Skip to content
Merged
Show file tree
Hide file tree
Changes from 8 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .example.env
Original file line number Diff line number Diff line change
Expand Up @@ -28,4 +28,4 @@ CORE_P2P_PORT=6690

# Build config
CORE_REPO="https://github.com/smartcontractkit/chainlink.git"
CORE_REF=aptos-init
CORE_REF=develop
6 changes: 3 additions & 3 deletions .github/actions/get-core-ref/get_core_ref.sh
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
#!/bin/bash

core_ref="develop-plugins"
core_ref="${DEFAULT_CORE_REF:-develop-plugins}"

# Extract and trim the value after core_ref:, handle multiple spaces
if [[ $PR_BODY =~ core_ref:[[:space:]]*([^;[:space:]]+)[[:space:]]*$ ]]; then
# Extract the value after core_ref:, allowing the documented semicolon terminator.
if [[ $PR_BODY =~ core_ref:[[:space:]]*([^;[:space:]]+) ]]; then
potential_ref="${BASH_REMATCH[1]}"

# Only allow alphanumeric, dash, underscore, forward slash
Expand Down
15 changes: 13 additions & 2 deletions .github/actions/get-core-ref/test_get_core_ref.sh
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,14 @@ run_test() {
local test_name="$1"
local pr_body="$2"
local expected="$3"
local default_ref="${4:-develop-plugins}"

echo "Test: $test_name"
echo "Input: $pr_body"

setup_test_env
export PR_BODY="$pr_body"
export DEFAULT_CORE_REF="$default_ref"

./get_core_ref.sh

Expand All @@ -42,6 +44,10 @@ run_test "Simple valid ref" \
"core_ref: develop" \
"develop"

run_test "Documented semicolon syntax" \
"core_ref: feature/aptos-core-branch;" \
"feature/aptos-core-branch"

run_test "Complex valid ref" \
"core_ref: feature/abc-123_test" \
"feature/abc-123_test"
Expand All @@ -66,11 +72,11 @@ run_test "Command injection via backticks" \

run_test "Command injection via semicolon" \
"core_ref: valid-ref; touch HACKED2" \
"develop-plugins"
"valid-ref"

run_test "Command injection via pipeline" \
"core_ref: valid-ref | touch HACKED3" \
"develop-plugins"
"valid-ref"

run_test "Command injection via subshell" \
"core_ref: \$(touch HACKED4)" \
Expand All @@ -97,6 +103,11 @@ run_test "Extra whitespace" \
" core_ref: spaces-everywhere " \
"spaces-everywhere"

run_test "Workflow-specific default override" \
"some other text" \
"develop" \
"develop"

# Final security check
if ls HACKED* 1>/dev/null 2>&1; then
echo "❌ CRITICAL: Command injection was successful!"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/aptos-run-smoke-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
contents: read
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
DEFAULT_CORE_REF: aptos-init
DEFAULT_CORE_REF: feature/aptos-develop-mock-trigger
runs-on: ubuntu-latest
steps:
- name: Checkout code
Expand All @@ -41,7 +41,7 @@ jobs:
uses: actions/checkout@v6
with:
repository: smartcontractkit/chainlink
ref: ${{ env.CUSTOM_CORE_REF || env.DEFAULT_CORE_REF }}
ref: ${{ env.core_ref || env.DEFAULT_CORE_REF }}
path: temp/chainlink

- name: Build chainlink image
Expand Down
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,5 +21,5 @@ Local development and tests how to
3. `go test`

### Custom images on PRs
If you want to test the CI with a custom core image you need to specify in the PR body either the commit sha or branch name in the following format `core_ref:<sha>;` e.g `core_ref:develop;`.
_Note:_ Develop does not work until the core aptos-init branch is merged
If you want to test the CI with a custom core image you need to specify in the PR body either the commit sha or branch name in the following format `core_ref:<sha>;`, for example `core_ref:develop;`.
If you do not provide an override, the smoke workflow uses `develop` by default.
30 changes: 23 additions & 7 deletions integration-tests/deploy/config.go
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,14 @@ var (
)

type CoreConfigToml struct {
Log CoreLogTomlConfig `toml:"Log"`
Feature CoreFeatureTomlConfig `toml:"Feature"`
OCR2 CoreOCR2TomlConfig `toml:"OCR2"`
P2P CoreP2PTomlConfig `toml:"P2P"`
WebServer CoreWebServerTomlConfig `toml:"WebServer"`
Aptos []CoreAptosTomlConfig `toml:"Aptos"`
EVM []CoreEVMTomlConfig `toml:"EVM"`
Log CoreLogTomlConfig `toml:"Log"`
Feature CoreFeatureTomlConfig `toml:"Feature"`
Capabilities CoreCapabilitiesTomlConfig `toml:"Capabilities"`
OCR2 CoreOCR2TomlConfig `toml:"OCR2"`
P2P CoreP2PTomlConfig `toml:"P2P"`
WebServer CoreWebServerTomlConfig `toml:"WebServer"`
Aptos []CoreAptosTomlConfig `toml:"Aptos"`
EVM []CoreEVMTomlConfig `toml:"EVM"`
}

type CoreLogTomlConfig struct {
Expand All @@ -35,6 +36,21 @@ type CoreFeatureTomlConfig struct {
UICSAKeys bool `toml:"UICSAKeys"`
}

type CoreCapabilitiesTomlConfig struct {
Local CoreLocalCapabilitiesTomlConfig `toml:"Local"`
}

type CoreLocalCapabilitiesTomlConfig struct {
// Preserve explicit local capability stanzas when we decode and re-encode
// core.toml; the mock trigger opt-in is represented by an otherwise-empty table.
Capabilities map[string]CoreCapabilityNodeTomlConfig `toml:"Capabilities"`
}

type CoreCapabilityNodeTomlConfig struct {
BinaryPathOverride string `toml:"BinaryPathOverride,omitempty"`
Config map[string]string `toml:"Config,omitempty"`
}

type CoreOCR2TomlConfig struct {
Enabled bool `toml:"Enabled"`
}
Expand Down
50 changes: 50 additions & 0 deletions integration-tests/deploy/config_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
package deploy

import (
"os"
"path/filepath"
"testing"

"github.com/BurntSushi/toml"
"github.com/stretchr/testify/require"

"github.com/smartcontractkit/chainlink-aptos/integration-tests/scripts"
)

func TestMarshalCoreTomlPreservesLocalCapabilities(t *testing.T) {
t.Parallel()

input := `
[Capabilities.Local]
[Capabilities.Local.Capabilities."[email protected]"]

[WebServer]
HTTPPort = 6688
AllowOrigins = '*'
[WebServer.TLS]
HTTPSPort = 0
`

var cfg CoreConfigToml
_, err := toml.Decode(input, &cfg)
require.NoError(t, err)

out, err := marshalCoreToml(&cfg)
require.NoError(t, err)
require.Contains(t, out, `[Capabilities.Local.Capabilities."[email protected]"]`)
}

func TestCoreTemplateRoundTripPreservesMockTrigger(t *testing.T) {
t.Parallel()

input, err := os.ReadFile(filepath.Join(scripts.Templates, "core.toml"))
require.NoError(t, err)

var cfg CoreConfigToml
_, err = toml.Decode(string(input), &cfg)
require.NoError(t, err)

out, err := marshalCoreToml(&cfg)
require.NoError(t, err)
require.Contains(t, out, `[Capabilities.Local.Capabilities."[email protected]"]`)
}
5 changes: 5 additions & 0 deletions integration-tests/templates/core.toml
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ FeedsManager = true
LogPoller = true
UICSAKeys = true

[Capabilities.Local]
# This empty stanza opt-ins the smoke nodes to the mock trigger that keeps the
# legacy workflow-based Aptos smoke path working against core `develop`.
[Capabilities.Local.Capabilities."[email protected]"]

[OCR2]
Enabled = true

Expand Down
Loading