Enable workflows to request a TEE

.mockery.yaml

@@ -38,13 +38,12 @@ packages:
   github.com/smartcontractkit/chainlink-common/pkg/workflows/wasm/host:
     interfaces:
       ModuleV1: {}
-      ModuleV2: {}
+  github.com/smartcontractkit/chainlink-common/pkg/workflows/host:
+    interfaces:
+      Module: {}
       ExecutionHelper:
         config:
-          inpackage: true
-          filename: "mock_{{.InterfaceName | snakecase}}_test.go"
-          mockname: "Mock{{.InterfaceName}}"
-          dir: "{{.InterfaceDir}}"
+            mockname: "Mock{{.InterfaceName}}"
   github.com/smartcontractkit/chainlink-common/pkg/custmsg:
     interfaces:
       MessageEmitter:
@@ -64,4 +63,4 @@ packages:
       dir: "{{.InterfaceDir}}/limits"
       outpkg: limits
     interfaces:
-      Getter:
+      Getter:

pkg/beholder/chip_ingress_emitter.go

@@ -43,7 +43,7 @@ func (c ChipIngressEmitterConfig) New(client chipingress.Client) (Emitter, error
 
 	return &ChipIngressEmitter{
 		client: client,
-		lggr:    lggr,
+		lggr:   lggr,
 		stopCh: make(services.StopChan),
 	}, nil
 }

pkg/beholder/client_test.go

@@ -936,7 +936,7 @@ func TestClient_batchEmitterService(t *testing.T) {
 	newBatchClient := func(t *testing.T) *beholder.Client {
 		t.Helper()
 		client, err := beholder.NewClient(beholder.Config{
-			OtelExporterGRPCEndpoint:       "localhost:4317",
+			OtelExporterGRPCEndpoint: "localhost:4317",
 			// Use simple exporter in this lifecycle test to avoid batch flush/shutdown delays.
 			EmitterBatchProcessor:          false,
 			LogBatchProcessor:              false,

pkg/beholder/config.go

@@ -26,7 +26,7 @@ type Config struct {
 	EmitterMaxQueueSize       int
 	// EmitterBatchProcessor controls custom-message export mode:
 	// true = batched async export; false = immediate per-record export.
-	EmitterBatchProcessor     bool
+	EmitterBatchProcessor bool
 
 	// OTel Trace
 	TraceSampleRatio  float64
@@ -127,7 +127,7 @@ func DefaultConfig() Config {
 		EmitterExportInterval:     1 * time.Second,
 		EmitterMaxQueueSize:       2048,
 		// Keep batched export enabled by default for throughput.
-		EmitterBatchProcessor:     true,
+		EmitterBatchProcessor: true,
 		// OTel message log exporter retry config
 		LogRetryConfig: defaultRetryConfig.Copy(),
 		// Trace
@@ -148,8 +148,8 @@ func DefaultConfig() Config {
 		LogMaxQueueSize:       2048,
 		LogBatchProcessor:     true,
 		LogStreamingEnabled:   true, // Enable logs streaming by default
-		LogLevel:      zapcore.InfoLevel,
-		LogCompressor: "gzip",
+		LogLevel:              zapcore.InfoLevel,
+		LogCompressor:         "gzip",
 		// Chip Ingress Batch Emitter
 		ChipIngressBatchEmitterEnabled: false,
 		ChipIngressBufferSize:          1000,

pkg/capabilities/errors/error_codes.go

@@ -144,44 +144,44 @@ func (e ErrorCode) String() string {
 }
 
 var errorCodeToString = map[ErrorCode]string{
-	Canceled:           "Canceled",
-	Unknown:            "Unknown",
-	InvalidArgument:    "InvalidArgument",
-	DeadlineExceeded:   "DeadlineExceeded",
-	NotFound:           "NotFound",
-	AlreadyExists:      "AlreadyExists",
-	PermissionDenied:   "PermissionDenied",
-	ResourceExhausted:  "ResourceExhausted",
-	FailedPrecondition: "FailedPrecondition",
-	Aborted:            "Aborted",
-	OutOfRange:         "OutOfRange",
-	Unimplemented:      "Unimplemented",
-	Internal:           "Internal",
-	Unavailable:        "Unavailable",
-	DataLoss:           "DataLoss",
-	Unauthenticated:    "Unauthenticated",
+	Canceled:                 "Canceled",
+	Unknown:                  "Unknown",
+	InvalidArgument:          "InvalidArgument",
+	DeadlineExceeded:         "DeadlineExceeded",
+	NotFound:                 "NotFound",
+	AlreadyExists:            "AlreadyExists",
+	PermissionDenied:         "PermissionDenied",
+	ResourceExhausted:        "ResourceExhausted",
+	FailedPrecondition:       "FailedPrecondition",
+	Aborted:                  "Aborted",
+	OutOfRange:               "OutOfRange",
+	Unimplemented:            "Unimplemented",
+	Internal:                 "Internal",
+	Unavailable:              "Unavailable",
+	DataLoss:                 "DataLoss",
+	Unauthenticated:          "Unauthenticated",
 	ConsensusFailed:          "ConsensusFailed",
 	LimitExceeded:            "LimitExceeded",
 	InsufficientObservations: "InsufficientObservations",
 }
 
 var stringToErrorCode = map[string]ErrorCode{
-	"Canceled":           Canceled,
-	"Unknown":            Unknown,
-	"InvalidArgument":    InvalidArgument,
-	"DeadlineExceeded":   DeadlineExceeded,
-	"NotFound":           NotFound,
-	"AlreadyExists":      AlreadyExists,
-	"PermissionDenied":   PermissionDenied,
-	"ResourceExhausted":  ResourceExhausted,
-	"FailedPrecondition": FailedPrecondition,
-	"Aborted":            Aborted,
-	"OutOfRange":         OutOfRange,
-	"Unimplemented":      Unimplemented,
-	"Internal":           Internal,
-	"Unavailable":        Unavailable,
-	"DataLoss":           DataLoss,
-	"Unauthenticated":    Unauthenticated,
+	"Canceled":                 Canceled,
+	"Unknown":                  Unknown,
+	"InvalidArgument":          InvalidArgument,
+	"DeadlineExceeded":         DeadlineExceeded,
+	"NotFound":                 NotFound,
+	"AlreadyExists":            AlreadyExists,
+	"PermissionDenied":         PermissionDenied,
+	"ResourceExhausted":        ResourceExhausted,
+	"FailedPrecondition":       FailedPrecondition,
+	"Aborted":                  Aborted,
+	"OutOfRange":               OutOfRange,
+	"Unimplemented":            Unimplemented,
+	"Internal":                 Internal,
+	"Unavailable":              Unavailable,
+	"DataLoss":                 DataLoss,
+	"Unauthenticated":          Unauthenticated,
 	"ConsensusFailed":          ConsensusFailed,
 	"LimitExceeded":            LimitExceeded,
 	"InsufficientObservations": InsufficientObservations,

pkg/capabilities/v2/actions/confidentialrelay/types.go

@@ -10,8 +10,9 @@ import (
 	"hash"
 	"sort"
 
-	"github.com/smartcontractkit/chainlink-common/pkg/teeattestation"
 	"github.com/smartcontractkit/libocr/ragep2p/peeridhelper"
+
+	"github.com/smartcontractkit/chainlink-common/pkg/teeattestation"
 )
 
 const (

pkg/capabilities/v2/protoc/pkg/template_generator.go

@@ -139,9 +139,9 @@ func (t *TemplateGenerator) runTemplate(name, tmplText string, args any, partial
 
 			if md == nil {
 				return false, nil
-			} else {
-				return md.MapToUntypedApi, nil
 			}
+
+			return md.MapToUntypedApi, nil
 		},
 		"addImport": func(importPath protogen.GoImportPath, ignore string) string {
 			importName := importPath.String()
@@ -259,6 +259,18 @@ func (t *TemplateGenerator) runTemplate(name, tmplText string, args any, partial
 				return line
 			}
 		},
+		"TeeEnabled": func(s *protogen.Service) (bool, error) {
+			md, err := getCapabilityMetadata(s)
+			if err != nil {
+				return false, err
+			}
+			for _, env := range md.AdditionalEnvironments {
+				if env == generator.AdditionalEnvironments_ADDITIONAL_ENVIRONMENTS_TEE {
+					return true, nil
+				}
+			}
+			return false, nil
+		},
 	}).Funcs(t.ExtraFns)
 
 	// Register partials

pkg/chipingress/batch/client.go

@@ -36,18 +36,18 @@ type Client struct {
 	maxGRPCRequestSize      int // configured max, used for metrics/error reporting
 	effectiveMaxRequestSize int // maxGRPCRequestSize minus grpcFramingOverhead, used for splitting
 	cloneEvent              bool
-	maxConcurrentSends chan struct{}
-	batchInterval      time.Duration
-	maxPublishTimeout  time.Duration
-	messageBuffer      chan *messageWithCallback
-	stopCh             stopCh
-	log                *zap.SugaredLogger
-	callbackWg         sync.WaitGroup
-	shutdownTimeout    time.Duration
-	shutdownOnce       sync.Once
-	batcherDone        chan struct{}
-	started            bool
-	counters           sync.Map // map[seqnumKey]*atomic.Uint64 for per-(source,type) seqnum, cleared on Stop()
+	maxConcurrentSends      chan struct{}
+	batchInterval           time.Duration
+	maxPublishTimeout       time.Duration
+	messageBuffer           chan *messageWithCallback
+	stopCh                  stopCh
+	log                     *zap.SugaredLogger
+	callbackWg              sync.WaitGroup
+	shutdownTimeout         time.Duration
+	shutdownOnce            sync.Once
+	batcherDone             chan struct{}
+	started                 bool
+	counters                sync.Map // map[seqnumKey]*atomic.Uint64 for per-(source,type) seqnum, cleared on Stop()
 
 	metrics batchClientMetrics
 }
@@ -77,14 +77,14 @@ func NewBatchClient(client chipingress.Client, opts ...Opt) (*Client, error) {
 		maxGRPCRequestSize:      10 * 1024 * 1024,
 		effectiveMaxRequestSize: 10*1024*1024 - grpcFramingOverhead,
 		cloneEvent:              true,
-		maxConcurrentSends: make(chan struct{}, 1),
-		messageBuffer:      make(chan *messageWithCallback, 200),
-		batchInterval:      100 * time.Millisecond,
-		maxPublishTimeout:  5 * time.Second,
-		stopCh:             make(chan struct{}),
-		callbackWg:         sync.WaitGroup{},
-		shutdownTimeout:    5 * time.Second,
-		batcherDone:        make(chan struct{}),
+		maxConcurrentSends:      make(chan struct{}, 1),
+		messageBuffer:           make(chan *messageWithCallback, 200),
+		batchInterval:           100 * time.Millisecond,
+		maxPublishTimeout:       5 * time.Second,
+		stopCh:                  make(chan struct{}),
+		callbackWg:              sync.WaitGroup{},
+		shutdownTimeout:         5 * time.Second,
+		batcherDone:             make(chan struct{}),
 	}
 
 	for _, opt := range opts {

pkg/workflows/artifacts/artifacts_test.go

@@ -45,8 +45,9 @@ func (s *ArtifactsTestSuite) TestArtifacts() {
 
 	s.lggr.Info("WorkflowCompiledBinary Size", "size", len(b64EncodedBinaryData))
 
-	// Compare the keccak256 hash of the binary data with the keccak256 hash of the
-	// base64 encoded binary from CRE-CLI
+	// Compare the keccak256 hash of the binary data against a value produced by
+	// the pinned Go toolchain (see GetBuildCmd in utils.go). Because Compile sets
+	// GOTOOLCHAIN from the nearest go.mod, this hash is stable across machines.
 	expKeccak256Hash, err := hex.DecodeString("a057a58ff8212122016515b2922b7c3893525f7f5afe95c8442e0cd629d68420")
 	s.NoError(err, "failed to decode expected keccak256 hash")
 	keccak256FromSha3Lib := sha3.NewLegacyKeccak256()
@@ -58,8 +59,7 @@ func (s *ArtifactsTestSuite) TestArtifacts() {
 	s.NoError(err, "failed to prepare artifacts")
 
 	base64EncodedBinaryData := artifacts.GetBinaryData()
-	// Compare if the compiled WASM binary is the same as the CRE-CLI output
-	s.Len(base64EncodedBinaryData, 636684, "binary data size should be same as CRE-CLI output")
+	s.Len(base64EncodedBinaryData, 636684, "binary data size should match the pinned toolchain output")
 	s.Equal("m1upG3s6AJQvOA8AAK295+EaARsHAADf/YcBgFURwPQAANDq5wFQVVVVVVVVVVVV3ZMQEI7ZtgMAAKqq",
 		string(base64EncodedBinaryData[0:80]))
 	s.Equal("gUEoFNoVRfyHGTsZmdg7wCJbGVibOhmYmsDAytgg92FTTmiddpI/x8SYzdANBkPGhtLoj/Hn7jvK26YE",

pkg/workflows/artifacts/utils.go

@@ -1,9 +1,11 @@
 package artifacts
 
 import (
+	"bufio"
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 )
 
@@ -78,10 +80,77 @@ func GetBuildCmd(inputFile string, outputFile string, rootFolder string) *exec.C
 			"-buildvcs=false",
 			inputFile,
 		)
-		buildCmd.Env = append(os.Environ(), "GOOS=wasip1", "GOARCH=wasm", "CGO_ENABLED=0")
+		env := append(os.Environ(), "GOOS=wasip1", "GOARCH=wasm", "CGO_ENABLED=0")
+		// Pin GOTOOLCHAIN to the version declared in the nearest go.mod so the
+		// compiled WASM is reproducible across machines whose local Go differs
+		// from go.mod (GOTOOLCHAIN=auto uses the local Go when it's newer).
+		if toolchain := goToolchainFromMod(rootFolder); toolchain != "" {
+			env = append(env, "GOTOOLCHAIN="+toolchain)
+		}
+		buildCmd.Env = env
 	}
 
 	buildCmd.Dir = rootFolder
 
 	return buildCmd
 }
+
+// goToolchainFromMod returns a GOTOOLCHAIN value (e.g. "go1.26.2") derived
+// from the nearest go.mod walking up from startDir. Prefers the toolchain
+// directive when present, falling back to the go directive. Returns "" when
+// no go.mod or version can be determined.
+func goToolchainFromMod(startDir string) string {
+	goModPath := findNearestGoMod(startDir)
+	if goModPath == "" {
+		return ""
+	}
+	f, err := os.Open(goModPath)
+	if err != nil {
+		return ""
+	}
+	defer f.Close()
+
+	var goVersion, toolchain string
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "//") {
+			continue
+		}
+		fields := strings.Fields(line)
+		if len(fields) < 2 {
+			continue
+		}
+		switch fields[0] {
+		case "go":
+			goVersion = fields[1]
+		case "toolchain":
+			toolchain = fields[1]
+		}
+	}
+	if toolchain != "" {
+		return toolchain
+	}
+	if goVersion != "" {
+		return "go" + goVersion
+	}
+	return ""
+}
+
+func findNearestGoMod(startDir string) string {
+	dir, err := filepath.Abs(startDir)
+	if err != nil {
+		return ""
+	}
+	for {
+		candidate := filepath.Join(dir, "go.mod")
+		if info, err := os.Stat(candidate); err == nil && !info.IsDir() {
+			return candidate
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			return ""
+		}
+		dir = parent
+	}
+}