Merge/master into next

.github/workflows/bench.yml

@@ -9,21 +9,21 @@ jobs:
       CARGO_TERM_COLOR: always # Force Cargo to use colors
       TERM: xterm-256color
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Checkout base branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ github.base_ref }}
           path: main/
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: "3.10"
       - name: Install Python dependencies
         run: |
           python -m pip install --upgrade pip
           pip install pyyaml
       - name: Cache cargo build
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cargo
@@ -53,7 +53,7 @@ jobs:
             echo "</details>"
           } > /tmp/message.txt
       - name: Post comment
-        uses: thollander/actions-comment-pull-request@v2
+        uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6 # v2.5.0
         with:
           filePath: /tmp/message.txt
           comment_tag: canbench

.github/workflows/coq.yml

@@ -11,8 +11,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v12
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: cachix/install-nix-action@07da2520eebede906fbeefa9dd0a2b635323909d # v12
       #- run: nix-build s coq
       # The above would also build the shell, includling niv.
       # This would be useful behaviour if our CI seeds some cache.

.github/workflows/license.yml

@@ -15,7 +15,7 @@ jobs:
     name: license-check:required
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: EmbarkStudios/cargo-deny-action@v1
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - uses: EmbarkStudios/cargo-deny-action@3f4a782664881cf5725d0ffd23969fcce89fd868 # v1.6.3
         with:
           command: check bans licenses sources

.github/workflows/publish.yml

@@ -0,0 +1,65 @@
+name: Publish crates to crates.io
+
+on:
+  workflow_dispatch:
+    inputs:
+      ic_principal:
+        description: "Publish ic_principal"
+        type: boolean
+        default: false
+      candid:
+        description: "Publish candid and candid_derive"
+        type: boolean
+        default: false
+      candid_parser:
+        description: "Publish candid_parser"
+        type: boolean
+        default: false
+
+jobs:
+  publish:
+    name: Publish selected crates
+    runs-on: ubuntu-24.04
+    if: >-
+      inputs.ic_principal || inputs.candid || inputs.candid_parser
+
+    permissions:
+      contents: read
+      id-token: write # Required for trusted publishing via OIDC
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606 # v1.15.4
+        with:
+          cache: false
+
+      - name: Authenticate with crates.io
+        id: auth
+        uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1
+
+      # Crates are ordered by dependency: publish dependencies before dependents.
+      # ic_principal has no workspace deps.
+      # candid_derive has no workspace deps.
+      # candid depends on ic_principal, candid_derive.
+      # candid_parser depends on candid.
+
+      - name: Publish ic_principal
+        if: inputs.ic_principal
+        run: cargo publish -p ic_principal
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+
+      - name: Publish candid and candid_derive
+        if: inputs.candid
+        run: cargo publish -p candid_derive && cargo publish -p candid
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+
+      - name: Publish candid_parser
+        if: inputs.candid_parser
+        run: cargo publish -p candid_parser
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

.github/workflows/release.yml

@@ -16,7 +16,7 @@ jobs:
             name: linux64
             artifact_name: target/x86_64-unknown-linux-musl/release/didc
             asset_name: didc-linux64
-          - os: macos-13-large
+          - os: macos-15-intel
             name: macos
             artifact_name: target/release/didc
             asset_name: didc-macos
@@ -25,22 +25,12 @@ jobs:
             artifact_name: target/arm-unknown-linux-gnueabihf/release/didc
             asset_name: didc-arm32
     steps:
-      - uses: actions/checkout@v4
-      - name: Install stable toolchain
-        if: matrix.name != 'arm'
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-      - name: Install stable toolchain
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Install Rust toolchain
+        run: rustup show active-toolchain || rustup toolchain install
+      - name: Add arm target
         if: matrix.name == 'arm'
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-          target: arm-unknown-linux-gnueabihf
+        run: rustup target add arm-unknown-linux-gnueabihf
       - name: Build
         if: matrix.name == 'linux64'
         run: |
@@ -54,13 +44,13 @@ jobs:
         run: cargo build --package didc --release --locked
       - name: Cross build
         if: matrix.name == 'arm'
-        uses: actions-rs/cargo@v1
+        uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
         with:
           use-cross: true
           command: build
           args: --package didc --target arm-unknown-linux-gnueabihf --release --locked
       - name: "Upload assets"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ matrix.asset_name }}
           path: ${{ matrix.artifact_name }}
@@ -77,14 +67,10 @@ jobs:
             asset_name: didc-linux64
           - os: ubuntu-22.04
             asset_name: didc-linux64
-          - os: macos-14-large
-            asset_name: didc-macos
-          - os: macos-13-large
-            asset_name: didc-macos
     steps:
       - name: Get executable
         id: download
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ matrix.asset_name }}
       - name: Executable runs
@@ -104,13 +90,46 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Get executable
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ matrix.asset_name }}
       - name: Upload binaries to release
-        uses: svenstaro/upload-release-action@v2
+        uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           file: didc
           asset_name: ${{ matrix.asset_name }}
           tag: ${{ github.ref }}
+
+  candid-ui:
+    name: Build and publish candid_ui canister
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Install Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '20'
+      - name: Install Rust toolchain
+        run: rustup show active-toolchain || rustup toolchain install
+      - name: Install binaryen
+        run: |
+          sudo apt-get update -yy
+          sudo apt-get install -yy binaryen
+      - name: Build candid_ui
+        working-directory: tools/ui
+        run: |
+          npm install
+          npm run build
+          cargo build --target wasm32-unknown-unknown --profile canister --package didjs
+          wasm-opt --strip-debug -Oz target/wasm32-unknown-unknown/canister/didjs.wasm -o target/wasm32-unknown-unknown/canister/didjs_opt.wasm
+      - name: Prepare asset
+        run: |
+          cp tools/ui/target/wasm32-unknown-unknown/canister/didjs_opt.wasm candid_ui.wasm
+      - name: Upload candid_ui to release
+        uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: candid_ui.wasm
+          asset_name: candid_ui.wasm
+          tag: ${{ github.ref }}

.github/workflows/rust.yml

@@ -13,9 +13,9 @@ jobs:
   rust:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Cache cargo build
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cargo/registry
@@ -39,7 +39,7 @@ jobs:
   fuzzing:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Install cargo-fuzz
         run: |
           cargo install cargo-fuzz

.github/workflows/tools.yml

@@ -15,7 +15,7 @@ jobs:
   build-didc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Build didc
         run: cargo build -p didc --release
@@ -26,16 +26,16 @@ jobs:
       run:
         working-directory: ${{ env.WORKING_DIR }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       # TODO: use dfinity/ci-tools/actions/setup-pnpm once the repo has a standard structure with a package.json file in the root
       - name: Install pnpm
-        uses: pnpm/action-setup@v3
+        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3
         with:
           package_json_file: ${{ env.WORKING_DIR }}/package.json
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: ${{ env.WORKING_DIR }}/.node-version
           registry-url: "https://registry.npmjs.org"

.gitignore

@@ -1,5 +1,6 @@
 target/
 .canbench/
+canbench_results.yml
 
 # IDEs
 .idea/