Validate query uses capabilities from blockchain config, not candidate block

.github/workflows/ci.yml

@@ -0,0 +1,147 @@
+name: CI
+
+on:
+  pull_request:
+    branches: ["master", "develop", "release/**"]
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  WORKING_DIR: src
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ${{ env.WORKING_DIR }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config clang libssl-dev libzstd-dev libgoogle-perftools-dev build-essential jq
+
+      - name: Install cargo-audit
+        run: cargo install --locked cargo-audit
+
+      - name: Run cargo-audit
+        run: |
+          set -euo pipefail
+
+          set +e
+          cargo audit --json > cargo-audit.json
+          AUDIT_EXIT=$?
+          set -e
+
+          TOTAL_COUNT=$(jq '[.vulnerabilities.list[]?] | length' cargo-audit.json)
+          CRITICAL_COUNT=$(jq '[.vulnerabilities.list[]? | select((((.advisory.cvss // 0) | tonumber?) // 0) >= 9)] | length' cargo-audit.json)
+
+          echo "cargo-audit report: ${TOTAL_COUNT} total vulnerabilities, ${CRITICAL_COUNT} critical."
+
+          if [ "${TOTAL_COUNT}" -gt 0 ]; then
+            echo "Detected advisories:"
+            jq -r '.vulnerabilities.list[]? | "- \(.advisory.id): \(.advisory.title) [\(.package.name) \(.package.version)] CVSS=\(.advisory.cvss // "n/a")"' cargo-audit.json
+          else
+            echo "No RustSec advisories found."
+          fi
+
+          if [ "${CRITICAL_COUNT}" -gt 0 ]; then
+            echo "Critical RustSec advisories detected. Failing CI."
+            exit 1
+          fi
+
+          if [ "${AUDIT_EXIT}" -ne 0 ] && [ "${TOTAL_COUNT}" -eq 0 ]; then
+            echo "cargo-audit failed for a non-advisory reason (exit ${AUDIT_EXIT})."
+            exit "${AUDIT_EXIT}"
+          fi
+
+          echo "No critical RustSec advisories found."
+
+  fmt:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ${{ env.WORKING_DIR }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: nightly
+          components: rustfmt
+
+      - name: Check formatting
+        run: make fmt check=--check
+
+  check:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ${{ env.WORKING_DIR }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config clang libssl-dev libzstd-dev libgoogle-perftools-dev build-essential
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src -> target
+          shared-key: check
+
+      - name: Clippy
+        run: make clippy
+
+      - name: Check
+        run: cargo check --all --tests --release
+
+  tests:
+    runs-on:
+      group: ton-large
+    defaults:
+      run:
+        working-directory: ${{ env.WORKING_DIR }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config clang libssl-dev libzstd-dev libgoogle-perftools-dev build-essential
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src -> target
+          shared-key: tests
+
+      - name: Run cargo tests
+        run: NODE_SKIP_TEST_LOGS=yes make test
+
+  tests-net:
+    runs-on:
+      group: ton-large
+    defaults:
+      run:
+        working-directory: ${{ env.WORKING_DIR }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config clang libssl-dev libzstd-dev libgoogle-perftools-dev build-essential xxd
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src -> target
+          shared-key: tests-net
+
+      - name: Run network test
+        run: cd node/tests/test_run_net && bash ./test_run_net_ci.sh

.github/workflows/helm-node-release.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Extract version from tag
         id: version

.github/workflows/helm-nodectl-release.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Extract version from tag
         id: version

src/node/src/validator/validate_query.rs

@@ -764,7 +764,8 @@ impl ValidateQuery {
         let mc_state_extra = mc_state.shard_state_extra()?.clone();
         let config_params = mc_state_extra.config();
         CHECK!(config_params, inited);
-        let block_version = base.info.gen_software().map_or(0, |v| v.version);
+        let (capabilities, block_version) =
+            base.info.gen_software().map_or((0, 0), |v| (v.capabilities, v.version));
         if block_version < config_params.global_version() {
             reject_query!(
                 "This block version {} is too old, node_version: {} net version: {}",
@@ -5544,10 +5545,11 @@ impl ValidateQuery {
         tasks: &mut TasksVec,
     ) -> Result<()> {
         // log::debug!(target: "validate_query", "({}): checking all transactions", base.next_block_descr);
-        let (capabilities, block_version) =
-            base.info.gen_software().map_or((0, 0), |v| (v.capabilities, v.version));
-        let config =
-            BlockchainConfig::with_params(capabilities, block_version, base.config_params.clone())?;
+        let config = BlockchainConfig::with_params(
+            base.config_params.capabilities(),
+            base.info.gen_software().map_or(0, |v| v.version),
+            base.config_params.clone(),
+        )?;
         base.account_blocks.iterate_with_keys_and_aug(|account_addr, acc_block, _fee| {
             let base = base.clone();
             let libraries = libraries.clone();

src/rust-toolchain.toml

@@ -1,2 +1,3 @@
 [toolchain]
 channel = "1.91.1"
+components = ["clippy"]