build: reproducible Rust builds

.cargo/config.toml

@@ -1,8 +1,35 @@
+# TODO: We shouldn't go with tokio_unstable to production
+
 [target.aarch64-unknown-linux-musl]
-rustflags = [ "-C", "target-feature=-crt-static" ]
+rustflags = ["-C", "target-feature=-crt-static"]
+linker = "aarch64-linux-musl-gcc"
 
 [target.x86_64-unknown-linux-musl]
-rustflags = [ "-C", "target-feature=-crt-static" ]
+rustflags = ["-C", "target-feature=-crt-static"]
+linker = "x86_64-linux-musl-gcc"
 
 [target.aarch64-unknown-linux-gnu]
 linker = "aarch64-linux-gnu-gcc"
+
+[target.x86_64-unknown-linux-gnu]
+linker = "x86_64-linux-gnu-gcc"
+
+[profile.release]
+opt-level = 3
+debug = false
+debug-assertions = false
+overflow-checks = false
+lto = true
+panic = 'abort'
+codegen-units = 1
+incremental = false
+rustflags = [
+    "-C", "relocation-model=pic",
+    "-C", "strip=debuginfo"
+]
+
+
+[build]
+rustflags = [
+    "--cfg", "tokio_unstable"
+]

.dockerignore

@@ -23,6 +23,7 @@ packages/*/dist
 packages/*/wasm
 packages/*/lib/wasm
 packages/*/node_modules
+packages/*/.env
 
 !packages/platform-test-suite/test
 

.github/actions/docker/action.yaml

@@ -37,6 +37,12 @@ inputs:
   region:
     description: S3 bucket region
     required: true
+  aws_access_key_id:
+    description: AWS access key ID
+    required: true
+  aws_secret_access_key:
+    description: AWS secret access key
+    required: true
 outputs:
   digest:
     value: ${{ steps.docker_build.outputs.digest }}
@@ -102,6 +108,8 @@ runs:
           SCCACHE_BUCKET=${{ inputs.bucket }}
           SCCACHE_REGION=${{ inputs.region }}
           SCCACHE_S3_KEY_PREFIX=${{ runner.os }}/sccache
+          AWS_ACCESS_KEY_ID=${{ inputs.aws_access_key_id }}
+          AWS_SECRET_ACCESS_KEY=${{ inputs.aws_secret_access_key }}
         cache-from: ${{ steps.layer_cache_settings.outputs.cache_from }}
         cache-to: ${{ steps.layer_cache_settings.outputs.cache_to }}
         outputs: type=image,name=${{ inputs.image_org }}/${{ inputs.image_name }},push-by-digest=${{ inputs.push_tags != 'true' }},name-canonical=true,push=true

.github/actions/javy/action.yaml

@@ -0,0 +1,37 @@
+---
+name: "Setup Javy"
+description: "Setup Javy binaries"
+inputs:
+  version:
+    description: Javy version to use
+    required: false
+    default: "1.4.0"
+runs:
+  using: composite
+  steps:
+    - name: Install Javy
+      shell: bash
+      run: |
+        set -e
+
+        case "${{ runner.arch }}" in
+          "ARM64")
+            JAVY_ARCH="arm-linux"
+            ;;
+          "X64")
+            JAVY_ARCH="x86_64-linux"            
+            ;;
+          *)
+            echo "Unsupported architecture: ${{ runner.arch }}"
+            exit 1
+            ;;
+        esac
+
+        curl -Ls "https://github.com/bytecodealliance/javy/releases/download/v${{ inputs.version }}/javy-${JAVY_ARCH}-v${{ inputs.version }}.gz" | gunzip > javy
+
+        chmod +x javy
+        sudo mv javy /usr/local/bin/javy
+
+    - name: Verify Javy installation
+      shell: bash
+      run: javy --version

.github/actions/local-network/action.yaml

@@ -97,3 +97,5 @@ runs:
     - name: Start local network
       shell: bash
       run: yarn start
+      env:
+        DEBUG: 1

.github/actions/nodejs/action.yaml

@@ -5,7 +5,7 @@ runs:
   using: composite
   steps:
     - name: Setup Node.JS
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: "20"
 

.github/actions/rust/action.yaml

@@ -5,7 +5,7 @@ inputs:
   toolchain:
     description: Rust toolchain to use, stable / nightly / beta, or exact version
     # The same as in /README.md
-    default: "stable"
+    default: "1.76"
   target:
     description: Target Rust platform
     required: false
@@ -49,13 +49,26 @@ runs:
         esac
 
     # TODO: Move to AMI and build every day
+    - name: Check if protoc is installed
+      id: check-protoc
+      shell: bash
+      run: |
+        if command -v protoc >/dev/null 2>&1; then
+          echo "protoc is already installed."
+          echo "protoc_installed=true" >> $GITHUB_OUTPUT
+        else
+          echo "protoc is not installed."
+          echo "protoc_installed=false" >> $GITHUB_OUTPUT
+        fi
+
     - name: Install protoc
+      if: steps.check-protoc.outputs.protoc_installed == 'false'
       id: deps-protoc
       shell: bash
       run: |
         curl -Lo /tmp/protoc.zip \
-          "https://github.com/protocolbuffers/protobuf/releases/download/v22.0/protoc-22.0-linux-${{ steps.protoc_arch.outputs.arch }}.zip"
-        unzip /tmp/protoc.zip -d ${HOME}/.local
+          "https://github.com/protocolbuffers/protobuf/releases/download/v25.2/protoc-25.2-linux-${{ steps.protoc_arch.outputs.arch }}.zip"
+        unzip -o /tmp/protoc.zip -d ${HOME}/.local
         echo "PROTOC=${HOME}/.local/bin/protoc" >> $GITHUB_ENV
         export PATH="${PATH}:${HOME}/.local/bin"
 

.github/package-filters/js-packages.yml

@@ -71,7 +71,12 @@ dash: &dash
 dashmate:
   - .github/workflows/tests*
   - packages/dashmate/**
-  - *dash
+  - *dashpay-contract
+  - *masternode-reward-shares-contract
+  - *dpns-contract
+  - *withdrawals-contract
+  - *wallet-lib
+  - *dapi-client
 
 '@dashevo/platform-test-suite':
   - .github/workflows/tests*

.github/package-filters/rs-packages.yml

@@ -14,13 +14,18 @@ dpns-contract: &dpns-contract
   - .github/workflows/tests*
   - packages/dpns-contract/**
 
+json-schema-compatibility-validator: &json-schema-compatibility-validator
+  - .github/workflows/tests*
+  - packages/rs-json-schema-compatibility-validator/**
+
 dpp: &dpp
   - .github/workflows/tests*
   - packages/rs-dpp/**
   - *dashpay-contract
   - *masternode-reward-shares-contract
   - *dpns-contract
   - *withdrawals-contract
+  - *json-schema-compatibility-validator
   - packages/rs-platform-serialization/**
   - packages/rs-platform-serialization-derive/**
   - packages/rs-platform-value/**
@@ -54,7 +59,7 @@ rs-dapi-client: &dapi_client
   - packages/rs-dapi-client/**
   - *dapi_grpc
 
-rs-sdk:
+dash-sdk:
   - .github/workflows/tests*
   - packages/rs-drive-proof-verifier/**
   - packages/rs-sdk/**

.github/workflows/docs.yml

@@ -2,7 +2,7 @@ name: Publish docs via GitHub Pages
 on:
   push:
     branches:
-      - master
+      - v1.0-dev
 
 jobs:
   build:

.github/workflows/release-docker-image.yml

@@ -25,7 +25,7 @@ jobs:
   build-image:
     name: Build ${{ matrix.platform }} image
     runs-on: ${{ matrix.runner }}
-    timeout-minutes: 20
+    timeout-minutes: 25
     strategy:
       matrix:
         include:
@@ -42,7 +42,9 @@ jobs:
       - name: Configure AWS credentials and bucket region
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-region: ${{ vars.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
 
       - name: Build and push by digest
         uses: ./.github/actions/docker
@@ -56,10 +58,13 @@ jobs:
           cargo_profile: release
           dockerhub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}
-          region: ${{ vars.AWS_REGION }}
+          region: ${{ secrets.AWS_REGION }}
+          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
       - name: Export digest
         run: |
+          rm -rf ${{ env.DIGEST_DIR_PATH }}
           mkdir -p ${{ env.DIGEST_DIR_PATH }}
           digest="${{ steps.docker_build.outputs.digest }}"
           touch "${{ env.DIGEST_DIR_PATH }}/${digest#sha256:}"

.github/workflows/release.yml

@@ -32,7 +32,9 @@ jobs:
       - name: Configure AWS credentials and bucket region
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-region: ${{ vars.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
 
       - name: Retrieve JS build artifacts
         uses: strophy/actions-cache@opendal-update
@@ -69,7 +71,7 @@ jobs:
           CARGO_BUILD_PROFILE: release
           RUSTC_WRAPPER: sccache
           SCCACHE_BUCKET: multi-runner-cache-x1xibo9c
-          SCCACHE_REGION: ${{ vars.AWS_REGION }}
+          SCCACHE_REGION: ${{ secrets.AWS_REGION }}
           SCCACHE_S3_KEY_PREFIX: ${{ runner.os }}/sccache/wasm/wasm32
         if: ${{ steps.cache.outputs.cache-hit != 'true' }}
 
@@ -135,7 +137,7 @@ jobs:
       image_name: drive
       target: drive-abci
 
-  release-drive-dapi:
+  release-dapi-image:
     name: Release DAPI image
     secrets: inherit
     uses: ./.github/workflows/release-docker-image.yml
@@ -193,8 +195,9 @@ jobs:
       - name: Configure AWS credentials and bucket region
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-region: ${{ vars.AWS_REGION }}
-          role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }}
+          aws-region: ${{ secrets.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
       - name: Retrieve JS build artifacts
         uses: strophy/actions-cache@opendal-update

.github/workflows/tests-build-image.yml

@@ -17,7 +17,7 @@ on:
 jobs:
   build-image:
     name: Build ${{ inputs.name }} image
-    runs-on: [ "self-hosted", "linux", "arm64", "ubuntu-platform-4x" ]
+    runs-on: ["self-hosted", "linux", "arm64", "ubuntu-platform"]
     steps:
       - name: Check out repo
         uses: actions/checkout@v4
@@ -27,20 +27,24 @@ jobs:
       - name: Configure AWS credentials and bucket region
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-region: ${{ vars.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
 
       - name: Login to ECR
-        run: aws ecr get-login-password --region ${{ vars.AWS_REGION }} | docker login --username AWS --password-stdin ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com
+        run: aws ecr get-login-password --region ${{ secrets.AWS_REGION }} | docker login --username AWS --password-stdin ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com
         shell: bash
 
       - name: Build and push by SHA
         uses: ./.github/actions/docker
         with:
           image_name: ${{ inputs.image_name }}
-          image_org: ${{ vars.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com
+          image_org: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com
           target: ${{ inputs.target }}
           platform: linux/arm64
           push_tags: true
           dockerhub_username: ${{ secrets.DOCKERHUB_USERNAME }}
           dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}
-          region: ${{ vars.AWS_REGION }}
+          region: ${{ secrets.AWS_REGION }}
+          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows/tests-build-js.yml

@@ -4,12 +4,14 @@ on:
 jobs:
   build-js:
     name: Build JS
-    runs-on: [ "self-hosted", "linux", "arm64", "ubuntu-platform-4x" ]
+    runs-on: ["self-hosted", "linux", "arm64", "ubuntu-platform"]
     steps:
       - name: Configure AWS credentials and bucket region
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-region: ${{ vars.AWS_REGION }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
 
       # TODO: Use upload artifacts action instead
       - name: Cache build artifacts
@@ -50,7 +52,7 @@ jobs:
         env:
           RUSTC_WRAPPER: sccache
           SCCACHE_BUCKET: multi-runner-cache-x1xibo9c
-          SCCACHE_REGION: ${{ vars.AWS_REGION }}
+          SCCACHE_REGION: ${{ secrets.AWS_REGION }}
           SCCACHE_S3_KEY_PREFIX: ${{ runner.os }}/sccache/wasm/wasm32
 
       - name: Ignore only already cached artifacts

.github/workflows/tests-codeql.yml

@@ -23,8 +23,9 @@ jobs:
       - name: Configure AWS credentials and bucket region
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          aws-region: ${{ vars.AWS_REGION }}
-          role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
 
       - name: Setup Node.JS
         uses: ./.github/actions/nodejs