feat: re-fork cometbft-bera onto the v0.40.x line

.github/workflows/build.yml

@@ -24,10 +24,10 @@ jobs:
         goos: ["linux"]
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: filter
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           filters: |
             code:
@@ -38,7 +38,7 @@ jobs:
       - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
         if: steps.filter.outputs.code == 'true'
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         if: steps.filter.outputs.code == 'true'
         with:
           go-version: ${{ env.GO_VERSION }}

.github/workflows/check-generated.yml

@@ -20,11 +20,11 @@ jobs:
   check-mocks-metrics:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -48,13 +48,13 @@ jobs:
   check-proto:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1  # we need a .git directory to run git diff
 
       - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
 

.github/workflows/compat-rolling-upgrade.yml

@@ -0,0 +1,103 @@
+# Runs test/compat/rolling_upgrade.sh: a live bera-v1.x <-> bera-v0.40.x
+# data-dir reuse and 4-validator rolling-upgrade test (built-in kvstore app,
+# no beacon-kit). See test/compat/README.md.
+#
+# Runs on every pull request that touches Go code (like tests.yml and e2e.yml)
+# and on pushes to the release branches. The bera-v1.x side is the commit
+# pinned in test/compat/gen-v1x/go.mod; the bera-v0.40.x side is this checkout.
+
+name: compat-rolling-upgrade
+on:
+  workflow_dispatch:
+    inputs:
+      soak_blocks:
+        description: "Blocks to soak at each stage (SOAK_BLOCKS)"
+        required: false
+        default: "25"
+  pull_request:
+  merge_group:
+  push:
+    branches:
+      - main
+      - bera-v[0-9]*.x
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  rolling-upgrade:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    env:
+      WORKDIR: ${{ github.workspace }}/build/compat
+    steps:
+      # Check out the PR/branch head, which is the bera-v0.40.x side of the test.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # Skip the whole job unless Go code, the compat suite, or this file changed.
+      - id: filter
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          filters: |
+            code:
+              - '**/*.go'
+              - 'Makefile'
+              - 'go.*'
+              - 'test/compat/**'
+              - '.github/workflows/compat-rolling-upgrade.yml'
+
+      # Read the Go version from the shared env file used by the other workflows.
+      - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
+        if: steps.filter.outputs.code == 'true'
+
+      # Install Go and cache modules for both this checkout and the bera-v1.x pin.
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        if: steps.filter.outputs.code == 'true'
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: |
+            go.sum
+            test/compat/gen-v1x/go.sum
+
+      # Reverse direction: write this fork's outputs, check they match the committed file, verify them with the bera-v1.x code.
+      - name: Verify bera-v1.x reads bera-v0.40.x outputs
+        if: steps.filter.outputs.code == 'true'
+        run: |
+          mkdir -p "$WORKDIR"
+          BERA_COMPAT_WRITE_OUTPUTS="$WORKDIR/bera_v040_outputs.json" go test -tags bls12381 -count=1 -run TestWriteV040Outputs ./test/compat/
+          cmp "$WORKDIR/bera_v040_outputs.json" test/compat/vectors/bera_v040_outputs.json \
+            || { echo "::error::test/compat/vectors/bera_v040_outputs.json is stale, regenerate it (see test/compat/README.md)"; exit 1; }
+          cd test/compat/gen-v1x
+          go vet .
+          go run . -verify ../vectors/bera_v040_outputs.json
+
+      # Build both binaries and run Phase A (data-dir reuse) and Phase B (rolling upgrade).
+      - name: Run rolling upgrade
+        if: steps.filter.outputs.code == 'true'
+        env:
+          SOAK_BLOCKS: ${{ github.event.inputs.soak_blocks || '25' }}
+        run: test/compat/rolling_upgrade.sh "$WORKDIR"
+
+      # Always keep the per-stage report, pass or fail.
+      - name: Archive report
+        if: ${{ always() && steps.filter.outputs.code == 'true' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: compat-report
+          path: ${{ env.WORKDIR }}/report.md
+          if-no-files-found: ignore
+          retention-days: 14
+
+      # On failure also keep node logs and configs (binaries and data dirs excluded).
+      - name: Archive node logs and configs
+        if: ${{ failure() && steps.filter.outputs.code == 'true' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: compat-workdir
+          path: |
+            ${{ env.WORKDIR }}/**/*.log
+            ${{ env.WORKDIR }}/**/config/*.toml
+            ${{ env.WORKDIR }}/**/config/genesis.json
+          if-no-files-found: ignore
+          retention-days: 7

.github/workflows/docker-build-cometbft.yml

@@ -60,13 +60,13 @@ jobs:
           TAGS=$(echo "${{ needs.vars.outputs.tags }}" | sed "s/[^,]*/&-${{ matrix.arch }}/g")
           echo "tags=${TAGS}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v7
-      - uses: docker/login-action@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/build-push-action@v7
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         id: build
         with:
           platforms: linux/${{ matrix.arch }}
@@ -84,7 +84,7 @@ jobs:
       - vars
       - build-images
     steps:
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/docker-build-e2e-node.yml

@@ -60,13 +60,13 @@ jobs:
           TAGS=$(echo "${{ needs.vars.outputs.tags }}" | sed "s/[^,]*/&-${{ matrix.arch }}/g")
           echo "tags=${TAGS}" >> $GITHUB_OUTPUT
 
-      - uses: actions/checkout@v7
-      - uses: docker/login-action@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/build-push-action@v7
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         id: build
         with:
           platforms: linux/${{ matrix.arch }}
@@ -84,7 +84,7 @@ jobs:
       - vars
       - build-images
     steps:
-      - uses: docker/login-action@v4
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}

.github/workflows/docs-toc.yml

@@ -10,8 +10,8 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: technote-space/get-diff-action@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: technote-space/get-diff-action@f27caffdd0fb9b13f4fc191c016bb4e0632844af # v6.1.2
         with:
           PATTERNS: |
             docs/architecture/**

.github/workflows/e2e-manual-multiversion.yml

@@ -12,14 +12,14 @@ jobs:
       fail-fast: false
       matrix:
         group: ['00', '01', '02', '03', '04', '05']
-    runs-on: depot-ubuntu-24.04-4
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.22'
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build
         working-directory: test/e2e

.github/workflows/e2e-manual.yml

@@ -12,14 +12,14 @@ jobs:
       fail-fast: false
       matrix:
         group: ['00', '01', '02', '03', '04', '05']
-    runs-on: depot-ubuntu-24.04-4
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.22'
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build
         working-directory: test/e2e

.github/workflows/e2e-nightly-main.yml

@@ -17,14 +17,14 @@ jobs:
       fail-fast: false
       matrix:
         group: ['00', '01', '02', '03', '04', '05']
-    runs-on: depot-ubuntu-24.04-4
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify Slack on failure
-        uses: slackapi/slack-github-action@v4.0.0
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         env:
           BRANCH: ${{ github.ref_name }}
           RUN_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

.github/workflows/e2e.yml

@@ -22,13 +22,13 @@ jobs:
       fail-fast: false
       matrix:
         group: ['networks/ci', 'networks/libp2p-ci', 'networks_regressions/*']
-    runs-on: depot-ubuntu-24.04-4
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: filter
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           filters: |
             code:
@@ -39,7 +39,7 @@ jobs:
       - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
         if: steps.filter.outputs.code == 'true'
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         if: steps.filter.outputs.code == 'true'
         with:
           go-version: ${{ env.GO_VERSION }}

.github/workflows/enforce_signed.yml

@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Verify all PR commits are signed
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { owner, repo } = context.repo;

.github/workflows/fuzz-nightly.yml

@@ -16,12 +16,12 @@ concurrency:
 
 jobs:
   fuzz-nightly-test:
-    runs-on: depot-ubuntu-24.04-4
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -55,14 +55,14 @@ jobs:
         continue-on-error: true
 
       - name: Archive crashers
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: crashers
           path: test/fuzz/**/crashers
           retention-days: 3
 
       - name: Archive suppressions
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: suppressions
           path: test/fuzz/**/suppressions
@@ -82,7 +82,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify Slack on failure
-        uses: slackapi/slack-github-action@v4.0.0
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         env:
           BRANCH: ${{ github.ref_name }}
           CRASHERS: ${{ needs.fuzz-nightly-test.outputs.crashers-count }}

.github/workflows/integration_tests.yml

@@ -16,10 +16,10 @@ jobs:
   integration_tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: filter
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           filters: |
             code:
@@ -30,7 +30,7 @@ jobs:
       - run: echo "GO_VERSION=$(cat .github/workflows/go-version.env | grep GO_VERSION | cut -d '=' -f2)" >> $GITHUB_ENV
         if: steps.filter.outputs.code == 'true'
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         if: steps.filter.outputs.code == 'true'
         with:
           go-version: ${{ env.GO_VERSION }}

.github/workflows/janitor.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 3
     steps:
-      - uses: styfle/cancel-workflow-action@0.13.1
+      - uses: styfle/cancel-workflow-action@d07a454dad7609a92316b57b23c9ccfd4f59af66 # 0.13.1
         with:
           workflow_id: 1041851,1401230,2837803
           access_token: ${{ github.token }}