Enable workflows to request a TEE

.mockery.yaml

@@ -38,13 +38,12 @@ packages:
   github.com/smartcontractkit/chainlink-common/pkg/workflows/wasm/host:
     interfaces:
       ModuleV1: {}
-      ModuleV2: {}
+  github.com/smartcontractkit/chainlink-common/pkg/workflows/host:
+    interfaces:
+      Module: {}
       ExecutionHelper:
         config:
-          inpackage: true
-          filename: "mock_{{.InterfaceName | snakecase}}_test.go"
-          mockname: "Mock{{.InterfaceName}}"
-          dir: "{{.InterfaceDir}}"
+            mockname: "Mock{{.InterfaceName}}"
   github.com/smartcontractkit/chainlink-common/pkg/custmsg:
     interfaces:
       MessageEmitter:
@@ -64,4 +63,4 @@ packages:
       dir: "{{.InterfaceDir}}/limits"
       outpkg: limits
     interfaces:
-      Getter:
+      Getter:

pkg/beholder/chip_ingress_emitter.go

@@ -43,7 +43,7 @@ func (c ChipIngressEmitterConfig) New(client chipingress.Client) (Emitter, error
 
 	return &ChipIngressEmitter{
 		client: client,
-		lggr:    lggr,
+		lggr:   lggr,
 		stopCh: make(services.StopChan),
 	}, nil
 }

pkg/beholder/client_test.go

@@ -936,7 +936,7 @@ func TestClient_batchEmitterService(t *testing.T) {
 	newBatchClient := func(t *testing.T) *beholder.Client {
 		t.Helper()
 		client, err := beholder.NewClient(beholder.Config{
-			OtelExporterGRPCEndpoint:       "localhost:4317",
+			OtelExporterGRPCEndpoint: "localhost:4317",
 			// Use simple exporter in this lifecycle test to avoid batch flush/shutdown delays.
 			EmitterBatchProcessor:          false,
 			LogBatchProcessor:              false,

pkg/beholder/config.go

@@ -26,7 +26,7 @@ type Config struct {
 	EmitterMaxQueueSize       int
 	// EmitterBatchProcessor controls custom-message export mode:
 	// true = batched async export; false = immediate per-record export.
-	EmitterBatchProcessor     bool
+	EmitterBatchProcessor bool
 
 	// OTel Trace
 	TraceSampleRatio  float64
@@ -127,7 +127,7 @@ func DefaultConfig() Config {
 		EmitterExportInterval:     1 * time.Second,
 		EmitterMaxQueueSize:       2048,
 		// Keep batched export enabled by default for throughput.
-		EmitterBatchProcessor:     true,
+		EmitterBatchProcessor: true,
 		// OTel message log exporter retry config
 		LogRetryConfig: defaultRetryConfig.Copy(),
 		// Trace
@@ -148,8 +148,8 @@ func DefaultConfig() Config {
 		LogMaxQueueSize:       2048,
 		LogBatchProcessor:     true,
 		LogStreamingEnabled:   true, // Enable logs streaming by default
-		LogLevel:      zapcore.InfoLevel,
-		LogCompressor: "gzip",
+		LogLevel:              zapcore.InfoLevel,
+		LogCompressor:         "gzip",
 		// Chip Ingress Batch Emitter
 		ChipIngressBatchEmitterEnabled: false,
 		ChipIngressBufferSize:          1000,

pkg/capabilities/errors/error_codes.go

@@ -144,44 +144,44 @@ func (e ErrorCode) String() string {
 }
 
 var errorCodeToString = map[ErrorCode]string{
-	Canceled:           "Canceled",
-	Unknown:            "Unknown",
-	InvalidArgument:    "InvalidArgument",
-	DeadlineExceeded:   "DeadlineExceeded",
-	NotFound:           "NotFound",
-	AlreadyExists:      "AlreadyExists",
-	PermissionDenied:   "PermissionDenied",
-	ResourceExhausted:  "ResourceExhausted",
-	FailedPrecondition: "FailedPrecondition",
-	Aborted:            "Aborted",
-	OutOfRange:         "OutOfRange",
-	Unimplemented:      "Unimplemented",
-	Internal:           "Internal",
-	Unavailable:        "Unavailable",
-	DataLoss:           "DataLoss",
-	Unauthenticated:    "Unauthenticated",
+	Canceled:                 "Canceled",
+	Unknown:                  "Unknown",
+	InvalidArgument:          "InvalidArgument",
+	DeadlineExceeded:         "DeadlineExceeded",
+	NotFound:                 "NotFound",
+	AlreadyExists:            "AlreadyExists",
+	PermissionDenied:         "PermissionDenied",
+	ResourceExhausted:        "ResourceExhausted",
+	FailedPrecondition:       "FailedPrecondition",
+	Aborted:                  "Aborted",
+	OutOfRange:               "OutOfRange",
+	Unimplemented:            "Unimplemented",
+	Internal:                 "Internal",
+	Unavailable:              "Unavailable",
+	DataLoss:                 "DataLoss",
+	Unauthenticated:          "Unauthenticated",
 	ConsensusFailed:          "ConsensusFailed",
 	LimitExceeded:            "LimitExceeded",
 	InsufficientObservations: "InsufficientObservations",
 }
 
 var stringToErrorCode = map[string]ErrorCode{
-	"Canceled":           Canceled,
-	"Unknown":            Unknown,
-	"InvalidArgument":    InvalidArgument,
-	"DeadlineExceeded":   DeadlineExceeded,
-	"NotFound":           NotFound,
-	"AlreadyExists":      AlreadyExists,
-	"PermissionDenied":   PermissionDenied,
-	"ResourceExhausted":  ResourceExhausted,
-	"FailedPrecondition": FailedPrecondition,
-	"Aborted":            Aborted,
-	"OutOfRange":         OutOfRange,
-	"Unimplemented":      Unimplemented,
-	"Internal":           Internal,
-	"Unavailable":        Unavailable,
-	"DataLoss":           DataLoss,
-	"Unauthenticated":    Unauthenticated,
+	"Canceled":                 Canceled,
+	"Unknown":                  Unknown,
+	"InvalidArgument":          InvalidArgument,
+	"DeadlineExceeded":         DeadlineExceeded,
+	"NotFound":                 NotFound,
+	"AlreadyExists":            AlreadyExists,
+	"PermissionDenied":         PermissionDenied,
+	"ResourceExhausted":        ResourceExhausted,
+	"FailedPrecondition":       FailedPrecondition,
+	"Aborted":                  Aborted,
+	"OutOfRange":               OutOfRange,
+	"Unimplemented":            Unimplemented,
+	"Internal":                 Internal,
+	"Unavailable":              Unavailable,
+	"DataLoss":                 DataLoss,
+	"Unauthenticated":          Unauthenticated,
 	"ConsensusFailed":          ConsensusFailed,
 	"LimitExceeded":            LimitExceeded,
 	"InsufficientObservations": InsufficientObservations,

pkg/capabilities/v2/actions/confidentialrelay/types.go

@@ -10,8 +10,9 @@ import (
 	"hash"
 	"sort"
 
-	"github.com/smartcontractkit/chainlink-common/pkg/teeattestation"
 	"github.com/smartcontractkit/libocr/ragep2p/peeridhelper"
+
+	"github.com/smartcontractkit/chainlink-common/pkg/teeattestation"
 )
 
 const (

pkg/capabilities/v2/protoc/pkg/template_generator.go

@@ -139,9 +139,9 @@ func (t *TemplateGenerator) runTemplate(name, tmplText string, args any, partial
 
 			if md == nil {
 				return false, nil
-			} else {
-				return md.MapToUntypedApi, nil
 			}
+
+			return md.MapToUntypedApi, nil
 		},
 		"addImport": func(importPath protogen.GoImportPath, ignore string) string {
 			importName := importPath.String()
@@ -259,6 +259,18 @@ func (t *TemplateGenerator) runTemplate(name, tmplText string, args any, partial
 				return line
 			}
 		},
+		"TeeEnabled": func(s *protogen.Service) (bool, error) {
+			md, err := getCapabilityMetadata(s)
+			if err != nil {
+				return false, err
+			}
+			for _, env := range md.AdditionalEnvironments {
+				if env == generator.AdditionalEnvironments_ADDITIONAL_ENVIRONMENTS_TEE {
+					return true, nil
+				}
+			}
+			return false, nil
+		},
 	}).Funcs(t.ExtraFns)
 
 	// Register partials

pkg/chipingress/batch/client.go

@@ -36,18 +36,18 @@ type Client struct {
 	maxGRPCRequestSize      int // configured max, used for metrics/error reporting
 	effectiveMaxRequestSize int // maxGRPCRequestSize minus grpcFramingOverhead, used for splitting
 	cloneEvent              bool
-	maxConcurrentSends chan struct{}
-	batchInterval      time.Duration
-	maxPublishTimeout  time.Duration
-	messageBuffer      chan *messageWithCallback
-	stopCh             stopCh
-	log                *zap.SugaredLogger
-	callbackWg         sync.WaitGroup
-	shutdownTimeout    time.Duration
-	shutdownOnce       sync.Once
-	batcherDone        chan struct{}
-	started            bool
-	counters           sync.Map // map[seqnumKey]*atomic.Uint64 for per-(source,type) seqnum, cleared on Stop()
+	maxConcurrentSends      chan struct{}
+	batchInterval           time.Duration
+	maxPublishTimeout       time.Duration
+	messageBuffer           chan *messageWithCallback
+	stopCh                  stopCh
+	log                     *zap.SugaredLogger
+	callbackWg              sync.WaitGroup
+	shutdownTimeout         time.Duration
+	shutdownOnce            sync.Once
+	batcherDone             chan struct{}
+	started                 bool
+	counters                sync.Map // map[seqnumKey]*atomic.Uint64 for per-(source,type) seqnum, cleared on Stop()
 
 	metrics batchClientMetrics
 }
@@ -77,14 +77,14 @@ func NewBatchClient(client chipingress.Client, opts ...Opt) (*Client, error) {
 		maxGRPCRequestSize:      10 * 1024 * 1024,
 		effectiveMaxRequestSize: 10*1024*1024 - grpcFramingOverhead,
 		cloneEvent:              true,
-		maxConcurrentSends: make(chan struct{}, 1),
-		messageBuffer:      make(chan *messageWithCallback, 200),
-		batchInterval:      100 * time.Millisecond,
-		maxPublishTimeout:  5 * time.Second,
-		stopCh:             make(chan struct{}),
-		callbackWg:         sync.WaitGroup{},
-		shutdownTimeout:    5 * time.Second,
-		batcherDone:        make(chan struct{}),
+		maxConcurrentSends:      make(chan struct{}, 1),
+		messageBuffer:           make(chan *messageWithCallback, 200),
+		batchInterval:           100 * time.Millisecond,
+		maxPublishTimeout:       5 * time.Second,
+		stopCh:                  make(chan struct{}),
+		callbackWg:              sync.WaitGroup{},
+		shutdownTimeout:         5 * time.Second,
+		batcherDone:             make(chan struct{}),
 	}
 
 	for _, opt := range opts {

pkg/workflows/artifacts/artifacts_test.go

@@ -45,8 +45,9 @@ func (s *ArtifactsTestSuite) TestArtifacts() {
 
 	s.lggr.Info("WorkflowCompiledBinary Size", "size", len(b64EncodedBinaryData))
 
-	// Compare the keccak256 hash of the binary data with the keccak256 hash of the
-	// base64 encoded binary from CRE-CLI
+	// Compare the keccak256 hash of the binary data against a value produced by
+	// the pinned Go toolchain (see GetBuildCmd in utils.go). Because Compile sets
+	// GOTOOLCHAIN from the nearest go.mod, this hash is stable across machines.
 	expKeccak256Hash, err := hex.DecodeString("a057a58ff8212122016515b2922b7c3893525f7f5afe95c8442e0cd629d68420")
 	s.NoError(err, "failed to decode expected keccak256 hash")
 	keccak256FromSha3Lib := sha3.NewLegacyKeccak256()
@@ -58,8 +59,7 @@ func (s *ArtifactsTestSuite) TestArtifacts() {
 	s.NoError(err, "failed to prepare artifacts")
 
 	base64EncodedBinaryData := artifacts.GetBinaryData()
-	// Compare if the compiled WASM binary is the same as the CRE-CLI output
-	s.Len(base64EncodedBinaryData, 636684, "binary data size should be same as CRE-CLI output")
+	s.Len(base64EncodedBinaryData, 636684, "binary data size should match the pinned toolchain output")
 	s.Equal("m1upG3s6AJQvOA8AAK295+EaARsHAADf/YcBgFURwPQAANDq5wFQVVVVVVVVVVVV3ZMQEI7ZtgMAAKqq",
 		string(base64EncodedBinaryData[0:80]))
 	s.Equal("gUEoFNoVRfyHGTsZmdg7wCJbGVibOhmYmsDAytgg92FTTmiddpI/x8SYzdANBkPGhtLoj/Hn7jvK26YE",

pkg/workflows/artifacts/utils.go

@@ -1,6 +1,7 @@
 package artifacts
 
 import (
+	"bufio"
 	"fmt"
 	"os"
 	"os/exec"
@@ -78,10 +79,66 @@ func GetBuildCmd(inputFile string, outputFile string, rootFolder string) *exec.C
 			"-buildvcs=false",
 			inputFile,
 		)
-		buildCmd.Env = append(os.Environ(), "GOOS=wasip1", "GOARCH=wasm", "CGO_ENABLED=0")
+		env := append(os.Environ(), "GOOS=wasip1", "GOARCH=wasm", "CGO_ENABLED=0")
+		// Pin GOTOOLCHAIN so the compiled WASM is reproducible. Prefer the
+		// configured GOTOOLCHAIN; when it's unset, fall back to the version
+		// declared in the module's go.mod (the local Go version wouldn't pin).
+		if toolchain := goToolchain(rootFolder); toolchain != "" {
+			env = append(env, "GOTOOLCHAIN="+toolchain)
+		}
+		buildCmd.Env = env
 	}
 
 	buildCmd.Dir = rootFolder
 
 	return buildCmd
 }
+
+// goToolchain returns a GOTOOLCHAIN value (e.g. "go1.26.2") to pin the build
+// to. It prefers the configured `go env GOTOOLCHAIN`; when that is unset (e.g.
+// "auto") it falls back to the go version declared in the module's go.mod. The
+// local Go version is not used as a fallback because it would not pin a
+// reproducible toolchain. Returns "" when nothing can be determined.
+func goToolchain(dir string) string {
+	if v := goEnv(dir, "GOTOOLCHAIN"); v != "" && v != "auto" {
+		return v
+	}
+	return goToolchainFromMod(dir)
+}
+
+// goEnv runs `go env <name>` in dir and returns the trimmed value, or "" on error.
+func goEnv(dir, name string) string {
+	cmd := exec.Command("go", "env", name)
+	cmd.Dir = dir
+	out, err := cmd.Output()
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(out))
+}
+
+// goToolchainFromMod returns a GOTOOLCHAIN value derived from the go directive
+// in the module's go.mod, located via `go env GOMOD`. Returns "" when no go.mod
+// or go version can be determined.
+func goToolchainFromMod(dir string) string {
+	goModPath := goEnv(dir, "GOMOD")
+	// `go env GOMOD` returns "" outside a module and os.DevNull when modules
+	// are disabled (GO111MODULE=off); neither is a real go.mod file.
+	if goModPath == "" || goModPath == os.DevNull {
+		return ""
+	}
+	f, err := os.Open(goModPath)
+	if err != nil {
+		return ""
+	}
+	defer f.Close()
+
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		if len(fields) == 2 && fields[0] == "go" {
+			return "go" + fields[1]
+		}
+	}
+	return ""
+}