Enable workflows to request a TEE

.mockery.yaml

@@ -38,13 +38,12 @@ packages:
   github.com/smartcontractkit/chainlink-common/pkg/workflows/wasm/host:
     interfaces:
       ModuleV1: {}
-      ModuleV2: {}
+  github.com/smartcontractkit/chainlink-common/pkg/workflows/host:
+    interfaces:
+      Module: {}
       ExecutionHelper:
         config:
-          inpackage: true
-          filename: "mock_{{.InterfaceName | snakecase}}_test.go"
-          mockname: "Mock{{.InterfaceName}}"
-          dir: "{{.InterfaceDir}}"
+            mockname: "Mock{{.InterfaceName}}"
   github.com/smartcontractkit/chainlink-common/pkg/custmsg:
     interfaces:
       MessageEmitter:
@@ -64,4 +63,4 @@ packages:
       dir: "{{.InterfaceDir}}/limits"
       outpkg: limits
     interfaces:
-      Getter:
+      Getter:

pkg/capabilities/v2/protoc/pkg/template_generator.go

@@ -139,9 +139,9 @@ func (t *TemplateGenerator) runTemplate(name, tmplText string, args any, partial
 
 			if md == nil {
 				return false, nil
-			} else {
-				return md.MapToUntypedApi, nil
 			}
+
+			return md.MapToUntypedApi, nil
 		},
 		"addImport": func(importPath protogen.GoImportPath, ignore string) string {
 			importName := importPath.String()
@@ -259,6 +259,13 @@ func (t *TemplateGenerator) runTemplate(name, tmplText string, args any, partial
 				return line
 			}
 		},
+		"TeeEnabled": func(s *protogen.Service) (bool, error) {
+			md, err := getCapabilityMetadata(s)
+			if err != nil {
+				return false, err
+			}
+			return slices.Contains(md.AdditionalEnvironments, generator.AdditionalEnvironments_ADDITIONAL_ENVIRONMENTS_TEE), nil
+		},
 	}).Funcs(t.ExtraFns)
 
 	// Register partials

pkg/workflows/artifacts/artifacts_test.go

@@ -45,8 +45,9 @@ func (s *ArtifactsTestSuite) TestArtifacts() {
 
 	s.lggr.Info("WorkflowCompiledBinary Size", "size", len(b64EncodedBinaryData))
 
-	// Compare the keccak256 hash of the binary data with the keccak256 hash of the
-	// base64 encoded binary from CRE-CLI
+	// Compare the keccak256 hash of the binary data against a value produced by
+	// the pinned Go toolchain (see GetBuildCmd in utils.go). Because Compile sets
+	// GOTOOLCHAIN from the nearest go.mod, this hash is stable across machines.
 	expKeccak256Hash, err := hex.DecodeString("a057a58ff8212122016515b2922b7c3893525f7f5afe95c8442e0cd629d68420")
 	s.NoError(err, "failed to decode expected keccak256 hash")
 	keccak256FromSha3Lib := sha3.NewLegacyKeccak256()
@@ -58,8 +59,7 @@ func (s *ArtifactsTestSuite) TestArtifacts() {
 	s.NoError(err, "failed to prepare artifacts")
 
 	base64EncodedBinaryData := artifacts.GetBinaryData()
-	// Compare if the compiled WASM binary is the same as the CRE-CLI output
-	s.Len(base64EncodedBinaryData, 636684, "binary data size should be same as CRE-CLI output")
+	s.Len(base64EncodedBinaryData, 636684, "binary data size should match the pinned toolchain output")
 	s.Equal("m1upG3s6AJQvOA8AAK295+EaARsHAADf/YcBgFURwPQAANDq5wFQVVVVVVVVVVVV3ZMQEI7ZtgMAAKqq",
 		string(base64EncodedBinaryData[0:80]))
 	s.Equal("gUEoFNoVRfyHGTsZmdg7wCJbGVibOhmYmsDAytgg92FTTmiddpI/x8SYzdANBkPGhtLoj/Hn7jvK26YE",

pkg/workflows/artifacts/utils.go

@@ -1,6 +1,7 @@
 package artifacts
 
 import (
+	"bufio"
 	"fmt"
 	"os"
 	"os/exec"
@@ -78,10 +79,66 @@ func GetBuildCmd(inputFile string, outputFile string, rootFolder string) *exec.C
 			"-buildvcs=false",
 			inputFile,
 		)
-		buildCmd.Env = append(os.Environ(), "GOOS=wasip1", "GOARCH=wasm", "CGO_ENABLED=0")
+		env := append(os.Environ(), "GOOS=wasip1", "GOARCH=wasm", "CGO_ENABLED=0")
+		// Pin GOTOOLCHAIN so the compiled WASM is reproducible. Prefer the
+		// configured GOTOOLCHAIN; when it's unset, fall back to the version
+		// declared in the module's go.mod (the local Go version wouldn't pin).
+		if toolchain := goToolchain(rootFolder); toolchain != "" {
+			env = append(env, "GOTOOLCHAIN="+toolchain)
+		}
+		buildCmd.Env = env
 	}
 
 	buildCmd.Dir = rootFolder
 
 	return buildCmd
 }
+
+// goToolchain returns a GOTOOLCHAIN value (e.g. "go1.26.2") to pin the build
+// to. It prefers the configured `go env GOTOOLCHAIN`; when that is unset (e.g.
+// "auto") it falls back to the go version declared in the module's go.mod. The
+// local Go version is not used as a fallback because it would not pin a
+// reproducible toolchain. Returns "" when nothing can be determined.
+func goToolchain(dir string) string {
+	if v := goEnv(dir, "GOTOOLCHAIN"); v != "" && v != "auto" {
+		return v
+	}
+	return goToolchainFromMod(dir)
+}
+
+// goEnv runs `go env <name>` in dir and returns the trimmed value, or "" on error.
+func goEnv(dir, name string) string {
+	cmd := exec.Command("go", "env", name)
+	cmd.Dir = dir
+	out, err := cmd.Output()
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(out))
+}
+
+// goToolchainFromMod returns a GOTOOLCHAIN value derived from the go directive
+// in the module's go.mod, located via `go env GOMOD`. Returns "" when no go.mod
+// or go version can be determined.
+func goToolchainFromMod(dir string) string {
+	goModPath := goEnv(dir, "GOMOD")
+	// `go env GOMOD` returns "" outside a module and os.DevNull when modules
+	// are disabled (GO111MODULE=off); neither is a real go.mod file.
+	if goModPath == "" || goModPath == os.DevNull {
+		return ""
+	}
+	f, err := os.Open(goModPath)
+	if err != nil {
+		return ""
+	}
+	defer f.Close()
+
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		if len(fields) == 2 && fields[0] == "go" {
+			return "go" + fields[1]
+		}
+	}
+	return ""
+}