Skip to content

Plug in workflow restrictions to TEEs#22965

Merged
nolag merged 23 commits into
developfrom
rtinianov_rtinianov_teeRuntimeAndRestrictions
Jun 26, 2026
Merged

Plug in workflow restrictions to TEEs#22965
nolag merged 23 commits into
developfrom
rtinianov_rtinianov_teeRuntimeAndRestrictions

Conversation

@nolag

@nolag nolag commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

No description provided.

nolag added 16 commits April 27, 2026 10:34
@nolag
Use TEE runtime to determine if workflows should run in confidential …
86432ab 
…module or not
@nolag
Update to new SDK and module that uses subscriptions
689aa30
@nolag
Update common
4d115e3
@nolag
Update common
5944bb6
@nolag
Regions, and fixup confidential module
ba154d6
@nolag
Update common to allow regions in any tee
53e611e
@nolag
unspecified tee type
fa5782f
@nolag
Forward restrictions to TEE for it's best-effort enforcement before s…
792fd9d 
…ending to the DON. The DON will still enforce if the TEE doesn't
@nolag
Update go mods
416f83b
@nolag
Merge branch 'develop' into rtinianov_rtinianov_teeRuntimeAndRestrict…
7a58446 
…ions
@nolag
Use the module's execution helper for capabilites and secrets
01e28d8
@nolag
Merge branch 'develop' into rtinianov_rtinianov_teeRuntimeAndRestrict…
34b103a 
…ions
@nolag
update cre-sdk
4e2e8cd
@nolag
Merge branch 'develop' into rtinianov_rtinianov_teeRuntimeAndRestrict…
5113248 
…ions
@nolag
undo refromatting of untouched files
bb27547
@nolag
undo refromatting of untouched files
69b2471
@nolag nolag requested review from a team as code owners June 25, 2026 15:20
@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

👋 nolag, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

@github-actions

github-actions Bot commented Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CORA - Pending Reviewers

All codeowners have approved! ✅

Legend: ✅ Approved | ❌ Changes Requested | 💬 Commented | 🚫 Dismissed | ⏳ Pending | ❓ Unknown

For more details, see the full review summary.

@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

I see you updated files related to core. Please run make gocs in the root directory to add a changeset as well as in the text include at least one of the following tags:

  • #added For any new functionality added.
  • #breaking_change For any functionality that requires manual action for the node to boot.
  • #bugfix For bug fixes.
  • #changed For any change to the existing functionality.
  • #db_update For any feature that introduces updates to database schema.
  • #deprecation_notice For any upcoming deprecation functionality.
  • #internal For changesets that need to be excluded from the final changelog.
  • #nops For any feature that is NOP facing and needs to be in the official Release Notes for the release.
  • #removed For any functionality/config that is removed.
  • #updated For any functionality that is updated.
  • #wip For any change that is not ready yet and external communication about it should be held off till it is feature complete.

@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

✅ No conflicts with other open PRs targeting develop

@trunk-io

trunk-io Bot commented Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Static Badge   Static Badge   Static Badge   Static Badge

Failed Test Failure Summary Logs
Test_CCIPTokenTransfer_Sui2EVM_LockReleaseTokenPool_Revert Logs ↗︎

View Full Report ↗︎ ⋅ Docs

@nolag nolag enabled auto-merge June 25, 2026 16:20
@nolag nolag force-pushed the rtinianov_rtinianov_teeRuntimeAndRestrictions branch from e1fb1ec to 254cebf Compare June 25, 2026 17:52
vreff
vreff reviewed Jun 26, 2026
View reviewed changes
Comment thread core/services/workflows/v2/confidential_module.go
OrgId: contexts.CREValue(ctx).Org,
Requirements: requirements,
BinaryUrl: m.binaryURL,
Restrictions: restrictions,

@vreff vreff Jun 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

where are these actually checked? In a different PR?

@nolag nolag Jun 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, this is a proto in chainlink-protos. We pull in the generated code from chainlink-common.

This PR, you may need to expand the file.

@vreff vreff Jun 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, but where does the relay check the restrictions against the secrets requested? Has that already been merged?

@nolag nolag Jun 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's checked here, common does the heavy lifting when you create the module here. Core was already updated to use the selecting module :).

@vreff vreff Jun 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cool!

@nolag nolag requested a review from vreff June 26, 2026 14:12
vreff
vreff previously approved these changes Jun 26, 2026
View reviewed changes
bolekk
bolekk previously approved these changes Jun 26, 2026
View reviewed changes
@nolag nolag dismissed stale reviews from bolekk and vreff via df143e5 June 26, 2026 18:59
@cl-sonarqube-production

cl-sonarqube-production Bot commented Jun 26, 2026

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
2 New issues
1 Fixed issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.2% Duplication on New Code

See analysis details on SonarQube

@nolag nolag added this pull request to the merge queue Jun 26, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jun 26, 2026
@nolag nolag added this pull request to the merge queue Jun 26, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jun 26, 2026
@nolag nolag added this pull request to the merge queue Jun 26, 2026
Merged via the queue into develop with commit 3ce708b Jun 26, 2026
221 of 225 checks passed
@nolag nolag deleted the rtinianov_rtinianov_teeRuntimeAndRestrictions branch June 26, 2026 20:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@DylanTinianov DylanTinianov DylanTinianov approved these changes
@vreff vreff vreff approved these changes
@bolekk bolekk bolekk left review comments
@kalverra kalverra Awaiting requested review from kalverra
@russell-stern russell-stern Awaiting requested review from russell-stern

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@nolag @bolekk @DylanTinianov @vreff