Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .example.env
Original file line number Diff line number Diff line change
Expand Up @@ -28,4 +28,4 @@ CORE_P2P_PORT=6690

# Build config
CORE_REPO="https://github.com/smartcontractkit/chainlink.git"
CORE_REF=aptos-init
CORE_REF=develop
6 changes: 3 additions & 3 deletions .github/actions/get-core-ref/get_core_ref.sh
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
#!/bin/bash

core_ref="develop-plugins"
core_ref="${DEFAULT_CORE_REF:-develop-plugins}"

# Extract and trim the value after core_ref:, handle multiple spaces
if [[ $PR_BODY =~ core_ref:[[:space:]]*([^;[:space:]]+)[[:space:]]*$ ]]; then
# Extract the value after core_ref:, allowing the documented semicolon terminator.
if [[ $PR_BODY =~ core_ref:[[:space:]]*([^;[:space:]]+) ]]; then
potential_ref="${BASH_REMATCH[1]}"

# Only allow alphanumeric, dash, underscore, forward slash
Expand Down
19 changes: 15 additions & 4 deletions .github/actions/get-core-ref/test_get_core_ref.sh
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,14 @@ run_test() {
local test_name="$1"
local pr_body="$2"
local expected="$3"
local default_ref="${4:-develop-plugins}"

echo "Test: $test_name"
echo "Input: $pr_body"

setup_test_env
export PR_BODY="$pr_body"
export DEFAULT_CORE_REF="$default_ref"

./get_core_ref.sh

Expand All @@ -42,9 +44,13 @@ run_test "Simple valid ref" \
"core_ref: develop" \
"develop"

run_test "Documented semicolon syntax" \
"core_ref: develop;" \
"develop"

run_test "Complex valid ref" \
"core_ref: feature/abc-123_test" \
"feature/abc-123_test"
"core_ref: release/abc-123_test" \
"release/abc-123_test"

run_test "Multiple colons" \
"core_ref: abc:def:ghi" \
Expand All @@ -66,11 +72,11 @@ run_test "Command injection via backticks" \

run_test "Command injection via semicolon" \
"core_ref: valid-ref; touch HACKED2" \
"develop-plugins"
"valid-ref"

run_test "Command injection via pipeline" \
"core_ref: valid-ref | touch HACKED3" \
"develop-plugins"
"valid-ref"

run_test "Command injection via subshell" \
"core_ref: \$(touch HACKED4)" \
Expand All @@ -97,6 +103,11 @@ run_test "Extra whitespace" \
" core_ref: spaces-everywhere " \
"spaces-everywhere"

run_test "Workflow-specific default override" \
"some other text" \
"develop" \
"develop"

# Final security check
if ls HACKED* 1>/dev/null 2>&1; then
echo "❌ CRITICAL: Command injection was successful!"
Expand Down
13 changes: 3 additions & 10 deletions .github/workflows/aptos-run-smoke-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,28 +20,21 @@ jobs:
contents: read
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
DEFAULT_CORE_REF: aptos-init
DEFAULT_CORE_REF: 43a6f2748d47fb6ec96a64505dfa66f1c302100b
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6

- name: Get core ref from PR body
if: github.event_name == 'pull_request'
env:
PR_BODY: ${{ github.event.pull_request.body }}
run: |
comment=$(echo "${PR_BODY}")
core_ref=$(echo $comment | grep -oP 'core ref: \K\S+' || true)
if [ ! -z "$core_ref" ]; then
echo "CUSTOM_CORE_REF=${core_ref}" >> "${GITHUB_ENV}"
fi
uses: ./.github/actions/get-core-ref

- name: Checkout chainlink repo
uses: actions/checkout@v6
with:
repository: smartcontractkit/chainlink
ref: ${{ env.CUSTOM_CORE_REF || env.DEFAULT_CORE_REF }}
ref: ${{ env.core_ref || env.DEFAULT_CORE_REF }}
path: temp/chainlink

- name: Build chainlink image
Expand Down
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,5 +21,5 @@ Local development and tests how to
3. `go test`

### Custom images on PRs
If you want to test the CI with a custom core image you need to specify in the PR body either the commit sha or branch name in the following format `core_ref:<sha>;` e.g `core_ref:develop;`.
_Note:_ Develop does not work until the core aptos-init branch is merged
If you want to test the CI with a custom core image you need to specify in the PR body either the commit sha or branch name in the following format `core_ref:<sha>;`, for example `core_ref:develop;`.
If you do not provide an override, the smoke workflow uses the merged `smartcontractkit/chainlink#21828` commit by default.
30 changes: 23 additions & 7 deletions integration-tests/deploy/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,14 @@ var (
)

type CoreConfigToml struct {
Log CoreLogTomlConfig `toml:"Log"`
Feature CoreFeatureTomlConfig `toml:"Feature"`
OCR2 CoreOCR2TomlConfig `toml:"OCR2"`
P2P CoreP2PTomlConfig `toml:"P2P"`
WebServer CoreWebServerTomlConfig `toml:"WebServer"`
Aptos []CoreAptosTomlConfig `toml:"Aptos"`
EVM []CoreEVMTomlConfig `toml:"EVM"`
Log CoreLogTomlConfig `toml:"Log"`
Feature CoreFeatureTomlConfig `toml:"Feature"`
Capabilities CoreCapabilitiesTomlConfig `toml:"Capabilities"`
OCR2 CoreOCR2TomlConfig `toml:"OCR2"`
P2P CoreP2PTomlConfig `toml:"P2P"`
WebServer CoreWebServerTomlConfig `toml:"WebServer"`
Aptos []CoreAptosTomlConfig `toml:"Aptos"`
EVM []CoreEVMTomlConfig `toml:"EVM"`
}

type CoreLogTomlConfig struct {
Expand All @@ -35,6 +36,21 @@ type CoreFeatureTomlConfig struct {
UICSAKeys bool `toml:"UICSAKeys"`
}

type CoreCapabilitiesTomlConfig struct {
Local CoreLocalCapabilitiesTomlConfig `toml:"Local"`
}

type CoreLocalCapabilitiesTomlConfig struct {
// Preserve explicit local capability stanzas when we decode and re-encode
// core.toml; the mock trigger opt-in is represented by an otherwise-empty table.
Capabilities map[string]CoreCapabilityNodeTomlConfig `toml:"Capabilities"`
}

type CoreCapabilityNodeTomlConfig struct {
BinaryPathOverride string `toml:"BinaryPathOverride,omitempty"`
Config map[string]string `toml:"Config,omitempty"`
}

type CoreOCR2TomlConfig struct {
Enabled bool `toml:"Enabled"`
}
Expand Down
50 changes: 50 additions & 0 deletions integration-tests/deploy/config_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
package deploy

import (
"os"
"path/filepath"
"testing"

"github.com/BurntSushi/toml"
"github.com/stretchr/testify/require"

"github.com/smartcontractkit/chainlink-aptos/integration-tests/scripts"
)

func TestMarshalCoreTomlPreservesLocalCapabilities(t *testing.T) {
t.Parallel()

input := `
[Capabilities.Local]
[Capabilities.Local.Capabilities."[email protected]"]

[WebServer]
HTTPPort = 6688
AllowOrigins = '*'
[WebServer.TLS]
HTTPSPort = 0
`

var cfg CoreConfigToml
_, err := toml.Decode(input, &cfg)
require.NoError(t, err)

out, err := marshalCoreToml(&cfg)
require.NoError(t, err)
require.Contains(t, out, `[Capabilities.Local.Capabilities."[email protected]"]`)
}

func TestCoreTemplateRoundTripPreservesMockTrigger(t *testing.T) {
t.Parallel()

input, err := os.ReadFile(filepath.Join(scripts.Templates, "core.toml"))
require.NoError(t, err)

var cfg CoreConfigToml
_, err = toml.Decode(string(input), &cfg)
require.NoError(t, err)

out, err := marshalCoreToml(&cfg)
require.NoError(t, err)
require.Contains(t, out, `[Capabilities.Local.Capabilities."[email protected]"]`)
}
5 changes: 5 additions & 0 deletions integration-tests/templates/core.toml
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ FeedsManager = true
LogPoller = true
UICSAKeys = true

[Capabilities.Local]
# This empty stanza opt-ins the smoke nodes to the mock trigger that keeps the
# legacy workflow-based Aptos smoke path working against core `develop`.
[Capabilities.Local.Capabilities."[email protected]"]

[OCR2]
Enabled = true

Expand Down
Loading