Merge branch 'master' into eero/fixup-services

.github/CODEOWNERS

@@ -16,14 +16,15 @@
 /bin/fuzzing_coverage.sh  @dfinity/product-security
 
 # [Bazel]
+.bazelrc                  @dfinity/idx
+.bazelversion             @dfinity/idx
 /bazel/                   @dfinity/idx
 /bazel/fuzz_testing.bzl   @dfinity/idx @dfinity/product-security
+/BUILD.bazel              @dfinity/idx
 /third_party/             @dfinity/idx
+/mainnet-canisters.json   @dfinity/idx @dfinity/nns-team
+/MODULE.bazel             @dfinity/idx
 /WORKSPACE.bazel          @dfinity/idx
-/mainnet-canisters.bzl    @dfinity/idx @dfinity/nns-team
-/BUILD.bazel              @dfinity/idx
-.bazelrc                  @dfinity/idx
-.bazelversion             @dfinity/idx
 
 # [Rust Lang]
 rust-toolchain.toml       @dfinity/networking
@@ -229,22 +230,22 @@ go_deps.bzl               @dfinity/idx
 /rs/test_utilities/src/cycles_account_manager.rs        @dfinity/execution
 /rs/test_utilities/types/src/batch/                     @dfinity/consensus
 /rs/tests/                                              @dfinity/idx
+/rs/tests/dashboards/IC/execution-metrics.json          @dfinity/execution @dfinity/idx
+/rs/tests/dashboards/IC/bitcoin.json                    @dfinity/execution @dfinity/idx
 /rs/tests/driver/src/driver/simulate_network.rs         @dfinity/networking
 /rs/tests/boundary_nodes/                               @dfinity/boundary-node @dfinity/idx
 /rs/tests/consensus/                                    @dfinity/consensus @dfinity/idx
 /rs/tests/crypto/                                       @dfinity/crypto-team @dfinity/idx
 /rs/tests/dre/                                          @dfinity/dre @dfinity/idx
 /rs/tests/execution/                                    @dfinity/execution @dfinity/idx
 /rs/tests/financial_integrations/                       @dfinity/finint @dfinity/idx
-/rs/tests/gix/                                          @dfinity/idx
 /rs/tests/message_routing/                              @dfinity/ic-message-routing-owners @dfinity/idx
 /rs/tests/networking/                                   @dfinity/networking @dfinity/idx
 /rs/tests/nns/                                          @dfinity/nns-team @dfinity/idx
 /rs/tests/node/                                         @dfinity/node @dfinity/idx
 /rs/tests/query_stats/                                  @dfinity/execution @dfinity/consensus @dfinity/idx
 /rs/tests/sdk/                                          @dfinity/sdk @dfinity/idx
 /rs/tests/src/basic_health_test.rs                      @dfinity/idx
-/rs/tests/src/boundary_nodes/                           @dfinity/boundary-node @dfinity/idx
 /rs/tests/src/btc_integration/                          @dfinity/execution @dfinity/idx
 /rs/tests/src/canister_http/                            @dfinity/networking @dfinity/idx
 /rs/tests/src/canister_sig_verification_cache_test/     @dfinity/crypto-team @dfinity/idx

.github/actions/bazel-test-all/action.yaml

@@ -11,9 +11,6 @@ inputs:
     required: false
     default: '--config=ci'
   BAZEL_EXTRA_ARGS:
-    required: false
-    default: '--keep_going'
-  BAZEL_EXTRA_ARGS_RULES:
     required: false
     default: ''
   BAZEL_STARTUP_ARGS:
@@ -66,7 +63,7 @@ runs:
           BAZEL_COMMAND: ${{ inputs.BAZEL_COMMAND }}
           BAZEL_TARGETS: ${{ inputs.BAZEL_TARGETS }}
           BAZEL_CI_CONFIG: ${{ inputs.BAZEL_CI_CONFIG }}
-          BAZEL_EXTRA_ARGS: "${{ inputs.BAZEL_EXTRA_ARGS }} ${{ inputs.BAZEL_EXTRA_ARGS_RULES }}"
+          BAZEL_EXTRA_ARGS: ${{ inputs.BAZEL_EXTRA_ARGS }}
           BAZEL_STARTUP_ARGS: ${{ inputs.BAZEL_STARTUP_ARGS }}
           CI_PULL_REQUEST_TARGET_BRANCH_NAME: ${{ github.event.pull_request.base.ref }}
           MERGE_BASE_SHA: ${{ github.event.pull_request.base.sha }}

.github/scripts/determine-initial-guest-os-versions.py

@@ -4,14 +4,15 @@
 from typing import Any, Dict, List, Optional, TypedDict, cast
 from urllib.request import urlopen
 
-ROLLOUT_DASHBOARD_ENDPOINT='https://rollout-dashboard.ch1-rel1.dfinity.network/api/v1/rollouts'
-PUBLIC_DASHBOARD_ENDPOINT='https://ic-api.internetcomputer.org/api/v3/subnets?format=json'
+ROLLOUT_DASHBOARD_ENDPOINT = "https://rollout-dashboard.ch1-rel1.dfinity.network/api/v1/rollouts"
+PUBLIC_DASHBOARD_ENDPOINT = "https://ic-api.internetcomputer.org/api/v3/subnets?format=json"
 
 # Key definitions
-EXECUTED_TIMESTAMP_SECONDS = 'executed_timestamp_seconds'
-REPLICA_VERSIONS = 'replica_versions'
-REPLICA_VERSION_ID = 'replica_version_id'
-SUBNETS = 'subnets'
+EXECUTED_TIMESTAMP_SECONDS = "executed_timestamp_seconds"
+REPLICA_VERSIONS = "replica_versions"
+REPLICA_VERSION_ID = "replica_version_id"
+SUBNETS = "subnets"
+
 
 # Minimal subset of API structure needed for rollout dashboard.
 # Always keep me in sync with https://github.com/dfinity/dre-airflow/blob/main/rollout-dashboard/server/src/types.rs
@@ -28,11 +29,13 @@ class SubnetRolloutState(Enum):
     complete = "complete"
     unknown = "unknown"
 
+
 class Subnet(TypedDict):
     subnet_id: str
     git_revision: str
     state: SubnetRolloutState
 
+
 class Batch(TypedDict):
     subnets: List[Subnet]
     # The following three are dates but they are ISO UTF Z,
@@ -41,6 +44,7 @@ class Batch(TypedDict):
     actual_start_time: Optional[str]
     end_time: Optional[str]
 
+
 class RolloutState(Enum):
     complete = "complete"
     failed = "failed"
@@ -50,43 +54,54 @@ class RolloutState(Enum):
     waiting = "waiting"
     problem = "problem"
 
+
 class Rollout(TypedDict):
     name: str
     state: RolloutState
     batches: Dict[str, Batch]
 
+
 # Minimal subset of API structure needed for public dashboard.
 # Swagger for the public dashboard API: https://ic-api.internetcomputer.org/api/v3/swagger .
 class PDReplicaVersion(TypedDict):
     executed_timestamp_seconds: Optional[int]
     proposal_id: str  # really an int
     replica_version_id: str
 
+
 class PDSubnet(TypedDict):
     replica_versions: List[PDReplicaVersion]
     subnet_id: str
 
+
 class PDSubnetsResponse(TypedDict):
     subnets: List[PDSubnet]
 
+
 def eprint(*args, **kwargs):
     print(*args, file=sys.stderr, **kwargs)
 
+
 def eprint_fmt(str, *args):
-    return # remove me to get some real action
+    return  # remove me to get some real action
     print((str % args) if args else str, file=sys.stderr)
 
+
 def request_json(url: str) -> Any:
     resp = urlopen(url, timeout=15)
     if resp.status != 200:
         try:
             data = resp.read()
         except Exception:
             data = None
-        raise RuntimeError("Non-200 HTTP response (%s) from %s: %s" % (resp.status, url, data[:160] if data else "(no data in response)"))
+        raise RuntimeError(
+            "Non-200 HTTP response (%s) from %s: %s"
+            % (resp.status, url, data[:160] if data else "(no data in response)")
+        )
     return json.load(resp)
 
-def fetch_versions_from_rollout_dashboard(): # type: () -> list[str] | None
+
+def fetch_versions_from_rollout_dashboard():  # type: () -> list[str] | None
     """
     Fetch data from rollout dashboard
 
@@ -101,7 +116,7 @@ def fetch_versions_from_rollout_dashboard(): # type: () -> list[str] | None
         return []
 
     # The value of the dict entry is datestring, git revision.
-    subnet_to_revision = {} # type: dict[str, list[tuple[str, str]]]
+    subnet_to_revision = {}  # type: dict[str, list[tuple[str, str]]]
 
     for rollout in reversed(rollouts):  # Oldest to newest
         for batch_num_ignored, batch in rollout["batches"].items():
@@ -119,7 +134,7 @@ def fetch_versions_from_rollout_dashboard(): # type: () -> list[str] | None
                         subnet["git_revision"],
                         subnet["subnet_id"],
                         rollout["name"],
-                        subnet["state"]
+                        subnet["state"],
                     )
                     continue
                 else:
@@ -128,7 +143,7 @@ def fetch_versions_from_rollout_dashboard(): # type: () -> list[str] | None
                         subnet["git_revision"],
                         subnet["subnet_id"],
                         rollout["name"],
-                        subnet["state"]
+                        subnet["state"],
                     )
                 t = batch.get("end_time") or batch.get("actual_start_time") or batch["planned_start_time"]
                 if subnet["subnet_id"] not in subnet_to_revision:
@@ -139,12 +154,17 @@ def fetch_versions_from_rollout_dashboard(): # type: () -> list[str] | None
     # Git revision coupled with the putative date or actual
     # finish date for the revision.  Let's fish the latest
     # revision for each subnet, and get that.
-    return list(set([
-        [revision for unused_date, revision in sorted(datestring_revision_tuple)][-1]
-        for datestring_revision_tuple in subnet_to_revision.values()
-    ]))
+    return list(
+        set(
+            [
+                [revision for unused_date, revision in sorted(datestring_revision_tuple)][-1]
+                for datestring_revision_tuple in subnet_to_revision.values()
+            ]
+        )
+    )
 
-def fetch_versions_from_public_dashboard(): # type: () -> list[str] | None
+
+def fetch_versions_from_public_dashboard():  # type: () -> list[str] | None
     """
     Fetch data from public dashboard
 
@@ -165,7 +185,7 @@ def fetch_versions_from_public_dashboard(): # type: () -> list[str] | None
             latest_replica_version = list(
                 sorted(
                     [r for r in subnet["replica_versions"] if r.get("executed_timestamp_seconds")],
-                    key=lambda rr: rr.get("executed_timestamp_seconds") or 0 # the or 0 to satisfy py3.8 typechecking
+                    key=lambda rr: rr.get("executed_timestamp_seconds") or 0,  # the or 0 to satisfy py3.8 typechecking
                 )
             )[-1]
             versions.add(latest_replica_version["replica_version_id"])
@@ -174,6 +194,7 @@ def fetch_versions_from_public_dashboard(): # type: () -> list[str] | None
 
     return list(versions)
 
+
 def main():
     unique_versions = fetch_versions_from_rollout_dashboard()
     if not unique_versions:
@@ -182,12 +203,13 @@ def main():
 
     if not unique_versions:
         # At this moment if we don't have any starting version we cannot proceed
-        raise RuntimeError(f"Didn't find any versions from:\n\t1. {ROLLOUT_DASHBOARD_ENDPOINT}\n\t2. {PUBLIC_DASHBOARD_ENDPOINT}")
+        raise RuntimeError(
+            f"Didn't find any versions from:\n\t1. {ROLLOUT_DASHBOARD_ENDPOINT}\n\t2. {PUBLIC_DASHBOARD_ENDPOINT}"
+        )
     eprint(f"Will qualify, starting from versions: {json.dumps(unique_versions)}")
-    matrix = {
-        "version": unique_versions
-    }
+    matrix = {"version": unique_versions}
     print(json.dumps(matrix))
 
+
 if __name__ == "__main__":
     main()

.github/scripts/generate-ci.py

@@ -34,7 +34,7 @@ def main():
     for file in os.listdir(workflows_source):
         if file.endswith(".yaml") or file.endswith(".yml"):
             input_file = workflows_source / file
-            output_file = workflows_output /file
+            output_file = workflows_output / file
             transform_yaml(input_file, output_file)
 
 

.github/workflows-source/ci-main.yml

@@ -15,12 +15,11 @@ on:
   workflow_call:
 
 # runs for the same workflow are cancelled on PRs but not on master
+# explanation: on push to master head_ref is not set, so we want it to fall back to run_id so it is not cancelled
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
-permissions: read-all
-
 env:
   CI_COMMIT_SHA: ${{ github.sha }}
   CI_JOB_NAME: ${{ github.job }}
@@ -73,7 +72,7 @@ anchors:
     name: Set up Python
     uses: actions/setup-python@v5
     with:
-      python-version: '3.10'
+      python-version: '3.12'
   bazel-upload: &bazel-upload
     name: Upload bazel-targets
     uses: actions/upload-artifact@v4
@@ -109,19 +108,36 @@ jobs:
       - <<: *checkout
       - <<: *before-script
       - <<: *docker-login
-      - name: Set BAZEL_EXTRA_ARGS_RULES
+      - name: Set BAZEL_EXTRA_ARGS
         shell: bash
         run: |
           set -xeuo pipefail
+
+          # Determine which tests to skip and append 'long_test' for pull requests or merge groups
+          EXCLUDED_TEST_TAGS=(system_test_hourly system_test_nightly system_test_nightly_nns system_test_staging system_test_hotfix system_test_benchmark fuzz_test fi_tests_nightly nns_tests_nightly)
+          [[ "${{ github.event_name }}" =~ ^(pull_request|merge_group)$ ]] && EXCLUDED_TEST_TAGS+=(long_test)
+
+          # Export excluded tags as environment variable for ci/bazel-scripts/diff.sh
+          echo "EXCLUDED_TEST_TAGS=${EXCLUDED_TEST_TAGS[*]}" >> $GITHUB_ENV
+
+          # Prepend tags with '-' and join them with commas for Bazel
+          TEST_TAG_FILTERS=$(IFS=,; echo "${EXCLUDED_TEST_TAGS[*]/#/-}")
+
+          # Determine BAZEL_EXTRA_ARGS based on event type or branch name
+          BAZEL_EXTRA_ARGS="--test_tag_filters=$TEST_TAG_FILTERS"
           if [[ "${{ github.event_name }}" == 'merge_group' ]]; then
-            echo "BAZEL_EXTRA_ARGS_RULES=--test_timeout_filters=short,moderate --flaky_test_attempts=3" >> $GITHUB_ENV
-          fi
-          if [[ $BRANCH_NAME =~ ^hotfix-.* ]]; then
-            echo "BAZEL_EXTRA_ARGS_RULES=--test_timeout_filters=short,moderate" >> $GITHUB_ENV
+              BAZEL_EXTRA_ARGS+=" --test_timeout_filters=short,moderate --flaky_test_attempts=3"
+          elif [[ $BRANCH_NAME =~ ^hotfix-.* ]]; then
+              BAZEL_EXTRA_ARGS+=" --test_timeout_filters=short,moderate"
+          else
+              BAZEL_EXTRA_ARGS+=" --keep_going"
           fi
+
+          # Export BAZEL_EXTRA_ARGS to environment
+          echo "BAZEL_EXTRA_ARGS=$BAZEL_EXTRA_ARGS" >> $GITHUB_ENV
       - name: Run Bazel Test All
         id: bazel-test-all
-        uses:  ./.github/actions/bazel-test-all/
+        uses: ./.github/actions/bazel-test-all/
         env:
           AWS_SHARED_CREDENTIALS_CONTENT: ${{ secrets.AWS_SHARED_CREDENTIALS_FILE }}
           # Only run ci/bazel-scripts/diff.sh on PRs that are not labeled with "CI_ALL_BAZEL_TARGETS".
@@ -132,7 +148,7 @@ jobs:
           BAZEL_TARGETS: "//..."
           BAZEL_CI_CONFIG: "--config=ci --repository_cache=/cache/bazel"
           # check if PR title contains release and set timeout filters accordingly
-          BAZEL_EXTRA_ARGS_RULES: ${{ env.BAZEL_EXTRA_ARGS_RULES || '' }}
+          BAZEL_EXTRA_ARGS: ${{ env.BAZEL_EXTRA_ARGS }}
           BUILDEVENT_APIKEY: ${{ secrets.HONEYCOMB_API_TOKEN }}
       - <<: *bazel-bep
       - <<: *bazel-upload
@@ -155,10 +171,11 @@ jobs:
 
   bazel-test-macos-intel:
     name: Bazel Test macOS Intel
-    timeout-minutes: 120
+    timeout-minutes: 130
     runs-on:
       labels: macOS
-    if: ${{ github.ref_protected && github.repository == 'ic' }} # Run on protected branches, but only on public repo
+    # Run on protected branches, but only on public repo
+    if: ${{ github.ref_protected && github.repository == 'dfinity/ic' }}
     steps:
       - <<: *checkout
       - name: Set PATH
@@ -385,4 +402,22 @@ jobs:
         run: |
           set -eExuo pipefail
           buildevents cmd "$CI_RUN_ID" "$CI_JOB_NAME" build-command -- \
-              cargo build --release
+              cargo build --release --locked
+
+  # CI job is also executed in Schedule Hourly
+  bazel-test-coverage:
+    name: Bazel Test Coverage
+    <<: *dind-large-setup
+    if: |
+      github.event_name == 'pull_request' &&
+      contains(github.event.pull_request.labels.*.name, 'CI_COVERAGE')
+    steps:
+      - <<: *checkout
+      - <<: *before-script
+      - name: Run Bazel Test Coverage
+        shell: bash
+        run: |
+          ./ci/scripts/bazel-coverage.sh
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

.github/workflows-source/ci-pr-only.yml

@@ -5,10 +5,9 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
-permissions: read-all
-
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  # only triggered on PR, so head_ref will always be set
+  group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 env:
   CI_PIPELINE_SOURCE: ${{ github.event_name }}
@@ -144,6 +143,10 @@ jobs:
         with:
           fetch-depth: 256
       - <<: *before-script
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
       - name: Setup python deps
         id: setup-python-deps
         shell: bash