Merge v1.10

.github/workflows/benchmark.yml

@@ -27,6 +27,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Setup private build environment
+        if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+        uses: ./actions/private-setup
+        with:
+          atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
       - name: Detect changed components
         uses: dorny/paths-filter@v3
         id: changes

.github/workflows/ci.yml

@@ -24,6 +24,12 @@ jobs:
       - name: Clone
         uses: actions/checkout@v6
 
+      - name: Setup private build environment
+        if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+        uses: ./actions/private-setup
+        with:
+          atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
@@ -43,6 +49,12 @@ jobs:
       - name: Clone
         uses: actions/checkout@v6
 
+      - name: Setup private build environment
+        if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+        uses: ./actions/private-setup
+        with:
+          atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
@@ -62,6 +74,12 @@ jobs:
       - name: Clone
         uses: actions/checkout@v6
 
+      - name: Setup private build environment
+        if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+        uses: ./actions/private-setup
+        with:
+          atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
@@ -84,6 +102,12 @@ jobs:
       - name: Clone
         uses: actions/checkout@v6
 
+      - name: Setup private build environment
+        if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+        uses: ./actions/private-setup
+        with:
+          atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
@@ -104,6 +128,12 @@ jobs:
           # required to update the embedded version during code generation
           fetch-depth: 0
 
+      - name: Setup private build environment
+        if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+        uses: ./actions/private-setup
+        with:
+          atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
@@ -145,5 +175,11 @@ jobs:
       - name: Clone
         uses: actions/checkout@v6
 
+      - name: Setup private build environment
+        if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+        uses: ./actions/private-setup
+        with:
+          atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
       - name: semgrep ci
         run: semgrep ci --config semgrep.yaml

.github/workflows/codeql-analysis.yml

@@ -35,6 +35,12 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@v5
 
+    - name: Setup private build environment
+      if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+      uses: ./actions/private-setup
+      with:
+        atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
     - name: Set up Go
       uses: actions/setup-go@v6
       with:

.github/workflows/compat.yaml

@@ -11,14 +11,23 @@ jobs:
     steps:
     - name: Clone
       uses: actions/checkout@v6
+
+    - name: Setup private build environment
+      if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+      uses: ./actions/private-setup
+      with:
+        atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
     - name: Setup Python
       uses: actions/setup-python@v6
       with:
         python-version: '3.12'
         cache: 'pip'
+
     - name: Install dependencies
       working-directory: compat
       run: pip3 install -r requirements.txt
+
     - name: Run
       working-directory: compat
       run: "python3 main.py"

.github/workflows/compatibility-check-template.yml

@@ -19,6 +19,7 @@ on:
     secrets:
       FIND_API_AUTH:
         required: true
+      ATREE_DEPLOY_KEY:
 
 concurrency:
   group: ${{ github.workflow }}-${{ inputs.base-branch || github.run_id }}-${{ inputs.chain }}
@@ -33,10 +34,16 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Setup private build environment
+        if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+        uses: ./actions/private-setup
+        with:
+          atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
       - uses: actions/setup-go@v6
         with:
           go-version-file: ./tools/compatibility-check/go.mod
-          cache: true
+          cache: false
 
       - name: Make output dirs
         run: |
@@ -75,8 +82,8 @@ jobs:
       - name: Configure permissions
         if: github.repository != 'onflow/cadence'
         run: |
-          echo "GOPRIVATE=github.com/${{ inputs.repo }}" >> "$GITHUB_ENV"
-          git config --global url."https://${{ github.actor }}:${{ github.token }}@github.com".insteadOf "https://github.com"
+          echo "GOPRIVATE=github.com/${{ inputs.repo }},github.com/onflow/*-internal" >> "$GITHUB_ENV"
+          git config --global url."https://${{ github.actor }}:${{ github.token }}@github.com/${{ inputs.repo }}".insteadOf "https://github.com/${{ inputs.repo }}"
 
       # Check contracts using current branch
 

.github/workflows/compatibility-check.yml

@@ -66,6 +66,7 @@ jobs:
       chain: mainnet
     secrets:
       FIND_API_AUTH: ${{ secrets.FIND_API_AUTH }}
+      ATREE_DEPLOY_KEY: ${{ secrets.ATREE_DEPLOY_KEY }}
 
   testnet:
     needs: setup
@@ -77,3 +78,4 @@ jobs:
       chain: testnet
     secrets:
       FIND_API_AUTH: ${{ secrets.FIND_API_AUTH }}
+      ATREE_DEPLOY_KEY: ${{ secrets.ATREE_DEPLOY_KEY }}

.github/workflows/downstream.yml

@@ -26,6 +26,12 @@ jobs:
         with:
           repository: 'onflow/flow-go'
 
+      - name: Setup private build environment
+        if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+        uses: ./actions/private-setup
+        with:
+          atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
       - name: Setup Go
         uses: actions/setup-go@v6
         with:
@@ -50,6 +56,12 @@ jobs:
         with:
           repository: 'onflow/flow-emulator'
 
+      - name: Setup private build environment
+        if: ${{ vars.PRIVATE_BUILDS_SUPPORTED == 'true' }}
+        uses: ./actions/private-setup
+        with:
+          atree_deploy_key: ${{ secrets.ATREE_DEPLOY_KEY }}
+
       - name: Setup Go
         uses: actions/setup-go@v6
         with:

actions/private-setup/action.yml

@@ -0,0 +1,27 @@
+name: "Private Build Setup"
+description: "Checks and configures the environment for building private dependencies"
+inputs:
+  atree_deploy_key:
+    description: "Deploy Key for Private Atree Repo"
+    required: true
+  go_private_value:
+    description: "The value for GOPRIVATE"
+    required: false
+    default: "github.com/onflow/*-internal"
+runs:
+  using: "composite"
+  steps:
+    - name: Load atree deploy key
+      uses: webfactory/ssh-agent@v0.10.0
+      with:
+        ssh-private-key: "${{ inputs.atree_deploy_key }}"
+
+    - name: Configure git for SSH
+      shell: bash
+      run: |
+        git config --global url."git@github.com:".insteadOf "https://github.com/"
+
+    - name: Configure GOPRIVATE env
+      shell: bash
+      run: |
+        echo "GOPRIVATE=${{ inputs.go_private_value }}" >> $GITHUB_ENV