Merge branch 'develop' into ccip-2379/capjobspec-migrations

smartcontractkit · Jun 12, 2024 · 1f7a95a · 1f7a95a
2 parents 42f816a + e0f2553
commit 1f7a95a
Show file tree

Hide file tree

Showing 46 changed files with 884 additions and 232 deletions.
diff --git a/.changeset/blue-phones-rest.md b/.changeset/blue-phones-rest.md
@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+#internal Use audited version of OCR2Base.sol in OCR3Capability.sol
diff --git a/.changeset/pink-ants-reply.md b/.changeset/pink-ants-reply.md
@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+#internal remove shared secret from transmission schedule
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -0,0 +1,13 @@
+<!--- Does this work have a corresponding ticket? --> 
+
+https://smartcontract-it.atlassian.net/browse/...
+
+<!--- Does this work depend on other open PRs? -->
+
+Requires:
+- https://github.com/smartcontractkit/chainlink-common/pull/123456
+
+<!--- Does this work support other open PRs? -->
+
+Supports:
+- https://github.com/smartcontractkit/ccip/pull/456789
diff --git a/.github/workflows/automation-nightly-tests.yml b/.github/workflows/automation-nightly-tests.yml
@@ -88,7 +88,7 @@ jobs:
         with:
           ref: ${{ github.head_ref || github.ref_name }}
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}

diff --git a/.github/workflows/automation-ondemand-tests.yml b/.github/workflows/automation-ondemand-tests.yml
@@ -218,7 +218,7 @@ jobs:
             echo "version=${{ inputs.chainlinkVersionUpdate }}" >>$GITHUB_OUTPUT
           fi
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}

diff --git a/.github/workflows/ci-core.yml b/.github/workflows/ci-core.yml
@@ -225,7 +225,7 @@ jobs:
       - name: Collect Metrics
         if: ${{ needs.filter.outputs.changes == 'true' && always() }}
         id: collect-gha-metrics
-        uses: smartcontractkit/push-gha-metrics-action@2954caaadb1b194740b24fde41daf3f4e6d1eba7
+        uses: smartcontractkit/push-gha-metrics-action@d9da21a2747016b3e13de58c7d4115a3d5c97935 # v3.0.1
         with:
           id: ${{ matrix.type.id }}
           org-id: ${{ secrets.GRAFANA_INTERNAL_TENANT_ID }}

diff --git a/.github/workflows/client-compatibility-tests.yml b/.github/workflows/client-compatibility-tests.yml
@@ -39,7 +39,7 @@ jobs:
             expression: '^[0-9]+\.[0-9]+\.[0-9]+(\-slots\-per\-epoch)?'    
     steps:
       - name: Update internal ECR if the latest Ethereum client image does not exist
-        uses: smartcontractkit/chainlink-testing-framework/.github/actions/update-internal-mirrors@7eb04a030823b316d8dd5bb555f1e49593a503fc
+        uses: smartcontractkit/chainlink-testing-framework/.github/actions/update-internal-mirrors@5eea86ee4f7742b4e944561a570a6b268e712d9e # v1.30.3
         with:
           aws_region: ${{ secrets.QA_AWS_REGION }}
           role_to_assume: ${{ secrets.QA_AWS_ROLE_TO_ASSUME }}

diff --git a/.github/workflows/evm-version-compatibility-tests.yml b/.github/workflows/evm-version-compatibility-tests.yml
@@ -229,7 +229,7 @@ jobs:
             echo "run_command=./smoke/${{ matrix.evm_node.product }}_test.go" >> "$GITHUB_OUTPUT"
           fi
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}

diff --git a/.github/workflows/gha-workflow-validation.yml b/.github/workflows/gha-workflow-validation.yml
@@ -14,14 +14,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: GHA Workflow Validator
-        uses: smartcontractkit/.github/actions/gha-workflow-validator@7d4c3591affba99d0b073e527569ec6638518d41 # gha-workflow-validator@0.1.0
+        uses: smartcontractkit/.github/actions/gha-workflow-validator@d316f66b2990ea4daa479daa3de6fc92b00f863e # gha-workflow-validator@0.2.0
         env:
           GITHUB_TOKEN: ${{ github.token }}
 
       - name: Collect Metrics
         if: always()
         id: collect-gha-metrics
-        uses: smartcontractkit/push-gha-metrics-action@dea9b546553cb4ca936607c2267a09c004e4ab3f # v3.0.0
+        uses: smartcontractkit/push-gha-metrics-action@d9da21a2747016b3e13de58c7d4115a3d5c97935 # v3.0.1
         with:
           id: lint-gh-workflows
           org-id: ${{ secrets.GRAFANA_INTERNAL_TENANT_ID }}

diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
@@ -322,7 +322,7 @@ jobs:
             echo "run_command=./smoke/${{ matrix.product.name }}_test.go" >> "$GITHUB_OUTPUT"
           fi
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -437,7 +437,7 @@ jobs:
             echo "run_command=./smoke/${{ matrix.product.name }}_test.go" >> "$GITHUB_OUTPUT"
           fi
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -660,7 +660,7 @@ jobs:
         run: |
           docker logs otel-collector
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}

diff --git a/.github/workflows/live-testnet-tests.yml b/.github/workflows/live-testnet-tests.yml
@@ -248,7 +248,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -331,7 +331,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -414,7 +414,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -497,7 +497,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -576,7 +576,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -659,7 +659,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -742,7 +742,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -825,7 +825,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -904,7 +904,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -983,7 +983,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}
@@ -1062,7 +1062,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}

diff --git a/.github/workflows/live-vrf-tests.yml b/.github/workflows/live-vrf-tests.yml
@@ -139,7 +139,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: Setup GAP for Grafana
-        uses: smartcontractkit/.github/actions/setup-gap@main
+        uses: smartcontractkit/.github/actions/setup-gap@6c9d62fdad050cfb8b59376ded291f1350705944 # [email protected]
         with:
           # aws inputs
           aws-region: ${{ secrets.AWS_REGION }}

diff --git a/.github/workflows/on-demand-keeper-smoke-tests.yml b/.github/workflows/on-demand-keeper-smoke-tests.yml
@@ -151,7 +151,7 @@ jobs:
 
       ## Run this step when changes that require tests to be run are made
       - name: Run Tests
-        uses: smartcontractkit/chainlink-github-actions/chainlink-testing-framework/run-tests@519851800779323566b7b7c22cc21bff95dbb639
+        uses: smartcontractkit/chainlink-github-actions/chainlink-testing-framework/run-tests@fc3e0df622521019f50d772726d6bf8dc919dd38 # v2.3.19
         with:
           test_command_to_run: cd ./integration-tests && go test -timeout 30m -count=1 -json -test.parallel=${{ matrix.product.nodes }} ${{ steps.build-go-test-command.outputs.run_command }} 2>&1 | tee /tmp/gotest.log | gotestloghelper -ci -singlepackage -hidepassingtests=false -hidepassinglogs
           test_download_vendor_packages_command: cd ./integration-tests && go mod download

diff --git a/.github/workflows/solidity.yml b/.github/workflows/solidity.yml
@@ -192,8 +192,9 @@ jobs:
 
       - name: Collect Metrics
         id: collect-gha-metrics
-        uses: smartcontractkit/push-gha-metrics-action@0281b09807758be1dcc41651e44e62b353808c47 # v2.1.0
+        uses: smartcontractkit/push-gha-metrics-action@d9da21a2747016b3e13de58c7d4115a3d5c97935 # v3.0.1
         with:
+          id: solidity-publish-beta
           org-id: ${{ secrets.GRAFANA_INTERNAL_TENANT_ID }}
           basic-auth: ${{ secrets.GRAFANA_INTERNAL_BASIC_AUTH }}
           hostname: ${{ secrets.GRAFANA_INTERNAL_HOST }}
@@ -234,8 +235,9 @@ jobs:
 
       - name: Collect Metrics
         id: collect-gha-metrics
-        uses: smartcontractkit/push-gha-metrics-action@0281b09807758be1dcc41651e44e62b353808c47 # v2.1.0
+        uses: smartcontractkit/push-gha-metrics-action@d9da21a2747016b3e13de58c7d4115a3d5c97935 # v3.0.1
         with:
+          id: solitidy-publish-prod
           org-id: ${{ secrets.GRAFANA_INTERNAL_TENANT_ID }}
           basic-auth: ${{ secrets.GRAFANA_INTERNAL_BASIC_AUTH }}
           hostname: ${{ secrets.GRAFANA_INTERNAL_HOST }}

diff --git a/contracts/.changeset/quiet-crews-impress.md b/contracts/.changeset/quiet-crews-impress.md
@@ -0,0 +1,5 @@
+---
+'@chainlink/contracts': patch
+---
+
+#internal Use audited version of OCR2Base.sol in OCR3Capability.sol
diff --git a/contracts/src/v0.8/keystone/OCR3Capability.sol b/contracts/src/v0.8/keystone/OCR3Capability.sol
@@ -1,28 +1,20 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.6;
+pragma solidity ^0.8.19;
 
-import {OCR2Base} from "../shared/ocr2/OCR2Base.sol";
+import {OCR2Base} from "./ocr/OCR2Base.sol";
 
 // OCR2Base provides config management compatible with OCR3
 contract OCR3Capability is OCR2Base {
   error ReportingUnsupported();
 
-  constructor() OCR2Base(true) {}
+  constructor() OCR2Base() {}
 
   function typeAndVersion() external pure override returns (string memory) {
-    return "Keystone 0.0.0";
+    return "Keystone 1.0.0";
   }
 
-  function _beforeSetConfig(uint8 _f, bytes memory _onchainConfig) internal override {}
-
-  function _afterSetConfig(uint8 _f, bytes memory _onchainConfig) internal override {}
-
-  function _validateReport(
-    bytes32 /* configDigest */,
-    uint40 /* epochAndRound */,
-    bytes memory /* report */
-  ) internal pure override returns (bool) {
-    return true;
+  function _beforeSetConfig(uint8 /* _f */, bytes memory /* _onchainConfig */) internal override {
+    // no-op
   }
 
   function _report(

diff --git a/contracts/src/v0.8/keystone/ocr/OCR2Abstract.sol b/contracts/src/v0.8/keystone/ocr/OCR2Abstract.sol
@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.19;
+
+import {ITypeAndVersion} from "../../shared/interfaces/ITypeAndVersion.sol";
+
+abstract contract OCR2Abstract is ITypeAndVersion {
+  // Maximum number of oracles the offchain reporting protocol is designed for
+  uint256 internal constant MAX_NUM_ORACLES = 31;
+
+  /**
+   * @notice triggers a new run of the offchain reporting protocol
+   * @param previousConfigBlockNumber block in which the previous config was set, to simplify historic analysis
+   * @param configDigest configDigest of this configuration
+   * @param configCount ordinal number of this config setting among all config settings over the life of this contract
+   * @param signers ith element is address ith oracle uses to sign a report
+   * @param transmitters ith element is address ith oracle uses to transmit a report via the transmit method
+   * @param f maximum number of faulty/dishonest oracles the protocol can tolerate while still working correctly
+   * @param onchainConfig serialized configuration used by the contract (and possibly oracles)
+   * @param offchainConfigVersion version of the serialization format used for "offchainConfig" parameter
+   * @param offchainConfig serialized configuration used by the oracles exclusively and only passed through the contract
+   */
+  event ConfigSet(
+    uint32 previousConfigBlockNumber,
+    bytes32 configDigest,
+    uint64 configCount,
+    address[] signers,
+    address[] transmitters,
+    uint8 f,
+    bytes onchainConfig,
+    uint64 offchainConfigVersion,
+    bytes offchainConfig
+  );
+
+  /**
+   * @notice sets offchain reporting protocol configuration incl. participating oracles
+   * @param signers addresses with which oracles sign the reports
+   * @param transmitters addresses oracles use to transmit the reports
+   * @param f number of faulty oracles the system can tolerate
+   * @param onchainConfig serialized configuration used by the contract (and possibly oracles)
+   * @param offchainConfigVersion version number for offchainEncoding schema
+   * @param offchainConfig serialized configuration used by the oracles exclusively and only passed through the contract
+   */
+  function setConfig(
+    address[] memory signers,
+    address[] memory transmitters,
+    uint8 f,
+    bytes memory onchainConfig,
+    uint64 offchainConfigVersion,
+    bytes memory offchainConfig
+  ) external virtual;
+
+  /**
+   * @notice information about current offchain reporting protocol configuration
+   * @return configCount ordinal number of current config, out of all configs applied to this contract so far
+   * @return blockNumber block at which this config was set
+   * @return configDigest domain-separation tag for current config (see _configDigestFromConfigData)
+   */
+  function latestConfigDetails()
+    external
+    view
+    virtual
+    returns (uint32 configCount, uint32 blockNumber, bytes32 configDigest);
+
+  /**
+    * @notice optionally emited to indicate the latest configDigest and epoch for
+     which a report was successfully transmited. Alternatively, the contract may
+     use latestConfigDigestAndEpoch with scanLogs set to false.
+  */
+  event Transmitted(bytes32 configDigest, uint32 epoch);
+
+  /**
+     * @notice optionally returns the latest configDigest and epoch for which a
+     report was successfully transmitted. Alternatively, the contract may return
+     scanLogs set to true and use Transmitted events to provide this information
+     to offchain watchers.
+   * @return scanLogs indicates whether to rely on the configDigest and epoch
+     returned or whether to scan logs for the Transmitted event instead.
+   * @return configDigest
+   * @return epoch
+   */
+  function latestConfigDigestAndEpoch()
+    external
+    view
+    virtual
+    returns (bool scanLogs, bytes32 configDigest, uint32 epoch);
+
+  /**
+   * @notice transmit is called to post a new report to the contract
+   * @param report serialized report, which the signatures are signing.
+   * @param rs ith element is the R components of the ith signature on report. Must have at most maxNumOracles entries
+   * @param ss ith element is the S components of the ith signature on report. Must have at most maxNumOracles entries
+   * @param rawVs ith element is the the V component of the ith signature
+   */
+  function transmit(
+    // NOTE: If these parameters are changed, expectedMsgDataLength and/or
+    // TRANSMIT_MSGDATA_CONSTANT_LENGTH_COMPONENT need to be changed accordingly
+    bytes32[3] calldata reportContext,
+    bytes calldata report,
+    bytes32[] calldata rs,
+    bytes32[] calldata ss,
+    bytes32 rawVs // signatures
+  ) external virtual;
+}