Capabilities development

.changeset/modern-planets-bake.md

@@ -0,0 +1,5 @@
+---
+"@chainlink/job-distributor": minor
+---
+
+Add CHAIN_TYPE_STELLAR to the node ChainType enum

.github/CODEOWNERS

@@ -12,7 +12,7 @@
 # CRE
 /cre/ @smartcontractkit/keystone @smartcontractkit/op-tooling
 /cre/capabilities/blockchain/ @smartcontractkit/bix-framework @smartcontractkit/keystone @smartcontractkit/op-tooling
-/cre/go/installer/pkg/embedded_gen.go @smartcontractkit/bix-framework @smartcontractkit/keystone @smartcontractkit/op-tooling
+/cre/go/installer/pkg/embedded_gen.go @smartcontractkit/bix-framework @smartcontractkit/keystone @smartcontractkit/op-tooling @smartcontractkit/privacy
 
 /workflows/ @smartcontractkit/foundations @smartcontractkit/core @smartcontractkit/op-tooling
 /billing/ @smartcontractkit/cre-business @smartcontractkit/core @smartcontractkit/op-tooling
@@ -22,8 +22,10 @@
 
 #CRE Privacy
 /cre/capabilities/networking/confidentialhttp @smartcontractkit/privacy @smartcontractkit/op-tooling
+/cre/capabilities/compute/confidentialworkflow @smartcontractkit/privacy @smartcontractkit/op-tooling
 
 # Data
+/data-feeds/ @smartcontractkit/data-feeds-engineers @smartcontractkit/op-tooling
 /svr/ @smartcontractkit/oev @smartcontractkit/op-tooling
 
 # Ring

.github/scripts/verify-cre-proto-subset-of-capdev.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# Verify PR cre/ proto changes are already present on capabilities-development.
+#
+# Usage (from repo root, on a PR branch):
+#   bash ./.github/scripts/verify-cre-proto-subset-of-capdev.sh
+
+set -euo pipefail
+
+BASE_BRANCH="${BASE_BRANCH:-main}"
+CAP_DEV_BRANCH="${CAP_DEV_BRANCH:-capabilities-development}"
+# When set to 1 (CI fallback after patch-id failure), fail if the PR has no proto changes.
+REQUIRE_PROTO_CHANGES="${REQUIRE_PROTO_CHANGES:-0}"
+
+git fetch origin "${BASE_BRANCH}" "${CAP_DEV_BRANCH}" --quiet
+
+PROTO_FILES=$(git diff --name-only "origin/${BASE_BRANCH}...HEAD" -- 'cre/**/*.proto' || true)
+
+if [[ -z "${PROTO_FILES}" ]]; then
+  if [[ "${REQUIRE_PROTO_CHANGES}" == "1" ]]; then
+    echo "::error::Patch-id check failed and PR has no cre/**/*.proto changes for subset fallback."
+    exit 1
+  fi
+  echo "No cre/ proto files changed in PR. Subset check skipped."
+  exit 0
+fi
+
+echo "Checking proto file(s) against origin/${CAP_DEV_BRANCH}..."
+echo ""
+
+WORKDIR=$(mktemp -d)
+trap 'rm -rf "$WORKDIR"' EXIT
+
+fail() {
+  echo "::error::$1"
+  exit 1
+}
+
+extract_block() {
+  local file=$1 kind=$2 name=$3
+  awk -v kind="$kind" -v name="$name" '
+    $1 == kind && $2 == name {
+      depth = 0
+      in_block = 1
+    }
+    in_block {
+      print
+      if ($0 ~ /{/) depth++
+      if ($0 ~ /}/) {
+        depth--
+        if (depth == 0) { exit }
+      }
+    }
+  ' "$file"
+}
+
+field_lines() {
+  grep -E '^\s*(repeated\s+)?[A-Za-z0-9_.]+\s+[A-Za-z0-9_]+\s*=\s*[0-9]+;' || true
+}
+
+check_proto_subset() {
+  local rel=$1
+  local pr_file=$2
+  local cap_file=$3
+
+  echo "  file: ${rel}"
+
+  while IFS= read -r rpc_line; do
+    [[ -z "$rpc_line" ]] && continue
+    grep -qF "$rpc_line" "$cap_file" || fail "${rel}: RPC missing on ${CAP_DEV_BRANCH}: ${rpc_line}"
+  done <<EOF
+$(grep -E '^\s+rpc ' "$pr_file" || true)
+EOF
+
+  while IFS= read -r enum_name; do
+    [[ -z "$enum_name" ]] && continue
+    extract_block "$cap_file" enum "$enum_name" >/dev/null || \
+      fail "${rel}: enum missing on ${CAP_DEV_BRANCH}: ${enum_name}"
+
+    while IFS= read -r val_line; do
+      [[ -z "$val_line" ]] && continue
+      grep -qF "$val_line" "$cap_file" || \
+        fail "${rel}: enum value missing on ${CAP_DEV_BRANCH} (${enum_name}): ${val_line}"
+    done <<EOF
+$(extract_block "$pr_file" enum "$enum_name" | grep -E '^\s*[A-Z0-9_]+\s*=' || true)
+EOF
+  done <<EOF
+$(grep -E '^enum ' "$pr_file" | awk '{print $2}' || true)
+EOF
+
+  while IFS= read -r msg_name; do
+    [[ -z "$msg_name" ]] && continue
+    extract_block "$cap_file" message "$msg_name" >/dev/null || \
+      fail "${rel}: message missing on ${CAP_DEV_BRANCH}: ${msg_name}"
+
+    while IFS= read -r field_line; do
+      [[ -z "$field_line" ]] && continue
+      grep -qF "$field_line" "$cap_file" || \
+        fail "${rel}: field missing on ${CAP_DEV_BRANCH} (${msg_name}): ${field_line}"
+    done <<EOF
+$(extract_block "$pr_file" message "$msg_name" | field_lines)
+EOF
+  done <<EOF
+$(grep -E '^message ' "$pr_file" | awk '{print $2}' || true)
+EOF
+
+  echo "  OK"
+}
+
+while IFS= read -r rel; do
+  [[ -z "$rel" ]] && continue
+
+  if ! git cat-file -e "origin/${CAP_DEV_BRANCH}:${rel}" 2>/dev/null; then
+    fail "${rel} does not exist on origin/${CAP_DEV_BRANCH}"
+  fi
+
+  git show "HEAD:${rel}" > "${WORKDIR}/pr.proto"
+  git show "origin/${CAP_DEV_BRANCH}:${rel}" > "${WORKDIR}/cap.proto"
+
+  check_proto_subset "$rel" "${WORKDIR}/pr.proto" "${WORKDIR}/cap.proto"
+  echo ""
+done <<EOF
+${PROTO_FILES}
+EOF
+
+echo "All PR proto changes are present on origin/${CAP_DEV_BRANCH}."
+exit 0

.github/workflows/cre-branch-protection.yml

@@ -0,0 +1,96 @@
+name: CRE branch protection
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  check-cre-target-branch:
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Enforce CRE changes target capabilities-development
+        env:
+          TARGET_BRANCH: ${{ github.base_ref }}
+        run: |
+          git fetch origin "${TARGET_BRANCH}" --quiet 2>/dev/null || true
+
+          CRE_CHANGED=$(git diff --name-only "origin/${TARGET_BRANCH}...HEAD" -- cre/)
+
+          if [[ -z "$CRE_CHANGED" ]]; then
+            echo "No cre/ files modified. Skipping branch check."
+            exit 0
+          fi
+
+          echo "The following cre/ files are modified in this PR:"
+          echo "$CRE_CHANGED"
+          echo ""
+
+          echo "PR targets 'main' and contains cre/ changes."
+          echo "Verifying all CRE-modifying commits are cherry-picks from capabilities-development..."
+          echo ""
+
+          if ! git fetch origin capabilities-development --quiet 2>/dev/null; then
+            echo "::error::Could not fetch the 'capabilities-development' branch. Ensure it exists on the remote."
+            echo "::error::CRE changes must target 'capabilities-development' or be cherry-picks of commits already in that branch."
+            exit 1
+          fi
+
+          # Precompute patch-ids for all CRE-touching commits in capabilities-development
+          CAP_PATCH_IDS=$(mktemp)
+          git log --format=%H origin/capabilities-development -- cre/ | while read -r cap_commit; do
+            git show "$cap_commit" -- cre/ | git patch-id --stable 2>/dev/null | awk '{print $1}'
+          done | sort -u > "$CAP_PATCH_IDS"
+
+          CAP_COUNT=$(wc -l < "$CAP_PATCH_IDS" | tr -d ' ')
+          echo "Found ${CAP_COUNT} unique CRE patch-ids in capabilities-development."
+          echo ""
+
+          # Check each PR commit that touches cre/
+          FAILURES=$(mktemp)
+          git log --format=%H "origin/${TARGET_BRANCH}..HEAD" -- cre/ | while read -r commit; do
+            PATCH_ID=$(git show "$commit" -- cre/ | git patch-id --stable 2>/dev/null | awk '{print $1}')
+
+            if [ -z "$PATCH_ID" ]; then
+              continue
+            fi
+
+            if ! grep -qF "$PATCH_ID" "$CAP_PATCH_IDS"; then
+              git log -1 --format='%h %s' "$commit" >> "$FAILURES"
+            fi
+          done
+
+          if [ -s "$FAILURES" ]; then
+            echo "::error::The following commits modify cre/ but are not cherry-picks of commits in capabilities-development:"
+            echo ""
+            while IFS= read -r line; do
+              echo "  - ${line}"
+            done < "$FAILURES"
+            echo ""
+            echo "Trying proto subset fallback (PR cre/**/*.proto vs capabilities-development)..."
+            echo ""
+
+            if BASE_BRANCH="${TARGET_BRANCH}" REQUIRE_PROTO_CHANGES=1 \
+              bash .github/scripts/verify-cre-proto-subset-of-capdev.sh; then
+              echo "Fallback passed: PR proto changes exist on capabilities-development."
+              rm -f "$CAP_PATCH_IDS" "$FAILURES"
+              exit 0
+            fi
+
+            echo ""
+            echo "::error::CRE changes must first be merged into 'capabilities-development'. PRs to other branches may only include cherry-picks of commits already in that branch, or proto changes that already exist on that branch."
+            rm -f "$CAP_PATCH_IDS" "$FAILURES"
+            exit 1
+          fi
+
+          rm -f "$CAP_PATCH_IDS" "$FAILURES"
+          echo "All CRE-modifying commits are verified cherry-picks from capabilities-development."

.github/workflows/register-data-feeds-schemas.yaml

@@ -0,0 +1,59 @@
+name: register-data-feeds-schemas
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/register-data-feeds-schemas.yaml"
+      - "data-feeds/**/*.proto"
+      - "data-feeds/chip-schemas.json"
+      - "data-feeds/chip-job-spec-schemas.json"
+      - "data-feeds/beholder-job-spec-schemas.json"
+  pull_request:
+    paths:
+      - ".github/workflows/register-data-feeds-schemas.yaml"
+      - "data-feeds/**/*.proto"
+      - "data-feeds/chip-schemas.json"
+      - "data-feeds/chip-job-spec-schemas.json"
+      - "data-feeds/beholder-job-spec-schemas.json"
+
+jobs:
+  register-schemas:
+    runs-on: ubuntu-latest
+    environment: publish
+    permissions:
+      id-token: write
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        config:
+          - { name: data-feeds,        file: chip-schemas.json }
+          - { name: job-spec,          file: chip-job-spec-schemas.json }
+          - { name: job-spec-beholder, file: beholder-job-spec-schemas.json }
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
+        with:
+          mask-aws-account-id: true
+          role-to-assume: ${{ secrets.AWS_IAM_ROLE_PUBLISH_ARN }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Register Data Feeds Schemas for ${{ matrix.config.name }} domain
+        uses: smartcontractkit/.github/actions/chip-schema-registration@b1bec0ae729606681897cbf7fad5d7c1d572173e # v1.1.0
+        with:
+          aws-account-id: ${{ secrets.AWS_ACCOUNT_ID_ROOT }}
+          aws-region: us-west-2
+          chip-schema-dir: "data-feeds"
+          chip-config-file-path: "data-feeds/${{ matrix.config.file }}"
+          chip-config-host: ${{ github.ref_name == 'main' && secrets.chip_config_host_prod || secrets.chip_config_host_staging }}
+          chip-config-user: ${{ secrets.chip_config_user }}
+          chip-config-password: ${{ github.ref_name == 'main' && secrets.chip_config_password_prod || secrets.chip_config_password_staging }}
+          ts-ouath-client-id: ${{ secrets.chip_config_ts_oauth_client_id }}
+          ts-ouath-secret: ${{ secrets.chip_config_ts_oauth_secret }}

.github/workflows/register-workflows-schemas.yaml

@@ -7,10 +7,12 @@ on:
       - main
     paths:
       - ".github/workflows/register-workflows-schemas.yaml"
+      - "workflows/chip-*.json"
       - "workflows/**/*.proto"
   pull_request:
     paths:
       - ".github/workflows/register-workflows-schemas.yaml"
+      - "workflows/chip-*.json"
       - "workflows/**/*.proto"
 
 jobs:

chainlink-ccv/committee-verifier/go.mod

@@ -1,16 +1,16 @@
 module github.com/smartcontractkit/chainlink-protos/chainlink-ccv/committee-verifier
 
-go 1.23.0
+go 1.24.0
 
 require (
 	github.com/smartcontractkit/chainlink-protos/chainlink-ccv/verifier v0.0.0-20251210213124-585855c1471e
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7
-	google.golang.org/grpc v1.75.0
-	google.golang.org/protobuf v1.36.8
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217
+	google.golang.org/grpc v1.79.3
+	google.golang.org/protobuf v1.36.10
 )
 
 require (
-	golang.org/x/net v0.41.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/text v0.26.0 // indirect
+	golang.org/x/net v0.48.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
 )