Merge remote-tracking branch 'origin/main' into solana-examples/conditional-ata-value

Author: nazreen

.changeset/chilled-wolves-vanish.md

@@ -0,0 +1,5 @@
+---
+"@layerzerolabs/verify-contract": patch
+---
+
+fix duplicated sourcemaps

.changeset/forty-months-turn.md

@@ -0,0 +1,7 @@
+---
+"@layerzerolabs/oft-adapter-initia-example": patch
+"@layerzerolabs/devtools-move": major
+"@layerzerolabs/oft-initia-example": patch
+---
+
+update initia.js version and object creation seed derivation

.changeset/small-starfishes-crash.md

@@ -0,0 +1,24 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directories:
+      - "/"
+      - "/packages/*"
+      - "/examples/*"
+
+    schedule:
+      interval: "daily"
+
+    # Keep at most one open Dependabot PR at a time
+    open-pull-requests-limit: 1
+
+    # Only update this single public package
+    allow:
+      - dependency-name: "@layerzerolabs/lz-definitions"
+        dependency-type: "direct"
+
+    # Grouping is redundant with the allow-list, but harmless and keeps naming consistent
+    groups:
+      lz-definitions:
+        patterns:
+          - "@layerzerolabs/lz-definitions"

.github/dependabot.yaml

@@ -0,0 +1,154 @@
+#   .-.-.   .-.-.   .-.-.   .-.-.   .-.-.   .-.-.   .-.-.   .-.-  .-.-.   .-.-.   .-.-
+#  / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ / / \ \ / / \ \ / / \
+# `-'   `-`-'   `-`-'   `-`-'   `-`-'   `-`-'   `-`-'   `-'   `-`-'   `-`-'   `-`-'
+#
+#                       CodeQL
+#
+#  This workflow replaces the GitHub CodeQL extension to support fork PRs.
+#  The extension doesn't trigger on fork PRs due to security restrictions.
+#  This workflow uses the pull_request event which works for all PRs.
+#
+#   .-.-.   .-.-.   .-.-.   .-.-.   .-.-.   .-.-.   .-.-.   .-.-  .-.-.   .-.-.   .-.-
+#  / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ \ / / \ / / \ \ / / \ \ / / \
+# `-'   `-`-'   `-`-'   `-`-'   `-`-'   `-`-'   `-`-'   `-`-'   `-'   `-`-'   `-`-'
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+      - develop
+  pull_request:
+    branches:
+      - main
+      - develop
+  merge_group:
+    # Required for GitHub merge queue
+    branches:
+      - main
+      - develop
+  schedule:
+    # Run weekly security scans every Monday at midnight UTC
+    - cron: '0 0 * * 1'
+
+# Cancel in-progress runs when a new commit is pushed
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+# Minimal permissions for fork PRs
+# Results are uploaded to Security tab and posted as checks
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  analyze:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['javascript-typescript']
+
+    # Skip autobuild - CodeQL can analyze source code directly
+    # No need to compile or install dependencies for static analysis
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: 'true'
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          # Use default queries plus security-extended for more coverage
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"
+
+  dockerfile:
+    name: Dockerfile Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: analyze
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run Hadolint
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: Dockerfile
+          format: sarif
+          output-file: hadolint.sarif
+          no-fail: true
+
+      - name: Upload Hadolint results
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: hadolint.sarif
+          category: "hadolint"
+
+# Note: ShellCheck action doesn't natively support SARIF output
+# Results will appear in workflow logs
+  shellcheck:
+    name: Shell Script Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: analyze
+
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@2.0.0
+        with:
+          scandir: '.'
+          format: gcc
+          severity: warning
+        continue-on-error: true
+
+  # Final status check job for backwards compatibility with the old CodeQL workflow
+  CodeQL:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    needs: [analyze, dockerfile, shellcheck]
+    if: always()
+    
+    steps:
+      - name: Check all jobs succeeded
+        run: |
+          if [ "${{ needs.analyze.result }}" != "success" ]; then
+            echo "CodeQL analysis failed"
+            exit 1
+          fi
+          if [ "${{ needs.dockerfile.result }}" != "success" ]; then
+            echo "Dockerfile lint failed"
+            exit 1
+          fi
+          if [ "${{ needs.shellcheck.result }}" != "success" ]; then
+            echo "ShellCheck lint failed"
+            exit 1
+          fi
+          echo "All security checks passed!"
+

.github/workflows/codeql.yml

@@ -12,6 +12,7 @@ name: Check code submission
 
 on:
   pull_request:
+  merge_group:
   workflow_dispatch:
 
 # We want the workflow to stop and yield to a new run if new code is pushed

.github/workflows/on-develop.yaml

@@ -162,16 +162,6 @@ jobs:
       - name: Setup build cache
         uses: ./.github/workflows/actions/setup-build-cache
 
-      - name: E2E Test Notice
-        run: |
-          echo "::notice::🧪 E2E tests are non-blocking and run against live networks"
-          echo "::notice::These tests validate real blockchain interactions but may fail due to:"
-          echo "::notice::  - Network connectivity issues"
-          echo "::notice::  - RPC rate limiting"
-          echo "::notice::  - External service downtime"
-          echo "::notice::  - Gas price fluctuations"
-          echo "::notice::E2E test failures do NOT block the main CI pipeline"
-
       # There is a small bug in docker compose that will cause 401 if we don't pull the base image manually
       #
       # See more here https://github.com/docker/compose-cli/issues/1545
@@ -217,34 +207,74 @@ jobs:
         with:
           path: ./logs
 
-      # Post comment on E2E test failure
-      - name: Comment on E2E failure
-        if: steps.test-e2e.outcome == 'failure'
+      # Post comment on E2E test completion (success or failure)
+      - name: Comment on E2E results
+        if: always() && steps.test-e2e.outcome != 'skipped' && steps.test-e2e.outcome != 'cancelled'
         uses: actions/github-script@v7
         with:
           script: |
+            const outcome = '${{ steps.test-e2e.outcome }}';
+            const emoji = outcome === 'success' ? '✅' : '❌';
+            const status = outcome === 'success' ? 'Passed' : 'Failed';
+            const timestamp = new Date().toISOString().replace('T', ' ').substring(0, 16) + ' (UTC)';
+            const runNumber = context.runNumber;
             const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
             const prNumber = context.payload.pull_request?.number;
+            const header = "## 🧪 E2E Test Status";
+            
+            const newEntry = `- ${emoji} [Run #${runNumber}](${runUrl}) - ${status} - ${timestamp}`;
 
             if (prNumber) {
-              const comment = "## 🚨 E2E Tests Failed\n\n" +
-                "The E2E tests failed during CI. These tests validate real blockchain interactions and may fail due to:\n" +
-                "- Network connectivity issues\n" +
-                "- RPC rate limiting\n" +
-                "- External service downtime\n" +
-                "**Action Run:** " + runUrl + "\n\n" +
-                "This is **non-blocking** and does not prevent merging. Check the action logs above for detailed failure information.";
-
               try {
-                await github.rest.issues.createComment({
-                  issue_number: prNumber,
+                const { data: comments } = await github.rest.issues.listComments({
                   owner: context.repo.owner,
                   repo: context.repo.repo,
-                  body: comment
+                  issue_number: prNumber,
                 });
+
+                const botComment = comments.find(comment => 
+                  comment.user.type === 'Bot' && 
+                  comment.body.includes(header)
+                );
+
+                if (botComment) {
+                  // Extract existing entries
+                  const bodyLines = botComment.body.split('\n');
+                  const runsStartIndex = bodyLines.findIndex(line => line.trim() === '**Test Runs (Newest First):**');
+                  
+                  let newBody;
+                  if (runsStartIndex !== -1) {
+                    // Prepend new entry to existing runs (newest first)
+                    const beforeRuns = bodyLines.slice(0, runsStartIndex + 1).join('\n');
+                    const existingRuns = bodyLines.slice(runsStartIndex + 1).join('\n');
+                    newBody = beforeRuns + '\n' + newEntry + '\n' + existingRuns;
+                  } else {
+                    // Shouldn't happen, but handle gracefully
+                    newBody = botComment.body + '\n\n**Test Runs (Newest First):**\n' + newEntry;
+                  }
+
+                  await github.rest.issues.updateComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    comment_id: botComment.id,
+                    body: newBody
+                  });
+                } else {
+                  // Create new comment
+                  const comment = header + "\n\n" +
+                    "E2E tests are non-blocking and validate real blockchain interactions. Failures may occur due to network issues, RPC rate limits, or external service downtime.\n\n" +
+                    "**Test Runs (Newest First):**\n" +
+                    newEntry;
+
+                  await github.rest.issues.createComment({
+                    issue_number: prNumber,
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    body: comment
+                  });
+                }
               } catch (error) {
-                // Silently fail if we don't have permission to comment (e.g., on forks)
-                console.log('Could not post comment to PR:', error.message);
+                console.log('Error managing PR comments:', error.message);
               }
             }
 

.github/workflows/reusable-test.yaml

@@ -10,5 +10,6 @@
 # (The "." will execute this inside the current shell instead of creating a child one)
 
 set -a
-source ${1:-.env}
+# shellcheck source=/dev/null
+source "${1:-.env}"
 set +a

bin/env

@@ -1,5 +1,22 @@
 # @layerzerolabs/lzapp-migration-example
 
+## 0.3.9
+
+### Patch Changes
+
+- a2851bf: bump versions of monorepo packages
+- Updated dependencies [a2851bf]
+- Updated dependencies [afb4dd3]
+  - @layerzerolabs/ua-devtools-evm-hardhat@9.0.1
+  - @layerzerolabs/devtools-evm-hardhat@4.0.4
+  - @layerzerolabs/ua-devtools-solana@8.0.5
+  - @layerzerolabs/protocol-devtools@3.0.2
+  - @layerzerolabs/devtools-solana@3.0.5
+  - @layerzerolabs/ua-devtools-evm@7.0.1
+  - @layerzerolabs/ua-devtools@5.0.2
+  - @layerzerolabs/devtools@2.0.4
+  - @layerzerolabs/io-devtools@0.3.2
+
 ## 0.3.8
 
 ### Patch Changes