Merge branch 'main' into estimate-cli-network-from-url

.github/actions/fullnode-sync/action.yaml

@@ -27,11 +27,6 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Install Dependencies
-      shell: bash
-      run: |
-        echo "${HOME}/bin/" >> $GITHUB_PATH # default INSTALL_DIR to path
-        scripts/dev_setup.sh -b # Install dependencies
     - name: Run fullnode sync
       shell: bash
       run: |

.github/actions/rust-smoke-tests/action.yaml

@@ -28,7 +28,7 @@ runs:
     # We always try to create the artifact, but it only creates on flaky or failed smoke tests -- when the directories are empty.
     - name: Upload smoke test logs for failed and flaky tests
       if: ${{ failure() || success() }}
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: failed-smoke-test-logs
         # Retain all smoke test data except for the db (which may be large).

.github/workflows/backport-to-release-branches.yaml

@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   permission-check:
+    if: github.event.pull_request.merged == true && contains(join(github.event.pull_request.labels.*.name, ','), 'v1.')
     runs-on: ubuntu-latest
     steps:
       - name: Check repository permission for user which triggered workflow

.github/workflows/cli-release.yaml

@@ -30,7 +30,7 @@ jobs:
           ref: ${{ github.event.inputs.source_git_ref_override }}
       - uses: aptos-labs/aptos-core/.github/actions/rust-setup@main
       - name: Build CLI
-        run: scripts/cli/build_cli_release.sh "Ubuntu"
+        run: scripts/cli/build_cli_release.sh "Ubuntu" "${{inputs.release_version}}"
       - name: Upload Binary
         uses: actions/upload-artifact@v4
         with:
@@ -46,7 +46,7 @@ jobs:
           ref: ${{ github.event.inputs.source_git_ref_override }}
       - uses: aptos-labs/aptos-core/.github/actions/rust-setup@main
       - name: Build CLI
-        run: scripts/cli/build_cli_release.sh "Ubuntu-22.04"
+        run: scripts/cli/build_cli_release.sh "Ubuntu-22.04" "${{inputs.release_version}}"
       - name: Upload Binary
         uses: actions/upload-artifact@v4
         with:

.github/workflows/fullnode-fast-devnet-main.yaml

@@ -0,0 +1,34 @@
+# This workflow runs a public fullnode using the `main` branch,
+# connects the public fullnode to `devnet` and synchronizes the
+# node using fast syncing to verify that nothing has been broken.
+
+name: "fullnode-fast-devnet-main"
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 2 * * *" # Once a day, at 02:00 (UTC)
+
+permissions:
+  contents: read
+  id-token: write
+  actions: write #required for workflow cancellation via check-aptos-core
+
+jobs:
+  check-repo:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aptos-labs/aptos-core/.github/actions/check-aptos-core@main
+        with:
+          cancel-workflow: ${{ github.event_name == 'schedule' }} # Cancel the workflow if it is scheduled on a fork
+
+  fullnode-fast-devnet-main:
+    needs: check-repo
+    uses: ./.github/workflows/run-fullnode-sync.yaml
+    secrets: inherit
+    with:
+      TEST_NAME: fullnode-fast-devnet-main
+      GIT_REF: main
+      NETWORK: devnet
+      BOOTSTRAPPING_MODE: DownloadLatestStates
+      CONTINUOUS_SYNCING_MODE: ExecuteTransactions

.github/workflows/fullnode-fast-devnet-stable.yaml

@@ -0,0 +1,34 @@
+# This workflow runs a public fullnode using the `devnet` branch,
+# connects the public fullnode to `devnet` and synchronizes the
+# node using fast syncing to verify that nothing has been broken.
+
+name: "fullnode-fast-devnet-stable"
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "30 2 */3 * *" # Once every three days, at 02:30 (UTC)
+
+permissions:
+  contents: read
+  id-token: write
+  actions: write #required for workflow cancellation via check-aptos-core
+
+jobs:
+  check-repo:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aptos-labs/aptos-core/.github/actions/check-aptos-core@main
+        with:
+          cancel-workflow: ${{ github.event_name == 'schedule' }} # Cancel the workflow if it is scheduled on a fork
+
+  fullnode-fast-devnet-stable:
+    needs: check-repo
+    uses: ./.github/workflows/run-fullnode-sync.yaml
+    secrets: inherit
+    with:
+      TEST_NAME: fullnode-fast-devnet-stable
+      GIT_REF: devnet
+      NETWORK: devnet
+      BOOTSTRAPPING_MODE: DownloadLatestStates
+      CONTINUOUS_SYNCING_MODE: ExecuteTransactions

.github/workflows/module-verify.yaml

@@ -48,7 +48,7 @@ jobs:
     secrets: inherit
     with:
       GIT_SHA: ${{ inputs.GIT_SHA }}
-      BUCKET: aptos-mainnet-backup-backup-831a69a8
+      BUCKET: aptos-mainnet-backup-backup-6addc21b
       SUB_DIR: e1
       BACKUP_CONFIG_TEMPLATE_PATH: terraform/helm/fullnode/files/backup/s3-public.yaml
       # workflow config

.github/workflows/replay-verify.yaml

@@ -72,7 +72,7 @@ jobs:
       BACKUP_CONFIG_TEMPLATE_PATH: terraform/helm/fullnode/files/backup/gcs.yaml
       # workflow config
       RUNS_ON: "high-perf-docker-with-local-ssd"
-      TIMEOUT_MINUTES: 240
+      TIMEOUT_MINUTES: 180
       MAX_VERSIONS_PER_RANGE: 2000000
 
   replay-mainnet:
@@ -96,7 +96,7 @@ jobs:
       BACKUP_CONFIG_TEMPLATE_PATH: terraform/helm/fullnode/files/backup/gcs.yaml
       # workflow config
       RUNS_ON: "high-perf-docker-with-local-ssd"
-      TIMEOUT_MINUTES: 240
+      TIMEOUT_MINUTES: 180
       MAX_VERSIONS_PER_RANGE: 800000
 
   test-replay:

.github/workflows/run-fullnode-sync.yaml

@@ -57,7 +57,7 @@ on:
 
 jobs:
   fullnode-sync:
-    runs-on: medium-perf-docker-with-local-ssd
+    runs-on: runs-on,family=c5ad.8xlarge,image=aptos-ubuntu-x64,run-id=${{ github.run_id }},spot=false
     timeout-minutes: ${{ inputs.TIMEOUT_MINUTES || 300 }} # the default run is 300 minutes (5 hours). Specified here because workflow_dispatch uses string rather than number
     steps:
       - uses: actions/checkout@v4
@@ -68,17 +68,17 @@ jobs:
           NETWORK: ${{ inputs.NETWORK }}
           BOOTSTRAPPING_MODE: ${{ inputs.BOOTSTRAPPING_MODE }}
           CONTINUOUS_SYNCING_MODE: ${{ inputs.CONTINUOUS_SYNCING_MODE }}
-          DATA_DIR_FILE_PATH: /tmp/
-          NODE_LOG_FILE_PATH: /tmp/node_log
-          METRICS_DUMP_FILE_PATH: /tmp/metrics
+          DATA_DIR_FILE_PATH: ${{ runner.temp }}/
+          NODE_LOG_FILE_PATH: ${{ runner.temp }}/node_log
+          METRICS_DUMP_FILE_PATH: ${{ runner.temp }}/metrics
 
       - name: Upload node logs as an artifact
         uses: actions/upload-artifact@v4
         if: ${{ always() }}
         with:
           name: node_log
           path: |
-            /tmp/node_log
+            ${{ runner.temp }}/node_log
           retention-days: 14
 
       - name: Upload the metrics dump as an artifact
@@ -87,7 +87,7 @@ jobs:
         with:
           name: metrics
           path: |
-            /tmp/metrics
+            ${{ runner.temp }}/metrics
           retention-days: 14
 
       - name: Post to a Slack channel on failure

.github/workflows/trigger-release-branch-validation.yaml

@@ -0,0 +1,36 @@
+name: Trigger Validation Tests on Release Branch Cut
+
+on:
+  create:
+
+jobs:
+  check-branch-prefix:
+    runs-on: ubuntu-latest
+    outputs:
+      branch_matches: ${{ steps.check-prefix.outputs.branch_matches }}
+    steps:
+      - name: Check if the branch starts with 'aptos-release'
+        id: check-prefix
+        run: |
+          if [[ "${{ github.ref }}" == refs/heads/aptos-release-* ]]; then
+            echo "branch_matches=true" >> $GITHUB_OUTPUT
+          else
+            echo "branch_matches=false" >> $GITHUB_OUTPUT
+          fi
+
+  trigger-forge-stable:
+    needs: check-branch-prefix
+    if: needs.check-branch-prefix.outputs.branch_matches == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Forge Stable Workflow'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'forge-stable.yaml',
+              ref: context.ref,
+            });
+            console.log('Triggered Forge Stable Workflow on %s', context.ref);

.github/workflows/workflow-run-forge.yaml

@@ -122,7 +122,7 @@ env:
   VERBOSE: true
   FORGE_NUM_VALIDATORS: ${{ inputs.FORGE_NUM_VALIDATORS }}
   FORGE_NUM_VALIDATOR_FULLNODES: ${{ inputs.FORGE_NUM_VALIDATOR_FULLNODES }}
-  FORGE_JUNIT_XML_PATH: ${{ inputs.SEND_RESULTS_TO_TRUNK && '/tmp/test.xml' || '' }}
+  # FORGE_JUNIT_XML_PATH: ${{ inputs.SEND_RESULTS_TO_TRUNK && '/tmp/test.xml' || '' }}
 
 # TODO: should we migrate this to a composite action, so that we can skip it
 # at the call site, and don't need to wrap each step in an if statement?
@@ -185,6 +185,33 @@ jobs:
         shell: bash
         run: gcloud config set project aptos-forge-gcp-0
 
+      - name: Check for Forge images
+        if: ${{ !inputs.SKIP_JOB }}
+        id: check-forge-images
+        run: |
+          check_image_exists() {
+            local tag=$1
+            local image_name=$2
+            local output_prefix=$3
+            if [[ -n "$tag" ]]; then
+              if docker manifest inspect us-docker.pkg.dev/aptos-registry/docker/${image_name}:${tag} &> /dev/null; then
+                echo "${output_prefix}_EXISTS=true" >> $GITHUB_OUTPUT
+                echo "${output_prefix}_TAG=$tag" >> $GITHUB_OUTPUT
+                echo "✅ $image_name image found for tag: $tag" >> $GITHUB_STEP_SUMMARY
+              else
+                echo "${output_prefix}_EXISTS=false" >> $GITHUB_OUTPUT
+                echo "⚠️ No $image_name image found for tag: $tag. The latest available image will be used instead." >> $GITHUB_STEP_SUMMARY
+              fi
+            fi
+          }
+
+          check_image_exists "${{ inputs.GIT_SHA }}" "validator" "VALIDATOR_GIT_SHA"
+          check_image_exists "${{ inputs.IMAGE_TAG }}" "validator" "VALIDATOR_IMAGE_TAG"
+          check_image_exists "${{ inputs.GIT_SHA }}" "forge" "FORGE_GIT_SHA"
+          check_image_exists "${{ inputs.FORGE_IMAGE_TAG }}" "forge" "FORGE_IMAGE_TAG"
+
+          echo "ℹ️ If testing Forge changes, ensure the 'CICD: build-images' label is added to your PR and the image build workflow has completed successfully." >> $GITHUB_STEP_SUMMARY
+
       - name: Run pre-Forge checks
         if: ${{ !inputs.SKIP_JOB }}
         shell: bash
@@ -234,13 +261,14 @@ jobs:
       - run: echo "Skipping forge test!"
         if: ${{ inputs.SKIP_JOB }}
 
-      - name: Upload results
-        # Run this step even if the test step ahead fails
-        if: ${{ !inputs.SKIP_JOB && inputs.SEND_RESULTS_TO_TRUNK && !cancelled() }}
-        uses: trunk-io/analytics-uploader@main
-        with:
-          # Configured in the nextest.toml file
-          junit-paths: ${{ env.FORGE_JUNIT_XML_PATH }}
-          org-slug: aptoslabs
-          token: ${{ secrets.TRUNK_API_TOKEN }}
-        continue-on-error: true
+      # TEMP disable till fixed
+      # - name: Upload results
+      #   # Run this step even if the test step ahead fails
+      #   if: ${{ !inputs.SKIP_JOB && inputs.SEND_RESULTS_TO_TRUNK && !cancelled() }}
+      #   uses: trunk-io/analytics-uploader@main
+      #   with:
+      #     # Configured in the nextest.toml file
+      #     junit-paths: ${{ env.FORGE_JUNIT_XML_PATH }}
+      #     org-slug: aptoslabs
+      #     token: ${{ secrets.TRUNK_API_TOKEN }}
+      #   continue-on-error: true

CODEOWNERS

@@ -61,7 +61,7 @@
 /crates/aptos-open-api @banool @gregnazario
 
 # Owners for the aptos-protos crate
-/crates/aptos-protos @banool @bowenyang007 @jillxuu @larry-aptos @rtso
+/crates/aptos-protos @banool @bowenyang007 @jillxuu @larry-aptos @rtso  @aptos-labs/ecosystem-infra
 
 /crates/aptos-rest-client @banool @gregnazario