feat(aea-ci): generic check-third-party-hashes + configurable generate-api-docs

.github/workflows/workflow.yml

@@ -367,7 +367,7 @@ jobs:
           sudo mv protoc/bin/protoc /usr/local/bin/protoc
 
           # pull pre-built images
-          docker pull valory/open-acn-node:latest
+          docker pull valory/open-acn:latest
       - name: Framework integration tests
         run: tox -e py3.10 -- -m 'integration and not unstable and not ledger and not profiling'
       - name: Packages integration tests

CLEANUP.md

@@ -57,9 +57,15 @@ The `golang_checks` CI job was previously a no-op (checkout + setup-go, no test
 
 **`libp2p_node` is now TCP-only by design ✓ (PR #874).** Replaced `libp2p.DefaultTransports` with explicit `libp2p.NoTransports` + `libp2p.Transport(tcp.NewTCPTransport)` in both `dhtpeer.go` and `dhtclient.go`. Every multiaddr the codebase produces is `/ip4|/dns4 + /tcp` (Go `LocalURI`/`PublicURI`, the `/p2p-circuit` fallback, the bootstrap peers fed from the Python embedding host, and Python's `MultiAddr.format()` itself). We never bind UDP, never run an HTTP/3 server, never construct or dial a `/quic`, `/webtransport`, `/ws`, or `/wss` multiaddr, and neither dhtpeer nor dhtclient enables hole-punching. Closes the runtime attack surface for the `quic-go` + `webtransport-go` Dependabot alerts (#163–#168) and shrinks the binary's reachable code. The packages remain in `go.mod` because `libp2p/config/quic.go` imports `quic-go` unconditionally for its key-derivation helpers, but those helpers are only called from the QUIC transport factory which is no longer constructed — so the vulnerable server-side code paths are unreachable.
 
-### `test_dht.py` integration tests — skipped pending ACN image rebuild
+### `test_dht.py` integration tests — Local variants re-enabled ✓
 
-`packages/valory/connections/test_libp2p/tests/test_dht.py` (23 tests, marked `@pytest.mark.integration`) dial pre-existing ACN peers — either the local `valory/open-acn-node:latest` docker image or the production fetchai/valory ACN nodes over the internet. Both targets were still on libp2p v0.8 / circuit-relay v1 at the time of PR #872 / #874 merge. This branch's libp2p v0.33 / circuit-relay v2 migration is wire-incompatible by design (documented in CLEANUP.md item 9 and the `p2p_libp2p` connection README). Skipping the whole module with `skip_acn_docker_mismatch` so CI shows `skipped: image outdated` instead of a random integration flake. **Re-enable once `valory/open-acn-node:latest` is rebuilt from the post-bump source tree** — the upstream open-acn main already has the equivalent code, so the rebuild is mechanical.
+`packages/valory/connections/test_libp2p/tests/test_dht.py` (23 tests, marked `@pytest.mark.integration`) dial pre-existing ACN peers — either a local docker image or the production fetchai/valory ACN nodes over the internet. At PR #872 / #874 merge time both targets were still on libp2p v0.8 / circuit-relay v1, which is wire-incompatible with this branch's v0.33 / v2. The whole module was skipped under `skip_acn_docker_mismatch` pending a rebuild.
+
+Addressed in PR #876:
+
+- **ACN image rebuilt.** `valory/open-acn` (separate Docker repo from the 2022-era `valory/open-acn-node`) now publishes a `:latest` alias tracking main, starting from `valory-xyz/open-acn#22`. The Python fixture and the CI `docker pull` step now pull `valory/open-acn:latest` (Go 1.24, libp2p v0.33.2).
+- **Second wire-compat fix uncovered.** libp2p v0.33 refuses to dial `/dns4/0.0.0.0/...` ("no good addresses") — v0.8 had tolerated the bind-all wildcard as a dial target. Switched `META_ADDRESS` from `0.0.0.0` to `127.0.0.1` in both `acn_image.py` and `conftest.py` so the entry-peer multiaddrs the fixture builds are actually dialable.
+- **Skip marker narrowed.** `skip_acn_docker_mismatch` (blanket) replaced with `skip_public_acn_not_upgraded`, applied only to the Public variants. Local variants and `TestDHTRobustness` now run; Public variants remain skipped until the production fetchai/valory ACN nodes are redeployed from the post-bump source tree.
 
 ### `InsecureSkipVerify` in `libs/go/aealite/connections/tcpsocket.go` ✓ annotated
 

docs/package_list.md

@@ -19,7 +19,7 @@
 | connection/valory/p2p_libp2p_mailbox/0.1.0                    | `bafybeifdbpetirc5id7v3y6wop5mylqh726mo7jgscl2jl3t4f7vusqcnq` |
 | connection/fetchai/local/0.20.0                               | `bafybeichu3hdecg2xk5luddc4qxkaluhnbk2qxiastdkp4ujwbftuhpyry` |
 | connection/valory/http_client/0.23.0                          | `bafybeihel6sg2yayxu7lqygaswdgciaxpqrgsbl5rwx74c6znu5qz2edd4` |
-| connection/valory/test_libp2p/0.1.0                           | `bafybeiabkhmxcfmjt5csjpzvhqep64v7jx44jk3yfjlrxnwt2gouvpgo44` |
+| connection/valory/test_libp2p/0.1.0                           | `bafybeiek2vebos35kioto3wxsrwsoque6f46bcc4rcssuqcwvtiv54cyva` |
 | skill/fetchai/echo/0.19.0                                     | `bafybeieqhk2g6l4pitjmuwbtt7n6vx3wawclygjv5cywjjrgay66lzq74u` |
 | skill/fetchai/error_test_skill/0.1.0                          | `bafybeiclf3qlci56sk5bw2jh3k52dc4o3hsqmn34msfud5qlsm65j7nrtm` |
 | skill/fetchai/http_echo/0.20.0                                | `bafybeie7j4y6ppruwf33fydd34yxaiwnhtpn7ocri37gslsnbvjfs7pg7m` |

packages/packages.json

@@ -19,7 +19,7 @@
         "connection/valory/p2p_libp2p_mailbox/0.1.0": "bafybeifdbpetirc5id7v3y6wop5mylqh726mo7jgscl2jl3t4f7vusqcnq",
         "connection/fetchai/local/0.20.0": "bafybeichu3hdecg2xk5luddc4qxkaluhnbk2qxiastdkp4ujwbftuhpyry",
         "connection/valory/http_client/0.23.0": "bafybeihel6sg2yayxu7lqygaswdgciaxpqrgsbl5rwx74c6znu5qz2edd4",
-        "connection/valory/test_libp2p/0.1.0": "bafybeiabkhmxcfmjt5csjpzvhqep64v7jx44jk3yfjlrxnwt2gouvpgo44",
+        "connection/valory/test_libp2p/0.1.0": "bafybeiek2vebos35kioto3wxsrwsoque6f46bcc4rcssuqcwvtiv54cyva",
         "skill/fetchai/echo/0.19.0": "bafybeieqhk2g6l4pitjmuwbtt7n6vx3wawclygjv5cywjjrgay66lzq74u",
         "skill/fetchai/error_test_skill/0.1.0": "bafybeiclf3qlci56sk5bw2jh3k52dc4o3hsqmn34msfud5qlsm65j7nrtm",
         "skill/fetchai/http_echo/0.20.0": "bafybeie7j4y6ppruwf33fydd34yxaiwnhtpn7ocri37gslsnbvjfs7pg7m",

packages/valory/connections/test_libp2p/connection.yaml

@@ -11,11 +11,11 @@ fingerprint:
   connection.py: bafybeiem3ty2megg3iuufnxgop2nva7idr6xjhrcvuvc32wyhdeuiziuva
   readme.md: bafybeihg5yfzgqvg5ngy7r2o5tfeqnelx2ffxw4po5hmheqjfhumpmxpoq
   tests/__init__.py: bafybeiarz6mhky6pnkdihibcuqrfpx3qo55roygneoaoq2mndi5lzdlcj4
-  tests/acn_image.py: bafybeicj4cmyefpu56rje36tccdsrfysrzabroezbmafgfgva7ouhwnvgm
+  tests/acn_image.py: bafybeicctoqz56uznwrwvcna2zfhgsgukogdlq2ta7guhzbkiizhlyinfq
   tests/base.py: bafybeiejoqkjvgc3hitouim2fzfqiukmfvweqnqarjyvvaa5arrrn5oycm
-  tests/conftest.py: bafybeifkjrvsysdb7ujp2wxurzgytzy3ecu6fv247zfszfymdvb7y7klpu
+  tests/conftest.py: bafybeifo2dcsu5cppohivxots7m4rh73j2piog7dkf4ewlk3kd5yxm7krm
   tests/test_certificate_dates.py: bafybeiboxx2e3vh4iioprbsubf4hjevvkcfdc63knhrgwkm262fywg6kky
-  tests/test_dht.py: bafybeidrdqr73gwugytzmusk5z6wo7rgd5kijc322nbgxp44u2y2tctlwa
+  tests/test_dht.py: bafybeiaiyqfjl4ppnb3n7t4rnqv3hzkblryy6o4vp534sjqragppkw3ste
   tests/test_p2p_libp2p/__init__.py: bafybeig7f7s5ptqtscf74y25dtqvhp75joekcxi6qnuzxgxyzictpsp4dm
   tests/test_p2p_libp2p/test_aea_cli.py: bafybeiej55kwbxuqjvjjz4tc7we54pxur7kvsh5o36lau7b7utltzwkc34
   tests/test_p2p_libp2p/test_communication.py: bafybeibanxoco2qjodcw4gjrnzj4jtmmojj2eowaldpyubbl4pz4r5cjoy

packages/valory/connections/test_libp2p/tests/acn_image.py

@@ -27,7 +27,11 @@
 from aea.exceptions import enforce
 from aea.test_tools.docker_image import Container, DockerClient, DockerImage
 
-META_ADDRESS = "0.0.0.0"  # nosec
+# Loopback, not the bind-all wildcard: libp2p v0.33 refuses to *dial*
+# a ``/dns4/0.0.0.0/...`` multiaddr ("no good addresses"), so the ACN
+# node URIs — which are consumed both as bind addresses and as peer
+# entry points — must be real loopback addresses.
+META_ADDRESS = "127.0.0.1"  # nosec
 
 # created agent: bootstrap_peer
 #     private key: 7f669ab5eee5719e385f7aeb1973769fc75b7cbbe0850ca16c4eabe84e01afbd
@@ -104,10 +108,16 @@ def __init__(
         self._config = config
         self._extra_hosts = {name: "host-gateway" for name in self.nodes}
 
+    # Tracks the current main build of the ACN via the ``:latest``
+    # alias (valory-xyz/open-acn#22). Post-libp2p-v0.33 rebuilds are
+    # wire-compatible with this branch's p2p_libp2p connection after
+    # the v0.8 → v0.33 bump.
+    ACN_IMAGE_TAG = "valory/open-acn:latest"
+
     @property
     def tag(self) -> str:
         """Get the image tag."""
-        return "valory/open-acn-node:latest"
+        return self.ACN_IMAGE_TAG
 
     @property
     def ports(self) -> List[str]:

packages/valory/connections/test_libp2p/tests/conftest.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 # ------------------------------------------------------------------------------
 #
-#   Copyright 2022 Valory AG
+#   Copyright 2022-2026 Valory AG
 #
 #   Licensed under the Apache License, Version 2.0 (the "License");
 #   you may not use this file except in compliance with the License.
@@ -57,7 +57,10 @@ class NodeConfig:
 logger = logging.getLogger(__name__)
 
 
-META_ADDRESS = "0.0.0.0"  # nosec
+# Loopback, not bind-all: libp2p v0.33 refuses to *dial*
+# ``/dns4/0.0.0.0/...`` multiaddrs, so entry-peer multiaddrs must use
+# a real loopback address.
+META_ADDRESS = "127.0.0.1"  # nosec
 ACN_CONFIGURATION: Dict[str, str] = dict(
     AEA_P2P_ID="54562eb807d2f80df8151db0a394cac72e16435a5f64275c277cae70308e8b24",
     AEA_P2P_URI_PUBLIC=f"{META_ADDRESS}:5000",

packages/valory/connections/test_libp2p/tests/test_dht.py

@@ -63,31 +63,22 @@
     )
 ]
 
-# The tests in this module all run against pre-existing ACN peers:
-#   - "Local" tests use the `valory/open-acn-node:latest` docker image
-#     via the ACNWithBootstrappedEntryNodes fixture.
+# The tests in this module run against pre-existing ACN peers:
+#   - "Local" tests spin up the ``valory/open-acn:<tag>`` docker image
+#     (pinned in ``acn_image.py``) via ``ACNWithBootstrappedEntryNodes``.
+#     The image was rebuilt against libp2p v0.33 / circuit-relay v2 and
+#     is wire-compatible with this branch, so the Local variants now run
+#     by default.
 #   - "Public" tests dial the production fetchai/valory ACN nodes over
-#     the internet.
-#
-# Both of those target peers are still running libp2p v0.8 / circuit-relay
-# v1. This branch migrates the p2p_libp2p connection to libp2p v0.33 /
-# circuit-relay v2, which is a wire-breaking change (documented in
-# CLEANUP.md as an intentional side-effect of the dependency bump). Until
-# the docker image and the public nodes are upgraded to a libp2p v0.33
-# build of the ACN, every test in this file either errors at bootstrap
-# (dial fails / "no good addresses") or hangs on message delivery.
-#
-# Skip the whole module with an explicit reason so CI (and local runs)
-# see "skipped: image outdated" instead of a random integration flake.
-# Remove this marker once the ACN side has been rebuilt from the post-
-# bump source tree.
-skip_acn_docker_mismatch = pytest.mark.skip(
+#     the internet. Those have not (yet) been redeployed against the new
+#     libp2p version, so dialling them still fails / hangs. They remain
+#     skipped until the production side is upgraded.
+skip_public_acn_not_upgraded = pytest.mark.skip(
     reason=(
-        "ACN peer (docker image `valory/open-acn-node:latest` for local "
-        "tests, production nodes for public tests) is libp2p v0.8 / "
-        "circuit-relay v1; this branch migrated to v0.33 / v2, which is "
-        "wire-incompatible by design. Re-enable once the ACN side is "
-        "rebuilt."
+        "Production fetchai/valory ACN nodes are still running libp2p "
+        "v0.8 / circuit-relay v1; this branch migrated to v0.33 / v2, "
+        "which is wire-incompatible. Re-enable when production is "
+        "redeployed from the post-bump source tree."
     ),
 )
 
@@ -262,10 +253,10 @@ class NodeConfigTestCase:
             test_cls = type(name, bases, {})
         else:
             test_cls = type(name, (base_cls,), {})
-        # Local AND public variants depend on an ACN peer running libp2p
-        # v0.8 / circuit-v1; this branch migrates to v0.33 / v2. Skip
-        # unconditionally; see `skip_acn_docker_mismatch` above.
-        test_cls = skip_acn_docker_mismatch(test_cls)
+            # Public variants still depend on production ACN nodes
+            # running libp2p v0.8 / circuit-v1; skip until they are
+            # redeployed against the new libp2p version.
+            test_cls = skip_public_acn_not_upgraded(test_cls)
 
         test_cls.__name__ = name
         test_cls.nodes = test_case.nodes
@@ -286,7 +277,6 @@ class NodeConfigTestCase:
 )
 
 
-@skip_acn_docker_mismatch
 class TestDHTRobustness(BaseP2PLibp2pTest, ACNWithBootstrappedEntryNodes):
     """Test DHT Robustness"""