Merge branch 'develop' into feature/FUN-877_persist_data_fetched_from…

…_contracts_improv

.github/actions/goreleaser-build-sign-publish/action.yml

@@ -3,21 +3,24 @@ description: A composite action that allows building and publishing signed chain
 inputs:
   goreleaser-version:
     description: The goreleaser version
-    default: 1.15.2
+    default: 1.23.0
+    required: false
+  goreleaser-key:
+    description: The goreleaser key
     required: false
   zig-version:
     description: The zig version
     default: 0.10.1
     required: false
   cosign-version:
     description: The cosign version
-    default: v1.13.1
+    default: v2.2.2
     required: false
   macos-sdk-dir:
     description: The macos sdk directory
     default: MacOSX12.3.sdk
     required: false
-  # publising inputs
+  # publishing inputs
   enable-docker-publish:
     description: Enable publishing of docker images / manifests
     default: "true"
@@ -75,16 +78,18 @@ runs:
     - name: Setup goreleaser
       uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
       with:
-        distribution: goreleaser
+        distribution: goreleaser-pro
         install-only: true
         version: ${{ inputs.goreleaser-version }}
+      env:
+        GORELEASER_KEY: ${{ inputs.goreleaser-key }}
     - name: Setup zig
       uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d5824358023be3a2802d # v2.2.0
       with:
         version: ${{ inputs.zig-version }}
     - name: Setup cosign
       if: inputs.enable-cosign == 'true'
-      uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
+      uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
       with:
         cosign-release: ${{ inputs.cosign-version }}
     - name: Login to docker registry

.github/actions/goreleaser-build-sign-publish/action_utils

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 set -x
+set -euo pipefail
 
 ENABLE_COSIGN=${ENABLE_COSIGN:-false}
 ENABLE_GORELEASER_SNAPSHOT=${ENABLE_GORELEASER_SNAPSHOT:-false}
@@ -70,9 +71,6 @@ goreleaser_release() {
     rm -rf cosign.pub
     rm -rf cosign.key
   fi
-
-  echo "metadata=$(cat dist/metadata.json)" >> "$GITHUB_OUTPUT"
-  echo "artifacts=$(cat dist/artifacts.json)" >> "$GITHUB_OUTPUT"
 }
 
 "$@"

.github/workflows/goreleaser-build-publish-develop.yml

@@ -34,8 +34,8 @@ jobs:
           enable-goreleaser-snapshot: "true"
           goreleaser-exec: ./tools/bin/goreleaser_wrapper
           goreleaser-config: .goreleaser.develop.yaml
-          # ISSUE: https://github.com/golang/go/issues/52690
-          zig-version: 0.11.0-dev.3380+7e0a02ee2 # TODO: update action to v0.11.x once released
+          goreleaser-key: ${{ secrets.GORELEASER_KEY }}
+          zig-version: 0.11.0
       - name: Collect Metrics
         if: always()
         id: collect-gha-metrics
@@ -46,6 +46,7 @@ jobs:
           hostname: ${{ secrets.GRAFANA_INTERNAL_HOST }}
           this-job-name: push-chainlink-develop-goreleaser
         continue-on-error: true
+
   mercury-e2e-tests:
     needs: [push-chainlink-develop-goreleaser]
     runs-on:

.github/workflows/integration-tests.yml

@@ -1022,6 +1022,8 @@ jobs:
 
           # Remove the created container
           docker rm "$CONTAINER_ID"
+      - name: Install Solana CLI # required for ensuring the local test validator is configured correctly
+        run: ./scripts/install-solana-ci.sh
       - name: Generate config overrides
         run: | # https://github.com/smartcontractkit/chainlink-testing-framework/blob/main/config/README.md
           cat << EOF > config.toml

.github/workflows/solidity-foundry.yml

@@ -32,7 +32,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        product: [vrf, automation, llo-feeds, l2ep, functions, shared]
+        product: [vrf, automation, llo-feeds, l2ep, functions, keystone, shared]
     needs: [changes]
     name: Foundry Tests ${{ matrix.product }}
     # See https://github.com/foundry-rs/foundry/issues/3827

.github/workflows/solidity-hardhat.yml

@@ -25,7 +25,7 @@ jobs:
         with:
           filters: |
             src:
-              - 'contracts/src/!(v0.8/(llo-feeds|ccip)/**)/**/*'
+              - 'contracts/src/!(v0.8/(llo-feeds|keystone|ccip)/**)/**/*'
               - 'contracts/test/**/*'
               - 'contracts/package.json'
               - 'contracts/pnpm-lock.yaml'

.goreleaser.develop.yaml

@@ -10,6 +10,7 @@ env:
 
 before:
   hooks:
+    - go mod tidy
     - ./tools/bin/goreleaser_utils before_hook
 
 # See https://goreleaser.com/customization/build/
@@ -62,6 +63,7 @@ dockers:
     goarch: amd64
     extra_files:
       - tmp/linux_amd64/libs
+      - tools/bin/ldd_fix
     build_flag_templates:
       - "--platform=linux/amd64"
       - "--pull"
@@ -84,6 +86,7 @@ dockers:
     goarch: arm64
     extra_files:
       - tmp/linux_arm64/libs
+      - tools/bin/ldd_fix
     build_flag_templates:
       - "--platform=linux/arm64"
       - "--pull"
@@ -106,6 +109,7 @@ dockers:
     goarch: amd64
     extra_files:
       - tmp/linux_amd64/libs
+      - tools/bin/ldd_fix
     build_flag_templates:
       - "--platform=linux/amd64"
       - "--pull"
@@ -129,6 +133,7 @@ dockers:
     goarch: arm64
     extra_files:
       - tmp/linux_arm64/libs
+      - tools/bin/ldd_fix
     build_flag_templates:
       - "--platform=linux/arm64"
       - "--pull"
@@ -170,13 +175,6 @@ docker_signs:
   - artifacts: all
     stdin: "{{ .Env.COSIGN_PASSWORD }}"
 
-archives:
-  - rlcp: true
-    files:
-      - src: tmp/{{ .Os }}_{{ .Arch }}/libs/*
-        dst: libs
-        strip_parent: true
-
 checksum:
   name_template: "checksums.txt"
 

.tool-versions

@@ -1,8 +1,8 @@
-golang 1.21.5
+golang 1.21.7
 mockery 2.38.0
 nodejs 16.16.0
 postgres 13.3
 helm 3.10.3
-zig 0.10.1
+zig 0.11.0
 golangci-lint 1.55.2
 protoc 25.1

CODEOWNERS

@@ -66,6 +66,8 @@ core/scripts/gateway @smartcontractkit/functions
 /contracts/**/*llo-feeds* @smartcontrackit/mercury-team
 /contracts/**/*vrf* @smartcontractkit/vrf-team
 /contracts/**/*l2ep* @smartcontractkit/integrations
+# TODO: replace with a team tag when ready
+/contracts/**/*keystone* @archseer @bolekk @patrick-dowell
 
 /contracts/src/v0.8/automation @smartcontractkit/keepers
 /contracts/src/v0.8/functions @smartcontractkit/functions

GNUmakefile

@@ -62,6 +62,10 @@ chainlink-local-start:
 install-medianpoc: ## Build & install the chainlink-medianpoc binary.
 	go install $(GOFLAGS) ./plugins/cmd/chainlink-medianpoc
 
+.PHONY: install-ocr3-capability
+install-ocr3-capability: ## Build & install the chainlink-ocr3-capability binary.
+	go install $(GOFLAGS) ./plugins/cmd/chainlink-ocr3-capability
+
 .PHONY: docker ## Build the chainlink docker image
 docker:
 	docker buildx build \

common/txmgr/confirmer.go

@@ -718,7 +718,7 @@ func (ec *Confirmer[CHAIN_ID, HEAD, ADDR, TX_HASH, BLOCK_HASH, R, SEQ, FEE]) Fin
 				oldestBlocksBehind = blockNum - *oldestBlockNum
 			}
 		} else {
-			logger.Sugared(lggr).AssumptionViolationf("Expected tx for gas bump to have at least one attempt", "etxID", etx.ID, "blockNum", blockNum, "address", address)
+			logger.Sugared(lggr).AssumptionViolationw("Expected tx for gas bump to have at least one attempt", "etxID", etx.ID, "blockNum", blockNum, "address", address)
 		}
 		lggr.Infow(fmt.Sprintf("Found %d transactions to re-sent that have still not been confirmed after at least %d blocks. The oldest of these has not still not been confirmed after %d blocks. These transactions will have their gas price bumped. %s", len(etxBumps), gasBumpThreshold, oldestBlocksBehind, label.NodeConnectivityProblemWarning), "blockNum", blockNum, "address", address, "gasBumpThreshold", gasBumpThreshold)
 	}
@@ -858,10 +858,19 @@ func (ec *Confirmer[CHAIN_ID, HEAD, ADDR, TX_HASH, BLOCK_HASH, R, SEQ, FEE]) han
 		}
 		return ec.handleInProgressAttempt(ctx, lggr, etx, replacementAttempt, blockHeight)
 	case client.ExceedsMaxFee:
-		// Confirmer: The gas price was bumped too high. This transaction attempt cannot be accepted.
-		// Best thing we can do is to re-send the previous attempt at the old
-		// price and discard this bumped version.
-		fallthrough
+		// Confirmer: Note it is not guaranteed that all nodes share the same tx fee cap.
+		// So it is very likely that this attempt was successful on another node since
+		// it was already successfully broadcasted. So we assume it is successful and
+		// warn the operator that the RPC node is misconfigured.
+		// This failure scenario is a strong indication that the RPC node
+		// is misconfigured. This is a critical error and should be resolved by the
+		// node operator.
+		// If there is only one RPC node, or all RPC nodes have the same
+		// configured cap, this transaction will get stuck and keep repeating
+		// forever until the issue is resolved.
+		lggr.Criticalw(`RPC node rejected this tx as outside Fee Cap but it may have been accepted by another Node`, "attempt", attempt)
+		timeout := ec.dbConfig.DefaultQueryTimeout()
+		return ec.txStore.SaveSentAttempt(ctx, timeout, &attempt, now)
 	case client.Fatal:
 		// WARNING: This should never happen!
 		// Should NEVER be fatal this is an invariant violation. The

common/txmgr/types/tx.go

@@ -150,6 +150,9 @@ type TxMeta[ADDR types.Hashable, TX_HASH types.Hashable] struct {
 	ForceFulfilled          *bool   `json:"ForceFulfilled,omitempty"`
 	ForceFulfillmentAttempt *uint64 `json:"ForceFulfillmentAttempt,omitempty"`
 
+	// Used for Keystone Workflows
+	WorkflowExecutionID *string `json:"WorkflowExecutionID,omitempty"`
+
 	// Used only for forwarded txs, tracks the original destination address.
 	// When this is set, it indicates tx is forwarded through To address.
 	FwdrDestAddress *ADDR `json:"ForwarderDestAddress,omitempty"`

contracts/GNUmakefile

@@ -1,6 +1,6 @@
 # ALL_FOUNDRY_PRODUCTS contains a list of all products that have a foundry
 # profile defined and use the Foundry snapshots. 
-ALL_FOUNDRY_PRODUCTS = l2ep llo-feeds functions shared
+ALL_FOUNDRY_PRODUCTS = l2ep llo-feeds functions keystone shared
 
 # To make a snapshot for a specific product, either set the `FOUNDRY_PROFILE` env var
 # or call the target with `FOUNDRY_PROFILE=product`

contracts/foundry.toml

@@ -46,6 +46,12 @@ test = 'src/v0.8/llo-feeds/test'
 solc_version = '0.8.19'
 # We cannot turn on deny_warnings = true as that will hide any CI failure
 
+[profile.keystone]
+solc_version = '0.8.19'
+src = 'src/v0.8/keystone'
+test = 'src/v0.8/keystone/test'
+optimizer_runs = 10_000
+
 [profile.shared]
 optimizer_runs = 1000000
 src = 'src/v0.8/shared'