Merge branch 'develop' into tooling-dashboard/add-assets-layout

.github/workflows/_cargo_deny.yml

@@ -7,24 +7,20 @@ on:
         type: string
         required: false
         default: "./Cargo.toml"
-    secrets:
-      SSH_PRIVATE_KEY_IOTA_CI:
-        required: true
-      SSH_GITHUB_KNOWN_HOSTS:
-        required: true
 
 concurrency:
   group: cargo-deny-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
-  cargo-deny:
+  bans-licenses-sources:
+    name: cargo deny (bans, licenses, sources)
     runs-on: [self-hosted]
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # pin@v4
-      - uses: EmbarkStudios/cargo-deny-action@8371184bd11e21dcf8ac82ebf8c9c9f74ebf7268 # pin@v2
-        with:
-          manifest-path: ${{ inputs.manifest-path }}
-          ssh-key: ${{ secrets.SSH_PRIVATE_KEY_IOTA_CI }}
-          ssh-known-hosts: ${{ secrets.SSH_GITHUB_KNOWN_HOSTS }}
-          use-git-cli: true
+      - run: cargo deny --manifest-path ${{ inputs.manifest-path || './Cargo.toml' }} check bans licenses sources
+
+  advisories:
+    name: cargo deny (advisories)
+    runs-on: [self-hosted]
+    steps:
+      - run: cargo deny --manifest-path ${{ inputs.manifest-path || './Cargo.toml' }} check advisories

.github/workflows/_rust.yml

@@ -42,7 +42,6 @@ jobs:
 
   deny:
     uses: ./.github/workflows/_cargo_deny.yml
-    secrets: inherit
 
   rust-tests:
     if: |

.github/workflows/_vercel_deploy.yml

@@ -40,14 +40,16 @@ jobs:
     secrets: inherit
     with:
       isProd: false
+      isStaging: false
 
-  explorer-prod:
-    name: Vercel Explorer Production
+  explorer-staging:
+    name: Vercel Explorer Staging
     if: inputs.isDevelop
     uses: ./.github/workflows/apps_explorer_deploy.yml
     secrets: inherit
     with:
-      isProd: true
+      isProd: false
+      isStaging: true
 
   ui-kit-preview:
     name: Vercel UI Kit Preview

.github/workflows/apps_explorer_deploy.yml

@@ -3,14 +3,25 @@ name: Deploy for Explorer
 env:
   VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
   VERCEL_PROJECT_ID: ${{ secrets.EXPLORER_VERCEL_PROJECT_ID }}
+  EXPLORER_VERCEL_PROJECT_STAGING_URL: ${{ secrets.EXPLORER_VERCEL_PROJECT_STAGING_URL }}
 
 on:
   workflow_dispatch:
+    inputs:
+      isProd:
+        type: boolean
+        required: true
+      isStaging:
+        type: boolean
+        required: true
   workflow_call:
     inputs:
       isProd:
         type: boolean
         required: true
+      isStaging:
+        type: boolean
+        required: true
 
 jobs:
   deploy:
@@ -64,8 +75,11 @@ jobs:
         id: deploy_url
         if: ${{ inputs.isProd == false }}
         run: echo "DEPLOY_URL=$(cat vercel_output.txt | awk 'END{print}')" >> $GITHUB_OUTPUT
+      - name: Alias Staging deploy
+        if: ${{ inputs.isStaging }}
+        run: vercel alias ${{ steps.deploy_url.outputs.DEPLOY_URL }} $EXPLORER_VERCEL_PROJECT_STAGING_URL --token=${{ secrets.VERCEL_TOKEN }} --scope=${{ secrets.VERCEL_SCOPE }}
       - name: Comment on pull request
-        if: ${{ inputs.isProd == false }}
+        if: ${{ inputs.isProd == false && inputs.isStaging == false }}
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # pin@v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/links_checker.yml

@@ -9,7 +9,7 @@ on:
     - cron: "0 0 * * *"
 
 jobs:
-  link_checker:
+  links-checker:
     name: Check links and create automated issue if needed
     runs-on: self-hosted
     env:
@@ -20,8 +20,9 @@ jobs:
 
       - name: Check all links at *.md and doc files
         id: lychee
-        uses: lycheeverse/lychee-action@ec3ed119d4f44ad2673a7232460dc7dff59d2421 # pin@v1.8.0
+        uses: lycheeverse/lychee-action@2b973e86fc7b1f6b36a93795fe2c9c6ae1118621 # pin@v1.10.0
         with:
+          token: ${{ secrets.GITHUB_TOKEN }}
           output: ${{ env.LYCHEE_OUT }}
           format: markdown
           ## Do not fail this step on broken links
@@ -35,42 +36,23 @@ jobs:
             --max-concurrency 10
             --no-progress
             './**/*.md'
-        env:
-          ## Avoid rate limiting when checking github.com links
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Find the last report issue open
         uses: micalevisk/last-issue-action@305829d9728f47beb0029417167a0af890edfd6e # [email protected]
         id: last_issue
         with:
           state: open
-          labels: |
-            report
-            automated issue
+          labels: broken-links
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Create issue from report file
-        if: steps.last_issue.outputs.has_found == 'false'
-        uses: peter-evans/create-issue-from-file@e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd # pin@v4
-        with:
-          title: Link checker report
-          content-filepath: ${{ env.LYCHEE_OUT }}
-          issue-number: ${{ steps.last_issue.outputs.issue_number }}
-          labels: |
-            report
-            automated issue
-
-      - name: Update last report open issue created
-        if: steps.last_issue.outputs.has_found == 'true'
+      - name: Create or update report
         uses: peter-evans/create-issue-from-file@e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd # pin@v4
         with:
           title: Link checker report
           content-filepath: ${{ env.LYCHEE_OUT }}
           issue-number: ${{ steps.last_issue.outputs.issue_number }}
-          labels: |
-            report
-            automated issue
+          labels: broken-links
 
       - name: Close last report open issue
         if: steps.lychee.outputs.exit_code == 0

.github/workflows/nightly.yml

@@ -33,7 +33,6 @@ jobs:
     uses: ./.github/workflows/_cargo_deny.yml
     with:
       manifest-path: external-crates/move/Cargo.toml
-    secrets: inherit
 
   release:
     name: build release binaries

.github/workflows/release_docker.yml

@@ -55,10 +55,10 @@ jobs:
             type=raw,value={{sha}},enable=${{ github.event_name == 'workflow_dispatch' }}
             type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
             type=raw,value={{tag}},enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-alpha.*\d*,group=0,value=alphanet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-beta.*\d*,group=0,value=devnet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-rc.*\d*,group=0,value=testnet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+$,group=0,value=mainnet,enable=${{ github.event_name == 'release' }}
+            type=raw,value=alphanet,enable=${{ github.event_name == 'release' && contains(github.ref, '-alpha') }}
+            type=raw,value=devnet,enable=${{ github.event_name == 'release' && contains(github.ref, '-beta') }}
+            type=raw,value=testnet,enable=${{ github.event_name == 'release' && contains(github.ref, '-rc') }}
+            type=raw,value=mainnet,enable=${{ github.event_name == 'release' && !contains(github.ref, '-alpha') && !contains(github.ref, '-beta') && !contains(github.ref, '-rc') }}
 
       - name: Login to Docker Registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pin@v3
@@ -114,10 +114,10 @@ jobs:
             type=raw,value={{sha}},enable=${{ github.event_name == 'workflow_dispatch' }}
             type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
             type=raw,value={{tag}},enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-alpha.*\d*,group=0,value=alphanet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-beta.*\d*,group=0,value=devnet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-rc.*\d*,group=0,value=testnet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+$,group=0,value=mainnet,enable=${{ github.event_name == 'release' }}
+            type=raw,value=alphanet,enable=${{ github.event_name == 'release' && contains(github.ref, '-alpha') }}
+            type=raw,value=devnet,enable=${{ github.event_name == 'release' && contains(github.ref, '-beta') }}
+            type=raw,value=testnet,enable=${{ github.event_name == 'release' && contains(github.ref, '-rc') }}
+            type=raw,value=mainnet,enable=${{ github.event_name == 'release' && !contains(github.ref, '-alpha') && !contains(github.ref, '-beta') && !contains(github.ref, '-rc') }}
 
       - name: Login to Docker Registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pin@v3
@@ -173,10 +173,10 @@ jobs:
             type=raw,value={{sha}},enable=${{ github.event_name == 'workflow_dispatch' }}
             type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
             type=raw,value={{tag}},enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-alpha.*\d*,group=0,value=alphanet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-beta.*\d*,group=0,value=devnet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-rc.*\d*,group=0,value=testnet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+$,group=0,value=mainnet,enable=${{ github.event_name == 'release' }}
+            type=raw,value=alphanet,enable=${{ github.event_name == 'release' && contains(github.ref, '-alpha') }}
+            type=raw,value=devnet,enable=${{ github.event_name == 'release' && contains(github.ref, '-beta') }}
+            type=raw,value=testnet,enable=${{ github.event_name == 'release' && contains(github.ref, '-rc') }}
+            type=raw,value=mainnet,enable=${{ github.event_name == 'release' && !contains(github.ref, '-alpha') && !contains(github.ref, '-beta') && !contains(github.ref, '-rc') }}
 
       - name: Login to Docker Registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pin@v3
@@ -232,10 +232,10 @@ jobs:
             type=raw,value={{sha}},enable=${{ github.event_name == 'workflow_dispatch' }}
             type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
             type=raw,value={{tag}},enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-alpha.*\d*,group=0,value=alphanet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-beta.*\d*,group=0,value=devnet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+-rc.*\d*,group=0,value=testnet,enable=${{ github.event_name == 'release' }}
-            type=match,pattern=v\d+\.\d+\.\d+$,group=0,value=mainnet,enable=${{ github.event_name == 'release' }}
+            type=raw,value=alphanet,enable=${{ github.event_name == 'release' && contains(github.ref, '-alpha') }}
+            type=raw,value=devnet,enable=${{ github.event_name == 'release' && contains(github.ref, '-beta') }}
+            type=raw,value=testnet,enable=${{ github.event_name == 'release' && contains(github.ref, '-rc') }}
+            type=raw,value=mainnet,enable=${{ github.event_name == 'release' && !contains(github.ref, '-alpha') && !contains(github.ref, '-beta') && !contains(github.ref, '-rc') }}
 
       - name: Login to Docker Registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pin@v3

.github/workflows/split_cluster.yml

@@ -3,57 +3,32 @@ name: Split Cluster Check
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
-  push:
-    branches:
-      - main
 
 jobs:
-  validate-mainnet:
-    if: github.event.pull_request.draft == false
-    runs-on: self-hosted
-    steps:
-      - name: checkout code repository
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # pin@v4
-        with:
-          fetch-depth: 0
-      - name: Run split cluster check script
-        id: mn-split-cluster-check
-        continue-on-error: true # if failure, continue to bisect
-        run: |
-          IOTA_PROTOCOL_CONFIG_CHAIN_OVERRIDE=mainnet \
-          scripts/compatibility/split-cluster-check.sh origin/mainnet ${{ github.sha }}
-      - name: Bisect
-        if: steps.mn-split-cluster-check.outcome == 'failure' && github.event_name == 'push'
-        run: |
-          git bisect start ${{ github.event.pull_request.head.sha }} origin/mainnet
-          IOTA_PROTOCOL_CONFIG_CHAIN_OVERRIDE=mainnet \
-          git bisect run scripts/split-cluster-check.sh origin/mainnet ${{ github.sha }}
-          git bisect reset
-      - name: Mark Failures
-        if: failure()
-        run: exit 1
-
+  # TODO: re-enable https://github.com/iotaledger/iota/issues/3862
+  # validate-mainnet:
+  #   if: github.event.pull_request.draft == false
+  #   runs-on: self-hosted
+  #   steps:
+  #     - name: Checkout code repository
+  #       uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # pin@v4
+  #       with:
+  #         fetch-depth: 0
+  #     - name: Run split cluster check script
+  #       id: mn-split-cluster-check
+  #       run: |
+  #         IOTA_PROTOCOL_CONFIG_CHAIN_OVERRIDE=mainnet \
+  #         scripts/compatibility/split-cluster-check.sh origin/mainnet ${{ github.sha }}
   validate-testnet:
     if: github.event.pull_request.draft == false
     runs-on: self-hosted
     steps:
-      - name: checkout code repository
+      - name: Checkout code repository
         uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # pin@v4
         with:
           fetch-depth: 0
       - name: Run split cluster check script
         id: tn-split-cluster-check
-        continue-on-error: true # if failure, continue to bisect
         run: |
           IOTA_PROTOCOL_CONFIG_CHAIN_OVERRIDE=testnet \
           scripts/compatibility/split-cluster-check.sh origin/testnet ${{ github.sha }}
-      - name: Bisect
-        if: steps.tn-split-cluster-check.outcome == 'failure' && github.event_name == 'push'
-        run: |
-          git bisect start ${{ github.event.pull_request.head.sha }} origin/testnet
-          IOTA_PROTOCOL_CONFIG_CHAIN_OVERRIDE=testnet \
-          git bisect run scripts/split-cluster-check.sh origin/testnet ${{ github.sha }}
-          git bisect reset
-      - name: Mark Failures
-        if: failure()
-        run: exit 1