bump zombienet-sdk version

.github/scripts/release/release_lib.sh

@@ -195,6 +195,9 @@ function get_s3_url_base() {
       eth-rpc)
         printf "releases.parity.io/eth-rpc"
         ;;
+      subkey)
+        printf "releases.parity.io/subkey"
+        ;;
       *)
         printf "UNSUPPORTED BINARY $name"
         exit 1

.github/workflows/check-semver.yml

@@ -11,7 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  TOOLCHAIN: nightly-2025-01-26
+  TOOLCHAIN: nightly-2025-05-09
 
 jobs:
   isdraft:
@@ -78,7 +78,7 @@ jobs:
 
       - name: Install parity-publish
         # Set the target dir to cache the build.
-        run: CARGO_TARGET_DIR=./target/ cargo install parity-publish@0.10.5 --locked -q
+        run: CARGO_TARGET_DIR=./target/ cargo install parity-publish@0.10.6 --locked -q
 
       - name: Get original PR number
         shell: bash

.github/workflows/publish-check-compile.yml

@@ -38,14 +38,49 @@ jobs:
 
       - name: install parity-publish
         run: |
-          cargo install parity-publish@0.10.4 --locked -q
+          cargo install parity-publish@0.10.6 --locked -q
 
-      - name: parity-publish update plan
-        run: parity-publish --color always plan --skip-check --prdoc prdoc/
+      - name: set current PR's prdoc name in a variable
+        env:
+          GITHUB_PR_NUM: ${{ github.event.pull_request.number }}
+        run: |
+          echo "CURRENT_PRDOC=pr_${GITHUB_PR_NUM}.prdoc" >> $GITHUB_ENV
 
-      - name: parity-publish apply plan
+      - name: parity-publish update plan w/o current prdoc
+        run: |
+          if [ -f prdoc/$CURRENT_PRDOC ]; then
+            mv prdoc/$CURRENT_PRDOC .
+          fi
+          parity-publish --color always plan --skip-check --prdoc prdoc/
+
+      # The code base is not in master's state (due to commits brought by the
+      # current PR), but we're interested in all master's prdocs to be applied
+      # as if master is a stable branch, and in next steps we're following up with
+      # a patch release of all crates based on some newly added prdocs
+      # (meaning only the current prdoc).
+      - name: parity-publish apply plan on the code state prior to current prdoc
         run: parity-publish --color always apply --registry
 
+      - name: move all prdocs except current one to unstable dir
+        run: |
+          if [ -f $CURRENT_PRDOC ]; then
+            mkdir prdoc/unstable
+            mv prdoc/pr_*.prdoc prdoc/unstable
+            mv $CURRENT_PRDOC prdoc
+          fi
+
+      - name: parity-publish update plan just for PR's prdoc
+        run: |
+          if [ -f "prdoc/$CURRENT_PRDOC" ]; then
+            parity-publish --color always plan --skip-check --prdoc prdoc/
+          fi
+
+      - name: parity-publish apply plan
+        run: |
+          if [ -f "prdoc/$CURRENT_PRDOC" ]; then
+            parity-publish --color always apply --registry
+          fi
+
       - name: parity-publish check compile
         run: |
           packages="$(parity-publish apply --print)"

.github/workflows/publish-check-crates.yml

@@ -27,7 +27,7 @@ jobs:
           cache-on-failure: true
 
       - name: install parity-publish
-        run: cargo install parity-publish@0.10.4 --locked -q
+        run: cargo install parity-publish@0.10.6 --locked -q
 
       - name: parity-publish check
         run: parity-publish --color always check --allow-unpublished

.github/workflows/release-20_build-rc.yml

@@ -15,6 +15,7 @@ on:
           - chain-spec-builder
           - substrate-node
           - eth-rpc
+          - subkey
           - all
 
       release_tag:
@@ -163,6 +164,21 @@ jobs:
       attestations: write
       contents: read
 
+  build-subkey-binary:
+    needs: [validate-inputs]
+    if: ${{ inputs.binary == 'subkey' || inputs.binary == 'all' }}
+    uses: "./.github/workflows/release-reusable-rc-build.yml"
+    with:
+      binary: '["subkey"]'
+      package: subkey
+      release_tag: ${{ needs.validate-inputs.outputs.release_tag }}
+      target: x86_64-unknown-linux-gnu
+    secrets: inherit
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
+
   build-polkadot-macos-binary:
     needs: [validate-inputs]
     if: ${{ inputs.binary == 'polkadot' || inputs.binary == 'all' }}
@@ -268,3 +284,18 @@ jobs:
       id-token: write
       attestations: write
       contents: read
+
+  build-subkey-macos-binary:
+    needs: [validate-inputs]
+    if: ${{ inputs.binary == 'subkey' || inputs.binary == 'all' }}
+    uses: "./.github/workflows/release-reusable-rc-build.yml"
+    with:
+      binary: '["subkey"]'
+      package: subkey
+      release_tag: ${{ needs.validate-inputs.outputs.release_tag }}
+      target: aarch64-apple-darwin
+    secrets: inherit
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read

.github/workflows/release-22_combined-rc-runtime-builds-release-draft.yml

@@ -41,6 +41,7 @@ on:
           - chain-spec-builder
           - substrate-node
           - eth-rpc
+          - subkey
           - all
       release_tag:
         description: Tag matching the actual release candidate with the format polkadot-stableYYMM(-X)-rcY or polkadot-stableYYMM(-X)

.github/workflows/release-build-binary.yml

@@ -66,11 +66,12 @@ jobs:
           PROFILE=${{ inputs.profile }}
           if [ "${{ inputs.binary }}" = "polkadot" ]; then
               for binary in polkadot polkadot-prepare-worker polkadot-execute-worker; do
-                  echo "Building $binary..."
-                  ./.github/scripts/release/build-linux-release.sh $binary ${{ inputs.package }} "${PROFILE}" ${{ inputs.features }}
+                  echo "Building $binary with profile $PROFILE and features ${{ inputs.features }}"
+                  ./.github/scripts/release/build-linux-release.sh $binary ${{ inputs.package }} ${{ inputs.features }}
               done
           else
-            ./.github/scripts/release/build-linux-release.sh ${{ inputs.binary }} ${{ inputs.package }} "${PROFILE}" ${{ inputs.features }}
+            echo "Building ${{ inputs.binary }} with profile $PROFILE and features ${{ inputs.features }}"
+            ./.github/scripts/release/build-linux-release.sh ${{ inputs.binary }} ${{ inputs.package }} ${{ inputs.features }}
           fi
 
       - name: Upload ${{ inputs.binary }} artifacts

.github/workflows/release-reusable-rc-build.yml

@@ -301,10 +301,7 @@ jobs:
       package: ${{ inputs.package }}
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-polkadot-parachain-artifacts-to-s3:
     if: ${{ inputs.package == 'polkadot-parachain-bin' && inputs.target == 'x86_64-unknown-linux-gnu' }}
@@ -314,10 +311,7 @@ jobs:
       package: polkadot-parachain
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-polkadot-omni-node-artifacts-to-s3:
     if: ${{ inputs.package == 'polkadot-omni-node' && inputs.target == 'x86_64-unknown-linux-gnu' }}
@@ -327,10 +321,7 @@ jobs:
       package: ${{ inputs.package }}
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-frame-omni-bencher-artifacts-to-s3:
     if: ${{ inputs.package == 'frame-omni-bencher' && inputs.target == 'x86_64-unknown-linux-gnu' }}
@@ -340,10 +331,7 @@ jobs:
       package: ${{ inputs.package }}
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-chain-spec-builder-artifacts-to-s3:
     if: ${{ inputs.package == 'staging-chain-spec-builder' && inputs.target == 'x86_64-unknown-linux-gnu' }}
@@ -353,10 +341,7 @@ jobs:
       package: chain-spec-builder
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-substrate-node-artifacts-to-s3:
     if: ${{ inputs.package == 'staging-node-cli' && inputs.target == 'x86_64-unknown-linux-gnu' }}
@@ -366,10 +351,7 @@ jobs:
       package: substrate-node
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-eth-rpc-artifacts-to-s3:
     if: ${{ inputs.package == 'pallet-revive-eth-rpc' && inputs.target == 'x86_64-unknown-linux-gnu' }}
@@ -379,10 +361,17 @@ jobs:
       package: eth-rpc
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
+
+  upload-subkey-artifacts-to-s3:
+    if: ${{ inputs.package == 'subkey' && inputs.target == 'x86_64-unknown-linux-gnu' }}
+    needs: [build-rc]
+    uses: ./.github/workflows/release-reusable-s3-upload.yml
+    with:
+      package: subkey
+      release_tag: ${{ inputs.release_tag }}
+      target: ${{ inputs.target }}
+    secrets: inherit
 
   upload-polkadot-macos-artifacts-to-s3:
     if: ${{ inputs.package == 'polkadot' && inputs.target == 'aarch64-apple-darwin' }}
@@ -394,10 +383,7 @@ jobs:
       package: ${{ inputs.package }}
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-polkadot-prepare-worker-macos-artifacts-to-s3:
     if: ${{ inputs.package == 'polkadot' && inputs.target == 'aarch64-apple-darwin' }}
@@ -407,10 +393,7 @@ jobs:
       package: polkadot-prepare-worker
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-polkadot-execute-worker-macos-artifacts-to-s3:
     if: ${{ inputs.package == 'polkadot' && inputs.target == 'aarch64-apple-darwin' }}
@@ -420,10 +403,10 @@ jobs:
       package: polkadot-execute-worker
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
+      # AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
+      # AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
+      # AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
 
   upload-polkadot-omni-node-macos-artifacts-to-s3:
     if: ${{ inputs.package == 'polkadot-omni-node' && inputs.target == 'aarch64-apple-darwin' }}
@@ -433,10 +416,7 @@ jobs:
       package: ${{ inputs.package }}
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-polkadot-parachain-macos-artifacts-to-s3:
     if: ${{ inputs.package == 'polkadot-parachain-bin' && inputs.target == 'aarch64-apple-darwin' }}
@@ -446,10 +426,7 @@ jobs:
       package: polkadot-parachain
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-frame-omni-bencher-macos-artifacts-to-s3:
     if: ${{ inputs.package == 'frame-omni-bencher' && inputs.target == 'aarch64-apple-darwin' }}
@@ -459,10 +436,10 @@ jobs:
       package: ${{ inputs.package }}
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
+      # AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
+      # AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
+      # AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
 
   upload-chain-spec-builder-macos-artifacts-to-s3:
     if: ${{ inputs.package == 'staging-chain-spec-builder' && inputs.target == 'aarch64-apple-darwin' }}
@@ -472,10 +449,7 @@ jobs:
       package: chain-spec-builder
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
 
   upload-substrate-node-macos-artifacts-to-s3:
     if: ${{ inputs.package == 'staging-node-cli' && inputs.target == 'aarch64-apple-darwin' }}
@@ -485,10 +459,10 @@ jobs:
       package: substrate-node
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
+      # AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
+      # AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
+      # AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
 
   upload-eth-rpc-macos-artifacts-to-s3:
     if: ${{ inputs.package == 'pallet-revive-eth-rpc' && inputs.target == 'aarch64-apple-darwin' }}
@@ -498,7 +472,14 @@ jobs:
       package: eth-rpc
       release_tag: ${{ inputs.release_tag }}
       target: ${{ inputs.target }}
-    secrets:
-      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-      AWS_RELEASE_ACCESS_KEY_ID: ${{ secrets.AWS_RELEASE_ACCESS_KEY_ID }}
-      AWS_RELEASE_SECRET_ACCESS_KEY: ${{ secrets.AWS_RELEASE_SECRET_ACCESS_KEY }}
+    secrets: inherit
+
+  upload-subkey-macos-artifacts-to-s3:
+    if: ${{ inputs.package == 'subkey' && inputs.target == 'aarch64-apple-darwin' }}
+    needs: [build-macos-rc]
+    uses: ./.github/workflows/release-reusable-s3-upload.yml
+    with:
+      package: subkey
+      release_tag: ${{ inputs.release_tag }}
+      target: ${{ inputs.target }}
+    secrets: inherit

.github/workflows/release-reusable-s3-upload.yml

@@ -18,14 +18,6 @@ on:
         required: true
         type: string
 
-    secrets:
-      AWS_DEFAULT_REGION:
-        required: true
-      AWS_RELEASE_ACCESS_KEY_ID:
-        required: true
-      AWS_RELEASE_SECRET_ACCESS_KEY:
-        required: true
-
 jobs:
   upload-artifacts-to-s3:
       runs-on: ubuntu-latest