feat: add env var overrides for bind addresses

.github/PULL_REQUEST_TEMPLATE.md

@@ -17,6 +17,6 @@
 ### Checklist
 
 - [ ] Test coverage for new or modified code paths
-- [ ] Changelog is updated
+- [ ] Changelog fragment(s) or "no changelog" label added (see [`changelog.d/README.md`](changelog.d/README.md))
 - [ ] Required documentation changes (e.g., `docs/rpc/openapi.yaml` and `rpc-endpoints.md` for v2 endpoints, `event-dispatcher.md` for new events)
 - [ ] New clarity functions have corresponding PR in `clarity-benchmarking` repo

.github/workflows/cargo-hack-check.yml

@@ -19,7 +19,7 @@ jobs:
       rust-toolchain: ${{ steps.toolchain.outputs.rust-toolchain }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -34,7 +34,7 @@ jobs:
     needs: setup
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -72,7 +72,7 @@ jobs:
     needs: setup
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -114,7 +114,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 

.github/workflows/changelog-check.yml

@@ -0,0 +1,70 @@
+name: Changelog Check
+
+on:
+  workflow_call:
+
+jobs:
+  changelog-check:
+    name: Check for changelog fragments
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for changelog fragments
+        uses: actions/github-script@v7
+        with:
+          script: |
+            if (context.eventName !== 'pull_request') {
+              core.info(`Event is '${context.eventName}', not a pull request — skipping.`);
+              return;
+            }
+            // Fetch current labels (payload labels are stale on re-runs)
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+            });
+            const labels = pr.labels.map(l => l.name);
+            if (labels.includes('no changelog')) {
+              core.info('PR has "no changelog" label — skipping changelog check.');
+              return;
+            }
+
+            const { data: files } = await github.rest.pulls.listFiles({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+              per_page: 100,
+            });
+
+            // Fail if CHANGELOG.md is modified directly
+            const directEdits = files.filter(f =>
+              (f.filename === 'CHANGELOG.md' || f.filename === 'stacks-signer/CHANGELOG.md') &&
+              f.status === 'modified'
+            );
+
+            if (directEdits.length > 0) {
+              const edited = directEdits.map(f => f.filename).join(', ');
+              core.setFailed(
+                `Do not edit ${edited} directly. ` +
+                'Add a changelog fragment to changelog.d/ or stacks-signer/changelog.d/ instead ' +
+                '(see changelog.d/README.md for instructions).'
+              );
+              return;
+            }
+
+            const validExtensions = ['added', 'changed', 'fixed', 'removed'];
+            const fragments = files.filter(f =>
+              (f.filename.startsWith('changelog.d/') || f.filename.startsWith('stacks-signer/changelog.d/')) &&
+              f.status === 'added' &&
+              validExtensions.some(ext => f.filename.endsWith(`.${ext}`))
+            );
+
+            if (fragments.length === 0) {
+              core.setFailed(
+                'No changelog fragment found. Please add a fragment file to changelog.d/ ' +
+                'or stacks-signer/changelog.d/ (see changelog.d/README.md for instructions). ' +
+                'If no changelog entry is needed, add the "no changelog" label to the PR.'
+              );
+            } else {
+              const names = fragments.map(f => f.filename).join(', ');
+              core.info(`Found changelog fragment(s): ${names}`);
+            }

.github/workflows/ci.yml

@@ -48,6 +48,10 @@ jobs:
         with:
           alias: "fmt-stacks"
 
+  changelog-check:
+    name: Changelog Check
+    uses: ./.github/workflows/changelog-check.yml
+
   ######################################################################################
   ## Check if the branch that this workflow is being run against is a release branch
   ##
@@ -64,6 +68,7 @@ jobs:
     name: Check Release
     needs:
       - rustfmt
+      - changelog-check
     runs-on: ubuntu-latest
     outputs:
       node_tag: ${{ steps.check_release.outputs.node_tag }}
@@ -96,6 +101,7 @@ jobs:
     name: Create Release
     needs:
       - rustfmt
+      - changelog-check
       - check-release
     secrets: inherit
     uses: ./.github/workflows/release-github.yml
@@ -121,6 +127,7 @@ jobs:
     name: Create Test Cache
     needs:
       - rustfmt
+      - changelog-check
       - check-release
     uses: ./.github/workflows/create-cache.yml
 
@@ -142,6 +149,7 @@ jobs:
     name: Stacks Core Tests
     needs:
       - rustfmt
+      - changelog-check
       - create-cache
       - check-release
     uses: ./.github/workflows/stacks-core-tests.yml
@@ -164,6 +172,7 @@ jobs:
     name: Constants Check
     needs:
       - rustfmt
+      - changelog-check
       - check-release
     uses: ./.github/workflows/constants-check.yml
 
@@ -185,6 +194,7 @@ jobs:
     name: Cargo Hack Check
     needs:
       - rustfmt
+      - changelog-check
       - check-release
     uses: ./.github/workflows/cargo-hack-check.yml
 
@@ -205,6 +215,7 @@ jobs:
     name: Bitcoin Tests
     needs:
       - rustfmt
+      - changelog-check
       - create-cache
       - check-release
     uses: ./.github/workflows/bitcoin-tests.yml
@@ -218,6 +229,7 @@ jobs:
     name: P2P Tests
     needs:
       - rustfmt
+      - changelog-check
       - create-cache
       - check-release
     uses: ./.github/workflows/p2p-tests.yml
@@ -231,6 +243,51 @@ jobs:
     name: Epoch Tests
     needs:
       - rustfmt
+      - changelog-check
       - create-cache
       - check-release
     uses: ./.github/workflows/epoch-tests.yml
+
+  ## Merge and upload code coverage report files once all tests are done
+  ##
+  ## Runs when:
+  ##   - always (unless workflow is cancelled)
+  trigger-code-coverage-report:
+    if: ${{ always() && !cancelled() }}
+    name: Upload Code Coverage Report
+    runs-on: ubuntu-latest
+    needs:
+      - stacks-core-tests
+      - bitcoin-tests
+      - p2p-tests
+      - epoch-tests
+    steps:
+      # Checkout the code (Coveralls requires source code to be available when action is called)
+      - name: Checkout the latest code
+        id: git_checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      # Download the code coverage .info files generated by tests from artifacts (prefixed by commit SHA)
+      - name: Download code coverage artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
+        with:
+          pattern: ${{ github.sha }}-*.info
+          path: code_coverage_files
+          merge-multiple: true
+      # Install lcov for merging the reports
+      - name: Install lcov
+        shell: bash
+        run: |
+          sudo apt-get install -y --no-install-recommends lcov
+      # Merge n coverage report files into 1 file using lcov
+      - name: Merge code coverage files
+        shell: bash
+        run: |
+          cd code_coverage_files && \
+          find . -name "*.info" | awk '{print "-a", $0}' | xargs lcov -o code-coverage-report.info
+      # Upload the merged code coverage file to Coveralls
+      - name: Upload code coverage to Coveralls
+        uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
+        with:
+          file: code_coverage_files/code-coverage-report.info
+          fail-on-error: true
+

.github/workflows/clippy.yml

@@ -25,7 +25,7 @@ jobs:
     steps:
       - name: Checkout the latest code
         id: git_checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Define Rust Toolchain
         id: define_rust_toolchain

.github/workflows/constants-check.yml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Checkout the latest code
         id: git_checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Define Rust Toolchain
         id: define_rust_toolchain

.github/workflows/docker-image.yml

@@ -57,7 +57,7 @@ jobs:
       ## Checkout the code
       - name: Checkout the latest code
         id: git_checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.BRANCH }}
 
@@ -200,7 +200,7 @@ jobs:
       ## Checkout the code
       - name: Checkout the latest code
         id: git_checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ env.BRANCH }}
           sparse-checkout: |

.github/workflows/fork-ci.yml

@@ -0,0 +1,116 @@
+## Lean CI for the stacks-core fork
+## Runs fmt, clippy, and a build check on every push to fork/ branches
+name: Fork CI
+
+on:
+  push:
+    branches:
+      - 'fork/**'
+  pull_request:
+    branches:
+      - 'fork/**'
+
+concurrency:
+  group: fork-ci-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  rustfmt:
+    name: Format Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+
+      - name: Check formatting
+        run: cargo fmt-stacks --check
+
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-clippy-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Clippy (all crates except stackslib)
+        run: cargo clippy-stacks
+
+      - name: Clippy (stackslib)
+        run: cargo clippy-stackslib
+
+  build:
+    name: Build Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Build
+        run: cargo build --features monitoring_prom,slog_json --release
+        env:
+          CARGO_INCREMENTAL: 0
+
+      - name: Report binary size
+        run: |
+          ls -lh target/release/stacks-node
+          ls -lh target/release/stacks-signer
+
+  test-quick:
+    name: Quick Tests
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Install nextest
+        uses: taiki-e/install-action@nextest
+
+      - name: Run tests (quick, non-ignored)
+        run: cargo nextest run --workspace --exclude stacks-node -j 4
+        timeout-minutes: 60
+        env:
+          RUST_BACKTRACE: 1