Add ICA-based signature verification for cascade actions

.github/actions/setup-env/action.yml

@@ -3,7 +3,7 @@ description: Sets up Go (dynamically from go.mod) and installs system dependenci
 
 inputs:
   bust_lumera_retag:
-    description: "One-time: remove lumera v1.8.0 sums after retag"
+    description: "One-time: remove lumera sums after retag"
     required: false
     default: 'false'
 outputs:

.github/workflows/build&release.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.1
 
       - name: Setup Go and dependencies
         uses: ./.github/actions/setup-env
@@ -52,7 +52,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
 
@@ -199,7 +199,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Create release with composed body (no existing release)
-        uses: softprops/action-gh-release@v0.1.15
+        uses: softprops/action-gh-release@v2
         if: success() && steps.rel_check.outputs.exists != 'true'
         with:
           tag_name: ${{ steps.tag_info.outputs.tag_name }}
@@ -210,7 +210,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload assets to existing release (preserve manual notes)
-        uses: softprops/action-gh-release@v0.1.15
+        uses: softprops/action-gh-release@v2
         if: success() && steps.rel_check.outputs.exists == 'true'
         with:
           tag_name: ${{ steps.tag_info.outputs.tag_name }}

.github/workflows/tests.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.1
       - name: Setup Go and system deps
         uses: ./.github/actions/setup-env
         with:
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.1
 
       - name: Setup Go and system deps
         uses: ./.github/actions/setup-env
@@ -50,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.1
 
       - name: Setup Go and system deps
         uses: ./.github/actions/setup-env

Makefile

@@ -1,15 +1,11 @@
 ###################################################
 ###  Supernode Makefile
 ###################################################
-
-.PHONY: build build-sncli build-sn-manager
-.PHONY: install-lumera setup-supernodes system-test-setup install-deps
-.PHONY: gen-cascade gen-supernode
-.PHONY: test-e2e test-unit test-integration test-system
 .PHONY: release
 
 # tools/paths
 GO ?= go
+RELEASE_DIR ?= release
 
 # Build variables
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
@@ -30,20 +26,32 @@ SN_MANAGER_LDFLAGS = -X main.Version=$(VERSION) \
                      -X main.GitCommit=$(GIT_COMMIT) \
                      -X main.BuildTime=$(BUILD_TIME)
 
+###################################################
+###              Build / Release                ###
+###################################################
+.PHONY: build build-sncli build-sn-manager release
+
+SN_SRC := $(shell find p2p -name "*.go") \
+	$(shell find pkg -name "*.go") \
+	$(shell find sdk -name "*.go") \
+	$(shell find supernode -name "*.go") \
+	$(shell find tools -name "*.go")
+
 go.sum: go.mod
+	@echo "Verifying and tidying go modules..."	\
 	${GO} mod tidy
 	${GO} mod verify
 
-build: go.sum
-	@mkdir -p release
+build: $(SN_SRC) go.sum Makefile
 	@echo "Building supernode..."
+	@mkdir -p $(RELEASE_DIR)
 	CGO_ENABLED=1 GOOS=linux GOARCH=amd64 ${GO} build \
 		-trimpath \
 		-ldflags="-s -w $(LDFLAGS)" \
-		-o release/supernode-linux-amd64 \
+		-o $(RELEASE_DIR)/supernode-linux-amd64 \
 		./supernode
-	@chmod +x release/supernode-linux-amd64
-	@echo "supernode built successfully at release/supernode-linux-amd64"
+	@chmod +x $(RELEASE_DIR)/supernode-linux-amd64
+	@echo "supernode built successfully in $(RELEASE_DIR)/supernode-linux-amd64"
 
 build-sncli: release/sncli
 
@@ -55,35 +63,65 @@ cmd/sncli/go.sum: cmd/sncli/go.mod
 	cd cmd/sncli && ${GO} mod verify
 
 release/sncli: $(SNCLI_SRC) cmd/sncli/go.sum
-	@mkdir -p release
 	@echo "Building sncli..."
-	@RELEASE_DIR=$(CURDIR)/release && \
-	cd cmd/sncli && \
+	@mkdir -p $(RELEASE_DIR)
+	@cd cmd/sncli && \
 	CGO_ENABLED=1 \
 	GOOS=linux \
 	GOARCH=amd64 \
 	${GO} build \
 		-trimpath \
 		-ldflags="-s -w $(LDFLAGS)" \
-		-o $$RELEASE_DIR/sncli && \
-	chmod +x $$RELEASE_DIR/sncli && \
-	echo "sncli built successfully at $$RELEASE_DIR/sncli"
+		-o $(RELEASE_DIR)/sncli && \
+	chmod +x $(RELEASE_DIR)/sncli && \
+	echo "sncli built successfully at $(RELEASE_DIR)/sncli"
 
 build-sn-manager:
-	@mkdir -p release
 	@echo "Building sn-manager..."
+	@mkdir -p $(RELEASE_DIR)
 	@cd sn-manager && \
 	CGO_ENABLED=0 \
 	GOOS=linux \
 	GOARCH=amd64 \
 	${GO} build \
 		-trimpath \
 		-ldflags="-s -w $(SN_MANAGER_LDFLAGS)" \
-		-o ../release/sn-manager \
+		-o ../$(RELEASE_DIR)/sn-manager \
 		.
-	@chmod +x release/sn-manager
-	@echo "sn-manager built successfully at release/sn-manager"
+	@chmod +x $(RELEASE_DIR)/sn-manager
+	@echo "sn-manager built successfully at $(RELEASE_DIR)/sn-manager"
+
+# Release command: push branch, tag, and push tag with auto-increment - this is for testing only (including releases) setup a new remote upstream or rename the script
+release:
+	@echo "Getting current branch..."
+	$(eval CURRENT_BRANCH := $(shell git branch --show-current))
+	@echo "Current branch: $(CURRENT_BRANCH)"
+
+	@echo "Getting latest tag..."
+	$(eval LATEST_TAG := $(shell git tag -l "v*" | sort -V | tail -n1))
+	$(eval NEXT_TAG := $(shell \
+		if [ -z "$(LATEST_TAG)" ]; then \
+			echo "v2.5.0"; \
+		else \
+			echo "$(LATEST_TAG)" | sed 's/^v//' | awk -F. '{print "v" $$1 "." $$2 "." $$3+1}'; \
+		fi))
+	@echo "Next tag: $(NEXT_TAG)"
+
+	@echo "Pushing branch to upstream..."
+	git push upstream $(CURRENT_BRANCH) -f
+
+	@echo "Creating and pushing tag $(NEXT_TAG)..."
+	git tag $(NEXT_TAG)
+	git push upstream $(NEXT_TAG)
+
+	@echo "Release complete: $(NEXT_TAG) pushed to upstream"
 
+###################################################
+###              Tests and Simulation           ###
+###################################################
+.PHONY: test-e2e test-unit test-integration test-system test-cascade test-sn-manager
+.PHONY: install-lumera setup-supernodes system-test-setup install-deps
+.PHONY: gen-cascade gen-supernode
 test-unit:
 	${GO} test -v ./...
 
@@ -169,27 +207,3 @@ test-sn-manager:
 
 
 
-# Release command: push branch, tag, and push tag with auto-increment - this is for testing only (including releases) setup a new remote upstream or rename the script
-release:
-	@echo "Getting current branch..."
-	$(eval CURRENT_BRANCH := $(shell git branch --show-current))
-	@echo "Current branch: $(CURRENT_BRANCH)"
-
-	@echo "Getting latest tag..."
-	$(eval LATEST_TAG := $(shell git tag -l "v*" | sort -V | tail -n1))
-	$(eval NEXT_TAG := $(shell \
-		if [ -z "$(LATEST_TAG)" ]; then \
-			echo "v2.5.0"; \
-		else \
-			echo "$(LATEST_TAG)" | sed 's/^v//' | awk -F. '{print "v" $$1 "." $$2 "." $$3+1}'; \
-		fi))
-	@echo "Next tag: $(NEXT_TAG)"
-
-	@echo "Pushing branch to upstream..."
-	git push upstream $(CURRENT_BRANCH) -f
-
-	@echo "Creating and pushing tag $(NEXT_TAG)..."
-	git tag $(NEXT_TAG)
-	git push upstream $(NEXT_TAG)
-
-	@echo "Release complete: $(NEXT_TAG) pushed to upstream"

cmd/sncli/go.mod

@@ -1,19 +1,22 @@
 module github.com/LumeraProtocol/supernode/v2/cmd/sncli
 
-go 1.25.1
+go 1.25.5
 
 replace (
 	github.com/LumeraProtocol/supernode/v2 => ../..
 	github.com/cosmos/cosmos-sdk => github.com/cosmos/cosmos-sdk v0.50.14
+	github.com/envoyproxy/protoc-gen-validate => github.com/bufbuild/protoc-gen-validate v1.3.0
+	github.com/lyft/protoc-gen-validate => github.com/envoyproxy/protoc-gen-validate v1.3.0
+	nhooyr.io/websocket => github.com/coder/websocket v1.8.7
 )
 
 require (
 	github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c
-	github.com/LumeraProtocol/lumera v1.8.5
+	github.com/LumeraProtocol/lumera v1.9.1
 	github.com/LumeraProtocol/supernode/v2 v2.0.0-00010101000000-000000000000
 	github.com/cosmos/cosmos-sdk v0.53.0
 	github.com/spf13/cobra v1.10.1
-	google.golang.org/grpc v1.76.0
+	google.golang.org/grpc v1.77.0
 	google.golang.org/protobuf v1.36.10
 )
 
@@ -34,6 +37,7 @@ require (
 	github.com/99designs/keyring v1.2.2 // indirect
 	github.com/DataDog/datadog-go v4.8.3+incompatible // indirect
 	github.com/DataDog/zstd v1.5.7 // indirect
+	github.com/Masterminds/semver/v3 v3.3.1 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/benbjohnson/clock v1.3.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -138,7 +142,7 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.22.0 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.63.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
@@ -168,16 +172,16 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/arch v0.15.0 // indirect
-	golang.org/x/crypto v0.42.0 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
 	golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b // indirect
-	golang.org/x/net v0.44.0 // indirect
+	golang.org/x/net v0.46.1-0.20251013234738-63d1a5100f82 // indirect
 	golang.org/x/sync v0.17.0 // indirect
-	golang.org/x/sys v0.36.0 // indirect
-	golang.org/x/term v0.35.0 // indirect
-	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
+	golang.org/x/term v0.36.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
 	google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250929231259-57b25ae835d4 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gotest.tools/v3 v3.5.2 // indirect
 	lukechampine.com/blake3 v1.4.1 // indirect