Merge branch 'master' into jason/NNS1-2522-1

.github/CODEOWNERS

@@ -50,6 +50,7 @@ go_deps.bzl               @dfinity/idx
 /packages/icrc-ledger-types/         @dfinity/finint
 /packages/ic-ledger-hash-of/         @dfinity/finint
 /packages/pocket-ic/                 @dfinity/pocket-ic
+/packages/ic-signature-verification/ @dfinity/crypto-team
 /packages/ic-vetkd-utils/            @dfinity/crypto-team
 
 # [IC-OS]
@@ -121,7 +122,7 @@ go_deps.bzl               @dfinity/idx
 /rs/cycles_account_manager/                             @dfinity/execution
 /rs/depcheck/                                           @dfinity/ic-interface-owners
 /rs/determinism_test/                                   @dfinity/execution
-/rs/drun/                                               @dfinity/execution
+/rs/drun/                                               @dfinity/languages
 /rs/embedders/                                          @dfinity/runtime
 /rs/ethereum/                                           @dfinity/cross-chain-team
 /rs/execution_environment/                              @dfinity/execution @dfinity/runtime
@@ -287,9 +288,6 @@ go_deps.bzl               @dfinity/idx
 /rs/workload_generator/                                 @dfinity/runtime
 /rs/xnet/                                               @dfinity/ic-message-routing-owners
 
-# [Scalability]
-/scalability/                                                       @dfinity/runtime
-
 # [No-Approvals]
 # Ghost is a group with no direct members. GitLab will bypass codeowners for files that match ghost ownership.
 *.lock

.github/workflows/slack-workflow-run.yml

@@ -26,11 +26,11 @@ jobs:
           CHANNEL="eng-idx-alerts"
           FULL_MESSAGE="nothing"
 
+          if [[ "$TRIGGERING_WORKFLOW_NAME" == "Release Testing" ]]; then
+            CHANNEL="release-management-alerts"
+          fi
           if [[ "${{ github.event.workflow_run.conclusion }}" =~ ^(success)$ ]]; then
-            if [[ "$TRIGGERING_WORKFLOW_NAME" == "Release Testing" ]]; then
-              FULL_MESSAGE=":white_check_mark: ${MESSAGE} :relaxed:"
-              CHANNEL="release-management-alerts"
-            fi
+            FULL_MESSAGE=":white_check_mark: ${MESSAGE} :relaxed:"
           elif [[ "${{ github.event.workflow_run.conclusion }}" =~ ^(failure|timed_out)$ ]]; then
             FULL_MESSAGE=":fire: ${MESSAGE} :disappointed:"
           fi

.github/workflows/system-tests-k8s.yml

@@ -0,0 +1,80 @@
+name: Sytem Tests K8s
+
+# Run specific system test:
+# gh workflow run system-tests-k8s.yml \
+#   --ref marko-system-tests-k8s \
+#   --field targets="//rs/tests/testing_verification:basic_health_test" \
+#   --field jobs="32"
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/system-tests-k8s.yml'
+  workflow_dispatch:
+    inputs:
+      targets:
+        description: 'System Tests / Bazel Targets'
+        required: false
+        default: '//rs/tests/testing_verification:basic_health_test'
+      jobs:
+        description: 'Concurrent Bazel Jobs'
+        required: false
+        default: '32'
+
+env:
+  TARGETS: "${{ github.event.inputs.targets || '//rs/tests/testing_verification:basic_health_test' }}"
+  JOBS: "${{ github.event.inputs.jobs || '32' }}"
+  AWS_SHARED_CREDENTIALS_CONTENT: ${{ secrets.AWS_SHARED_CREDENTIALS_FILE }}
+  BAZEL_STARTUP_ARGS: "--output_base=/var/tmp/bazel-output/"
+  CI_COMMIT_SHA: ${{ github.sha }}
+  CI_COMMIT_REF_PROTECTED: ${{ github.ref_protected }}
+  CI_JOB_NAME: ${{ github.job }}
+  CI_JOB_ID: ${{ github.job }}
+  CI_JOB_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+  CI_PIPELINE_SOURCE: ${{ github.event_name }}
+  CI_PROJECT_DIR: ${{ github.workspace }}
+  ROOT_PIPELINE_ID: ${{ github.run_id }}
+  DOCKER_HUB_USER: ${{ secrets.DOCKER_HUB_USER }}
+  DOCKER_HUB_PASSWORD_RO: ${{ secrets.DOCKER_HUB_PASSWORD_RO }}
+  BUILDEVENT_APIKEY: ${{ secrets.HONEYCOMB_API_TOKEN }}
+  BUILDEVENT_DATASET: "github-ci-dfinity"
+
+jobs:
+  bazel-system-tests-k8s:
+    name: Bazel System Tests K8s
+    runs-on:
+      group: ln1
+      labels: dind-large
+    container:
+      image: ghcr.io/dfinity/ic-build@sha256:26cc347efa50935342742acddfb5d710fae1982d401911013ad8750f0603c590
+      options: >-
+        -e NODE_NAME -e KUBECONFIG
+        --privileged --cgroupns host
+        -v /cache:/cache -v /var/sysimage:/var/sysimage -v /var/tmp:/var/tmp
+    timeout-minutes: 180
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Before script
+        id: before-script
+        shell: bash
+        run: ./gitlab-ci/src/ci-scripts/before-script.sh
+
+      - name: Set KUBECONFIG
+        shell: bash
+        run: |
+          echo "$TNET_KUBECONFIG" > /tmp/kubeconfig
+          echo "KUBECONFIG=/tmp/kubeconfig" >> $GITHUB_ENV
+        env:
+          TNET_KUBECONFIG: ${{ secrets.TNET_KUBECONFIG }}
+
+      - name: Run System Tests on K8s
+        id: bazel-test-all
+        uses: ./.github/actions/bazel-test-all/
+        with:
+          BAZEL_COMMAND: "test"
+          BAZEL_TARGETS: "${{ env.TARGETS }}"
+          BAZEL_CI_CONFIG: "--config=ci --repository_cache=/cache/bazel"
+          BAZEL_EXTRA_ARGS: "--jobs=${{ env.JOBS }} --test_tag_filters=k8s,-manual --k8s"
+          HONEYCOMB_API_TOKEN: ${{ secrets.HONEYCOMB_API_TOKEN }}

.github/workflows/test-namespace-darwin.yml

@@ -1,12 +1,16 @@
 # Darwin tests on runners from https://namespace.so
 name: test-namespace
 on: [push]
+
+# Ensure there's only one instance of this workflow for any PR/branch/tag, and
+# cancel the previous one if necessary
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test-namespace:
-    strategy:
-      matrix:
-        os: [ namespace-profile-darwin-small ] # profile created in namespace console
-    runs-on: ${{ matrix.os }}
+    runs-on: namespace-profile-darwin-small # profile created in namespace console
     steps:
 
       - name: Install nsc

.gitignore

@@ -112,8 +112,7 @@ artifacts
 # Boundary node prober binary
 boundary-node-prober
 
-# Scalability test results
-scalability/results/
+# Python pip file
 *Pipfile*
 
 # Bazel outdir dirs

.gitlab/CODEOWNERS

@@ -287,9 +287,6 @@ go_deps.bzl               @dfinity-lab/teams/idx
 /rs/workload_generator/                                 @dfinity-lab/teams/runtime-owners
 /rs/xnet/                                               @dfinity-lab/teams/message-routing-owners
 
-# [Scalability]
-/scalability/                                                       @dfinity-lab/teams/runtime-owners
-
 # [No-Approvals]
 # Ghost is a group with no direct members. GitLab will bypass codeowners for files that match ghost ownership.
 *.lock                    @dfinity-lab/teams/ghost

.pre-commit-config.yaml

@@ -76,3 +76,5 @@ repos:
           (?x)^(
               testnet/tests/.*|.*/docker-compose.yml|testnet/env/shared-config\.yml
           )$
+      # To be uncommented upon moving to new ansible-lint
+      # args: ['-i', 'testnet/ansible/.ansible-lint-ignore', 'testnet/ansible']

BUILD.bazel

@@ -98,8 +98,3 @@ test_suite(
     tags = ["manual"],
     tests = ["//rs/tests/testing_verification/testnets:single_large_node"],
 )
-
-alias(
-    name = "deterministic-ips",
-    actual = "//rs/ic_os/deterministic_ips:deterministic-ips",
-)