[Release/CI] Github flow to build `polkadot`/`polkadot-parachain` rc binaries and deb package (#5963)

This PR introduces a GitHub flow, that should replace a semi manual part
of the release process to build rc binaries for `polkadot` and
`polkadot-parachain` + the `polkadot` deb package.

Right now, this part of the release is done on the `cleanroom` machine
by the release engineers via triggering bash scripts directly on the
server. These GitHub flows should replace it and move everything to the
CI.

The whole flow is meant to be run in the new
[paritytech-release](https://github.com/paritytech-release) where the
automated release is going to be moved.

The flow includes the following steps:
- Build `polkadot`, `polakdot-prepare-worker`, `polkadot-execute-worker`
and `polkadopt-parachain` binaries
- Sign those artefacts using `gpg` and generate a sha256 checksum
- Build deb package for `polakdot`
- Make a GitHub attestation
- Upload artefacts to the S3 buckets

Closes: https://github.com/paritytech/release-engineering/issues/223



---------

Co-authored-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

PR removes short-benchmarks from GitLab, adds condition for
cargo-check-rutimes

Disable flaky tests reported in:
#5972 
#5973 
#5974

This bumps `ethbloom`, `ethereum-types`, `primitive-types` and `rlp` to
their latest version.

Fixes: https://github.com/paritytech/polkadot-sdk/issues/5870



---------

Co-authored-by: command-bot <>
Co-authored-by: ggwpez <ggwpez@users.noreply.github.com>
Co-authored-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>
Co-authored-by: Shawn Tabrizi <shawntabrizi@gmail.com>
Co-authored-by: Dónal Murray <donal.murray@parity.io>

Bump zombienet version, including fixes for `ci` and set _resources
requests_ for the runner.

Thx!

Co-authored-by: Bastian Köcher <git@kchr.de>

Changes:
- Add `--exclude-pallets` to exclude some pallets from runtimes where we
dont have genesis presets yet
- Make `--genesis-builder-policy=none` work with `--runtime`
- CI: Run the frame-omni-bencher for all runtimes

---------

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>
Co-authored-by: ggwpez <ggwpez@users.noreply.github.com>
Co-authored-by: Bastian Köcher <git@kchr.de>
Co-authored-by: Branislav Kontur <bkontur@gmail.com>
Co-authored-by: alvicsam <alvicsam@gmail.com>
Co-authored-by: Maksym H <mordamax@gmail.com>
Co-authored-by: Alexander Samusev <41779041+alvicsam@users.noreply.github.com>
Co-authored-by: Maksym H <1177472+mordamax@users.noreply.github.com>

- moved the omni-node lib from
  `cumulus/polkadot-parachain/polkadot-parachain-lib` to
  `cumulus/polkadot-omni-node/lib`
- renamed `polkadot-parachain-lib` to `polkadot-omni-node-lib`
- added `polkadot-omni-node` binary

Related to https://github.com/paritytech/polkadot-sdk/issues/5566

Related to
https://github.com/paritytech/polkadot-sdk/pull/5924#issuecomment-2393558697

improve prdoc arguments validation & help:
- convert audiences options to snake_case. Fixes
https://github.com/paritytech/polkadot-sdk/issues/5927
  - support more than one audiences
  - define allowed bump options
- infer --pr from the actual PR (now it's optional, can still be
overwritten)


![image](https://github.com/user-attachments/assets/24e18fe2-2f67-4ce0-90e4-34f6c2f860c9)

Test evidence:
https://github.com/paritytech-stg/polkadot-sdk/pull/52/commits/6dd274e3678d287c163cfa6cb696acee9852767d

`AccountData` should be set to `()` and not to `AccountInfo`.

Closes: https://github.com/paritytech/polkadot-sdk/issues/5922



---------

Co-authored-by: Shawn Tabrizi <shawntabrizi@gmail.com>

Resolves https://github.com/polkadot-fellows/runtimes/issues/459



Tested with rococo/westend/kusama/polkadot runtimes

---------

Co-authored-by: DavidK <davidk@parity.io>
Co-authored-by: Muharem <ismailov.m.h@gmail.com>
Co-authored-by: Shawn Tabrizi <shawntabrizi@gmail.com>
Co-authored-by: Dónal Murray <donal.murray@parity.io>

This is a no-op refactor of staking pallet to move all `T::Currency` api
calls under one module.

A followup PR (https://github.com/paritytech/polkadot-sdk/pull/5501)
will implement the Currency <> Fungible migration for the pallet.

Introduces the new `asset` module that centralizes all interaction with
`T::Currency`. This is an attempt to try minimising staking logic
changes to minimal parts of the codebase.

## Things of note
- `T::Currency::free_balance` in current implementation includes both
staked (locked) and liquid tokens (kinda sounds wrong to call it free
then). This PR renames it to `stakeable_balance` (any better name
suggestions?). With #5501, this will become `free balance that can be
held/staked` + `already held/staked balance`.

This PR adds **static** validation that prevents upload of code that:

1) Contains basic blocks larger than the specified limit (currently
`200`)
2) Contains invalid instructions
3) Uses the `sbrk` instruction

Doing that statically at upload time (instead of at runtime) allows us
to change the basic block limit or add instructions later without
worrying about breaking old code. This is well worth the linear scan of
the whole blob on deployment in my opinion. Please note that those
checks are not applied when existing code is just run (hot path).

Also some drive by fixes:
- Remove superflous `publish = true`
- Abort fixture build on warning and fix existing warnings
- Re-enable optimizations in fixture builds (should be fixed now in
PolkaVM)
- Disable stripping for fixture builds (maybe we can get some line
information on trap via `RUST_LOG`)

---------

Co-authored-by: command-bot <>
Co-authored-by: PG Herveou <pgherveou@gmail.com>

This PR introduces a `VestedTransfer` Trait, which handles making a
transfer while also applying a vesting schedule to that balance.

This can be used in pallets like the Treasury pallet, where now we can
easily introduce a `vested_spend` extrinsic as an alternative to giving
all funds up front.

We implement `()` for the `VestedTransfer` trait, which just returns an
error, and allows anyone to opt out from needing to use or implement
this trait.

This PR also updates the logic of `do_vested_transfer` to remove the
"pre-check" which was needed before we had a default transactional layer
in FRAME.

Finally, I also fixed up some bad formatting in the test.rs file.

---------

Co-authored-by: Guillaume Thiolliere <gui.thiolliere@gmail.com>
Co-authored-by: Bastian Köcher <git@kchr.de>

This PR adds the ability to start version guarding when performing
standalone relaying of messages and parachains.

## Follow-up
- decouple and simplify `fn start_relay_guards`:
https://github.com/paritytech/polkadot-sdk/issues/5923

---------

Co-authored-by: command-bot <>

closes #5942

Couldn't find any emissions of `Event::Issued` without amount check
other than in this PR.

Currently, we have;


https://github.com/paritytech/polkadot-sdk/blob/4bda956d2c635c3926578741a19fbcc3de69cbb8/substrate/frame/balances/src/impl_currency.rs#L212-L220

and


https://github.com/paritytech/polkadot-sdk/blob/4bda956d2c635c3926578741a19fbcc3de69cbb8/substrate/frame/balances/src/impl_currency.rs#L293-L306

Update try-runtime-cli to 0.8.0 for MBM testing.

---------

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

Seems to also need actions permission otherwise it error when trying to
backport a change to the yml files liker
[here](https://github.com/paritytech/polkadot-sdk/actions/runs/11143649431/job/30969199054).

There are cases during warp sync or re-orgs, where we receive a
notification with a block parent that was not reported in the past. This
PR extends the tracking state to catch those cases and report a `Stop`
event to the user.

This PR adds a new state to the RPC-v2 chainHead to track which blocks
have been reported.

In the past we relied on the pinning mechanism to provide us details if
a block is pinned or not.
However, the pinning state keeps the minimal information around for
pinning. Therefore, unpinning a block will cause the state to disappear.

Closes: https://github.com/paritytech/polkadot-sdk/issues/5761

---------

Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
Co-authored-by: Sebastian Kunert <skunert49@gmail.com>

cc https://github.com/paritytech/ci_cd/issues/1039

This PR updates the substrate-relay version for the bridges' Zombienet
tests.

Runtime side of https://github.com/paritytech/polkadot-sdk/issues/5048

Send the core selector ump signal in cumulus. Guarded by a compile time
feature until nodes are upgraded to a version that includes
https://github.com/paritytech/polkadot-sdk/pull/5423

 for gracefully
handling ump signals.

---------

Co-authored-by: GitHub Action <action@github.com>

# Description
## What?
Make it possible for other pallets to implement their own logic when a
slash on a balance occurs.

## Why?
In the [introduction of
holds](https://github.com/paritytech/substrate/pull/12951) @gavofyork
said:
> Since Holds are designed to be infallibly slashed, this means that any
logic using a Freeze must handle the possibility of the frozen amount
being reduced, potentially to zero. A permissionless function should be
provided in order to allow bookkeeping to be updated in this instance.

At Polimec we needed to find a way to reduce the vesting schedules of
our users after a slash was made, and after talking to @Kianenigma at
the Web3Summit, we realized there was no easy way to implement this with
the current traits, so we came up with this solution.



## How?
- First we abstract the `done_slash` function of holds::Balanced to it's
own trait that any pallet can implement.
- Then we add a config type in pallet-balances that accepts a callback
tuple of all the pallets that implement this trait.
- Finally implement done_slash for pallet-balances such that it calls
the config type.

## Integration
The default implementation of done_slash is still an empty function, and
the new config type of pallet-balances can be set to an empty tuple, so
nothing changes by default.

## Review Notes
- I suggest to focus on the first commit which contains the main logic
changes.
- I also have a working implementation of done_slash for pallet_vesting,
should I add it to this PR?
- If I run `cargo +nightly fmt --all` then I get changes to a lot of
unrelated crates, so not sure if I should run it to avoid the fmt
failure of the CI
- Should I hunt down references to fungible/fungibles documentation and
update it accordingly?

**Polkadot address:** `15fj1UhQp8Xes7y7LSmDYTy349mXvUwrbNmLaP5tQKBxsQY1`

# Checklist

* [x] My PR includes a detailed description as outlined in the
"Description" and its two subsections above.
* [x] My PR follows the [labeling requirements](

https://github.com/paritytech/polkadot-sdk/blob/master/docs/contributor/CONTRIBUTING.md#Process


) of this project (at minimum one label for `T` required)
* External contributors: ask maintainers to put the right label on your
PR.
* [ ] I have made corresponding changes to the documentation (if
applicable)

---------

Co-authored-by: Kian Paimani <5588131+kianenigma@users.noreply.github.com>
Co-authored-by: command-bot <>
Co-authored-by: Francisco Aguirre <franciscoaguirreperez@gmail.com>

Closes https://github.com/paritytech/polkadot-sdk/issues/5045 and
https://github.com/paritytech/polkadot-sdk/issues/5046

<del>On top of
https://github.com/paritytech/polkadot-sdk/pull/5362</del>

TODO:
- [x] storage migration for allowed relay parents tracker 
- [x] check session index
- [x] PRdoc
- [x] tests
- [x] ensure UMP queue cannot be abused with this change
- [x] Zombienet runtime upgrade test

---------

Signed-off-by: Andrei Sandu <andrei-mihail@parity.io>

Bumps the ci_dependencies group with 1 update:
[docker/build-push-action](https://github.com/docker/build-push-action).

Updates `docker/build-push-action` from 6.7.0 to 6.8.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/build-push-action/releases">docker/build-push-action's
releases</a>.</em></p>
<blockquote>
<h2>v6.8.0</h2>
<ul>
<li>Bump <code>@​docker/actions-toolkit</code> from 0.37.1 to 0.38.0 in
<a
href="https://redirect.github.com/docker/build-push-action/pull/1230">docker/build-push-action#1230</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/docker/build-push-action/compare/v6.7.0...v6.8.0">https://github.com/docker/build-push-action/compare/v6.7.0...v6.8.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/docker/build-push-action/commit/32945a339266b759abcbdc89316275140b0fc960"><code>32945a3</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/build-push-action/issues/1230">#1230</a>
from docker/dependabot/npm_and_yarn/docker/actions-t...</li>
<li><a
href="https://github.com/docker/build-push-action/commit/e0fe9cf0f26132beab7b62929bd647eef9e7df31"><code>e0fe9cf</code></a>
chore: update generated content</li>
<li><a
href="https://github.com/docker/build-push-action/commit/8f1ff6bf9a836299c21b10f942be49efb52a832c"><code>8f1ff6b</code></a>
chore(deps): Bump <code>@​docker/actions-toolkit</code> from 0.37.1 to
0.38.0</li>
<li>See full diff in <a
href="https://github.com/docker/build-push-action/compare/5cd11c3a4ced054e52742c5fd54dca954e0edd85...32945a339266b759abcbdc89316275140b0fc960">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/build-push-action&package-manager=github_actions&previous-version=6.7.0&new-version=6.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores

)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Bastian Köcher <git@kchr.de>

# Description

Adding Dwellir bootnodes in the `people-polkadot.json` spec file.

This PR adds a new beefy metric to monitor the number of live beefy
peers.

Part of investigation of litep2p request failures:
https://github.com/paritytech/polkadot-sdk/issues/4985

cc @paritytech/networking

---------

Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>

Fixes #5900.

Bump zombienet version. Including fixes for `ci` failures like 

https://gitlab.parity.io/parity/mirrors/polkadot-sdk/-/jobs/7511363
https://gitlab.parity.io/parity/mirrors/polkadot-sdk/-/jobs/7511379

Updated runners for CMD and Docs

This PR introduces the concept of immutable storage data, used for
[Solidity immutable
variables](https://docs.soliditylang.org/en/latest/contracts.html#immutable).

This is a minimal implementation. Immutable data is attached to a
contract; to keep `ContractInfo` fixed in size, we only store the length
there, and store the immutable data in a dedicated storage map instead.
Which comes at the cost of requiring an additional storage read (costly)
for contracts using this feature.

We discussed more optimal solutions not requiring any additional storage
accesses internally, but they turned out to be non-trivial to implement.
Another optimization benefiting multiple calls to the same contract in a
single call stack would be to cache the immutable data in `Stack`.
However, this potential creates a DOS vulnerability (the attack vector
is to call into as many contracts in a single stack as possible, where
they all have maximum immutable data to fill the cache as efficiently as
possible). So this either has to be guaranteed to be a non-issue by
limits, or, more likely, to have some logic to bound the cache.
Eventually, we should think about introducing the concept of warm and
cold storage reads (akin to EVM). Since immutable variables are commonly
used in contracts, this change is blocking our initial launch and we
should only optimize it properly in follow-ups.

This PR also disables the `set_code_hash` API (which isn't usable for
Solidity contracts without pre-compiles anyways). With immutable storage
attached to contracts, we now want to run the constructor of the new
code hash to collect the immutable data during `set_code_hash`. This
will be implemented in a follow up PR.

---------

Signed-off-by: Cyrill Leutwiler <bigcyrill@hotmail.com>
Signed-off-by: xermicus <cyrill@parity.io>
Co-authored-by: command-bot <>
Co-authored-by: Alexander Theißen <alex.theissen@me.com>
Co-authored-by: PG Herveou <pgherveou@gmail.com>

For permissionless lanes, we add `lane_state` to the `InboundLaneData`
and `OutboundLaneData` structs. However, for a period of time (until
both BHK and BHP are upgraded to the same version), we need the relayer
to function with runtimes where one has been migrated with `lane_state`
and the other has not. This PR addresses the incompatibility by
introducing wrapper structs for decoding without `lane_state`.

The AllowTopLevelPaidExecutionFrom allows ClearOrigin instructions
before the expected BuyExecution instruction, it also allows messages
without any origin altering instructions.

This commit enhances the barrier to also support messages that use
AliasOrigin, or DescendOrigin. This is sometimes desired in asset
transfer XCM programs that need to run the inbound assets instructions
using the origin chain root origin, but then want to drop privileges for
the rest of the program. Currently these programs drop privileges by
clearing the origin completely, but that also unnecessarily limits the
range of actions available to the rest of the program. Using
DescendOrigin or AliasOrigin allows the sending chain to instruct the
receiving chain what the deprivileged real origin is.

See https://github.com/polkadot-fellows/RFCs/pull/109 and
https://github.com/polkadot-fellows/RFCs/pull/122

 for more details on
how DescendOrigin and AliasOrigin could be used instead of ClearOrigin.

---------

Signed-off-by: Adrian Catangiu <adrian@parity.io>

# Description

Closes [#5790](https://github.com/paritytech/polkadot-sdk/issues/5790).
Useful for starting nodes based on minimal/solochain when doing
development or for testing omni node with less happy code paths. It is
reusing the presets defined for the nodes chain specs.

## Integration

Specifically useful for development/testing if generating chain-specs
for `minimal` or `solochain` runtimes from `templates` directories.

## Review Notes

Added `genesis_config_presets` modules for both minimal/solochain. I
reused the presets defined in each node `chain_spec` module
correspondingly.

### PRDOC

Not sure who uses templates, maybe node devs and runtime devs at start
of their learning journey, but happy to get some guidance on how to
write the prdoc if needed.

### Thinking out loud

I saw concerns around sharing functionality for such genesis config
presets between the template chains. I think there might be a case for
doing that, on the lines of this comment:
https://github.com/paritytech/polkadot-sdk/pull/4739#issuecomment-2157341035.
I would add that `parachains-common::genesis_config_heleper` contains a
few methods from those mentioned, but I am unsure if using it as a
dependency for templates is correct. Feels like the comment suggests
there should be a `commons` crate concerning just `templates`, which I
agree with to some degree, if we assume `cumulus` needs might be driven
in certain directions that are not relevant to `templates` and vice
versa. However I am not so certain about this, so would welcome some
thoughts, since I am seeing `parachains-common` being used already in a
few runtime implementations:
https://crates.io/crates/parachains-common/reverse_dependencies?page=3

,
so might be a good candidate already for the `common` logic.

---------

Signed-off-by: Iulian Barbu <iulian.barbu@parity.io>

Jaeger tracing went mostly unused and it created bigger problems like
wasting CPU or memory leaks, so remove it entirely.

Fixes: https://github.com/paritytech/polkadot-sdk/issues/4995



---------

Signed-off-by: Alexandru Gheorghe <alexandru.gheorghe@parity.io>

# Description

The EthereumBlobExporter consumes the `dest` parameter when the
destination is not `Here`. Subsequent exporters will receive a `None`
value for the destination instead of the original destination value,
which is incorrect.
 
Closes #5788

## Integration

Minor fix related to the exporter behaviour.

## Review Notes

Verified that tests
`exporter_validate_with_invalid_dest_does_not_alter_destination` and
`exporter_validate_with_invalid_universal_source_does_not_alter_universal_source`
fail without the fix in the exporter.

---------

Co-authored-by: Adrian Catangiu <adrian@parity.io>

Relates to: https://github.com/paritytech/polkadot-sdk/pull/5916
Relates to: https://github.com/polkadot-js/api/pull/5976



---------

Co-authored-by: Javier Viola <javier@parity.io>

This PR adds the `stableYYMM-rcX` or `stableYYMM-X-rcX` tags to the
docker images, so that they could be published with the new tag naming
scheme.

Closes: https://github.com/paritytech/release-engineering/issues/224

Removing the shell node variant for the polkadot-parachain as discussed
here:
https://github.com/paritytech/polkadot-sdk/pull/5586#discussion_r1752635254

Resolves https://github.com/paritytech/polkadot-sdk/issues/5898

This PR removes the requirement to set the `LaneId` in the relayer CLI
configuration where it was not really necessary.

---------

Co-authored-by: command-bot <>

- update baseline for pallet_revive
- update cmd pipeline name
- Fix compilation after renaming some of benchmarks in pallet_revive.
[Runtime Dev]. Changed the "instr" benchmark so that it should no longer
return to little weight. It is still bogus but at least benchmarking
should not work. (by @athei

 )

---------

Co-authored-by: GitHub Action <action@github.com>
Co-authored-by: Alexander Theißen <alex.theissen@me.com>
Co-authored-by: Alexander Samusev <41779041+alvicsam@users.noreply.github.com>
Co-authored-by: command-bot <>