Merge branch 'anodar/3569-5-node-available-chains-switch' into anodar/3569-6-chain-aware-presigs

Author: anodar

.cliffignore

@@ -1,5 +1,5 @@
 # Commits to exclude from the changelog (read by git-cliff via cliff.toml,
-# invoked from scripts/ops/prepare-release.sh and the manual flow in RELEASES.md).
+# invoked from scripts/ops/prepare-github-release.sh and the manual flow in RELEASES.md).
 # The block below is the 502 commits from the threshold-signatures repo that
 # were merged in 59037a57 ("Merge threshold-signatures repo"). Their full
 # pre-merge history would otherwise pollute the changelog.

.editorconfig

@@ -29,6 +29,6 @@ insert_final_newline = false
 # localnet verify_quote call; the text rules do not apply.
 [crates/tee-verifier/tests/fixtures/*.borsh]
 end_of_line = unset
-insert_final_newline = false
+insert_final_newline = unset
 trim_trailing_whitespace = false
 charset = unset

.github/prompts/pr-review.prompt.md

@@ -56,7 +56,7 @@ REVIEW STYLE:
 - Flag code-comment quality issues per [engineering-standards.md]. The goal is to avoid comments that may become stale or add little value to the reader.
 - Do NOT comment on style, formatting, or naming unless it causes a bug.
 - Do NOT restate what the diff already shows
-- Do NOT ask for `third-party-licenses/licenses.html` to be regenerated on a dependency or lockfile change. Those notices are refreshed during release preparation by [prepare-release.sh]; drift between releases is expected and no CI job gates it. Stale notices are only a finding on a release PR, where that script should already have refreshed them.
+- Do NOT ask for `third-party-licenses/licenses.html` to be regenerated on a dependency or lockfile change. Those notices are refreshed during release preparation by [prepare-github-release.sh]; drift between releases is expected and no CI job gates it. Stale notices are only a finding on a release PR, where that script should already have refreshed them.
 - If no critical issues found: approve with a one-line summary
 - Sign off with: ✅ (approved) or ⚠️ (issues found)
 
@@ -109,4 +109,4 @@ Please always use `gh pr comment` to post your review instead.
 [AGENTS.md]: ../../AGENTS.md
 [CONTRIBUTING.md]: ../../CONTRIBUTING.md
 [engineering-standards.md]: ../../docs/engineering-standards.md
-[prepare-release.sh]: ../../scripts/ops/prepare-release.sh
+[prepare-github-release.sh]: ../../scripts/ops/prepare-github-release.sh

.github/workflows/build_contract.yml

@@ -17,7 +17,7 @@ permissions:
 jobs:
   build-contract:
     name: "Build contract reproducibly"
-    runs-on: warp-ubuntu-2404-x64-16x
+    runs-on: warp-ubuntu-2604-x64-16x
 
     steps:
       - name: Checkout repository

.github/workflows/bump-nearcore.yml

@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   bump:
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-2604-x64-2x
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:

.github/workflows/changes.yml

@@ -16,7 +16,7 @@ on:
 
 jobs:
   detect:
-    runs-on: warp-ubuntu-2404-x64-2x
+    runs-on: warp-ubuntu-2604-x64-2x
     permissions:
       contents: read
       pull-requests: read

.github/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
     name: "Build MPC Node TEE Docker image"
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
-    runs-on: warp-ubuntu-2404-x64-16x
+    runs-on: warp-ubuntu-2604-x64-16x
     timeout-minutes: 60
     permissions:
       contents: read
@@ -48,14 +48,13 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Allow unprivileged user namespaces (needed by repro-env/podman on Ubuntu 24.04)
+      - name: Allow unprivileged user namespaces (needed by repro-env)
         run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
 
       - name: Install repro-env
         run: |
-          wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env'
-          echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a  repro-env' | sha256sum -c -
-          sudo install -m755 repro-env -t /usr/bin
+          sudo apt-get update
+          sudo apt-get install -y repro-env
 
       - name: Build MPC Node binary and image
         run: |
@@ -71,7 +70,7 @@ jobs:
     name: "Build Rust Launcher Docker image and verify"
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
-    runs-on: warp-ubuntu-2404-x64-8x
+    runs-on: warp-ubuntu-2604-x64-8x
     timeout-minutes: 60
     permissions:
       contents: read
@@ -82,24 +81,18 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Allow unprivileged user namespaces (needed by repro-env/podman on Ubuntu 24.04)
+      - name: Allow unprivileged user namespaces (needed by repro-env)
         run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
 
       - name: Install build dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y skopeo liblzma-dev podman
-
-      - name: Install repro-env
-        run: |
-          wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env'
-          echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a  repro-env' | sha256sum -c -
-          sudo install -m755 repro-env -t /usr/bin
+          sudo apt-get install -y liblzma-dev repro-env
 
-      - name: Build Rust launcher docker image and verify its hash
+      - name: Build Rust launcher docker image
         shell: bash
         run: |
-          ./scripts/build-and-verify-rust-launcher-docker-image.sh
+          ./deployment/build-images.sh --rust-launcher
 
       - name: Run Rust launcher non-TEE runtime check
         shell: bash
@@ -114,7 +107,7 @@ jobs:
     # Skipping at the job level only registers unexpanded template name and
     # required checks will be stuck.
     if: ${{ !cancelled() }}
-    runs-on: ${{ matrix.runner || 'warp-ubuntu-2404-x64-16x' }}
+    runs-on: ${{ matrix.runner || 'warp-ubuntu-2604-x64-16x' }}
     timeout-minutes: 60
     permissions:
       contents: read
@@ -127,7 +120,7 @@ jobs:
           - group: "contract"
             nextest-args: "--profile=ci-contract -p mpc-contract"
             extra-tools: true
-            runner: warp-ubuntu-2404-x64-32x
+            runner: warp-ubuntu-2604-x64-32x
           - group: "other"
             nextest-args: "--profile=ci-other"
             extra-tools: true
@@ -166,7 +159,7 @@ jobs:
     name: "MPC contract reproducible build"
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
-    runs-on: warp-ubuntu-2404-x64-16x
+    runs-on: warp-ubuntu-2604-x64-16x
     timeout-minutes: 60
     permissions:
       contents: read
@@ -201,7 +194,7 @@ jobs:
     name: "Nix build mpc-contract"
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
-    runs-on: warp-ubuntu-2404-x64-16x
+    runs-on: warp-ubuntu-2604-x64-16x
     timeout-minutes: 60
     permissions:
       contents: read
@@ -231,7 +224,7 @@ jobs:
 
   fast-ci-checks:
     name: "Fast CI checks"
-    runs-on: warp-ubuntu-2404-x64-8x
+    runs-on: warp-ubuntu-2604-x64-8x
     permissions:
       contents: read
     steps:
@@ -262,7 +255,7 @@ jobs:
     name: "MPC E2E tests"
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
-    runs-on: warp-ubuntu-2404-x64-32x
+    runs-on: warp-ubuntu-2604-x64-32x
     timeout-minutes: 60
     permissions:
       contents: read
@@ -317,7 +310,7 @@ jobs:
     name: "Extra CI checks"
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.code_changed != 'false' }}
-    runs-on: warp-ubuntu-2404-x64-2x
+    runs-on: warp-ubuntu-2604-x64-2x
     permissions:
       contents: read
     steps:
@@ -338,7 +331,7 @@ jobs:
   check-todo-closed-issues:
     name: "Check TODOs for issues closed by this PR"
     if: github.event_name == 'pull_request'
-    runs-on: warp-ubuntu-2404-x64-2x
+    runs-on: warp-ubuntu-2604-x64-2x
     permissions:
       contents: read
       pull-requests: read

.github/workflows/claude-pr-review.yml

@@ -19,7 +19,7 @@ jobs:
        (contains(github.event.comment.body, '@claude review') ||
         contains(github.event.comment.body, '@claude code review')))
 
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-2604-x64-2x
     permissions:
       contents: read
       pull-requests: read

.github/workflows/docker_build_node.yml

@@ -15,7 +15,7 @@ on:
 jobs:
   build-and-push-images:
     name: "Build and push Docker node image with commit hash"
-    runs-on: warp-ubuntu-2404-x64-16x
+    runs-on: warp-ubuntu-2604-x64-16x
     environment: production
     permissions:
       contents: read
@@ -32,19 +32,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_PAT }}
 
-      - name: Allow unprivileged user namespaces (needed by repro-env/podman on Ubuntu 24.04)
+      - name: Allow unprivileged user namespaces (needed by repro-env)
         run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
 
       - name: Install repro-env
-        run: |
-          wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env'
-          echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a  repro-env' | sha256sum -c -
-          sudo install -m755 repro-env -t /usr/bin
-
-      - name: Install skopeo
         run: |
           sudo apt-get update
-          sudo apt-get install -y skopeo
+          sudo apt-get install -y repro-env
 
       - name: Build and push node image
         run: |

.github/workflows/docker_build_node_gcp.yml

@@ -15,7 +15,7 @@ on:
 jobs:
   build-and-push-images:
     name: "Build and push Docker node gcp image with commit hash"
-    runs-on: warp-ubuntu-2404-x64-16x
+    runs-on: warp-ubuntu-2604-x64-16x
     environment: production
     permissions:
       contents: read
@@ -32,19 +32,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_PAT }}
 
-      - name: Allow unprivileged user namespaces (needed by repro-env/podman on Ubuntu 24.04)
+      - name: Allow unprivileged user namespaces (needed by repro-env)
         run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
 
       - name: Install repro-env
-        run: |
-          wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env'
-          echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a  repro-env' | sha256sum -c -
-          sudo install -m755 repro-env -t /usr/bin
-
-      - name: Install skopeo
         run: |
           sudo apt-get update
-          sudo apt-get install -y skopeo
+          sudo apt-get install -y repro-env
 
       - name: Build and push node gcp image
         run: |