts/functions @smartcontractkit/functions
 core/scripts/gateway @smartcontractkit/functions
 
+# Keystone
+/core/services/registrysyncer @smartcontractkit/keystone
+/core/services/workflows @smartcontractkit/keystone
+/core/services/standardcapabilities @smartcontractkit/keystone
+/core/scripts/keystone @smartcontractkit/keystone
+
 # Contracts
 /contracts/ @RensR @matYang @RayXpub @elatoskinas
 
@@ -102,6 +109,7 @@ core/scripts/gateway @smartcontractkit/functions
 
 # CI/CD
 /.github/** @smartcontractkit/releng @smartcontractkit/test-tooling-team
+/.github/CODEOWNERS @smartcontractkit/prodsec-public @smartcontractkit/foundations
 /.github/workflows/performance-tests.yml @smartcontractkit/test-tooling-team
 /.github/workflows/automation-ondemand-tests.yml @smartcontractkit/keepers
 /.github/workflows/automation-benchmark-tests.yml @smartcontractkit/keepers
@@ -118,8 +126,8 @@ contracts/package.json @smartcontractkit/prodsec-public
 contracts/pnpm.lock @smartcontractkit/prodsec-public
 go.mod @smartcontractkit/prodsec-public @smartcontractkit/releng @smartcontractkit/foundations
 go.sum @smartcontractkit/prodsec-public @smartcontractkit/releng @smartcontractkit/foundations
-integration-tests/go.mod @smartcontractkit/prodsec-public
-integration-tests/go.sum @smartcontractkit/prodsec-public
+integration-tests/go.mod @smartcontractkit/prodsec-public @smartcontractkit/test-tooling-team @smartcontractkit/foundations
+integration-tests/go.sum @smartcontractkit/prodsec-public @smartcontractkit/test-tooling-team @smartcontractkit/foundations
 flake.nix @smartcontractkit/prodsec-public
 flake.lock @smartcontractkit/prodsec-public
 

.github/actions/goreleaser-build-sign-publish/README.md

@@ -21,8 +21,6 @@ jobs:
  permissions:
  id-token: write
  contents: read
- env:
- MACOS_SDK_VERSION: 12.3
  steps:
  - name: Checkout repository
  uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -32,28 +30,11 @@ jobs:
  role-to-assume: ${{ secrets.aws-role-arn }}
  role-duration-seconds: ${{ secrets.aws-role-dur-sec }}
  aws-region: ${{ secrets.aws-region }}
- - name: Cache macos sdk
- id: sdk-cache
- uses: actions/cache@v3
- with:
- path: ${{ format('MacOSX{0}.sdk', env.MAC_SDK_VERSION) }}
- key: ${{ runner.OS }}-${{ env.MAC_SDK_VERSION }}-macos-sdk-cache-${{ hashFiles('**/SDKSettings.json') }}
- restore-keys: |
- ${{ runner.OS }}-${{ env.MAC_SDK_VERSION }}-macos-sdk-cache-
- - name: Get macos sdk
- if: steps.sdk-cache.outputs.cache-hit != 'true'
- run: |
- curl -L https://github.com/joseluisq/macosx-sdks/releases/download/${MACOS_SDK_VERSION}/MacOSX${MACOS_SDK_VERSION}.sdk.tar.xz > MacOSX${MACOS_SDK_VERSION}.sdk.tar.xz
- tar -xf MacOSX${MACOS_SDK_VERSION}.sdk.tar.xz
  - name: Build, sign, and publish
  uses: ./.github/actions/goreleaser-build-sign-publish
  with:
- enable-docker-publish: "true"
- enable-goreleaser-snapshot: "false"
  docker-registry: ${{ secrets.aws-ecr-registry }}
- goreleaser-exec: goreleaser
  goreleaser-config: .goreleaser.yaml
- macos-sdk-dir: ${{ format('MacOSX{0}.sdk', env.MAC_SDK_VERSION) }}
  env:
  GITHUB_TOKEN: ${{ secrets.gh-token }}
 ```
@@ -64,29 +45,8 @@ jobs:
 - name: Build, sign, and publish image
  uses: ./.github/actions/goreleaser-build-sign-publish
  with:
- enable-docker-publish: "true"
- enable-goreleaser-snapshot: "true"
- docker-registry: ${{ secrets.aws-ecr-registry }}
- goreleaser-exec: goreleaser
- goreleaser-config: .goreleaser.yaml
-```
-
-### image signing
-
-```yaml
-- name: Build, sign, and publish
- uses: ./.github/actions/goreleaser-build-sign-publish
- with:
- enable-docker-publish: "true"
- enable-goreleaser-snapshot: "false"
- enable-cosign: "true"
  docker-registry: ${{ secrets.aws-ecr-registry }}
- goreleaser-exec: goreleaser
  goreleaser-config: .goreleaser.yaml
- cosign-password: ${{ secrets.cosign-password }}
- cosign-public-key: ${{ secrets.cosign-public-key }}
- cosign-private-key: ${{ secrets.cosign-private-key }}
- macos-sdk-dir: MacOSX12.3.sdk
 ```
 
 ## customizing
@@ -98,22 +58,9 @@ Following inputs can be used as `step.with` keys
 | Name | Type | Default | Description |
 | ---------------------------- | ------ | ------------------ | ----------------------------------------------------------------------- |
 | `goreleaser-version` | String | `~> v2` | `goreleaser` version |
-| `zig-version` | String | `0.10.1` | `zig` version |
-| `cosign-version` | String | `v2.2.2` | `cosign` version |
-| `macos-sdk-dir` | String | `MacOSX12.3.sdk` | MacOSX sdk directory |
-| `enable-docker-publish` | Bool | `true` | Enable publishing of Docker images / manifests |
 | `docker-registry` | String | `localhost:5001` | Docker registry |
-| `docker-image-name` | String | `chainlink` | Docker image name |
 | `docker-image-tag` | String | `develop` | Docker image tag |
-| `enable-goreleaser-snapshot` | Bool | `false` | Enable goreleaser build / release snapshot |
-| `enable-goreleaser-split` | Bool | `false` | Enable goreleaser build using split and merge |
-| `goreleaser-split-arch` | String | `""` | The arch to build the image with - amd64, arm64 |
-| `goreleaser-exec` | String | `goreleaser` | The goreleaser executable, can invoke wrapper script |
 | `goreleaser-config` | String | `.goreleaser.yaml` | The goreleaser configuration yaml |
-| `enable-cosign` | Bool | `false` | Enable signing of Docker images |
-| `cosign-public-key` | String | `""` | The public key to be used with cosign for verification |
-| `cosign-private-key` | String | `""` | The private key to be used with cosign to sign the image |
-| `cosign-password-key` | String | `""` | The password to decrypt the cosign private key needed to sign the image |
 
 ## testing
 
@@ -126,10 +73,7 @@ docker run -d --restart=always -p "127.0.0.1:5001:5000" --name registry registry
 - run snapshot release, publish to local docker registry
 
 ```sh
-GORELEASER_EXEC="<goreleaser-wrapper" \
 GORELEASER_CONFIG=".goreleaser.yaml" \
-ENABLE_GORELEASER_SNAPSHOT=true \
-ENABLE_DOCKER_PUBLISH=true \
 DOCKER_MANIFEST_EXTRA_ARGS="--insecure" \
 ./.github/actions/goreleaser-build-sign-publish/action_utils goreleaser_release
 ```

.github/actions/goreleaser-build-sign-publish/action.yml

@@ -8,67 +8,29 @@ inputs:
  goreleaser-key:
  description: The goreleaser key
  required: false
- zig-version:
- description: The zig version
- default: 0.10.1
- required: false
- cosign-version:
- description: The cosign version
- default: v2.4.0
- required: false
- macos-sdk-dir:
- description: The macos sdk directory
- default: MacOSX12.3.sdk
- required: false
  # publishing inputs
- enable-docker-publish:
- description: Enable publishing of docker images / manifests
- default: "true"
- required: false
  docker-registry:
  description: The docker registry
  default: localhost:5001
  required: false
- docker-image-name:
- description: The docker image name
- default: chainlink
- required: false
  docker-image-tag:
  description: The docker image tag
  default: develop
  required: false
  # goreleaser inputs
- goreleaser-exec:
- description: "The goreleaser executable, can invoke wrapper script"
- default: "goreleaser"
+ goreleaser-release-type:
+ description: The goreleaser release type, it can be either "nightly", "merge", "snapshot", "release" 
+ default: "snapshot"
  required: false
  goreleaser-config:
  description: "The goreleaser configuration yaml"
  default: ".goreleaser.yaml"
  required: false
- enable-goreleaser-snapshot:
- description: Enable goreleaser build / release snapshot
- default: "false"
- required: false
- enable-goreleaser-split:
- description: Enable goreleaser split and merge builds
- default: "false"
- required: false
- goreleaser-split-arch:
- description: The architecture to split the goreleaser build
- required: false
- # signing inputs
- enable-cosign:
- description: Enable signing of docker images
- default: "false"
- required: false
 runs:
  using: composite
  steps:
  - name: Setup docker buildx
  uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0
- - name: Set up qemu
- uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
  - name: Setup go
  uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
  with:
@@ -81,42 +43,24 @@ runs:
  version: ${{ inputs.goreleaser-version }}
  env:
  GORELEASER_KEY: ${{ inputs.goreleaser-key }}
- - name: Setup zig
- uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d5824358023be3a2802d # v2.2.0
- with:
- version: ${{ inputs.zig-version }}
- - name: Setup cosign
- if: inputs.enable-cosign == 'true'
- uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
- with:
- cosign-release: ${{ inputs.cosign-version }}
+
  - name: Login to docker registry
- if: inputs.enable-docker-publish == 'true'
  uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
  with:
  registry: ${{ inputs.docker-registry }}
- - name: Set goreleaser split env
- if: inputs.enable-goreleaser-split == 'true'
- shell: bash
- run: |
- echo "GOOS=linux" | tee -a $GITHUB_ENV
- echo "GOARCH=${{ inputs.goreleaser-split-arch }}" | tee -a $GITHUB_ENV
+
  - name: Install syft
  uses: anchore/sbom-action/download-syft@61119d458adab75f756bc0b9e4bde25725f86a7a # v0.17.2
+
  - name: Run goreleaser release
  shell: bash
  env:
- ENABLE_GORELEASER_SNAPSHOT: ${{ inputs.enable-goreleaser-snapshot }}
- ENABLE_GORELEASER_SPLIT: ${{ inputs.enable-goreleaser-split }}
- ENABLE_DOCKER_PUBLISH: ${{ inputs.enable-docker-publish }}
+ GORELEASER_CONFIG: ${{ inputs.goreleaser-config }}
+ RELEASE_TYPE: ${{ inputs.goreleaser-release-type }}
  IMAGE_PREFIX: ${{ inputs.docker-registry }}
- IMAGE_NAME: ${{ inputs.docker-image-name }}
  IMAGE_TAG: ${{ inputs.docker-image-tag }}
- GORELEASER_EXEC: ${{ inputs.goreleaser-exec }}
- GORELEASER_CONFIG: ${{ inputs.goreleaser-config }}
  GORELEASER_KEY: ${{ inputs.goreleaser-key }}
  GITHUB_TOKEN: ${{ github.token }}
- MACOS_SDK_DIR: ${{ inputs.macos-sdk-dir }}
  run: |
  # https://github.com/orgs/community/discussions/24950
- ${GITHUB_ACTION_PATH}/action_utils goreleaser_release
+ ${GITHUB_ACTION_PATH}/release.js