Merge branch 'feat/DEPLOY-694-scroll-suf-zero-value-checks' of github…

….com:smartcontractkit/chainlink into feat/DEPLOY-694-scroll-suf-zero-value-checks

.github/workflows/ci-core.yml

@@ -50,7 +50,7 @@ jobs:
       - name: Checkout the repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Setup node
-        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
       - name: Setup NodeJS
         uses: ./.github/actions/setup-nodejs
         with:
@@ -97,7 +97,7 @@ jobs:
         working-directory: ./.github/actions/setup-postgres
       - name: Store logs artifacts
         if: always()
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         with:
           name: ${{ matrix.cmd }}_logs
           path: |
@@ -136,7 +136,7 @@ jobs:
       - name: Checkout the repo
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Setup node
-        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
       - name: Setup NodeJS
         uses: ./.github/actions/setup-nodejs
         with:
@@ -154,7 +154,7 @@ jobs:
       - name: Setup DB
         run: ./chainlink.test local db preparetest
       - name: Load test outputs
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           path: ./artifacts
       - name: Build flakey test runner

.github/workflows/codeql-analysis.yml

@@ -26,7 +26,7 @@ jobs:
 
       - name: Set up Go
         if: ${{ matrix.language == 'go' }}
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version-file: 'go.mod'
 

.github/workflows/dependency-check.yml

@@ -29,7 +29,7 @@ jobs:
 
       - name: Set up Go
         if: needs.changes.outputs.src == 'true'
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version-file: 'go.mod'
         id: go

.github/workflows/helm-chart-publish.yml

@@ -31,7 +31,7 @@ jobs:
         uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@be16258da8010256c6e82849661221415f031968 # v1.5.0
+        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
         with:
           charts_dir: charts
           config: .github/cr.yaml

.github/workflows/integration-tests.yml

@@ -492,7 +492,7 @@ jobs:
           ls -l ./integration-tests/smoke/traces
       - name: Upload Trace Data
         if: steps.check-label.outputs.trace == 'true' && matrix.product.name == 'ocr2' && matrix.product.tag_suffix == '-plugins'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         with:
           name: trace-data
           path: ./integration-tests/smoke/traces/trace-data.json

.github/workflows/on-demand-log-poller.yml

@@ -76,7 +76,7 @@ jobs:
         with:
           ref: ${{ env.REF_NAME }}          
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version-file: "integration-tests/go.mod"
           cache: true

.github/workflows/performance-tests.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
       - name: Build and Push
-        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
+        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
         with:
           context: .
           file: core/chainlink.Dockerfile
@@ -72,7 +72,7 @@ jobs:
           QA_KUBECONFIG: ${{ secrets.QA_KUBECONFIG }}
       - name: Publish pprof artifacts
         if: ${{ success() }}
-        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         with:
           name: pprof_results
           path: ./integration-tests/performance/logs

.github/workflows/solidity-hardhat.yml

@@ -84,7 +84,7 @@ jobs:
       - name: Rename coverage
         run: mv ./contracts/coverage.json ./contracts/coverage-${{ matrix.split.idx }}.json
       - name: Upload coverage
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
         with:
           name: solidity-coverage-${{ matrix.split.idx }}
           path: ./contracts/coverage-${{ matrix.split.idx }}.json
@@ -110,7 +110,7 @@ jobs:
       - name: Make coverage directory
         run: mkdir ./contracts/coverage-reports
       - name: Download coverage
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           path: ./contracts/coverage-reports
       - name: Display structure of downloaded files

.github/workflows/stale.yml

@@ -18,7 +18,7 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # v8.0.0
+    - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         exempt-all-pr-assignees: true

core/chains/legacyevm/chain.go

@@ -37,7 +37,6 @@ import (
 	"github.com/smartcontractkit/chainlink/v2/core/config"
 	"github.com/smartcontractkit/chainlink/v2/core/logger"
 	"github.com/smartcontractkit/chainlink/v2/core/services/keystore"
-	"github.com/smartcontractkit/chainlink/v2/core/services/pg"
 )
 
 //go:generate mockery --quiet --name Chain --output ./mocks/ --case=underscore
@@ -164,9 +163,8 @@ func (c ChainRelayExtenderConfig) Validate() error {
 type ChainOpts struct {
 	AppConfig AppConfig
 
-	EventBroadcaster pg.EventBroadcaster
-	MailMon          *mailbox.Monitor
-	GasEstimator     gas.EvmFeeEstimator
+	MailMon      *mailbox.Monitor
+	GasEstimator gas.EvmFeeEstimator
 
 	*sqlx.DB
 
@@ -185,9 +183,7 @@ func (o ChainOpts) Validate() error {
 	if o.AppConfig == nil {
 		err = errors.Join(err, errors.New("nil AppConfig"))
 	}
-	if o.EventBroadcaster == nil {
-		err = errors.Join(err, errors.New("nil EventBroadcaster"))
-	}
+
 	if o.MailMon == nil {
 		err = errors.Join(err, errors.New("nil MailMon"))
 	}

core/chains/legacyevm/chain_test.go

@@ -14,7 +14,6 @@ import (
 	"github.com/smartcontractkit/chainlink/v2/core/chains/legacyevm/mocks"
 	"github.com/smartcontractkit/chainlink/v2/core/internal/testutils/configtest"
 	"github.com/smartcontractkit/chainlink/v2/core/internal/testutils/pgtest"
-	"github.com/smartcontractkit/chainlink/v2/core/services/pg"
 )
 
 func TestLegacyChains(t *testing.T) {
@@ -34,10 +33,9 @@ func TestLegacyChains(t *testing.T) {
 
 func TestChainOpts_Validate(t *testing.T) {
 	type fields struct {
-		AppConfig        legacyevm.AppConfig
-		EventBroadcaster pg.EventBroadcaster
-		MailMon          *mailbox.Monitor
-		DB               *sqlx.DB
+		AppConfig legacyevm.AppConfig
+		MailMon   *mailbox.Monitor
+		DB        *sqlx.DB
 	}
 	tests := []struct {
 		name    string
@@ -47,30 +45,27 @@ func TestChainOpts_Validate(t *testing.T) {
 		{
 			name: "valid",
 			fields: fields{
-				AppConfig:        configtest.NewTestGeneralConfig(t),
-				EventBroadcaster: pg.NewNullEventBroadcaster(),
-				MailMon:          &mailbox.Monitor{},
-				DB:               pgtest.NewSqlxDB(t),
+				AppConfig: configtest.NewTestGeneralConfig(t),
+				MailMon:   &mailbox.Monitor{},
+				DB:        pgtest.NewSqlxDB(t),
 			},
 		},
 		{
 			name: "invalid",
 			fields: fields{
-				AppConfig:        nil,
-				EventBroadcaster: nil,
-				MailMon:          nil,
-				DB:               nil,
+				AppConfig: nil,
+				MailMon:   nil,
+				DB:        nil,
 			},
 			wantErr: true,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			o := legacyevm.ChainOpts{
-				AppConfig:        tt.fields.AppConfig,
-				EventBroadcaster: tt.fields.EventBroadcaster,
-				MailMon:          tt.fields.MailMon,
-				DB:               tt.fields.DB,
+				AppConfig: tt.fields.AppConfig,
+				MailMon:   tt.fields.MailMon,
+				DB:        tt.fields.DB,
 			}
 			if err := o.Validate(); (err != nil) != tt.wantErr {
 				t.Errorf("ChainOpts.Validate() error = %v, wantErr %v", err, tt.wantErr)

core/cmd/shell.go

@@ -176,7 +176,7 @@ func (n ChainlinkAppFactory) NewApplication(ctx context.Context, cfg chainlink.G
 
 	evmFactoryCfg := chainlink.EVMFactoryConfig{
 		CSAETHKeystore: keyStore,
-		ChainOpts:      legacyevm.ChainOpts{AppConfig: cfg, EventBroadcaster: eventBroadcaster, MailMon: mailMon, DB: db},
+		ChainOpts:      legacyevm.ChainOpts{AppConfig: cfg, MailMon: mailMon, DB: db},
 	}
 	// evm always enabled for backward compatibility
 	// TODO BCF-2510 this needs to change in order to clear the path for EVM extraction

core/cmd/shell_local_test.go

@@ -25,7 +25,6 @@ import (
 	"github.com/smartcontractkit/chainlink/v2/core/logger/audit"
 	"github.com/smartcontractkit/chainlink/v2/core/services/chainlink"
 	chainlinkmocks "github.com/smartcontractkit/chainlink/v2/core/services/chainlink/mocks"
-	"github.com/smartcontractkit/chainlink/v2/core/services/pg"
 	evmrelayer "github.com/smartcontractkit/chainlink/v2/core/services/relay/evm"
 	"github.com/smartcontractkit/chainlink/v2/core/sessions/localauth"
 	"github.com/smartcontractkit/chainlink/v2/core/store/dialects"
@@ -89,10 +88,9 @@ func TestShell_RunNodeWithPasswords(t *testing.T) {
 				Logger:   lggr,
 				KeyStore: keyStore.Eth(),
 				ChainOpts: legacyevm.ChainOpts{
-					AppConfig:        cfg,
-					EventBroadcaster: pg.NewNullEventBroadcaster(),
-					MailMon:          &mailbox.Monitor{},
-					DB:               db,
+					AppConfig: cfg,
+					MailMon:   &mailbox.Monitor{},
+					DB:        db,
 				},
 			}
 			testRelayers := genTestEVMRelayers(t, opts, keyStore)
@@ -194,10 +192,9 @@ func TestShell_RunNodeWithAPICredentialsFile(t *testing.T) {
 				Logger:   lggr,
 				KeyStore: keyStore.Eth(),
 				ChainOpts: legacyevm.ChainOpts{
-					AppConfig:        cfg,
-					EventBroadcaster: pg.NewNullEventBroadcaster(),
-					MailMon:          &mailbox.Monitor{},
-					DB:               db,
+					AppConfig: cfg,
+					MailMon:   &mailbox.Monitor{},
+					DB:        db,
 				},
 			}
 			testRelayers := genTestEVMRelayers(t, opts, keyStore)

core/config/docs/core.toml

@@ -574,3 +574,8 @@ MaxStaleAge = "1h" # Default
 # LatestReportDeadline controls how long to wait for a response from the
 # mercury server before retrying. Setting this to zero will wait indefinitely.
 LatestReportDeadline = "5s" # Default
+
+# Mercury.TLS controls client settings for when the node talks to traditional web servers or load balancers.
+[Mercury.TLS]
+# CertFile is the path to a PEM file of trusted root certificate authority certificates
+CertFile = "/path/to/client/certs.pem" # Example

core/config/mercury_config.go

@@ -12,7 +12,12 @@ type MercuryCache interface {
 	LatestReportDeadline() time.Duration
 }
 
+type MercuryTLS interface {
+	CertFile() string
+}
+
 type Mercury interface {
 	Credentials(credName string) *ocr2models.MercuryCredentials
 	Cache() MercuryCache
+	TLS() MercuryTLS
 }

core/config/toml/types.go

@@ -1304,12 +1304,37 @@ func (mc *MercuryCache) setFrom(f *MercuryCache) {
 	}
 }
 
+type MercuryTLS struct {
+	CertFile *string
+}
+
+func (m *MercuryTLS) setFrom(f *MercuryTLS) {
+	if v := f.CertFile; v != nil {
+		m.CertFile = v
+	}
+}
+
+func (m *MercuryTLS) ValidateConfig() (err error) {
+	if *m.CertFile != "" {
+		if !isValidFilePath(*m.CertFile) {
+			err = multierr.Append(err, configutils.ErrInvalid{Name: "CertFile", Value: *m.CertFile, Msg: "must be a valid file path"})
+		}
+	}
+	return
+}
+
 type Mercury struct {
 	Cache MercuryCache `toml:",omitempty"`
+	TLS   MercuryTLS   `toml:",omitempty"`
 }
 
 func (m *Mercury) setFrom(f *Mercury) {
 	m.Cache.setFrom(&f.Cache)
+	m.TLS.setFrom(&f.TLS)
+}
+
+func (m *Mercury) ValidateConfig() (err error) {
+	return m.TLS.ValidateConfig()
 }
 
 type MercuryCredentials struct {

core/config/toml/types_test.go

@@ -531,5 +531,50 @@ func TestTracing_ValidateMode(t *testing.T) {
 	}
 }
 
+func TestMercuryTLS_ValidateTLSCertPath(t *testing.T) {
+	tests := []struct {
+		name        string
+		tlsCertPath *string
+		wantErr     bool
+		errMsg      string
+	}{
+		{
+			name:        "valid file path",
+			tlsCertPath: ptr("/etc/ssl/certs/cert.pem"),
+			wantErr:     false,
+		},
+		{
+			name:        "relative file path",
+			tlsCertPath: ptr("certs/cert.pem"),
+			wantErr:     false,
+		},
+		{
+			name:        "excessively long file path",
+			tlsCertPath: ptr(strings.Repeat("z", 4097)),
+			wantErr:     true,
+			errMsg:      "CertFile: invalid value (" + strings.Repeat("z", 4097) + "): must be a valid file path",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mercury := &Mercury{
+				TLS: MercuryTLS{
+					CertFile: tt.tlsCertPath,
+				},
+			}
+
+			err := mercury.ValidateConfig()
+
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Equal(t, tt.errMsg, err.Error())
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
 // ptr is a utility function for converting a value to a pointer to the value.
 func ptr[T any](t T) *T { return &t }

core/internal/cltest/cltest.go

@@ -360,10 +360,9 @@ func NewApplicationWithConfig(t testing.TB, cfg chainlink.GeneralConfig, flagsAn
 
 	evmOpts := chainlink.EVMFactoryConfig{
 		ChainOpts: legacyevm.ChainOpts{
-			AppConfig:        cfg,
-			EventBroadcaster: eventBroadcaster,
-			MailMon:          mailMon,
-			DB:               db,
+			AppConfig: cfg,
+			MailMon:   mailMon,
+			DB:        db,
 		},
 		CSAETHKeystore: keyStore,
 	}