release:v1.27.1

.github/actions/install-go/action.yml

@@ -1,6 +1,11 @@
 name: Install Go
 description: Install Go for Filecoin Lotus
 
+inputs:
+  working-directory:
+    description: Specifies the working directory where the command is run.
+    required: false
+
 runs:
   using: composite
   steps:
@@ -10,6 +15,8 @@ runs:
         cache: false
     - id: go-mod
       uses: ipdxco/unified-github-workflows/.github/actions/read-go-mod@main
+      with:
+        working-directory: ${{ inputs.working-directory || github.workspace }}
     - uses: actions/setup-go@v5
       with:
         go-version: ${{ fromJSON(steps.go-mod.outputs.json).Go }}.x

.github/actions/start-yugabytedb/action.yml

@@ -4,7 +4,7 @@ description: Install Yugabyte Database for Filecoin Lotus
 runs:
   using: composite
   steps:
-    - run: docker run --rm --name yugabyte -d -p 5433:5433 yugabytedb/yugabyte:2.18.0.0-b65 bin/yugabyted start --daemon=false
+    - run: docker run --rm --name yugabyte -d -p 5433:5433 yugabytedb/yugabyte:2.21.0.1-b1 bin/yugabyted start --daemon=false
       shell: bash
     - run: |
         while true; do

.github/pull_request_template.md

@@ -15,7 +15,7 @@ Before you mark the PR ready for review, please make sure that:
 - [ ] PR title is in the form of of `<PR type>: <area>: <change being made>`
   - example: ` fix: mempool: Introduce a cache for valid signatures`
   - `PR type`: fix, feat, build, chore, ci, docs, perf, refactor, revert, style, test
-  - `area`, e.g. api, chain, state, market, mempool, multisig, networking, paych, proving, sealing, wallet, deps
+  - `area`, e.g. api, chain, state, mempool, multisig, networking, paych, proving, sealing, wallet, deps
 - [ ] If the PR affects users (e.g., new feature, bug fix, system requirements change), update the CHANGELOG.md and add details to the UNRELEASED section.
 - [ ] New features have usage guidelines and / or documentation updates in
   - [ ] [Lotus Documentation](https://lotus.filecoin.io)

.github/workflows/build.yml

@@ -16,7 +16,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   build:

.github/workflows/builtin-actor-tests.yml

@@ -8,7 +8,8 @@ on:
     branches:
       - release/*
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   release:

.github/workflows/check.yml

@@ -16,7 +16,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   check-docsgen:
@@ -43,7 +44,6 @@ jobs:
       - uses: ./.github/actions/install-go
       - run: make deps lotus
       - run: go install golang.org/x/tools/cmd/goimports
-      - run: go install github.com/hannahhoward/cbor-gen-for
       - run: make gen
       - run: git diff --exit-code
       - run: make docsgen-cli
@@ -57,7 +57,7 @@ jobs:
           submodules: 'recursive'
       - uses: ./.github/actions/install-system-dependencies
       - uses: ./.github/actions/install-go
-      - run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.58.2
+      - run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.59.0
       - run: make deps
       - run: golangci-lint run -v --timeout 10m --concurrency 4
   check-fmt:

.github/workflows/docker.yml

@@ -10,16 +10,21 @@ on:
   schedule:
     - cron: '0 0 * * *'
   workflow_dispatch:
+    inputs:
+      ref:
+        description: The GitHub ref (e.g. refs/tags/v1.0.0) to release
+        required: false
 
 defaults:
   run:
     shell: bash
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   docker:
-    name: Docker (${{ matrix.image }} / ${{ matrix.network }}) [publish=${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/') }}]
+    name: Docker (${{ matrix.image }} / ${{ matrix.network }}) [publish=${{ (inputs.ref || github.ref) == 'refs/heads/master' || startsWith(inputs.ref || github.ref, 'refs/tags/') }}]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -35,13 +40,13 @@ jobs:
           - image: lotus
             network: mainnet
     env:
-      PUBLISH: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/') }}
+      PUBLISH: ${{ github.ref == 'refs/heads/master' || startsWith(inputs.ref || github.ref, 'refs/tags/') }}
     steps:
       - id: channel
         env:
-          IS_MASTER: ${{ github.ref == 'refs/heads/master' }}
-          IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
-          IS_RC: ${{ endsWith(github.ref, '-rc') }}
+          IS_MASTER: ${{ (inputs.ref || github.ref) == 'refs/heads/master' }}
+          IS_TAG: ${{ startsWith(inputs.ref || github.ref, 'refs/tags/') }}
+          IS_RC: ${{ contains(inputs.ref || github.ref, '-rc') }}
           IS_SCHEDULED: ${{ github.event_name == 'schedule' }}
         run: |
           channel=''
@@ -58,10 +63,20 @@ jobs:
               channel=stable
             fi
           fi
-          echo "channel=$channel" | tee -a $GITHUB_ENV
+          echo "channel=$channel" | tee -a $GITHUB_OUTPUT
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
+          ref: ${{ inputs.ref || github.ref }}
+      - id: git
+        env:
+          REF: ${{ inputs.ref || github.ref }}
+        run: |
+          ref="${REF#refs/heads/}"
+          ref="${ref#refs/tags/}"
+          sha="$(git rev-parse --short HEAD)"
+          echo "ref=$ref" | tee -a "$GITHUB_OUTPUT"
+          echo "sha=$sha" | tee -a "$GITHUB_OUTPUT"
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Docker meta
@@ -70,10 +85,9 @@ jobs:
         with:
           images: filecoin/${{ matrix.image }}
           tags: |
-            type=schedule
-            type=raw,enable=${{ github.event_name != 'schedule' && steps.channel.outputs.channel != '' }},value=${{ steps.channel.outputs.channel }}
-            type=ref,event=tag
-            type=sha,prefix=
+            type=raw,enable=${{ steps.channel.outputs.channel != '' }},value=${{ steps.channel.outputs.channel }}
+            type=raw,enable=${{ startsWith(inputs.ref || github.ref, 'refs/tags/') }},value=${{ steps.git.outputs.ref }}
+            type=raw,value=${{ steps.git.outputs.sha }}
           flavor: |
             latest=false
             suffix=${{ matrix.network != 'mainnet' && format('-{0}', matrix.network) || '' }}

.github/workflows/release.yml

@@ -8,12 +8,17 @@ on:
     tags:
       - v*
   workflow_dispatch:
+    inputs:
+      ref:
+        description: The GitHub ref (e.g. refs/tags/v1.0.0) to release
+        required: false
 
 defaults:
   run:
     shell: bash
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -41,38 +46,61 @@ jobs:
             echo "::error title=Unexpected Runner::Expected $OS/$ARCH, got $RUNNER_OS/$RUNNER_ARCH"
             exit 1
           fi
+      - uses: actions/checkout@v4
+        with:
+          path: actions
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
-      - uses: ./.github/actions/install-system-dependencies
-      - uses: ./.github/actions/install-go
+          ref: ${{ inputs.ref || github.ref }}
+          path: lotus
+      - uses: ./actions/.github/actions/install-system-dependencies
+      - uses: ./actions/.github/actions/install-go
+        with:
+          working-directory: lotus
       - env:
           GITHUB_TOKEN: ${{ github.token }}
         run: make deps lotus lotus-miner lotus-worker
+        working-directory: lotus
       - if: runner.os == 'macOS'
         run: otool -hv lotus
-      - run: ./scripts/version-check.sh ./lotus
+        working-directory: lotus
+      - env:
+          INPUTS_REF: ${{ inputs.ref }}
+        run: |
+          export GITHUB_REF=${INPUTS_REF:-$GITHUB_REF}
+          ../actions/scripts/version-check.sh ./lotus
+        working-directory: lotus
       - uses: actions/upload-artifact@v4
         with:
           name: lotus-${{ matrix.os }}-${{ matrix.arch }}
           path: |
-            lotus
-            lotus-miner
-            lotus-worker
+            lotus/lotus
+            lotus/lotus-miner
+            lotus/lotus-worker
   release:
-    name: Release [publish=${{ startsWith(github.ref, 'refs/tags/') }}]
+    name: Release [publish=${{ startsWith(inputs.ref || github.ref, 'refs/tags/') }}]
     permissions:
       # This enables the job to create and/or update GitHub releases
       contents: write
     runs-on: ubuntu-latest
     needs: [build]
     env:
+<<<<<<< HEAD
       PUBLISH: ${{ startsWith(github.ref, 'refs/tags/') }}
+=======
+      PUBLISH: ${{ startsWith(inputs.ref || github.ref, 'refs/tags/') }}
+>>>>>>> release/v1.27.1
     steps:
+      - uses: actions/checkout@v4
+        with:
+          path: actions
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
           fetch-depth: 0
+          path: lotus
+          ref: ${{ inputs.ref || github.ref }}
       - uses: actions/download-artifact@v4
         with:
           name: lotus-Linux-X64
@@ -85,21 +113,37 @@ jobs:
         with:
           name: lotus-macOS-ARM64
           path: darwin_arm64
+<<<<<<< HEAD
       - uses: ./.github/actions/install-go
+=======
+      - uses: ./actions/.github/actions/install-go
+        with:
+          working-directory: lotus
+>>>>>>> release/v1.27.1
       - uses: ipfs/download-ipfs-distribution-action@v1
         with:
           name: kubo
           version: v0.16.0
       - uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           distribution: goreleaser-pro
-          version: latest
-          args: release --clean --debug ${{ env.PUBLISH == 'false' && '--snapshot' || '' }}
+          version: 2.0.1
+          args: release --clean ${{ env.PUBLISH == 'false' && '--snapshot' || '' }}
+          workdir: lotus
         env:
-          GITHUB_TOKEN: ${{ env.PUBLISH == 'true' && github.token || '' }}
+          GITHUB_TOKEN: ${{ env.PUBLISH == 'true' && secrets.GORELEASER_GITUB_TOKEN || github.token || '' }}
           GORELEASER_KEY: ${{ env.PUBLISH == 'true' && secrets.GORELEASER_KEY || '' }}
-      - run: ./scripts/generate-checksums.sh
+      - env:
+          INPUTS_REF: ${{ inputs.ref }}
+        run: |
+          export GITHUB_REF=${INPUTS_REF:-$GITHUB_REF}
+          ../actions/scripts/generate-checksums.sh
+        working-directory: lotus
       - if: env.PUBLISH == 'true'
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        run: ./scripts/publish-checksums.sh
+          INPUTS_REF: ${{ inputs.ref }}
+        run: |
+          export GITHUB_REF=${INPUTS_REF:-$GITHUB_REF}
+          ../actions/scripts/publish-checksums.sh
+        working-directory: lotus

.github/workflows/sorted-pr-checks.yml

@@ -17,15 +17,17 @@ on:
       - completed
 
 permissions:
+  actions: read
+  checks: read
   pull-requests: write
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.inputs.pull_number || github.event.workflow_run.pull_requests[0].number || 'unknown' }}
+  group: ${{ github.workflow }}-${{ github.event.inputs.pull_number || github.event.workflow_run.pull_requests[0].number }}
   cancel-in-progress: true
 
 jobs:
   comment:
-    if: github.event.inputs.pull_number || github.event.workflow_run.pull_requests[0]
+    if: github.event.inputs.pull_number || github.event.workflow_run.event == 'pull_request'
     uses: ipdxco/sorted-pr-checks/.github/workflows/comment.yml@v1
     with:
       pull_number: ${{ github.event.inputs.pull_number || github.event.workflow_run.pull_requests[0].number }}

.github/workflows/stale.yml

@@ -4,7 +4,8 @@ on:
   schedule:
   - cron: '0 12 * * *'
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   stale:

.github/workflows/sync-master-main.yaml

@@ -5,7 +5,8 @@ on:
     branches:
       - master
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   sync:

.github/workflows/test.yml

@@ -16,7 +16,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   discover:
@@ -96,6 +97,7 @@ jobs:
               "itest-get_messages_in_ts": ["self-hosted", "linux", "x64", "xlarge"],
               "itest-lite_migration": ["self-hosted", "linux", "x64", "xlarge"],
               "itest-lookup_robust_address": ["self-hosted", "linux", "x64", "xlarge"],
+              "itest-manual_onboarding": ["self-hosted", "linux", "x64", "xlarge"],
               "itest-mempool": ["self-hosted", "linux", "x64", "xlarge"],
               "itest-mpool_msg_uuid": ["self-hosted", "linux", "x64", "xlarge"],
               "itest-mpool_push_with_uuid": ["self-hosted", "linux", "x64", "xlarge"],
@@ -115,7 +117,7 @@ jobs:
             }
           # A list of test groups that require YugabyteDB to be running
           yugabytedb: |
-            ["itest-harmonydb", "itest-harmonytask", "itest-curio"]
+            ["itest-harmonydb"]
           # A list of test groups that require Proof Parameters to be fetched
           parameters: |
             [
@@ -128,6 +130,7 @@ jobs:
               "itest-deals",
               "itest-direct_data_onboard_verified",
               "itest-direct_data_onboard",
+              "itest-manual_onboarding",
               "itest-net",
               "itest-path_detach_redeclare",
               "itest-path_type_filters",
@@ -144,7 +147,8 @@ jobs:
               "itest-worker",
               "multicore-sdr",
               "unit-cli",
-              "unit-storage"
+              "unit-storage",
+              "itest-curio"
             ]
         run: |
           # Create a list of integration test groups
@@ -203,7 +207,7 @@ jobs:
           echo -e "path<<EOF\n$CACHE_PATH\nEOF" | tee -a $GITHUB_OUTPUT
       - id: make_deps
         env:
-          CACHE_KEY: ${{ runner.os }}-${{ runner.arch }}-make-deps-${{ hashFiles('./extern/filecoin-ffi/install-filcrypto') }}-${{ hashFiles('./extern/filecoin-ffi/rust/rustc-target-features-optimized.json') }}
+          CACHE_KEY: ${{ runner.os }}-${{ runner.arch }}-make-deps-${{ hashFiles('./.git/modules/extern/filecoin-ffi/HEAD') }}
           CACHE_PATH: |
             ./extern/filecoin-ffi/filcrypto.h
             ./extern/filecoin-ffi/libfilcrypto.a