Merge remote-tracking branch 'origin/master' into frankdavid/recovery-admin

# Conflicts:
#	rs/nns/governance/conversions/src/lib.rs

Author: frankdavid

.claude/CLAUDE.md

@@ -8,11 +8,13 @@ After changing Rust code (`*.rs`) follow these steps in order:
 
 1. **Format** by running the following from the root of the repository:
    ```
+   cd "$(git rev-parse --show-toplevel)"
    rustfmt <MODIFIED_RUST_FILES>
    ```
    where `<MODIFIED_RUST_FILES>` is a space separated list of paths of all modified Rust files relative to the root of the repository.
 2. **Lint** by running the following from the root of the repository:
    ```
+   cd "$(git rev-parse --show-toplevel)"
    cargo clippy --all-features <CRATES> -- \
        -D warnings \
        -D clippy::all \
@@ -30,6 +32,7 @@ After changing Rust code (`*.rs`) follow these steps in order:
    Fix any linting errors.
 3. **Build** the directly affected bazel targets by running the following from the root of the repository:
    ```
+   cd "$(git rev-parse --show-toplevel)"
    TARGETS="$(bazel query 'kind(rule, rdeps(//..., set(<MODIFIED_FILES>), 1))' --keep_going 2>/dev/null)"
    if [ -n "$TARGETS" ]; then
        bazel build $TARGETS
@@ -40,6 +43,7 @@ After changing Rust code (`*.rs`) follow these steps in order:
    Fix all build errors.
 4. **Test** the directly affected bazel tests by running the following from the root of the repository:
    ```
+   cd "$(git rev-parse --show-toplevel)"
    TESTS="$(bazel query 'kind(".*_test|test_suite", kind(rule, rdeps(//..., set(<MODIFIED_FILES>), 2)))' --keep_going 2>/dev/null)"
    if [ -n "$TESTS" ]; then
        bazel test --test_output=errors $TESTS

.devcontainer/devcontainer.json

@@ -1,5 +1,5 @@
 {
-  "image": "ghcr.io/dfinity/ic-build@sha256:2e372158cdc56750ab57d4c770655c636fa5a9f80038a6b48768424b24430730",
+  "image": "ghcr.io/dfinity/ic-dev@sha256:fe06783d9cf8e9fc901a5996d9fc8b726f15769f2fd6bd86969d1fbbf77ae025",
   "remoteUser": "ubuntu",
   "privileged": true,
   "runArgs": [

.github/CODEOWNERS

@@ -137,7 +137,9 @@ go.sum                    @dfinity/idx
 /rs/interfaces/                                         @dfinity/ic-interface-owners
 /rs/interfaces/adapter_client/                          @dfinity/consensus
 /rs/interfaces/certified_stream_store/                  @dfinity/team-dsm
-/rs/interfaces/mocks/src/payload_builder                @dfinity/consensus
+/rs/interfaces/mocks/src/consensus_pool.rs              @dfinity/consensus
+/rs/interfaces/mocks/src/crypto.rs                      @dfinity/consensus
+/rs/interfaces/mocks/src/payload_builder.rs             @dfinity/consensus
 /rs/interfaces/registry/                                @dfinity/governance-team
 /rs/interfaces/src/canister_http.rs                     @dfinity/consensus
 /rs/interfaces/src/consensus.rs                         @dfinity/consensus

.github/actions/netrc/action.yaml

@@ -14,6 +14,7 @@ runs:
         echo "machine api.github.com login x-access-token password ${{ github.token }}" >> ~/.netrc
         echo "Current GitHub API rate limits:"
 
-        # Show how close we are to the limits
-        curl -s --netrc https://api.github.com/rate_limit | \
-          jq -r '.resources.core | "Rate limit remaining: \(.remaining)/\(.limit) (resets at \(.reset | strftime("%Y-%m-%d %H:%M:%S %Z")))"'
+        # Show how close we are to the limits (ignore errors from curl or invalid JSON)
+        curl -sf --netrc https://api.github.com/rate_limit 2>/dev/null | \
+          jq -r '.resources.core | "Rate limit remaining: \(.remaining)/\(.limit) (resets at \(.reset | strftime("%Y-%m-%d %H:%M:%S %Z")))"' 2>/dev/null \
+          || echo "Could not retrieve rate limit information"

.github/workflows/api-bn-recovery-test.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:2e372158cdc56750ab57d4c770655c636fa5a9f80038a6b48768424b24430730
+      image: ghcr.io/dfinity/ic-build@sha256:18d23aef1f5e9e7e1eef94c32563f8ed15531ae79065bb00bb5206a643fc49fe
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"

.github/workflows/ci-main.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: &dind-large-setup
       labels: dind-large
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:2e372158cdc56750ab57d4c770655c636fa5a9f80038a6b48768424b24430730
+      image: ghcr.io/dfinity/ic-build@sha256:18d23aef1f5e9e7e1eef94c32563f8ed15531ae79065bb00bb5206a643fc49fe
       options: >-
          -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 90
@@ -724,6 +724,7 @@ jobs:
           filters: |
             container-run:
               - '.github/workflows/ci-pr-only.yml'
+              - '.github/workflows/container-autobuild.yml'
               - 'ci/container/**'
       - name: Test Container Run
         if: |

.github/workflows/ci-pr-only.yml

@@ -37,7 +37,7 @@ jobs:
     runs-on: &dind-small-setup
       labels: dind-small
     container: &container-setup
-      image: ghcr.io/dfinity/ic-build@sha256:2e372158cdc56750ab57d4c770655c636fa5a9f80038a6b48768424b24430730
+      image: ghcr.io/dfinity/ic-build@sha256:18d23aef1f5e9e7e1eef94c32563f8ed15531ae79065bb00bb5206a643fc49fe
       options: >-
          -e NODE_NAME --mount type=tmpfs,target="/tmp/containers"
     steps:

.github/workflows/container-api-bn-recovery.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:2e372158cdc56750ab57d4c770655c636fa5a9f80038a6b48768424b24430730
+      image: ghcr.io/dfinity/ic-build@sha256:18d23aef1f5e9e7e1eef94c32563f8ed15531ae79065bb00bb5206a643fc49fe
       options: >-
         -e NODE_NAME --privileged --cgroupns host
         --mount type=tmpfs,target="/home/buildifier/.local/share/containers"

.github/workflows/container-autobuild.yml

@@ -65,7 +65,8 @@ jobs:
           - image: ic-dev
             target: dev
     outputs:
-      imageid: ${{ steps.set-imageid.outputs.imageid }} # both images share the same imageid
+      ic-build-imageid: ${{ steps.set-output-imageid.outputs.ic-build-imageid }}
+      ic-dev-imageid: ${{ steps.set-output-imageid.outputs.ic-dev-imageid }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -92,10 +93,17 @@ jobs:
           target: ${{ matrix.target }}
           build-args: |
             CI_USER=1001
-      - name: Set imageid output
-        id: set-imageid
-        if: matrix.image == 'ic-build'
-        run: echo "imageid=${{ steps.build.outputs.imageid }}" >> $GITHUB_OUTPUT
+      - name: Set output imageid
+        id: set-output-imageid
+        run: |
+          if [ "${{ matrix.image }}" == "ic-build" ]; then
+            echo "ic-build-imageid=${{ steps.build.outputs.imageid }}" >> $GITHUB_OUTPUT
+          elif [ "${{ matrix.image }}" == "ic-dev" ]; then
+            echo "ic-dev-imageid=${{ steps.build.outputs.imageid }}" >> $GITHUB_OUTPUT
+          else
+            echo "Unknown image: ${{ matrix.image }}"
+            exit 1
+          fi
 
   update-image-references:
     name: Update Image References in Repo
@@ -122,21 +130,26 @@ jobs:
           # Update container image references
           set -xeuo pipefail
 
-          IMG_NAME=${{ github.repository_owner }}/ic-build
-          IMG_NAME_FULL="ghcr.io/${IMG_NAME}@${{ needs.ic-build-image.outputs.imageid }}"
+
+          IMAGE_PREFIX="ghcr.io/dfinity/"
+          IMG_NAME_IC_BUILD="${IMAGE_PREFIX}ic-build@${{ needs.ic-build-image.outputs.ic-build-imageid }}"
+          IMG_NAME_IC_DEV="${IMAGE_PREFIX}ic-dev@${{ needs.ic-build-image.outputs.ic-dev-imageid }}"
 
           echo '${{ needs.build-image-prep.outputs.image_tag }}' > ci/container/TAG
           pushd .devcontainer
-          sed -i -E "s|(ghcr.io/)?$IMG_NAME(:\|@)[^\"]{5,}|$IMG_NAME_FULL|g" -- *
+          sed -i -E "s|${IMAGE_PREFIX}ic-dev(:\|@)[^\"]{5,}|$IMG_NAME_IC_DEV|g" -- *
           popd
           pushd .github
-          sed -i -E "s|(ghcr.io/)?$IMG_NAME(:\|@)[^\"]{5,}|$IMG_NAME_FULL|g" -- workflow*/*
+          sed -i -E "s|${IMAGE_PREFIX}ic-build(:\|@)[^\"]{5,}|$IMG_NAME_IC_BUILD|g" -- workflow*/*
           popd
 
           git config --global user.name "IDX GitHub Automation"
           git config --global user.email "<>"
           git add .
-          git commit -m 'Updating container image to ${{ needs.ic-build-image.outputs.imageid }}' -m 'Image tag: ${{ needs.build-image-prep.outputs.image_tag }}'
+          git commit \
+            -m 'Updating container images to tag: ${{ needs.build-image-prep.outputs.image_tag }}' \
+            -m 'ic-build: ${{ needs.ic-build-image.outputs.ic-build-imageid }}' \
+            -m 'ic-dev:   ${{ needs.ic-build-image.outputs.ic-dev-imageid }}'
           git push
 
       - name: Add PR Comment
@@ -145,8 +158,9 @@ jobs:
         with:
           script: |
             let message = 'Run URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\n\n'
-            message += 'New container image: `${{ needs.ic-build-image.outputs.imageid }}`\n'
-            message += 'New container tag: `${{ needs.build-image-prep.outputs.image_tag }}`'
+            message += 'New container images with tag: `${{ needs.build-image-prep.outputs.image_tag }}`\n'
+            message += 'ic-build: `${{ needs.ic-build-image.outputs.ic-build-imageid }}`\n'
+            message += 'ic-dev: `${{ needs.ic-build-image.outputs.ic-dev-imageid }}`\n'
 
             // Find existing comment from this workflow
             const comments = await github.rest.issues.listComments({

.github/workflows/container-scan-nightly.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on:
       labels: dind-large
     container:
-      image: ghcr.io/dfinity/ic-build@sha256:2e372158cdc56750ab57d4c770655c636fa5a9f80038a6b48768424b24430730
+      image: ghcr.io/dfinity/ic-build@sha256:18d23aef1f5e9e7e1eef94c32563f8ed15531ae79065bb00bb5206a643fc49fe
       options: >-
         -e NODE_NAME --privileged --cgroupns host --mount type=tmpfs,target="/tmp/containers"
     timeout-minutes: 60