Merge branch 'main' into fix/L-01

.github/ISSUE_TEMPLATE/epic.yml

@@ -0,0 +1,30 @@
+---
+name: Epic/Major Feature
+about: File an Epic
+assignees: 'dfox-consensys,julien-marchand'
+---
+
+## Description
+Write a clear and concise description of what you want to happen. Add any considered drawbacks.
+
+## Motivation
+This section should indicate what value we are receiving from it.
+
+## Architecture
+- [ ] Link to an architecture document
+
+## Implementation guidelines
+- [ ] List implementation steps to complete the epic/feature 
+
+## Metrics/monitoring
+- [ ] What needs to be monitored once this epic has been shipped?
+
+## Rollout
+- [ ] Describe rollout plan for this epic
+
+## Infrastructure & Node operators
+- [ ] What is the impact and migration steps required for the infrastructure and node operators
+
+## Documentation & communication
+- [ ] What needs to be documented for this feature?
+

.github/actions/check-image-tags-exist/action.yml

@@ -5,48 +5,24 @@ inputs:
   last_commit_tag:
     description: 'The tag of the last commit image'
     required: true
-  common_ancestor_tag:
-    description: 'The tag of the common ancestor commit image'
-    required: true
   image_name:
     description: 'The name of the image to check'
     required: true
-  docker_username:
-    description: 'The username to login to Docker Hub'
-    required: true
-  docker_password:
-    description: 'The password to login to Docker Hub'
-    required: true
 outputs:
   last_commit_tag_exists:
     description: 'Whether the last commit image tag exists'
     value: ${{ steps.last_commit_image_exists.outputs.last_commit_tag_exists }}
-  common_ancestor_commit_tag_exists:
-    description: 'Whether the common ancestor commit image tag exists'
-    value: ${{ steps.ancestor_commit_image_exists.outputs.common_ancestor_commit_tag_exists }}
 
 runs:
   using: 'composite'
   steps:
-    - name: Login to Docker Hub
-      uses: docker/login-action@v2
-      with:
-        username: ${{ inputs.docker_username }}
-        password: ${{ inputs.docker_password }}
     - name: Check last commit image tag exists
       id: last_commit_image_exists
       shell: bash
       continue-on-error: true
       run: |
         echo last_commit_tag_exists=$(docker pull ${{ inputs.image_name }}:${{ inputs.last_commit_tag }} > /dev/null ; echo $?) >> $GITHUB_OUTPUT
-    - name: Check ancestor commit image tag exists
-      shell: bash
-      id: ancestor_commit_image_exists
-      continue-on-error: true
-      run: |
-        echo common_ancestor_commit_tag_exists=$(docker pull ${{ inputs.image_name }}:${{ inputs.common_ancestor_tag }} > /dev/null ; echo $?) >> $GITHUB_OUTPUT
     - name: Show outputs
       shell: bash
       run: |
         echo "last_commit_tag_exists: ${{ steps.last_commit_image_exists.outputs.last_commit_tag_exists }}"
-        echo "common_ancestor_commit_tag_exists: ${{ steps.ancestor_commit_image_exists.outputs.common_ancestor_commit_tag_exists }}"

.github/actions/image-tag-and-push/action.yml

@@ -8,40 +8,32 @@ inputs:
   last_commit_tag:
     description: 'The tag of the last commit image'
     required: true
-  common_ancestor_tag:
-    description: 'The tag of the common ancestor commit image'
-    required: true
   develop_tag:
     description: 'The tag of the develop image'
     required: true
-  untested_tag_suffix:
-    description: 'The suffix to add to untested images'
-    required: true
   image_name:
     description: 'The name of the image to tag and push'
     required: true
   last_commit_tag_exists:
     description: 'Whether the last commit image tag exists'
     required: true
-  common_ancestor_commit_tag_exists:
-    description: 'Whether the common ancestor commit image tag exists'
-    required: true
   docker_username:
     description: 'The username to login to Docker Hub'
-    required: true
+    required: false
   docker_password:
     description: 'The password to login to Docker Hub'
-    required: true
+    required: false
 
 outputs:
-  image_tagged: 
+  image_tagged:
     description: 'Whether the image was tagged'
     value: ${{ steps.set-output.outputs.image_tagged }}
 
 runs:
   using: 'composite'
   steps:
     - name: Login to Docker Hub
+      if: ${{ github.ref == 'refs/heads/main' && inputs.last_commit_tag_exists == '0' }}
       uses: docker/login-action@v2
       with:
         username: ${{ inputs.docker_username }}
@@ -50,29 +42,15 @@ runs:
       shell: bash
       run: |
         echo IMAGE_TAGGED=false >> $GITHUB_ENV
-    - name: Tag Docker image with last commit tag with the commit hash plus w/o "untested" suffix
-      shell: bash
-      if: ${{ inputs.last_commit_tag != '0000000' && inputs.last_commit_tag_exists == '0' }}
-      run: |
-        docker buildx imagetools create --tag ${{ inputs.image_name }}:${{ inputs.commit_tag }} ${{ inputs.image_name }}:${{ inputs.last_commit_tag }}
-        docker buildx imagetools create --tag ${{ inputs.image_name }}:${{ inputs.commit_tag }}-${{ inputs.untested_tag_suffix }} ${{ inputs.image_name }}:${{ inputs.last_commit_tag }}
-        echo IMAGE_TAGGED=true >> $GITHUB_ENV
-    - name: Tag Docker image with common ancestor commit tag with the commit hash plus w/o "untested" suffix
-      shell: bash
-      if: ${{ inputs.last_commit_tag == '0000000' && inputs.common_ancestor_commit_tag_exists == '0' }}
-      run: |
-        docker buildx imagetools create --tag ${{ inputs.image_name }}:${{ inputs.commit_tag }} ${{ inputs.image_name }}:${{ inputs.common_ancestor_tag }}
-        docker buildx imagetools create --tag ${{ inputs.image_name }}:${{ inputs.commit_tag }}-${{ inputs.untested_tag_suffix }} ${{ inputs.image_name }}:${{ inputs.common_ancestor_tag }}
-        echo IMAGE_TAGGED=true >> $GITHUB_ENV
     - name: Tag Docker image with develop if on main branch
       shell: bash
       if: ${{ github.ref == 'refs/heads/main' && inputs.last_commit_tag_exists == '0' }}
       run: |
         docker buildx imagetools create --tag ${{ inputs.image_name }}:${{ inputs.develop_tag }} ${{ inputs.image_name }}:${{ inputs.last_commit_tag }}
+        docker buildx imagetools create --tag ${{ inputs.image_name }}:${{ inputs.commit_tag }} ${{ inputs.image_name }}:${{ inputs.last_commit_tag }}
         echo IMAGE_TAGGED=true >> $GITHUB_ENV
-    
     - name: Set output from environment variable
       shell: bash
       id: set-output
       run: |
-        echo "image_tagged=$IMAGE_TAGGED" >> $GITHUB_OUTPUT
+        echo "image_tagged=$IMAGE_TAGGED" >> $GITHUB_OUTPUT

.github/workflows/all-tools.yml

@@ -50,10 +50,7 @@ jobs:
         uses: ./.github/actions/check-image-tags-exist
         with:
           last_commit_tag: ${{ needs.store_image_name_and_tags.outputs.last_commit_tag }}
-          common_ancestor_tag: ${{ needs.store_image_name_and_tags.outputs.common_ancestor_tag }}
           image_name: consensys/linea-alltools
-          docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
-          docker_password: ${{ secrets.DOCKERHUB_TOKEN }}
 
   all-tools-tag-only:
     runs-on: [self-hosted, ubuntu-20.04, X64, small]
@@ -71,12 +68,9 @@ jobs:
         with:
           commit_tag: ${{ needs.store_image_name_and_tags.outputs.commit_tag }}
           last_commit_tag: ${{ needs.store_image_name_and_tags.outputs.last_commit_tag }}
-          common_ancestor_tag: ${{ needs.store_image_name_and_tags.outputs.common_ancestor_tag }}
           develop_tag: ${{ needs.store_image_name_and_tags.outputs.develop_tag }}
-          untested_tag_suffix: ${{ needs.store_image_name_and_tags.outputs.untested_tag_suffix }}
           image_name: consensys/linea-alltools
           last_commit_tag_exists: ${{ needs.check_image_tags_exist.outputs.last_commit_tag_exists }}
-          common_ancestor_commit_tag_exists: ${{ needs.check_image_tags_exist.outputs.common_ancestor_commit_tag_exists }}
           docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
           docker_password: ${{ secrets.DOCKERHUB_TOKEN }}
 

.github/workflows/build-and-publish.yml

@@ -6,18 +6,13 @@ on:
       commit_tag:
         required: true
         type: string
-      last_commit_tag:
-        required: true
-        type: string
-      common_ancestor_tag:
-        required: true
-        type: string
       develop_tag:
         required: true
         type: string
-      untested_tag_suffix:
-        required: true
-        type: string
+      push_image:
+        required: false
+        type: boolean
+        default: false
       coordinator_changed:
         required: true
         type: string
@@ -50,67 +45,57 @@ on:
         type: string
     secrets:
       DOCKERHUB_USERNAME:
-        required: true
+        required: false
       DOCKERHUB_TOKEN:
-        required: true
+        required: false
 
 jobs:
   coordinator:
     uses: ./.github/workflows/coordinator-build-and-publish.yml
     if: ${{ always() && (inputs.coordinator_changed == 'true' || inputs.coordinator_image_tagged != 'true') }}
     with:
       commit_tag: ${{ inputs.commit_tag }}
-      last_commit_tag: ${{ inputs.last_commit_tag }}
-      common_ancestor_tag: ${{ inputs.common_ancestor_tag }}
       develop_tag: ${{ inputs.develop_tag }}
-      untested_tag_suffix: ${{ inputs.untested_tag_suffix }}
       image_name: consensys/linea-coordinator
+      push_image: ${{ inputs.push_image }}
     secrets: inherit
 
   prover:
     uses: ./.github/workflows/prover-build-and-publish.yml
     if: ${{ always() && (inputs.prover_changed == 'true' || inputs.prover_image_tagged != 'true') }}
     with:
       commit_tag: ${{ inputs.commit_tag }}
-      last_commit_tag: ${{ inputs.last_commit_tag }}
-      common_ancestor_tag: ${{ inputs.common_ancestor_tag }}
       develop_tag: ${{ inputs.develop_tag }}
-      untested_tag_suffix: ${{ inputs.untested_tag_suffix }}
       image_name: consensys/linea-prover
+      push_image: ${{ inputs.push_image }}
     secrets: inherit
 
   postman:
     uses: ./.github/workflows/postman-build-and-publish.yml
     if: ${{ always() && (inputs.postman_changed == 'true' || inputs.postman_image_tagged != 'true') }}
     with:
       commit_tag: ${{ inputs.commit_tag }}
-      last_commit_tag: ${{ inputs.last_commit_tag }}
-      common_ancestor_tag: ${{ inputs.common_ancestor_tag }}
       develop_tag: ${{ inputs.develop_tag }}
-      untested_tag_suffix: ${{ inputs.untested_tag_suffix }}
       image_name: consensys/linea-postman
+      push_image: ${{ inputs.push_image }}
     secrets: inherit
 
   traces-api-facade:
     uses: ./.github/workflows/traces-api-facade-build-and-publish.yml
     if: ${{ always() && (inputs.traces_api_facade_changed == 'true' || inputs.traces_api_facade_image_tagged != 'true') }}
     with:
       commit_tag: ${{ inputs.commit_tag }}
-      last_commit_tag: ${{ inputs.last_commit_tag }}
-      common_ancestor_tag: ${{ inputs.common_ancestor_tag }}
       develop_tag: ${{ inputs.develop_tag }}
-      untested_tag_suffix: ${{ inputs.untested_tag_suffix }}
       image_name: consensys/linea-traces-api-facade
+      push_image: ${{ inputs.push_image }}
     secrets: inherit
 
   transaction_exclusion_api:
     uses: ./.github/workflows/transaction-exclusion-api-build-and-publish.yml
     if: ${{ always() && (inputs.transaction_exclusion_api_changed == 'true' || inputs.transaction_exclusion_api_image_tagged != 'true') }}
     with:
       commit_tag: ${{ inputs.commit_tag }}
-      last_commit_tag: ${{ inputs.last_commit_tag }}
-      common_ancestor_tag: ${{ inputs.common_ancestor_tag }}
       develop_tag: ${{ inputs.develop_tag }}
-      untested_tag_suffix: ${{ inputs.untested_tag_suffix }}
       image_name: consensys/linea-transaction-exclusion-api
+      push_image: ${{ inputs.push_image }}
     secrets: inherit

.github/workflows/codeql.yml

@@ -75,3 +75,11 @@ jobs:
       uses: github/codeql-action/analyze@v3
       with:
         category: "/language:${{matrix.language}}"
+        output: sarif-results
+        sarif-file: ${{ matrix.language }}-results.sarif
+    - name: Upload CodeQL Results
+      uses: actions/upload-artifact@v3
+      with:
+        name: codeql-results-${{ matrix.language }}
+        path: sarif-results
+        retention-days: 1