Merge branch 'master' into pmarco/fix-golden-state-test-split-time-advancement

Author: pietrodimarco-dfinity

.bazelversion

@@ -1 +1 @@
-8.5.1
+8.6.0

.claude/CLAUDE.md

@@ -8,11 +8,13 @@ After changing Rust code (`*.rs`) follow these steps in order:
 
 1. **Format** by running the following from the root of the repository:
    ```
+   cd "$(git rev-parse --show-toplevel)"
    rustfmt <MODIFIED_RUST_FILES>
    ```
    where `<MODIFIED_RUST_FILES>` is a space separated list of paths of all modified Rust files relative to the root of the repository.
 2. **Lint** by running the following from the root of the repository:
    ```
+   cd "$(git rev-parse --show-toplevel)"
    cargo clippy --all-features <CRATES> -- \
        -D warnings \
        -D clippy::all \
@@ -30,6 +32,7 @@ After changing Rust code (`*.rs`) follow these steps in order:
    Fix any linting errors.
 3. **Build** the directly affected bazel targets by running the following from the root of the repository:
    ```
+   cd "$(git rev-parse --show-toplevel)"
    TARGETS="$(bazel query 'kind(rule, rdeps(//..., set(<MODIFIED_FILES>), 1))' --keep_going 2>/dev/null)"
    if [ -n "$TARGETS" ]; then
        bazel build $TARGETS
@@ -40,6 +43,7 @@ After changing Rust code (`*.rs`) follow these steps in order:
    Fix all build errors.
 4. **Test** the directly affected bazel tests by running the following from the root of the repository:
    ```
+   cd "$(git rev-parse --show-toplevel)"
    TESTS="$(bazel query 'kind(".*_test|test_suite", kind(rule, rdeps(//..., set(<MODIFIED_FILES>), 2)))' --keep_going 2>/dev/null)"
    if [ -n "$TESTS" ]; then
        bazel test --test_output=errors $TESTS

.devcontainer/devcontainer.json

@@ -1,5 +1,5 @@
 {
-  "image": "ghcr.io/dfinity/ic-build@sha256:15e6eca52d696697a681916c92ab3623ebff1fcff70156220b0270c2985a6b2b",
+  "image": "ghcr.io/dfinity/ic-dev@sha256:fe06783d9cf8e9fc901a5996d9fc8b726f15769f2fd6bd86969d1fbbf77ae025",
   "remoteUser": "ubuntu",
   "privileged": true,
   "runArgs": [

.github/CODEOWNERS

@@ -137,7 +137,9 @@ go.sum                    @dfinity/idx
 /rs/interfaces/                                         @dfinity/ic-interface-owners
 /rs/interfaces/adapter_client/                          @dfinity/consensus
 /rs/interfaces/certified_stream_store/                  @dfinity/team-dsm
-/rs/interfaces/mocks/src/payload_builder                @dfinity/consensus
+/rs/interfaces/mocks/src/consensus_pool.rs              @dfinity/consensus
+/rs/interfaces/mocks/src/crypto.rs                      @dfinity/consensus
+/rs/interfaces/mocks/src/payload_builder.rs             @dfinity/consensus
 /rs/interfaces/registry/                                @dfinity/governance-team
 /rs/interfaces/src/canister_http.rs                     @dfinity/consensus
 /rs/interfaces/src/consensus.rs                         @dfinity/consensus

.github/actions/bazel/action.yaml

@@ -65,14 +65,6 @@ runs:
       run: |
         set -euo pipefail
 
-        # Set up .netrc so that bazel can authenticate with GitHub to have higher rate limits for fetching dependencies.
-        touch  ~/.netrc
-        chmod 600 ~/.netrc
-        echo "machine github.com login x-access-token password ${{ github.token }}" > ~/.netrc
-        echo "machine api.github.com login x-access-token password ${{ github.token }}" >> ~/.netrc
-        echo "Current GitHub API rate limits:"
-        curl -s --netrc https://api.github.com/rate_limit | jq '.resources.core'
-
         # Here we overwrite the PATH with our custom bazel wrapper to ensure
         # the specified commands are run with the CI-specific options included
         # in the wrapper.

.github/actions/netrc/action.yaml

@@ -0,0 +1,20 @@
+name: 'GitHub Authentication with netrc'
+description: Set up authentication in netrc using github token. Picked up by tools like Bazel.
+
+runs:
+  using: "composite"
+  steps:
+    # write netrc to $HOME
+    - shell: bash
+      run: |
+        # Set up .netrc so that tools can authenticate with GitHub to have higher rate limits for fetching dependencies.
+        touch  ~/.netrc
+        chmod 600 ~/.netrc
+        echo "machine github.com login x-access-token password ${{ github.token }}" > ~/.netrc
+        echo "machine api.github.com login x-access-token password ${{ github.token }}" >> ~/.netrc
+        echo "Current GitHub API rate limits:"
+
+        # Show how close we are to the limits (ignore errors from curl or invalid JSON)
+        curl -sf --netrc https://api.github.com/rate_limit 2>/dev/null | \
+          jq -r '.resources.core | "Rate limit remaining: \(.remaining)/\(.limit) (resets at \(.reset | strftime("%Y-%m-%d %H:%M:%S %Z")))"' 2>/dev/null \
+          || echo "Could not retrieve rate limit information"

.github/workflows/api-bn-recovery-test.yml

@@ -22,14 +22,15 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:2caf6df6009b29ede72a520b60f3db064324e22192be532349caa82a987f8c50
+      image: ghcr.io/dfinity/ic-build@sha256:18d23aef1f5e9e7e1eef94c32563f8ed15531ae79065bb00bb5206a643fc49fe
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - uses: ./.github/actions/netrc
 
       - name: Install dfx
         run: |

.github/workflows/ci-main.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:15e6eca52d696697a681916c92ab3623ebff1fcff70156220b0270c2985a6b2b
+      image: ghcr.io/dfinity/ic-build@sha256:18d23aef1f5e9e7e1eef94c32563f8ed15531ae79065bb00bb5206a643fc49fe
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 90
@@ -37,6 +37,7 @@ jobs:
         with:
           fetch-depth: ${{ github.event_name == 'pull_request' && 256 || 0 }}
           ref: ${{ inputs.commit-sha }}
+      - uses: ./.github/actions/netrc
       - name: Run Libfuzzer targets
         uses: ./.github/actions/bazel
         with:
@@ -159,6 +160,7 @@ jobs:
     timeout-minutes: 150
     steps:
       - *checkout
+      - uses: ./.github/actions/netrc
       - name: "Node Name"
         run: |
           echo "::notice::Node Name: ${NODE_NAME}"
@@ -281,6 +283,7 @@ jobs:
         with:
           fetch-depth: 1 # on macOS we don't need any git history
           ref: ${{ inputs.commit-sha }}
+      - uses: ./.github/actions/netrc
         # The amd64-darwin runners are pretty slow so we don't always run the tests -- we do however
         # wanna make sure bazel evaluates successfully.
       - name: Evaluate workspace
@@ -353,19 +356,9 @@ jobs:
           nsc bazel cache setup --bazelrc=/tmp/bazel-cache.bazelrc
           cat /tmp/bazel-cache.bazelrc
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/netrc
       - name: Build and Test
         run: |
-          # Set up .netrc so that bazel can authenticate with GitHub to have higher rate limits for fetching dependencies.
-          touch  ~/.netrc
-          chmod 600 ~/.netrc
-          echo "machine github.com login x-access-token password ${{ github.token }}" > ~/.netrc
-          echo "machine api.github.com login x-access-token password ${{ github.token }}" >> ~/.netrc
-          echo "Current GitHub API rate limits:"
-
-          # Show how close we are to the limits
-          curl -s --netrc https://api.github.com/rate_limit | \
-            jq -r '.resources.core | "Rate limit remaining: \(.remaining)/\(.limit) (resets at \(.reset | strftime("%Y-%m-%d %H:%M:%S %Z")))"'
-
           mkdir -p /tmp/zig-cache
 
           bazel \
@@ -504,6 +497,7 @@ jobs:
     if: ${{ github.event_name != 'merge_group' }}
     steps:
       - *checkout
+      - uses: ./.github/actions/netrc
       - name: "Node Name"
         run: |
           echo "::notice::Node Name: ${NODE_NAME}"
@@ -637,6 +631,7 @@ jobs:
     timeout-minutes: 90
     steps:
       - *checkout
+      - uses: ./.github/actions/netrc
       - name: Run Bazel Build All No Cache
         uses: ./.github/actions/bazel
         with:
@@ -688,13 +683,18 @@ jobs:
 
   check-pull-request-bazel-targets:
     name: Check PULL_REQUEST_BAZEL_TARGETS
-    runs-on: ubuntu-latest
+    runs-on:
+      labels: dind-small
+    container: *container-setup
     timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - uses: ./.github/actions/netrc
       - name: Check PULL_REQUEST_BAZEL_TARGETS
-        run: ./ci/scripts/targets.py check
+        uses: ./.github/actions/bazel
+        with:
+          run: ./ci/scripts/targets.py check
 
 # only run on pull-request event - they are also triggered from schedule-daily.yml
   pocket-ic-tests-windows:
@@ -724,6 +724,7 @@ jobs:
           filters: |
             container-run:
               - '.github/workflows/ci-pr-only.yml'
+              - '.github/workflows/container-autobuild.yml'
               - 'ci/container/**'
       - name: Test Container Run
         if: |

.github/workflows/ci-pr-only.yml

@@ -37,7 +37,7 @@ jobs:
     runs-on: &dind-small-setup
       labels: dind-small
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:15e6eca52d696697a681916c92ab3623ebff1fcff70156220b0270c2985a6b2b
+      image: ghcr.io/dfinity/ic-build@sha256:18d23aef1f5e9e7e1eef94c32563f8ed15531ae79065bb00bb5206a643fc49fe
       options: >-
          -e NODE_NAME --mount type=tmpfs,target="/tmp/containers"
     steps:
@@ -47,6 +47,7 @@ jobs:
           # Ensures we fetch the merge-base, which we compare against
           fetch-depth: 0
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || inputs.commit-sha }}
+      - uses: ./.github/actions/netrc
       - name: Run candid compatibility checks
         uses: ./.github/actions/bazel
         with:
@@ -77,6 +78,7 @@ jobs:
         with:
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || inputs.commit-sha }}
           token: ${{ steps.app-token.outputs.token }}
+      - uses: ./.github/actions/netrc
       - name: Run Linter
         id: linter
         uses: ./.github/actions/bazel

.github/workflows/container-api-bn-recovery.yml

@@ -28,14 +28,15 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:2caf6df6009b29ede72a520b60f3db064324e22192be532349caa82a987f8c50
+      image: ghcr.io/dfinity/ic-build@sha256:18d23aef1f5e9e7e1eef94c32563f8ed15531ae79065bb00bb5206a643fc49fe
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"
     timeout-minutes: 60
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - uses: ./.github/actions/netrc
 
       - name: Build binaries with Bazel
         uses: ./.github/actions/bazel