Merge pull request #43 from kaleido-io/merge-v1-develop

Merge v1 develop into release-v1-develop

Author: annamcallister

.github/WORKFLOWS.md

@@ -54,13 +54,13 @@ Once changes are merged into the `main` branch, workflows prepare the project fo
   Detects documentation updates and publishes the latest content to the documentation site.
 
 ## Release Time
-Paladin follows a two-stage release process to ensure quality and stability:
+Paladin follows a two-stage release process to ensure quality and stability. All releases are triggered through the **[Release Entry Point](https://github.com/LFDT-Paladin/paladin/actions/workflows/release-entry.yaml)** workflow due to the way npm trusted publishing works.
 
-### [Stage 1: Release Candidate (RC)](https://github.com/LFDT-Paladin/paladin/actions/workflows/release-candidate.yaml)
+### Stage 1: Release Candidate (RC)
 Release candidates are created first for testing and validation:
 
 - **[Release Candidate Workflow](workflows/release-candidate.yaml):**  
-  Triggered by an RC tag (e.g., `v1.2.3-rc.1`), this workflow creates pre-releases:
+  Triggered via the Release Entry Point with `release_type=rc`, this workflow creates pre-releases:
   - **[Release Docker Images](workflows/release-images.yaml):**  
     Builds and **publishes Docker images** tagged with the RC version (e.g., `v1.2.3-rc.1`).
     - **Registries:** 
@@ -75,11 +75,11 @@ Release candidates are created first for testing and validation:
     Packages contract ABIs and deployment artifacts for distribution.
   - **GitHub Release:** Creates a pre-release with all artifacts
 
-### [Stage 2: Final Release](https://github.com/LFDT-Paladin/paladin/actions/workflows/release.yaml)
+### Stage 2: Final Release
 Once the RC has been tested and validated, the final release can be created:
 
 - **[Release Orchestrator](workflows/release.yaml):**  
-  Triggered by a final version tag (e.g., `v1.2.3`), this workflow coordinates the final release:
+  Triggered via the Release Entry Point with `release_type=final`, this workflow coordinates the final release:
   - **[Release Docker Images](workflows/release-images.yaml):**  
     Builds and **publishes Docker images** tagged with the release version (e.g., `v1.2.3`) and `latest`.
     - **Registries:** 
@@ -101,29 +101,45 @@ Once the RC has been tested and validated, the final release can be created:
 
 ## How to Create a Release
 
+All releases are triggered through the unified **[Release Entry Point](https://github.com/LFDT-Paladin/paladin/actions/workflows/release-entry.yaml)** workflow.
+
 ### Quick Start: Release Process
 Follow these steps to create a new Paladin release:
 
 #### Step 1: Create a Release Candidate
-1. Go to **[Actions → Release Candidate](https://github.com/LFDT-Paladin/paladin/actions/workflows/release-candidate.yaml)**
+1. Go to **[Actions → Release Entry Point](https://github.com/LFDT-Paladin/paladin/actions/workflows/release-entry.yaml)**
 2. Click **"Run workflow"**
-3. Enter the RC tag (e.g., `v1.2.3-rc.1`)
+3. Fill in the required fields:
+   - **release_type**: Select `rc`
+   - **tag**: RC tag (e.g., `v1.2.3-rc.1`)
 4. Click **"Run workflow"**
 5. Wait for the workflow to complete and test the RC thoroughly
 
 #### Step 2: Create the Final Release
-1. Go to **[Actions → Release](https://github.com/LFDT-Paladin/paladin/actions/workflows/release.yaml)**
+1. Go to **[Actions → Release Entry Point](https://github.com/LFDT-Paladin/paladin/actions/workflows/release-entry.yaml)**
 2. Click **"Run workflow"**
 3. Fill in the required fields:
+   - **release_type**: Select `final`
    - **tag**: Final release version (e.g., `v1.2.3`)
    - **rc_tag**: The RC tag you tested (e.g., `v1.2.3-rc.1`)
    - **latest**: Check if this should be marked as the latest release
 4. Click **"Run workflow"**
 
+#### SDK-Only Release (Optional)
+To release only the TypeScript SDK without a full release:
+1. Go to **[Actions → Release Entry Point](https://github.com/LFDT-Paladin/paladin/actions/workflows/release-entry.yaml)**
+2. Click **"Run workflow"**
+3. Fill in the required fields:
+   - **release_type**: Select `sdk`
+   - **tag**: SDK version (e.g., `v1.2.3`)
+   - **sdk_dist_tags**: NPM dist-tags, semicolon-separated (e.g., `latest` or `rc;rc.1`)
+   - **ref**: (Optional) Commit ref for checkout, defaults to workflow branch
+4. Click **"Run workflow"**
+
 ### Example Release Flow
 ```
-1. Create RC:     v1.2.3-rc.1  → Test thoroughly
-2. Final Release: v1.2.3       → Built from v1.2.3-rc.1
+1. Create RC:     release_type=rc, tag=v1.2.3-rc.1  → Test thoroughly
+2. Final Release: release_type=final, tag=v1.2.3, rc_tag=v1.2.3-rc.1
 ```
 
 ### Important Release Process Notes:
@@ -239,12 +255,10 @@ You will publish a Helm chart version `0.11.0-fix.0` that points to images built
 ## Manual Actions 🛠️
 Workflows can also be triggered manually when needed. Available options include:
 
+- **[Release Entry Point](workflows/release-entry.yaml)** (RC, final, and SDK releases)
 - **[Test Rollout](workflows/test-rollout.yaml)** (Version rollout testing)
-- **[Release Orchestrator](workflows/release.yaml)** (Final releases)
-- **[Release Candidate](workflows/release-candidate.yaml)** (RC releases)
 - **[Release Docker Images](workflows/release-images.yaml)**
 - **[Release Helm Chart](workflows/release-charts.yaml)**
-- **[Release TypeScript SDK](workflows/release-typescript-sdk.yaml)**
 - **[Release Solidity Contracts](workflows/release-solidity-contracts.yaml)**
 - **[Build Helm Chart](workflows/build-chart.yaml)**
 - **[Build Docker Images](workflows/build-image.yaml)**  

.github/actions/print-disk-usage/action.yml

@@ -0,0 +1,11 @@
+name: 'Print Disk Usage'
+description: 'Prints current disk usage statistics.'
+runs:
+  using: "composite"
+  steps:
+    - name: Print disk usage
+      shell: bash
+      run: |
+        echo "--- Disk Usage ---"
+        df -h
+

.github/workflows/build-chart.yaml

@@ -98,6 +98,9 @@ jobs:
             -PpaladinImageName=${{ inputs.paladin-image }} \
             -PpaladinImageTag=${{ inputs.paladin-image-tag }} \
             -PdeleteCluster=false
+     
+      - name: Print disk usage
+        uses: ./.github/actions/print-disk-usage
 
       - name: Port-forward pprof endpoints
         if: failure()
@@ -155,5 +158,4 @@ jobs:
             cm-3.json
             goroutine_dump_node1.txt
             goroutine_dump_node2.txt
-            goroutine_dump_node3.txt
-            
+            goroutine_dump_node3.txt

.github/workflows/build-image.yaml

@@ -72,6 +72,9 @@ jobs:
           echo "push: ${{ inputs.push }}"
           echo "platforms: ${{ inputs.platforms }}"
 
+      - name: Free up disk space on runner
+        uses: ./.github/actions/free-up-disk-space
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
@@ -135,4 +138,7 @@ jobs:
         with:
           name: ${{ inputs.image }}-${{ github.sha }}
           path: /tmp/${{ steps.image-name-sanitizer.outputs.IMAGE_NAME_SANITIZED }}-${{ github.sha }}.tar
-          retention-days: 7
+          retention-days: 7
+
+      - name: Print disk usage
+        uses: ./.github/actions/print-disk-usage

.github/workflows/build.yaml

@@ -15,6 +15,9 @@ jobs:
         with:
           fetch-depth: 0
           submodules: recursive
+
+      - name: Free up disk space on runner
+        uses: ./.github/actions/free-up-disk-space
 
       - name: Install pre-requisites
         uses: ./.github/actions/setup
@@ -25,6 +28,9 @@ jobs:
       - name: Build with Gradle
         run: ./gradlew -PverboseTests=true --no-daemon --parallel --max-workers=5 build
 
+      - name: Print disk usage
+        uses: ./.github/actions/print-disk-usage
+
       - name: Upload testbed logs
         uses: actions/upload-artifact@v4
         if: always()

.github/workflows/copy-images.yaml

@@ -36,6 +36,12 @@ jobs:
       matrix:
         image: [paladin, paladin-operator]
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Print disk usage
+        uses: ./.github/actions/print-disk-usage
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -53,9 +59,6 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Checkout code
-        uses: actions/checkout@v4
-
       - name: Set Source Repository Name
         id: source_repo
         uses: ./.github/actions/repository
@@ -96,4 +99,6 @@ jobs:
               ${SOURCE_IMAGE}:${SOURCE_TAG}
           fi
 
+      - name: Print disk usage
+        uses: ./.github/actions/print-disk-usage
 

.github/workflows/release-candidate.yaml

@@ -11,10 +11,7 @@ permissions:
   id-token: write
 
 on:
-  push:
-    tags:
-      - 'v*.*.*-rc.*'
-  workflow_dispatch:
+  workflow_call:
     inputs:
       tag:
         required: true
@@ -34,18 +31,8 @@ jobs:
       - id: set-vars
         shell: bash
         env:
-          EVENT_NAME: ${{ github.event_name }}
-          REF: ${{ github.ref }}
-          INPUT_TAG: ${{ github.event.inputs.tag }}
+          TAG: ${{ inputs.tag }}
         run: |
-          if [[ "$EVENT_NAME" == "push" && "$REF" == refs/tags/v* ]]; then
-            echo "Tag push event"
-            TAG="${REF##*/}"
-          else
-            echo "Workflow dispatch or other event"
-            TAG="$INPUT_TAG"
-          fi
-          
           # Validate tag begins with 'v'
           if [[ ! "$TAG" =~ ^v ]]; then
             echo "Error: Tag must begin with 'v' (e.g., v1.2.3-rc.1)"
@@ -149,8 +136,6 @@ jobs:
       # For a tag like 'v0.1.0-rc.1', this will become "rc;rc.1"
       # We can't use the rc_number (e.g. 1)because it's not a valid npm tag
       sdk_tag: "rc;${{ needs.setup.outputs.npm_prerelease_tag }}"
-    secrets:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   # ================================ PRE-RELEASE TESTING ================================
   # Test that the built artifacts are compatible and functional before creating the RC release
@@ -198,6 +183,14 @@ jobs:
     needs: [setup, prepare-release]
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout repository code
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Print disk usage
+        uses: ./.github/actions/print-disk-usage
+
 
       - name: Download Helm artifacts
         uses: actions/download-artifact@v4
@@ -229,3 +222,6 @@ jobs:
             contracts/zeto-abis.tar.gz
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Print disk usage
+        uses: ./.github/actions/print-disk-usage

.github/workflows/release-charts.yaml

@@ -72,6 +72,9 @@ jobs:
           submodules: recursive
           ref: ${{ inputs.ref != '' && inputs.ref || github.ref }}
 
+      - name: Free up disk space on runner
+        uses: ./.github/actions/free-up-disk-space
+
       - name: Install pre-requisites
         uses: ./.github/actions/setup
 
@@ -217,4 +220,7 @@ jobs:
           \`\`\`sh
           helm upgrade --install paladin paladin/paladin-operator -n paladin --create-namespace --version ${{ steps.clean-tag.outputs.PROCESSED_TAG }}
           \`\`\`
-          EOF
+          EOF
+
+      - name: Print disk usage
+        uses: ./.github/actions/print-disk-usage

.github/workflows/release-entry.yaml

@@ -0,0 +1,71 @@
+# Unified release entry point for all release operations.
+# This is the sole workflow_dispatch entry point, enabling npm trusted publishing via OIDC.
+#
+# Usage:
+#   - RC release:    release_type=rc, tag=v1.2.3-rc.1
+#   - Final release: release_type=final, tag=v1.2.3, rc_tag=v1.2.3-rc.1
+#   - SDK only:      release_type=sdk, tag=v1.2.3, sdk_dist_tags=latest;stable [, ref=<commit>]
+name: Release Entry Point
+
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_type:
+        type: choice
+        options:
+          - rc
+          - final
+          - sdk
+        description: 'Type of release'
+        required: true
+      tag:
+        type: string
+        description: 'Target tag (RC tag for rc, final tag for final, version for sdk)'
+        required: true
+      rc_tag:
+        type: string
+        description: '(final only) RC tag to release from'
+        required: false
+      latest:
+        type: boolean
+        default: true
+        description: '(final only) Mark as latest release'
+      ref:
+        type: string
+        description: '(sdk only) Commit ref for checkout, defaults to workflow branch'
+        required: false
+      sdk_dist_tags:
+        type: string
+        description: '(sdk only) NPM dist-tags, semicolon-separated'
+        required: false
+
+jobs:
+  release-candidate:
+    if: inputs.release_type == 'rc'
+    uses: ./.github/workflows/release-candidate.yaml
+    with:
+      tag: ${{ inputs.tag }}
+    secrets: inherit
+
+  release-final:
+    if: inputs.release_type == 'final'
+    uses: ./.github/workflows/release.yaml
+    with:
+      tag: ${{ inputs.tag }}
+      rc_tag: ${{ inputs.rc_tag }}
+      latest: ${{ inputs.latest }}
+    secrets: inherit
+
+  release-sdk:
+    if: inputs.release_type == 'sdk'
+    uses: ./.github/workflows/release-typescript-sdk.yaml
+    with:
+      sdk_version: ${{ inputs.tag }}
+      sdk_tag: ${{ inputs.sdk_dist_tags }}
+      ref: ${{ inputs.ref }}
+

.github/workflows/release-solidity-contracts.yaml

@@ -54,6 +54,9 @@ jobs:
         submodules: recursive
         ref: ${{ inputs.ref != '' && inputs.ref || github.ref }}
 
+    - name: Print disk usage
+      uses: ./.github/actions/print-disk-usage
+
     - name: Install pre-requisites
       uses: ./.github/actions/setup
 
@@ -103,4 +106,7 @@ jobs:
     - name: Print upload-artifacts output
       shell: bash
       run: |
-        echo "upload-artifacts URL: ${{ steps.upload-artifacts.outputs.artifact-url }}"
+        echo "upload-artifacts URL: ${{ steps.upload-artifacts.outputs.artifact-url }}"
+
+    - name: Print disk usage
+      uses: ./.github/actions/print-disk-usage