Merge branch 'master' into improve-makefile

.github/ISSUE_TEMPLATE/prepare_release.md

@@ -18,7 +18,7 @@ For detailed info on the release process refer to https://github.com/logos-messa
 All items below are to be completed by the owner of the given release.
 
 - [ ] Create release branch with major and minor only ( e.g. release/v0.X ) if it doesn't exist.
-- [ ] Update the `version` field in `waku.nimble` to match the release version (e.g. `version = "0.X.0"`).
+- [ ] Update the `version` field in `waku.nimble` to match the release version (e.g. `version = "0.X.0"`) **and merge it before assigning any tag** - the `release-assets` workflow gates artifact build/upload.
 - [ ] Assign release candidate tag to the release branch HEAD (e.g. `v0.X.0-rc.0`, `v0.X.0-rc.1`, ... `v0.X.0-rc.N`).
 - [ ] Generate and edit release notes in CHANGELOG.md.
 

.github/workflows/release-assets.yml

@@ -11,7 +11,35 @@ env:
   NPROC: 2
 
 jobs:
+  # Release gate: the pushed tag MUST exactly match waku.nimble's version,
+  # so every published artifact reports the correct getNodeInfo Version.
+  # CI cannot reject/remove a tag, so we gate artifact build & upload on
+  # this instead: a mismatched tag yields no released artifacts.
+  verify-version:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Assert pushed tag equals waku.nimble version
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          set -euo pipefail
+          NIMBLE_VERSION=$(grep -m1 '^version = ' waku.nimble | sed -E 's/version = "([^"]+)"/\1/')
+          # Strip leading v and any prerelease suffix (e.g. v0.38.0-rc.1 ->
+          # 0.38.0) so release-candidate tags build against the same
+          # waku.nimble version as the final tag.
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          BASE_VERSION="${TAG_VERSION%%-*}"
+          echo "tag:                 ${GITHUB_REF_NAME} (base ${BASE_VERSION})"
+          echo "waku.nimble version: ${NIMBLE_VERSION}"
+          if [ "${BASE_VERSION}" != "${NIMBLE_VERSION}" ]; then
+            echo "::error::Tag ${GITHUB_REF_NAME} (base ${BASE_VERSION}) does not match"
+            echo "::error::waku.nimble version (${NIMBLE_VERSION}). Bump waku.nimble before tagging."
+            exit 1
+          fi
+          echo "OK: tag base matches waku.nimble."
+
   build-and-upload:
+    needs: verify-version
     strategy:
       matrix:
         os: [ubuntu-22.04, macos-15]

.github/workflows/version-check.yml

@@ -0,0 +1,49 @@
+name: version check
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches: [master]
+
+jobs:
+  # PR check: waku.nimble version must be >= the nearest tag reachable from
+  # this branch (`git describe --tags --abbrev=0`, i.e. ancestor-aware).
+  # Because we check out the PR HEAD (not the simulated merge ref), a branch
+  # that predates a release tag does not see that tag in its history, so a
+  # newly pushed tag does NOT break in-flight PRs. Once the branch merges/
+  # rebases past the tag, the bump is then enforced. This keeps waku.nimble
+  # fixed as early as possible, independent of whether a release is cut.
+  # The exact tag==nimble guarantee at release time lives in
+  # release-assets.yml, which gates artifact publishing on it.
+  nimble-not-behind-tag:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Compare waku.nimble version with nearest ancestor tag
+        run: |
+          set -euo pipefail
+          NIMBLE_VERSION=$(grep -m1 '^version = ' waku.nimble | sed -E 's/version = "([^"]+)"/\1/')
+          # Nearest tag reachable from HEAD; --abbrev=0 drops the -<n>-g<sha>
+          # suffix so we get the bare tag (e.g. v0.38.0).
+          BASE_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          BASE_TAG=${BASE_TAG#v}
+          # Compare on the base version, ignoring any -rc.N prerelease suffix.
+          BASE_TAG=${BASE_TAG%%-*}
+          echo "waku.nimble version: ${NIMBLE_VERSION}"
+          echo "ancestor git tag:    ${BASE_TAG:-<none>}"
+          if [ -z "${BASE_TAG}" ]; then
+            echo "No ancestor release tag; skipping."
+            exit 0
+          fi
+          # lowest of the two by version sort must be the tag => nimble >= tag
+          LOWEST=$(printf '%s\n%s\n' "${NIMBLE_VERSION}" "${BASE_TAG}" | sort -V | head -1)
+          if [ "${LOWEST}" != "${BASE_TAG}" ] && [ "${NIMBLE_VERSION}" != "${BASE_TAG}" ]; then
+            echo "::error::waku.nimble version (${NIMBLE_VERSION}) is behind its"
+            echo "::error::ancestor git tag (v${BASE_TAG}). Bump 'version' in waku.nimble."
+            exit 1
+          fi
+          echo "OK: waku.nimble is not behind its ancestor tag."

flake.nix

@@ -36,6 +36,20 @@
 
       forAllSystems = nixpkgs.lib.genAttrs systems;
 
+      lib = nixpkgs.lib;
+
+      # Single source of truth for the semver: the `version` field of
+      # waku.nimble. Kept in sync with git tags by the version-check CI.
+      nimbleVersion =
+        let line = lib.findFirst (l: lib.hasPrefix "version = " l)
+                     "version = \"unknown\""
+                     (lib.splitString "\n" (builtins.readFile ./waku.nimble));
+        in lib.removeSuffix "\"" (lib.removePrefix "version = \"" line);
+
+      # A flake sandbox has no .git, so `git describe` is impossible; the
+      # commit comes from the flake metadata instead.
+      shortRev = self.shortRev or self.dirtyShortRev or "dirty";
+
       nimbleOverlay = final: prev: {
         nimble = prev.nimble.overrideAttrs (_: {
           version = "0.22.3";
@@ -60,6 +74,7 @@
             inherit pkgs;
             src = ./.;
             zerokitRln = zerokit.packages.${system}.rln;
+            gitVersion = "v${nimbleVersion}-g${builtins.substring 0 6 shortRev}";
           };
         in {
           inherit liblogosdelivery;

nix/default.nix

@@ -1,6 +1,7 @@
 { pkgs
 , src
 , zerokitRln
+, gitVersion           ? "n/a"
 , enablePostgres       ? true
 , enableNimDebugDlOpen ? true
 , chroniclesLogLevel   ? null
@@ -10,7 +11,8 @@ let
   deps      = import ./deps.nix    { inherit pkgs; };
 
   nimDefineArgs = pkgs.lib.concatStringsSep " \\\n      " (
-       [ "--define:disable_libbacktrace" ]
+       [ "--define:disable_libbacktrace"
+         "--define:git_version=${gitVersion}" ]
     ++ pkgs.lib.optional enablePostgres       "--define:postgres"
     ++ pkgs.lib.optional enableNimDebugDlOpen "--define:nimDebugDlOpen"
     ++ pkgs.lib.optional (chroniclesLogLevel != null)

waku.nimble

@@ -4,7 +4,7 @@ import os
 mode = ScriptMode.Verbose
 
 ### Package
-version = "0.37.4"
+version = "0.38.1"
 author = "Status Research & Development GmbH"
 description = "Waku, Private P2P Messaging for Resource-Restricted Devices"
 license = "MIT or Apache License 2.0"

waku/factory/waku_state_info.nim

@@ -5,7 +5,7 @@
 ## accessible through the debug API.
 
 import std/[tables, sequtils, strutils]
-import metrics, eth/p2p/discoveryv5/enr, libp2p/peerid
+import metrics, eth/p2p/discoveryv5/enr, libp2p/peerid, stew/byteutils
 import waku/[waku_node, net/bound_ports]
 
 type
@@ -16,6 +16,7 @@ type
     MyENR
     MyPeerId
     MyBoundPorts
+    MyMixPubKey
 
   WakuStateInfo* {.requiresInit.} = object
     node: WakuNode
@@ -46,6 +47,11 @@ proc getNodeInfoItem*(self: WakuStateInfo, infoItemId: NodeInfoId): string =
     return $PeerId(self.node.peerId())
   of NodeInfoId.MyBoundPorts:
     return $self.node.ports
+  of NodeInfoId.MyMixPubKey:
+    ## Empty when the mix protocol is not mounted on this node.
+    if self.node.wakuMix.isNil():
+      return ""
+    return self.node.wakuMix.pubKey.to0xHex()
   else:
     return "unknown info item id"