Merge remote-tracking branch 'origin/develop' into feature/vertex-sto…

…re-overflow-mitigations

.dockerignore

@@ -62,7 +62,6 @@
 
 # node
 /**/node_modules/
-/**/package-lock.json
 /**/.yarn/
 /**/dist/
 

.github/actions/gradle-task/action.yml

@@ -11,13 +11,21 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - id: setup_version_properties
+      name: Setup version properties
+      uses: ./.github/actions/setup-version-properties
     - id: set_variables
+      env:
+        VERSION_BRANCH: ${{ steps.setup_version_properties.outputs.VERSION_BRANCH }}
+        VERSION_COMMIT: ${{ steps.setup_version_properties.outputs.VERSION_COMMIT }}
+        VERSION_DISPLAY: ${{ steps.setup_version_properties.outputs.VERSION_DISPLAY }}
+        VERSION_BUILD: ${{ steps.setup_version_properties.outputs.VERSION_BUILD }}
+        VERSION_TAG: ${{ steps.setup_version_properties.outputs.VERSION_TAG }}
+        VERSION_LAST_TAG: ${{ steps.setup_version_properties.outputs.VERSION_LAST_TAG }}
       run: |
         if [[ ${{ inputs.is_release }} == "false"  ]];then
           echo "Workflow triggered by push to a branch"
-          export CI_VERSION=true
         fi
-        version=$(./gradlew radixCiVersion | grep radixdlt-version | cut -d: -f2)
-        echo "Version: $version"
+        echo "Version: $VERSION_TAG"
         ./gradlew ${{ inputs.gradle_command }}
       shell: bash

.github/actions/setup-version-properties/action.yaml

@@ -0,0 +1,48 @@
+name: 'Setup version properties'
+description: 'Setup the github version properties'
+outputs:
+  VERSION_BRANCH:
+    description: The branch (if available) that triggered this build
+    value: ${{ steps.setup_version_properties.outputs.VERSION_BRANCH }}
+  VERSION_TAG:
+    description: The git tag (if applicable) that triggered the release
+    value: ${{ steps.setup_version_properties.outputs.VERSION_TAG }}
+  VERSION_COMMIT:
+    description: The full git commit hash
+    value: ${{ steps.setup_version_properties.outputs.VERSION_COMMIT }}
+  VERSION_BUILD:
+    description: The first 8 characters of the git commit hash
+    value: ${{ steps.setup_version_properties.outputs.VERSION_BUILD }}
+  VERSION_LAST_TAG:
+    description: The name of the last tag added.
+    value: ${{ steps.setup_version_properties.outputs.VERSION_LAST_TAG }}
+  VERSION_DISPLAY:
+    description: The display version for this build. If the build is triggered by a tag, then the tag is used. Otherwise, the version consists of $VERSION_LAST_TAG-$VERSION_BRANCH-$VERSION_BUILD
+    value: ${{ steps.setup_version_properties.outputs.VERSION_DISPLAY }}
+runs:
+  using: "composite"
+  steps:
+    - id: setup_version_properties
+      run: |
+        VERSION_BUILD=$(git rev-parse --short=8 HEAD | cut -c1-8)
+        VERSION_LAST_TAG=$(git tag --sort=-creatordate | head -n 1)
+        echo "VERSION_BUILD=$VERSION_BUILD" >> $GITHUB_OUTPUT
+        echo "VERSION_COMMIT=${GITHUB_SHA}" >> $GITHUB_OUTPUT
+        echo "VERSION_LAST_TAG=$VERSION_LAST_TAG" >> $GITHUB_OUTPUT
+        
+        if [[  $GITHUB_REF == *"refs/tags/"* ]]; then 
+          VERSION_TAG=$(echo $GITHUB_REF | cut -d'/' -f 3)
+          echo "VERSION_TAG=$VERSION_TAG" >> $GITHUB_OUTPUT
+          echo "VERSION_DISPLAY=$VERSION_TAG" >> $GITHUB_OUTPUT
+        else
+          VERSION_BRANCH=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}
+          echo "VERSION_BRANCH=$VERSION_BRANCH" >> $GITHUB_OUTPUT
+          echo "VERSION_DISPLAY=$VERSION_LAST_TAG-$VERSION_BRANCH-$VERSION_BUILD" >> $GITHUB_OUTPUT
+        fi
+        echo "VERSION_BRANCH: $VERSION_BRANCH"
+        echo "VERSION_COMMIT: $VERSION_COMMIT"
+        echo "VERSION_DISPLAY: $VERSION_DISPLAY"
+        echo "VERSION_BUILD: $VERSION_BUILD"
+        echo "VERSION_TAG: $VERSION_TAG"
+        echo "VERSION_LAST_TAG: $VERSION_LAST_TAG"
+      shell: bash

.github/pull_request_template.md

@@ -1,7 +1,7 @@
 > [!IMPORTANT]
 >
-> * Please read our [Contributing Guidelines](CONTRIBUTING.md) before opening a PR.
-> * Before creating your PR, please ensure you have used the _correct base branch_ as per the [branching strategy](/docs/branching-strategy.md), both for branching from, and in the PR UI above.
+> * Please read our [Contributing Guidelines](https://github.com/radixdlt/babylon-node/blob/main/CONTRIBUTING.md) before opening a PR.
+> * Before creating your PR, please ensure you have used the _correct base branch_ as per the [branching strategy](https://github.com/radixdlt/babylon-node/blob/main/docs/branching-strategy.md), both for branching from, and in the PR UI above.
 >   * For most code changes, this is `develop`.
 >   * For stand-alone docs changes, this is `main`.
 >   * For workflow changes, this is the oldest supported `release/*` branch. 
@@ -26,4 +26,4 @@
 
 > [!TIP]
 > 
-> Explain what testing / verification is done, including manual testing or automated testing.
+> Explain what testing / verification is done, including manual testing or automated testing.

.github/workflows/add-artifacts-to-release.yml

@@ -5,11 +5,27 @@ on:
     types: [published]
 
 jobs:
-
+  setup_version_properties:
+    name: Setup version properties
+    runs-on: ubuntu-latest
+    outputs:
+      VERSION_BRANCH: ${{ steps.setup_version_properties.outputs.VERSION_BRANCH }}
+      VERSION_BUILD: ${{ steps.setup_version_properties.outputs.VERSION_BUILD }}
+      VERSION_COMMIT: ${{ steps.setup_version_properties.outputs.VERSION_COMMIT }}
+      VERSION_DISPLAY: ${{ steps.setup_version_properties.outputs.VERSION_DISPLAY }}
+      VERSION_TAG: ${{ steps.setup_version_properties.outputs.VERSION_TAG }}
+      VERSION_LAST_TAG: ${{ steps.setup_version_properties.outputs.VERSION_LAST_TAG }}
+    steps:
+      - uses: RDXWorks-actions/checkout@main
+        with:
+          fetch-depth: 0
+      - name: Setup version properties
+        id: setup_version_properties
+        uses: ./.github/actions/setup-version-properties
   build-core-rust:
     continue-on-error: true
     runs-on: '${{ matrix.os }}'
-    timeout-minutes: 45
+    timeout-minutes: 60
     strategy:
       matrix:
         include:
@@ -93,6 +109,9 @@ jobs:
     if: github.event_name == 'release'
     needs: 
       - build-core-rust
+      - setup_version_properties
+    permissions:
+      contents: write
     runs-on: 'ubuntu-latest'
     continue-on-error: true
     strategy:
@@ -127,34 +146,30 @@ jobs:
       - name: Build core-rust
         run: |
           ls -lah libcorerust-${{ matrix.target }}
-          zip -j babylon-node-rust-${{ matrix.zipname }}-release-${{ github.event.release.tag_name }}.zip libcorerust-${{ matrix.target }}/${{ matrix.artifact }}
-      - if: github.event_name == 'release'
-        id: get_version
-        name: Get radixdlt version
-        uses: ./.github/actions/get-version
-        with:
-          is_release: true      
+          zip -j babylon-node-rust-${{ matrix.zipname }}-release-${{ needs.setup_version_properties.outputs.VERSION_TAG }}.zip libcorerust-${{ matrix.target }}/${{ matrix.artifact }}
 
       - name: Upload distribution zip
         if: github.event_name == 'release'
         uses: RDXWorks-actions/action-gh-release@master
         with:
           files: |
-            babylon-node-rust-${{ matrix.zipname }}-release-${{ github.event.release.tag_name }}.zip
-      
-
+            babylon-node-rust-${{ matrix.zipname }}-release-${{ needs.setup_version_properties.outputs.VERSION_TAG }}.zip
 
   publish-distribution-zip:
     if: github.event_name == 'release'
     name: Build and Upload Application Binary
+    permissions:
+      contents: write
     runs-on: ubuntu-22.04
+    needs:
+      - setup_version_properties
     environment: publish-artifacts
     steps:
       - name: Dump context
         uses: RDXWorks-actions/ghaction-dump-context@master
       - uses: RDXWorks-actions/checkout@main
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ needs.setup_version_properties.outputs.VERSION_TAG }}
           fetch-depth: 0
       - name: Set up JDK 17
         uses: RDXWorks-actions/setup-java@main
@@ -175,20 +190,15 @@ jobs:
         with:
           is_release: true
           gradle_command: clean build -x test
-      - id: get_version
-        name: Get radixdlt version
-        uses: ./.github/actions/get-version
-        with:
-          is_release: true
       - name: List files
         run: |
           ls -la ./core/build/distributions/
-          mv ./core/build/distributions/core-${{ steps.get_version.outputs.radixdlt_version }}.zip babylon-node-${{ steps.get_version.outputs.radixdlt_version }}.zip
+          mv ./core/build/distributions/core-${{ needs.setup_version_properties.outputs.VERSION_TAG }}.zip babylon-node-${{ needs.setup_version_properties.outputs.VERSION_TAG }}.zip
       - name: Upload distribution zip
         uses: RDXWorks-actions/action-gh-release@master
         with:
           files: |
-            babylon-node-${{ steps.get_version.outputs.radixdlt_version }}.zip
+            babylon-node-${{ needs.setup_version_properties.outputs.VERSION_TAG }}.zip
 
   snyk-sbom:
     if: github.event_name == 'release'
@@ -208,7 +218,7 @@ jobs:
       - name: Generate SBOM
         uses: RDXWorks-actions/snyk-actions/gradle-jdk17@master
         with:
-          args: --all-projects --org=${{ env.SNYK_NETWORK_ORG_ID }} --format=cyclonedx1.4+json --json-file-output sbom.json
+          args: --all-projects --org=${{ env.SNYK_NETWORK_ORG_ID }} --format=cyclonedx1.4+json > sbom.json
           command: sbom
       - name: Upload SBOM
         uses: RDXWorks-actions/action-gh-release@master

.github/workflows/ci.yml

@@ -79,7 +79,7 @@ jobs:
       - name: Generate SBOM # check SBOM can be generated but nothing is done with it
         uses: RDXWorks-actions/snyk-actions/gradle-jdk17@master
         with:
-          args: --all-projects --org=${{ env.SNYK_NETWORK_ORG_ID }} --format=cyclonedx1.4+json --json-file-output sbom.json
+          args: --all-projects --org=${{ env.SNYK_NETWORK_ORG_ID }} --format=cyclonedx1.4+json > sbom.json
           command: sbom
   build:
     name: Unit tests and sonarqube
@@ -94,7 +94,8 @@ jobs:
           fetch-depth: 0
       - uses: RDXWorks-actions/rust-toolchain@master
         with:
-          toolchain: stable
+          toolchain: 1.77.2
+          default: true
       - name: Set up JDK 17
         uses: RDXWorks-actions/setup-java@main
         with:
@@ -122,6 +123,25 @@ jobs:
         env:
           RADIXDLT_LOG_LEVEL: error
         run: ./gradlew clean check jacocoTestReport --stacktrace --refresh-dependencies
+      - name: Install cargo-llvm-cov
+        uses: RDXWorks-actions/install-action@cargo-llvm-cov
+      - uses: radixdlt/public-iac-resuable-artifacts/fetch-secrets@main
+        with:
+          role_name: ${{ secrets.COMMON_SECRETS_ROLE_ARN }}
+          app_name: "babylon-node"
+          step_name: "codecoverage"
+          secret_prefix: "CODECOV"
+          secret_name: ${{ secrets.AWS_SECRET_NAME_CODECOV }}
+          parse_json: true
+      - name: Generate Code Coverage
+        run: cd core-rust && cargo llvm-cov --lcov --output-path lcov.info && cd ..
+      - name: Upload to codecov.io
+        uses: RDXWorks-actions/codecov-action@main
+        with:
+          fail_ci_if_error: true
+          file: ./core-rust/lcov.info
+          name: codecov-rust
+          flags: rust
       - name: DistZip
         run: ./gradlew distZip
       - name: Publish Java distZip
@@ -154,7 +174,8 @@ jobs:
           fetch-depth: 0
       - uses: RDXWorks-actions/rust-toolchain@master
         with:
-          toolchain: stable
+          toolchain: 1.77.2
+          default: true
       - name: Set up JDK 17
         uses: RDXWorks-actions/setup-java@main
         with:
@@ -178,7 +199,8 @@ jobs:
           fetch-depth: 0
       - uses: RDXWorks-actions/rust-toolchain@master
         with:
-          toolchain: stable
+          toolchain: 1.77.2
+          default: true
       - name: Set up JDK 17
         uses: RDXWorks-actions/setup-java@main
         with:
@@ -206,7 +228,8 @@ jobs:
           fetch-depth: 0
       - uses: RDXWorks-actions/rust-toolchain@master
         with:
-          toolchain: stable
+          toolchain: 1.77.2
+          default: true
       - name: Set up JDK 17
         uses: RDXWorks-actions/setup-java@main
         with:
@@ -233,10 +256,11 @@ jobs:
           fetch-depth: 1
       - uses: RDXWorks-actions/rust-toolchain@master
         with:
-          toolchain: stable
+          toolchain: 1.77.2
+          default: true
           targets: x86_64-pc-windows-msvc
-      - name: Update clang version to 16
-        run: sudo apt remove clang-14 && sudo apt autoclean && sudo apt autoremove && wget https://apt.llvm.org/llvm.sh && chmod +x llvm.sh && sudo ./llvm.sh 16 && sudo ls /usr/bin/ | grep clang && sudo ln -sf /usr/bin/clang-16 /usr/bin/clang && sudo ln -sf /usr/bin/clang++-16 /usr/bin/clang++ && sudo apt-get install -y libclang-dev llvm llvm-dev
+      - name: Update clang version to 17
+        run: sudo apt remove clang-14 && sudo apt autoclean && sudo apt autoremove && wget https://apt.llvm.org/llvm.sh && chmod +x llvm.sh && sudo ./llvm.sh 17 && sudo ls /usr/bin/ | grep clang && sudo ln -sf /usr/bin/clang-17 /usr/bin/clang && sudo ln -sf /usr/bin/clang++-17 /usr/bin/clang++ && sudo apt-get install -y libclang-dev llvm llvm-dev
       - name: Install cargo-xwin
         run: cargo install cargo-xwin
       - name: cross compile to windows

.github/workflows/deploy-and-smoke-test.yaml

@@ -33,6 +33,12 @@ jobs:
           secret_prefix: "JENKINS"
           secret_name: "github-actions/radixdlt/babylon-node/jenkins-api-token"
           parse_json: true
+      - name: Connect to tailnet
+        uses: radixdlt/public-iac-resuable-artifacts/tailnet@main
+        with:
+          role_name: "arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access"
+          region: "eu-west-2"
+          secret_name: "arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/tailscale-public-workflows-DpiE80"
       - name: Deploy
         uses: RDXWorks-actions/jenkins-job-trigger-action@master
         with:
@@ -68,6 +74,12 @@ jobs:
           secret_prefix: "JENKINS"
           secret_name: "github-actions/radixdlt/babylon-node/jenkins-api-token"
           parse_json: true
+      - name: Connect to tailnet
+        uses: radixdlt/public-iac-resuable-artifacts/tailnet@main
+        with:
+          role_name: "arn:aws:iam::${{ secrets.SECRETS_ACCOUNT_ID }}:role/gh-common-secrets-read-access"
+          region: "eu-west-2"
+          secret_name: "arn:aws:secretsmanager:eu-west-2:${{ secrets.SECRETS_ACCOUNT_ID }}:secret:github-actions/common/tailscale-public-workflows-DpiE80"
       - name: SmokeTests
         uses: RDXWorks-actions/jenkins-job-trigger-action@master
         with: