Merge branch 'master' into tsv-disabling

Author: tdimitrov

.github/pr-custom-review.yml

@@ -9,7 +9,7 @@ rules:
         - ^\.config/nextest.toml
         - ^\.cargo/.*
       exclude: 
-        - ^./gitlab/pipeline/zombienet.*
+        - ^\.gitlab/pipeline/zombienet.*
     minApprovals: 2
     type: basic
     teams:

.github/review-bot.yml

@@ -3,7 +3,7 @@ name: Build and Attach Runtimes to Releases/RC
 on:
   release:
     types:
-      - created
+      - published
 
 env:
   PROFILE: production
@@ -44,12 +44,6 @@ jobs:
         runtime_dir: ${{ matrix.runtime.path }}
         profile: ${{ env.PROFILE }}
 
-    - name: Build Summary
-      run: |
-        echo "${{ steps.srtool_build.outputs.json }}" | jq . > ${{ matrix.runtime.name }}-srtool-digest.json
-        cat ${{ matrix.runtime.name }}-srtool-digest.json
-        echo "Runtime location: ${{ steps.srtool_build.outputs.wasm }}"
-
     - name: Set up paths and runtime names
       id: setup
       run: |

.github/workflows/build-and-attach-release-runtimes.yml

@@ -10,10 +10,7 @@ on:
 
 jobs:
   check-publish:
-    strategy:
-      matrix:
-        os: ["ubuntu-latest"]
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
 
@@ -23,7 +20,7 @@ jobs:
           cache-on-failure: true
 
       - name: install parity-publish
-        run: cargo install parity-publish --profile dev
+        run: cargo install parity-publish@0.3.0
 
       - name: parity-publish check
         run: parity-publish check --allow-unpublished

.github/workflows/check-publish.yml

@@ -18,7 +18,7 @@ jobs:
           cache-on-failure: true
 
       - name: install parity-publish
-        run: cargo install parity-publish@0.2.0
+        run: cargo install parity-publish@0.3.0
 
       - name: parity-publish claim
         env:

.github/workflows/claim-crates.yml

@@ -13,8 +13,19 @@ on:
       - unlocked
       - ready_for_review
       - reopened
+  # the job doesn't check out any code, so it is relatively safe to run it on any event
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - unlocked
+      - ready_for_review
+      - reopened
   merge_group:
 
+# drop all permissions for GITHUB_TOKEN
+permissions: {}
+
 jobs:
   sync:
     runs-on: ubuntu-latest

.github/workflows/gitspiegel-trigger.yml

@@ -0,0 +1,24 @@
+name: Merge-Queue
+
+on:
+  merge_group:
+
+jobs:
+  trigger-merge-queue-action:
+    runs-on: ubuntu-latest
+    environment: master
+    steps:
+      - name: Generate token
+        id: app_token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+        with:
+          app_id: ${{ secrets.REVIEW_APP_ID }}
+          private_key: ${{ secrets.REVIEW_APP_KEY }}
+      - name: Add Merge Queue status check
+        uses: billyjbryant/create-status-check@3e6fa0ac599d10d9588cf9516ca4330ef669b858 # v2
+        with:
+          authToken: ${{ steps.app_token.outputs.token }}
+          context: 'review-bot'
+          description: 'PRs for merge queue gets approved'
+          state: 'success'
+          sha: ${{ github.event.merge_group.head_commit.id }}

.github/workflows/merge-queue.yml

@@ -268,7 +268,7 @@ jobs:
 
       - name: Build and push
         id:   docker_build
-        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 #  v5.0.0
+        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 #  v5.1.0
         with:
           push: true
           file: docker/dockerfiles/polkadot/polkadot_injected_debian.Dockerfile

.github/workflows/pr-custom-review.yml

@@ -30,8 +30,7 @@ variables:
   RUSTY_CACHIER_COMPRESSION_METHOD: zstd
   NEXTEST_FAILURE_OUTPUT: immediate-final
   NEXTEST_SUCCESS_OUTPUT: final
-  ZOMBIENET_IMAGE: "docker.io/paritytech/zombienet:v1.3.79"
-  DOCKER_IMAGES_VERSION: "${CI_COMMIT_SHA}"
+  DOCKER_IMAGES_VERSION: "${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHORT_SHA}"
 
 default:
   retry:
@@ -70,7 +69,6 @@ default:
 .common-before-script:
   before_script:
     - !reference [.job-switcher, before_script]
-    - !reference [.timestamp, before_script]
     - !reference [.pipeline-stopper-vars, script]
 
 .job-switcher:
@@ -199,9 +197,6 @@ default:
     - if: $CI_COMMIT_REF_NAME =~ /^[0-9]+$/ # PRs
     - if: $CI_COMMIT_REF_NAME =~ /^gh-readonly-queue.*$/ # merge queues
 
-.zombienet-refs:
-  extends: .build-refs
-
 include:
   # check jobs
   - .gitlab/pipeline/check.yml
@@ -215,10 +210,6 @@ include:
   - .gitlab/pipeline/publish.yml
   # zombienet jobs
   - .gitlab/pipeline/zombienet.yml
-  # timestamp handler
-  - project: parity/infrastructure/ci_cd/shared
-    ref: v0.2
-    file: /common/timestamp.yml
   # ci image
   - project: parity/infrastructure/ci_cd/shared
     ref: main