merged with master

.github/CODEOWNERS

@@ -47,6 +47,7 @@ go_deps.bzl               @dfinity/idx
 /packages/icrc-ledger-types/         @dfinity/finint
 /packages/ic-ledger-hash-of/         @dfinity/finint
 /packages/pocket-ic/                 @dfinity/pocket-ic
+/packages/ic-sha3/                   @dfinity/crypto-team
 /packages/ic-signature-verification/ @dfinity/crypto-team
 /packages/ic-vetkd-utils/            @dfinity/crypto-team
 

.github/workflows-source/ci-main.yml

@@ -9,6 +9,8 @@ on:
       - master
       - 'dev-gh-*'
   pull_request:
+    branches-ignore:
+      - hotfix-* # This is to ensure that this workflow is not triggered twice on ic-private, as it's already triggered from release-testing
   # Used as reusable workflow within release-testing workflow
   workflow_call:
 
@@ -234,6 +236,7 @@ jobs:
         env:
           CI_COMMIT_REF_PROTECTED: ${{ github.ref_protected }}
           CI_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          REPO_NAME: ${{ github.repository }}
 
   build-ic:
     name: Build IC

.github/workflows-source/ci-pr-only.yml

@@ -138,6 +138,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
       SLACK_PSEC_BOT_OAUTH_TOKEN: ${{ secrets.SLACK_PSEC_BOT_OAUTH_TOKEN }}
+      REPO_NAME: ${{ github.repository }}
     steps:
       - <<: *checkout
         with:

.github/workflows-source/release-testing.yml

@@ -62,7 +62,7 @@ anchors:
     # we avoid collecting artifacts of jobs that were cancelled
     if: success() || failure()
     uses: actions/upload-artifact@v4
-    with:
+    with: &bazel-bep-with
       name: ${{ github.job }}-bep
       retention-days: 14
       if-no-files-found: ignore
@@ -145,6 +145,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
       SLACK_PSEC_BOT_OAUTH_TOKEN: ${{ secrets.SLACK_PSEC_BOT_OAUTH_TOKEN }}
+      REPO_NAME: ${{ github.repository }}
     steps:
       - <<: *checkout
       - <<: *before-script
@@ -201,3 +202,7 @@ jobs:
           BAZEL_EXTRA_ARGS_RULES: "--test_timeout=7200 --test_env=OLD_VERSION=${{ matrix.version }}"
           HONEYCOMB_API_TOKEN: ${{ secrets.HONEYCOMB_API_TOKEN }}
       - <<: *bazel-bep
+        name: Upload bazel bep for version ${{ matrix.version }}
+        with:
+          <<: *bazel-bep-with
+          name: ${{ github.job }}-${{ matrix.version }}-bep

.github/workflows-source/schedule-daily.yml

@@ -191,6 +191,7 @@ jobs:
       JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
       SLACK_PSEC_BOT_OAUTH_TOKEN: ${{ secrets.SLACK_PSEC_BOT_OAUTH_TOKEN }}
       GITHUB_REF: ${{ github.ref }}
+      REPO_NAME: ${{ github.repository }}
     steps:
       - <<: *checkout
       - <<: *before-script

.github/workflows/ci-main.yml

@@ -8,6 +8,8 @@ on:
       - master
       - 'dev-gh-*'
   pull_request:
+    branches-ignore:
+      - hotfix-* # This is to ensure that this workflow is not triggered twice on ic-private, as it's already triggered from release-testing
   # Used as reusable workflow within release-testing workflow
   workflow_call:
 # runs for the same workflow are cancelled on PRs but not on master
@@ -303,6 +305,7 @@ jobs:
         env:
           CI_COMMIT_REF_PROTECTED: ${{ github.ref_protected }}
           CI_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          REPO_NAME: ${{ github.repository }}
   build-ic:
     name: Build IC
     runs-on:

.github/workflows/ci-pr-only.yml

@@ -136,6 +136,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
       SLACK_PSEC_BOT_OAUTH_TOKEN: ${{ secrets.SLACK_PSEC_BOT_OAUTH_TOKEN }}
+      REPO_NAME: ${{ github.repository }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/release-testing.yml

@@ -188,6 +188,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
       SLACK_PSEC_BOT_OAUTH_TOKEN: ${{ secrets.SLACK_PSEC_BOT_OAUTH_TOKEN }}
+      REPO_NAME: ${{ github.repository }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -279,16 +280,16 @@ jobs:
           BAZEL_CI_CONFIG: "--config=systest --repository_cache=/cache/bazel"
           BAZEL_EXTRA_ARGS_RULES: "--test_timeout=7200 --test_env=OLD_VERSION=${{ matrix.version }}"
           HONEYCOMB_API_TOKEN: ${{ secrets.HONEYCOMB_API_TOKEN }}
-      - name: Upload bazel-bep
-        # runs only if previous step succeeded or failed;
+      - # runs only if previous step succeeded or failed;
         # we avoid collecting artifacts of jobs that were cancelled
         if: success() || failure()
         uses: actions/upload-artifact@v4
+        name: Upload bazel bep for version ${{ matrix.version }}
         with:
-          name: ${{ github.job }}-bep
           retention-days: 14
           if-no-files-found: ignore
           compression-level: 9
           path: |
             bazel-bep.pb
             profile.json
+          name: ${{ github.job }}-${{ matrix.version }}-bep

.github/workflows/schedule-daily.yml

@@ -241,6 +241,7 @@ jobs:
       JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
       SLACK_PSEC_BOT_OAUTH_TOKEN: ${{ secrets.SLACK_PSEC_BOT_OAUTH_TOKEN }}
       GITHUB_REF: ${{ github.ref }}
+      REPO_NAME: ${{ github.repository }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4

BUILD.bazel

@@ -1,4 +1,5 @@
 load("@bazel_gazelle//:def.bzl", "gazelle")
+load("@bazel_skylib//rules:common_settings.bzl", "string_setting")
 load("@rules_python//python:pip.bzl", "compile_pip_requirements")
 
 package(default_visibility = ["//visibility:public"])
@@ -98,3 +99,54 @@ test_suite(
     tags = ["manual"],
     tests = ["//rs/tests/testing_verification/testnets:single_large_node"],
 )
+
+### Pocket IC
+
+# The pocket-ic server binary. Use this as a test dependency if the test
+# does not require a specific pocket-ic version (see ":pocket-ic-server-variant"
+# for details).
+# By default returns the pocket-ic server from the source tree to ensure
+# consistency within the source tree. See 'pocket_ic_mainnet_test' for
+# overrides.
+alias(
+    name = "pocket-ic-server",
+    actual = select({
+        ":pocket-ic-server-variant-mainnet": "//:pocket-ic-mainnet",
+        ":pocket-ic-server-variant-head": "//rs/pocket_ic_server:pocket-ic-server",
+        "//conditions:default": "//rs/pocket_ic_server:pocket-ic-server",
+    }),
+)
+
+# A setting to switch between different variants of pocket-ic. The
+# default pocket-ic variant/version (head) is the one as in the
+# source tree.
+string_setting(
+    name = "pocket-ic-server-variant",
+    build_setting_default = "head",
+    visibility = ["//visibility:public"],
+)
+
+config_setting(
+    name = "pocket-ic-server-variant-head",
+    flag_values = {
+        ":pocket-ic-server-variant": "head",
+    },
+)
+
+# A "mainnet" variant of the pocket-ic server which represents a
+# released version of pocket-ic.
+config_setting(
+    name = "pocket-ic-server-variant-mainnet",
+    flag_values = {
+        ":pocket-ic-server-variant": "mainnet",
+    },
+)
+
+# The pocket-ic as released; use this for tests that need to ensure consistency
+# with a release pocket-ic/replica.
+genrule(
+    name = "pocket-ic-mainnet",
+    srcs = ["@pocket-ic-mainnet-gz//file"],
+    outs = ["pocket-ic"],
+    cmd = "gunzip -c $< > $@",
+)