fix: merge main to base

.github/workflows/backport.yml

@@ -0,0 +1,38 @@
+# Adapted from https://github.com/marketplace/actions/backporting
+#
+# Usage: 
+#   - Let's say you want to backport a pull request on a branch named `production`.
+#   - Then label it with `backport production`.
+#   - That's it! When the pull request gets merged, it will be backported to 
+#     the `production` branch. If the pull request cannot be backported, a comment 
+#     explaining why will automatically be posted.
+#
+# Note: multiple backport labels can be added. For example, if a pull request 
+#       has the labels `backport staging` and `backport production` it will be 
+#       backported to both branches: `staging` and `production`.
+name: Backport
+on:
+  pull_request_target:
+    types:
+      - closed
+      - labeled
+
+jobs:
+  backport:
+    name: Backport
+    runs-on: ubuntu-latest
+    # Only react to merged PRs for security reasons.
+    # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
+    if: >
+      github.event.pull_request.merged
+      && (
+        github.event.action == 'closed'
+        || (
+          github.event.action == 'labeled'
+          && contains(github.event.label.name, 'backport')
+        )
+      )
+    steps:
+      - uses: tibdex/backport@v2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/changelog-reminder.yml

@@ -0,0 +1,11 @@
+name: Changelog Reminder
+on:
+  pull_request:
+    types: [assigned, opened, synchronize, reopened, labeled, unlabeled]
+    branches:
+      - main
+
+jobs:
+  changelog_reminder:
+    uses: babylonlabs-io/.github/.github/workflows/[email protected]
+    secrets: inherit

.github/workflows/ci.yml

@@ -14,6 +14,9 @@ jobs:
       go-lint-version: 'v1.60.2'
       run-unit-tests: true
       run-lint: true
+      run-build: true
+      run-gosec: true
+      gosec-args: "-exclude-generated -exclude-dir=itest -exclude-dir=testutil ./..."
 
   e2e_babylon:
     runs-on: ubuntu-22.04
@@ -26,17 +29,6 @@ jobs:
       - name: Run e2e Babylon tests
         run: make test-e2e-babylon
 
-  e2e_wasmd:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.23'
-      - name: Run e2e Wasmd tests
-        run: make test-e2e-wasmd
-
   e2e_bcd:
     runs-on: ubuntu-22.04
     steps:
@@ -64,3 +56,5 @@ jobs:
     secrets: inherit
     with:
       publish: false
+      dockerfile: ./Dockerfile
+      repoName: finality-provider

.github/workflows/goreleaser.yml

@@ -0,0 +1,11 @@
+name: goreleaser
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  release:
+    uses: babylonlabs-io/.github/.github/workflows/[email protected]
+    secrets: inherit

.github/workflows/publish.yml

@@ -16,6 +16,9 @@ jobs:
       go-lint-version: 'v1.60.2'
       run-unit-tests: true
       run-lint: true
+      run-build: true
+      run-gosec: true
+      gosec-args: "-exclude-generated -exclude-dir=itest -exclude-dir=testutil ./..."
 
   e2e_babylon:
     runs-on: ubuntu-22.04
@@ -28,17 +31,6 @@ jobs:
       - name: Run e2e Babylon tests
         run: make test-e2e-babylon
 
-  e2e_wasmd:
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.23'
-      - name: Run e2e Wasmd tests
-        run: make test-e2e-wasmd
-
   e2e_bcd:
     runs-on: ubuntu-22.04
     steps:
@@ -66,7 +58,15 @@ jobs:
 
   docker_pipeline:
     needs: ["lint_test"]
-    uses: babylonlabs-io/.github/.github/workflows/reusable_docker_pipeline.yml@v0.7.0
+    uses: babylonlabs-io/.github/.github/workflows/reusable_docker_pipeline.yml@v0.10.2
     secrets: inherit
     with:
       publish: true
+      dockerfile: ./Dockerfile
+      repoName: finality-provider
+      docker_scan: true
+    permissions:
+      # required for all workflows
+      security-events: write
+      # required to fetch internal or private CodeQL packs
+      packages: read

.gitignore

@@ -29,5 +29,6 @@ devnet-data/
 main
 tmp/
 build/
+dist/
 
 *.swp

.golangci.yml

@@ -1,6 +1,86 @@
 run:
-  build-tags: 
+  build-tags:
     - e2e_op
     - e2e_babylon
     - e2e_bcd
     - e2e_wasmd
+  timeout: 5m
+
+linters:
+  disable-all: true
+  enable:
+    - asasalint
+    - asciicheck
+    - bidichk
+    - bodyclose
+    - containedctx
+    - contextcheck
+    - decorder
+    - dogsled
+    - durationcheck
+    - errcheck
+    - errchkjson
+    - errname
+    - errorlint
+    - exhaustive
+    - forbidigo
+    - forcetypeassert
+    - goconst
+    - gocritic
+    - gocyclo
+    - goheader
+    - gomodguard
+    - goprintffuncname
+    - gosimple
+    - govet
+    - grouper
+    - importas
+    - ineffassign
+    - loggercheck
+    - maintidx
+    - makezero
+    - misspell
+    - nakedret
+    - nilerr
+    - nlreturn
+    - noctx
+    - nonamedreturns
+    - nosprintfhostport
+    - paralleltest
+    - reassign
+    - revive
+    - rowserrcheck
+    - sqlclosecheck
+    - staticcheck
+    - stylecheck
+    - tenv
+    - testableexamples
+    - tparallel
+    - typecheck
+    - unconvert
+    - unparam
+    - usestdlibvars
+    - unused
+    - wastedassign
+    - whitespace
+#    - wrapcheck # we really should be using this, lax for now todo(lazar): unlax at somepoint, good practice
+
+issues:
+  max-same-issues: 0
+  # Default: https://golangci-lint.run/usage/false-positives/#default-exclusions
+  exclude-dirs:
+    - e2etest
+    - itest
+  exclude-rules:
+    # Exclude some linters from running on tests files.
+    - path: _test\.go
+      linters:
+        - gocyclo
+        - errcheck
+        - dupl
+        - gosec
+        - nonamedreturns
+        - unparam
+    - path-except: _test\.go
+      linters:
+        - forbidigo

.goreleaser.yml

@@ -0,0 +1,73 @@
+project_name: finality-provider
+
+builds:
+  - id: fpd-linux-amd64
+    main: ./finality-provider/cmd/fpd/main.go
+    binary: fpd
+    hooks:
+      pre:
+        - wget https://github.com/CosmWasm/wasmvm/releases/download/{{ .Env.COSMWASM_VERSION }}/libwasmvm_muslc.x86_64.a -O /usr/lib/libwasmvm_muslc.x86_64.a
+    goos:
+      - linux
+    goarch:
+      - amd64
+    env:
+      - GO111MODULE=on
+    flags:
+      - -mod=readonly
+      - -trimpath
+    tags:
+      - netgo
+      - osusergo
+
+  - id: eotsd-linux-amd64
+    main: ./eotsmanager/cmd/eotsd/main.go
+    binary: eotsd
+    hooks:
+      pre:
+        - wget https://github.com/CosmWasm/wasmvm/releases/download/{{ .Env.COSMWASM_VERSION }}/libwasmvm_muslc.x86_64.a -O /usr/lib/libwasmvm_muslc.x86_64.a
+    goos:
+      - linux
+    goarch:
+      - amd64
+    env:
+      - GO111MODULE=on
+    flags:
+      - -mod=readonly
+      - -trimpath
+    tags:
+      - netgo
+      - osusergo
+
+archives:
+  - id: zipped
+    builds:
+      - fpd-linux-amd64
+      - eotsd-linux-amd64
+    name_template: "{{.ProjectName}}-{{ .Version }}-{{ .Os }}-{{ .Arch }}"
+    format: tar.gz
+    files:
+      - none*
+  - id: binaries
+    builds:
+      - fpd-linux-amd64
+      - eotsd-linux-amd64
+    name_template: "{{.ProjectName}}-{{ .Version }}-{{ .Os }}-{{ .Arch }}"
+    format: binary
+    files:
+      - none*
+
+checksum:
+  name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
+  algorithm: sha256
+
+release:
+  github:
+    owner: babylonlabs-io
+    name: finality-provider
+
+# Docs: https://goreleaser.com/customization/changelog/
+changelog:
+  disable: true
+
+dist: dist

.trivyignore

@@ -0,0 +1,5 @@
+# LND < 0.17.0 issue, not fixing
+CVE-2024-27304
+GHSA-7jwh-3vrq-q3m8
+CVE-2024-27289
+CVE-2024-38359