Merge remote-tracking branch 'origin/develop' into release-2.19.1-to-…

…develop

.changeset/beige-geckos-explode.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+#updated Gracefully fail if CL_DATABASE_URL is not set.

.changeset/eighty-geckos-switch.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+Reduce PriceMin on Avalanche to 1 gwei #nops

.changeset/fresh-lobsters-fly.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+#internal Refactored ChainComponents tests to run in parallel

.changeset/large-fishes-enjoy.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+Fix logic for mapping affected files in CI that affects golangci-lint execution

.changeset/mean-ravens-stare.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+#internal add versioned geth wrappers for keystone prod contracts

.changeset/metal-houses-approve.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+Added TxExpirationRebroadcast feature and config for Solana TXM. #added

.changeset/shaggy-carpets-deliver.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+#removed dead transmission tests

.changeset/sour-hairs-cross.md

@@ -0,0 +1,5 @@
+---
+"chainlink": patch
+---
+
+#internal depreciate keystone deployment library

.changeset/wild-cats-think.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+Added the `EVM.Transactions.Enabled` config to enable or disable the transaction manager. #added

.github/actions/build-sign-publish-chainlink/action.yml

@@ -210,12 +210,12 @@ runs:
         IMAGES_NAME_RAW=${{ fromJSON(steps.buildpush-nonroot.outputs.metadata)['image.name'] }}
         IMAGE_DIGEST=${{ fromJSON(steps.buildpush-nonroot.outputs.metadata)['containerimage.digest'] }}
         IMAGE_NAME=$(echo "$IMAGES_NAME_RAW" | cut -d"," -f1)
-        IMAGE_TAG=$(echo "$IMAGES_NAME_RAW" | cut -d":" -f2)
+        IMAGE_TAG=$(echo "$IMAGE_NAME" | cut -d":" -f2)
         echo "nonroot_image_name=${IMAGE_NAME}" >> $GITHUB_ENV
         echo "nonroot_image_digest=${IMAGE_DIGEST}" >> $GITHUB_ENV
         echo '### Docker Image' >> $GITHUB_STEP_SUMMARY
-        echo "Image Name: ${IMAGE_NAME}"  >> $GITHUB_STEP_SUMMARY
-        echo "Image Digest: ${IMAGE_DIGEST}"  >> $GITHUB_STEP_SUMMARY
+        echo "Image Name: ${IMAGE_NAME}" >> $GITHUB_STEP_SUMMARY
+        echo "Image Digest: ${IMAGE_DIGEST}" >> $GITHUB_STEP_SUMMARY
         echo "image-tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
         echo "image-digest=${IMAGE_DIGEST}" >> $GITHUB_OUTPUT
 

.github/actions/crib/action.yml

@@ -0,0 +1,156 @@
+name: "CRIB Action"
+description: "Spin up a CRIB environment. Optionally run tests and tear it down."
+
+inputs:
+  aws-role-duration-seconds:
+    description: "Duration in seconds for AWS role"
+    required: false
+    default: "3600"
+  aws-role-arn:
+    description: "AWS Role ARN for CRIB"
+    required: true
+  aws-region:
+    description: "AWS Region"
+    required: true
+  aws-account-id:
+    description: "AWS Account ID"
+    required: true
+  api-gw-host-crib:
+    description: "API Gateway Host for CRIB"
+    required: true
+  api-gw-host-k8s:
+    description: "API Gateway Host for K8s"
+    required: true
+  k8s-api-endpoint:
+    description: "Kubernetes API endpoint"
+    required: true
+  k8s-cluster-name:
+    description: "Kubernetes cluster name"
+    required: true
+  aws-token-issuer-role-arn:
+    description: "AWS Role ARN for token issuer"
+    required: true
+  aws-token-issuer-lambda-url:
+    description: "AWS Lambda URL for token issuer"
+    required: true
+  ingress-base-domain:
+    description: "Ingress base domain"
+    required: true
+  k8s-staging-ingress-suffix:
+    description: "K8S staging ingress suffix"
+    required: true
+  gap-url-integration-tests:
+    description: "GAP URL for integration tests"
+    required: true
+  crib-alert-slack-webhook:
+    description: "CRIB alert Slack webhook"
+    required: true
+  crib-chainlink-docker-image-name:
+    description: "Docker image name"
+    required: true
+  crib-chainlink-docker-image-tag:
+    description: "Docker image tag"
+    required: true
+  crib-cleanup-ttl:
+    # See: https://kyverno.io/docs/writing-policies/cleanup/
+    description: "Time to keep environment up for before destroying it. Examples: 15m, 1h, 3d"
+    required: false
+    default: "1h"
+  crib-destroy-environment:
+    description: "Whether to destroy the CRIB environment after testing"
+    required: false
+    default: "true"
+  integration-tests-run:
+    description: "Whether to run integration tests"
+    required: false
+    default: "true"
+
+runs:
+  using: "composite"
+  steps:
+    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      with:
+        nix_path: nixpkgs=channel:nixos-unstable
+
+    - name: setup-gap crib
+      uses: smartcontractkit/.github/actions/setup-gap@00b58566e0ee2761e56d9db0ea72b783fdb89b8d # setup-gap@0.4.0
+      with:
+        aws-role-duration-seconds: ${{ inputs.aws-role-duration-seconds }}
+        aws-role-arn: ${{ inputs.aws-role-arn }}
+        api-gateway-host: ${{ inputs.api-gw-host-crib }}
+        aws-region: ${{ inputs.aws-region }}
+        ecr-private-registry: ${{ inputs.aws-account-id }}
+        k8s-cluster-name: ${{ inputs.k8s-cluster-name }}
+        gap-name: crib
+        use-private-ecr-registry: true
+        use-tls: true
+        proxy-port: 8080
+
+    - name: setup-gap k8s
+      uses: smartcontractkit/.github/actions/setup-gap@00b58566e0ee2761e56d9db0ea72b783fdb89b8d # setup-gap@0.4.0
+      with:
+        aws-role-duration-seconds: ${{ inputs.aws-role-duration-seconds }}
+        aws-role-arn: ${{ inputs.aws-role-arn }}
+        api-gateway-host: ${{ inputs.api-gw-host-k8s }}
+        aws-region: ${{ inputs.aws-region }}
+        ecr-private-registry: ${{ inputs.aws-account-id }}
+        k8s-cluster-name: ${{ inputs.k8s-cluster-name }}
+        gap-name: k8s
+        use-private-ecr-registry: true
+        use-k8s: true
+        proxy-port: 8443
+
+    - name: Setup GitHub token using GATI
+      id: token
+      uses: smartcontractkit/.github/actions/setup-github-token@ef78fa97bf3c77de6563db1175422703e9e6674f # setup-github-token@0.2.1
+      with:
+        aws-role-arn: ${{ inputs.aws-token-issuer-role-arn }}
+        aws-lambda-url: ${{ inputs.aws-token-issuer-lambda-url }}
+        aws-region: ${{ inputs.aws-region }}
+        aws-role-duration-seconds: "1800"
+
+    - name: Deploy and validate CRIB Environment for Core
+      uses: smartcontractkit/.github/actions/crib-deploy-environment@815e0d550527897746e889441407926d7e28169c # crib-deploy-environment@7.4.0
+      id: deploy-crib
+      with:
+        github-token: ${{ steps.token.outputs.access-token }}
+        aws-ecr-private-registry: ${{ inputs.aws-account-id }}
+        aws-region: ${{ inputs.aws-region }}
+        aws-role-arn: ${{ inputs.aws-role-arn }}
+        ingress-base-domain: ${{ inputs.ingress-base-domain }}
+        k8s-api-endpoint: ${{ inputs.k8s-api-endpoint }}
+        k8s-cluster-name: ${{ inputs.k8s-cluster-name }}
+        chainlink-team: releng
+        chainlink-product: crib
+        command: "core-dev-simulated-core-ocr1"
+        crib-alert-slack-webhook: ${{ inputs.crib-alert-slack-webhook }}
+        product-image: ${{ inputs.crib-chainlink-docker-image-name }}
+        product-image-tag: ${{ inputs.crib-chainlink-docker-image-tag }}
+        ns-ttl: ${{ inputs.crib-cleanup-ttl }}
+
+    - name: Set up Go
+      uses: ./.github/actions/setup-go
+      with:
+        go-version-file: "go.mod"
+
+    - name: Run CRIB integration test
+      if: inputs.integration-tests-run == 'true'
+      shell: bash
+      working-directory: integration-tests/crib
+      env:
+        K8S_STAGING_INGRESS_SUFFIX: ${{ inputs.k8s-staging-ingress-suffix }}
+        CRIB_NAMESPACE: ${{ steps.deploy-crib.outputs.devspace-namespace }}
+        CRIB_NETWORK: geth
+        CRIB_NODES: 5
+        GAP_URL: ${{ inputs.gap-url-integration-tests }}
+        SETH_LOG_LEVEL: info
+        TEST_PERSISTENCE: true
+        E2E_TEST_CHAINLINK_IMAGE: public.ecr.aws/chainlink/chainlink
+        E2E_TEST_CHAINLINK_VERSION: latest
+      run: go test -v -run TestCRIBChaos
+
+    - name: Destroy CRIB Environment
+      if: inputs.crib-destroy-environment == 'true' && always() && steps.deploy-crib.outputs.devspace-namespace != ''
+      uses: smartcontractkit/.github/actions/crib-purge-environment@142671bc21953c8cc3edbd21848c50b5ec201c2a # crib-purge-environment@0.3.0
+      with:
+        namespace: ${{ steps.deploy-crib.outputs.devspace-namespace }}

.github/actions/golangci-lint/action.yml

@@ -26,51 +26,83 @@ runs:
       # Only do a full checkout on merge_groups
       if: github.event_name == 'merge_group'
       with:
+        persist-credentials: false
         fetch-depth: 0
+
     - name: Checkout repo
       uses: actions/checkout@v4.2.1
       if: github.event_name != 'merge_group'
       with:
+        persist-credentials: false
         fetch-depth: 1
+
     - name: Setup Go
       uses: ./.github/actions/setup-go
       with:
         only-modules: ${{ inputs.only-modules }}
         cache-version: ${{ inputs.cache-version }}
         go-version-file: ${{ inputs.go-version-file }}
         go-module-file: ${{ inputs.go-module-file }}
+
     - name: Touching core/web/assets/index.html
       shell: bash
       run: mkdir -p core/web/assets && touch core/web/assets/index.html
-    - name: Build binary
-      working-directory: ${{ inputs.go-directory }}
-      shell: bash
-      run: go build ./...
-    - name: Set golangci-lint working directory
+
+    - name: Set Golangci-lint working directory
       shell: bash
       id: set-working-directory
       # XXX: Don't use `.` default working directory here due to issues with the golangci-lint-action.
       run: |
         if [ "${{ inputs.go-directory }}" == "." ]; then
-          echo "golangci-lint-working-directory=" | tee -a $GITHUB_OUTPUT
+          echo "golangci-lint-working-directory=" >> $GITHUB_OUTPUT
         else
-          echo "golangci-lint-working-directory=${{ inputs.go-directory }}" | tee -a $GITHUB_OUTPUT
+          echo "golangci-lint-working-directory=${{ inputs.go-directory }}/" >> $GITHUB_OUTPUT
         fi
-    - name: golangci-lint
+
+    - name: Golangci-lint
       uses: golangci/golangci-lint-action@38e1018663fa5173f3968ea0777460d3de38f256 # v5.3.0
       with:
-        version: v1.61.0
+        version: v1.62.2
         only-new-issues: true
         args: --out-format colored-line-number,checkstyle:golangci-lint-report.xml
         working-directory: ${{ steps.set-working-directory.outputs.golangci-lint-working-directory }}
-    - name: Print lint report artifact
+
+    - name: Print Golangci-lint report results
       if: failure()
       shell: bash
-      run: cat ${{ inputs.go-directory }}/golangci-lint-report.xml
-    - name: Store lint report artifact
+      run: cat ./${{ steps.set-working-directory.outputs.golangci-lint-working-directory }}golangci-lint-report.xml
+
+      # Get a valid name for the upload-artifact step.
+      # Avoid error: `The artifact name is not valid: <path>/<to>/<artifact>/` caused by `/`.
+      # Remove trailing `/` from the directory name: `core/scripts/` -> `core/scripts`.
+      # Replace remaining `/` with `-`: `core/scripts` -> `core-scripts`.
+      # Assign `root` if the directory name is empty (ref: step.id: set-working-directory).
+    - name: Get valid suffix for artifact name
+      if: always()
+      id: suffix
+      shell: bash
+      run: |
+        go_directory=${{ steps.set-working-directory.outputs.golangci-lint-working-directory }}
+        echo "Validating if directory name '$go_directory' is empty or has slashes"
+        
+        if [[ $go_directory == *\/* ]]; then
+            suffix=$(echo "$go_directory" | sed 's:\/$::' | tr '/' '-')
+            echo "Directory name with slashes '$go_directory' updated to a valid artifact suffix '$suffix'"
+        elif [[ $go_directory == "" ]]; then
+          suffix="root"
+          echo "Root directory (empty string) updated to a valid artifact suffix '$suffix'"
+        else
+          suffix="$go_directory"
+          echo "Directory name is valid for the artifact suffix: '$suffix'"
+        fi
+
+        echo "suffix=${suffix}" >> $GITHUB_OUTPUT
+
+    - name: Store Golangci-lint report artifact
       if: always()
       uses: actions/upload-artifact@v4.4.3
       with:
-        name: golangci-lint-report
-        path: ${{ inputs.go-directory }}/golangci-lint-report.xml
-        retention-days: 7
+        # Use a unique suffix for each lint report artifact to avoid duplication errors
+        name: golangci-lint-report-${{ steps.suffix.outputs.suffix }}
+        # N/B: value may be empty (no slash) OR `<path>/<to>/<module>/` (with slash tat the end)
+        path: ./${{ steps.set-working-directory.outputs.golangci-lint-working-directory }}golangci-lint-report.xml

.github/actions/goreleaser-build-sign-publish/README.md

@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4.2.1
+        with:
+          persist-credentials: false
       - name: Configure aws credentials
         uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
         with:

.github/actions/setup-go/action.yml

@@ -29,10 +29,22 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Get Go Version
+      shell: bash
+      id: go-version
+      run: |
+        version=$(sed -ne '/^toolchain /s/^toolchain go//p' ${{ inputs.go-version-file }})
+        if [ -z "$version" ]; then
+          version=$(sed -ne '/^go /s/^go //p' ${{ inputs.go-version-file }})
+          echo "Toolchain version not found in ${{ inputs.go-version-file }}, using go directive instead."
+        fi
+        echo "Go Version: $version"
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
     - name: Set up Go
       uses: actions/setup-go@v5.0.2
       with:
-        go-version-file: ${{ inputs.go-version-file }}
+        go-version: ${{ steps.go-version.outputs.version }}
         cache: false
         check-latest: true
 
@@ -57,7 +69,7 @@ runs:
     # If multiple jobs call actions/cache, then only one will get priority to create upon a cache miss.
     # We will only restore the cache by default (by calling actions/cache/restore) and let the
     # `go-mod-cache.yml` workflow handle the creation.
-    - uses: actions/cache/restore@v4.1.1
+    - uses: actions/cache/restore@v4
       if: ${{ inputs.restore-module-cache-only == 'true' }}
       name: Cache Go Modules
       with:
@@ -71,7 +83,7 @@ runs:
 
     # If this is called, then it will create the cache entry upon a cache miss.
     # The cache is created after a cache miss, and after job completes successfully.
-    - uses: actions/cache@v4.1.1
+    - uses: actions/cache@v4
       if: ${{ inputs.restore-module-cache-only != 'true' }}
       name: Cache Go Modules
       with:
@@ -83,7 +95,7 @@ runs:
         restore-keys: |
           ${{ runner.os }}-gomod-${{ inputs.cache-version }}-
 
-    - uses: actions/cache/restore@v4.1.1
+    - uses: actions/cache/restore@v4
       name: Cache Go Build Outputs (restore)
       # For certain events, we don't necessarily want to create a build cache, but we will benefit from restoring from one. 
       if: ${{ inputs.only-modules == 'false' && (github.event_name == 'merge_group' || inputs.restore-build-cache-only == 'true') }}
@@ -97,7 +109,7 @@ runs:
           ${{ runner.os }}-gobuild-${{ inputs.build-cache-version || inputs.cache-version }}-
           ${{ runner.os }}-gobuild-${{ inputs.cache-version }}-
 
-    - uses: actions/cache@v4.1.1
+    - uses: actions/cache@v4
       # don't save cache on merge queue events
       if: ${{ inputs.only-modules == 'false' && (github.event_name != 'merge_group' && inputs.restore-build-cache-only == 'false') }}
       name: Cache Go Build Outputs