Add CI for monorepo (#1145)

* Add CI for monorepo

* fix frame tests

* Format features

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

* add note for skipping tests and disable test-linux-stable-all

* Fix tests and compile issues (#1152)

* Fix feature dependant import

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

* Bump test timeout

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

* Remove feature gate

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

* Add resolver 2

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

* Remove old lockfile

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

* Format features

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

---------

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

* Fix check-dependency-rules

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

* rm test-runtime

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

* Actually fix script

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

* enable cargo-check-each-crate-macos

* Run check-each-crate on 6 machines (#1163)

---------

Signed-off-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>
Co-authored-by: Oliver Tale-Yazdi <oliver.tale-yazdi@parity.io>

.gitlab/check-each-crate.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+
+# A script that checks each workspace crate individually.
+# It's relevant to check workspace crates individually because otherwise their compilation problems
+# due to feature misconfigurations won't be caught, as exemplified by
+# https://github.com/paritytech/substrate/issues/12705
+#
+# `check-each-crate.py target_group groups_total`
+#
+# - `target_group`: Integer starting from 1, the group this script should execute.
+# - `groups_total`: Integer starting from 1, total number of groups.
+
+import subprocess, sys
+
+# Get all crates
+output = subprocess.check_output(["cargo", "tree", "--locked", "--workspace", "--depth", "0", "--prefix", "none"])
+
+# Convert the output into a proper list
+crates = []
+for line in output.splitlines():
+	if line != b"":
+		crates.append(line.decode('utf8').split(" ")[0])
+
+# Make the list unique and sorted
+crates = list(set(crates))
+crates.sort()
+
+target_group = int(sys.argv[1]) - 1
+groups_total = int(sys.argv[2])
+
+if len(crates) == 0:
+	print("No crates detected!", file=sys.stderr)
+	sys.exit(1)
+
+print(f"Total crates: {len(crates)}", file=sys.stderr)
+
+crates_per_group = len(crates) // groups_total
+
+# If this is the last runner, we need to take care of crates
+# after the group that we lost because of the integer division.
+if target_group + 1 == groups_total:
+	overflow_crates = len(crates) % groups_total
+else:
+	overflow_crates = 0
+
+print(f"Crates per group: {crates_per_group}", file=sys.stderr)
+
+# Check each crate
+for i in range(0, crates_per_group + overflow_crates):
+	crate = crates_per_group * target_group + i
+
+	print(f"Checking {crates[crate]}", file=sys.stderr)
+
+	res = subprocess.run(["cargo", "check", "--locked", "-p", crates[crate]])
+
+	if res.returncode != 0:
+		sys.exit(1)

.gitlab/common/lib.sh

@@ -0,0 +1,195 @@
+#!/bin/sh
+
+api_base="https://api.github.com/repos"
+
+# Function to take 2 git tags/commits and get any lines from commit messages
+# that contain something that looks like a PR reference: e.g., (#1234)
+sanitised_git_logs(){
+  git --no-pager log --pretty=format:"%s" "$1...$2" |
+  # Only find messages referencing a PR
+  grep -E '\(#[0-9]+\)' |
+  # Strip any asterisks
+  sed 's/^* //g'
+}
+
+# Checks whether a tag on github has been verified
+# repo: 'organization/repo'
+# tagver: 'v1.2.3'
+# Usage: check_tag $repo $tagver
+check_tag () {
+  repo=$1
+  tagver=$2
+  if [ -n "$GITHUB_RELEASE_TOKEN" ]; then
+    echo '[+] Fetching tag using privileged token'
+    tag_out=$(curl -H "Authorization: token $GITHUB_RELEASE_TOKEN" -s "$api_base/$repo/git/refs/tags/$tagver")
+  else
+    echo '[+] Fetching tag using unprivileged token'
+    tag_out=$(curl -H "Authorization: token $GITHUB_PR_TOKEN" -s "$api_base/$repo/git/refs/tags/$tagver")
+  fi
+  tag_sha=$(echo "$tag_out" | jq -r .object.sha)
+  object_url=$(echo "$tag_out" | jq -r .object.url)
+  if [ "$tag_sha" = "null" ]; then
+    return 2
+  fi
+  echo "[+] Tag object SHA: $tag_sha"
+  verified_str=$(curl -H "Authorization: token $GITHUB_RELEASE_TOKEN" -s "$object_url" | jq -r .verification.verified)
+  if [ "$verified_str" = "true" ]; then
+    # Verified, everything is good
+    return 0
+  else
+    # Not verified. Bad juju.
+    return 1
+  fi
+}
+
+# Checks whether a given PR has a given label.
+# repo: 'organization/repo'
+# pr_id: 12345
+# label: B1-silent
+# Usage: has_label $repo $pr_id $label
+has_label(){
+  repo="$1"
+  pr_id="$2"
+  label="$3"
+
+  # These will exist if the function is called in Gitlab.
+  # If the function's called in Github, we should have GITHUB_ACCESS_TOKEN set
+  # already.
+  if [ -n "$GITHUB_RELEASE_TOKEN" ]; then
+    GITHUB_TOKEN="$GITHUB_RELEASE_TOKEN"
+  elif [ -n "$GITHUB_PR_TOKEN" ]; then
+    GITHUB_TOKEN="$GITHUB_PR_TOKEN"
+  fi
+
+  out=$(curl -H "Authorization: token $GITHUB_TOKEN" -s "$api_base/$repo/pulls/$pr_id")
+  [ -n "$(echo "$out" | tr -d '\r\n' | jq ".labels | .[] | select(.name==\"$label\")")" ]
+}
+
+github_label () {
+  echo
+  echo "# run github-api job for labeling it ${1}"
+  curl -sS -X POST \
+    -F "token=${CI_JOB_TOKEN}" \
+    -F "ref=master" \
+    -F "variables[LABEL]=${1}" \
+    -F "variables[PRNO]=${CI_COMMIT_REF_NAME}" \
+    -F "variables[PROJECT]=paritytech/polkadot" \
+    "${GITLAB_API}/projects/${GITHUB_API_PROJECT}/trigger/pipeline"
+}
+
+# Formats a message into a JSON string for posting to Matrix
+# message: 'any plaintext message'
+# formatted_message: '<strong>optional message formatted in <em>html</em></strong>'
+# Usage: structure_message $content $formatted_content (optional)
+structure_message() {
+  if [ -z "$2" ]; then
+    body=$(jq -Rs --arg body "$1" '{"msgtype": "m.text", $body}' < /dev/null)
+  else
+    body=$(jq -Rs --arg body "$1" --arg formatted_body "$2" '{"msgtype": "m.text", $body, "format": "org.matrix.custom.html", $formatted_body}' < /dev/null)
+  fi
+  echo "$body"
+}
+
+# Post a message to a matrix room
+# body: '{body: "JSON string produced by structure_message"}'
+# room_id: !fsfSRjgjBWEWffws:matrix.parity.io
+# access_token: see https://matrix.org/docs/guides/client-server-api/
+# Usage: send_message $body (json formatted) $room_id $access_token
+send_message() {
+curl -XPOST -d "$1" "https://matrix.parity.io/_matrix/client/r0/rooms/$2/send/m.room.message?access_token=$3"
+}
+
+# Pretty-printing functions
+boldprint () { printf "|\n| \033[1m%s\033[0m\n|\n" "${@}"; }
+boldcat () { printf "|\n"; while read -r l; do printf "| \033[1m%s\033[0m\n" "${l}"; done; printf "|\n" ; }
+
+skip_if_companion_pr() {
+  url="https://api.github.com/repos/paritytech/polkadot/pulls/${CI_COMMIT_REF_NAME}"
+  echo "[+] API URL: $url"
+
+  pr_title=$(curl -sSL -H "Authorization: token ${GITHUB_PR_TOKEN}" "$url" | jq -r .title)
+  echo "[+] PR title: $pr_title"
+
+  if echo "$pr_title" | grep -qi '^companion'; then
+    echo "[!] PR is a companion PR. Build is already done in substrate"
+    exit 0
+  else
+    echo "[+] PR is not a companion PR. Proceeding test"
+  fi
+}
+
+# Fetches the tag name of the latest release from a repository
+# repo: 'organisation/repo'
+# Usage: latest_release 'paritytech/polkadot'
+latest_release() {
+  curl -s "$api_base/$1/releases/latest" | jq -r '.tag_name'
+}
+
+# Check for runtime changes between two commits. This is defined as any changes
+# to /primitives/src/* and any *production* chains under /runtime
+has_runtime_changes() {
+  from=$1
+  to=$2
+
+  if git diff --name-only "${from}...${to}" \
+    | grep -q -e '^runtime/polkadot' -e '^runtime/kusama' -e '^primitives/src/' -e '^runtime/common'
+  then
+    return 0
+  else
+    return 1
+  fi
+}
+
+# given a bootnode and the path to a chainspec file, this function will create a new chainspec file
+# with only the bootnode specified and test whether that bootnode provides peers
+# The optional third argument is the index of the bootnode in the list of bootnodes, this is just used to pick an ephemeral
+# port for the node to run on. If you're only testing one, it'll just use the first ephemeral port
+# BOOTNODE: /dns/polkadot-connect-0.parity.io/tcp/443/wss/p2p/12D3KooWEPmjoRpDSUuiTjvyNDd8fejZ9eNWH5bE965nyBMDrB4o
+# CHAINSPEC_FILE: /path/to/polkadot.json
+check_bootnode(){
+    BOOTNODE=$1
+    BASE_CHAINSPEC=$2
+    RUNTIME=$(basename "$BASE_CHAINSPEC" | cut -d '.' -f 1)
+    MIN_PEERS=1
+
+    # Generate a temporary chainspec file containing only the bootnode we care about
+    TMP_CHAINSPEC_FILE="$RUNTIME.$(echo "$BOOTNODE" | tr '/' '_').tmp.json"
+    jq ".bootNodes = [\"$BOOTNODE\"] " < "$CHAINSPEC_FILE" > "$TMP_CHAINSPEC_FILE"
+
+    # Grab an unused port by binding to port 0 and then immediately closing the socket
+    # This is a bit of a hack, but it's the only way to do it in the shell
+    RPC_PORT=$(python -c "import socket; s=socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()")
+
+    echo "[+] Checking bootnode $BOOTNODE"
+    polkadot --chain "$TMP_CHAINSPEC_FILE" --no-mdns --rpc-port="$RPC_PORT" --tmp > /dev/null 2>&1 &
+    # Wait a few seconds for the node to start up
+    sleep 5
+    POLKADOT_PID=$!
+
+    MAX_POLLS=10
+    TIME_BETWEEN_POLLS=3
+    for _ in $(seq 1 "$MAX_POLLS"); do
+    # Check the health endpoint of the RPC node
+      PEERS="$(curl -s -X POST -H "Content-Type: application/json" --data '{"jsonrpc":"2.0","method":"system_health","params":[],"id":1}' http://localhost:"$RPC_PORT" | jq -r '.result.peers')"
+      # Sometimes due to machine load or other reasons, we don't get a response from the RPC node
+      # If $PEERS is an empty variable, make it 0 so we can still do the comparison
+      if [ -z "$PEERS" ]; then
+        PEERS=0
+      fi
+      if [ "$PEERS" -ge $MIN_PEERS ]; then
+        echo "[+] $PEERS peers found for $BOOTNODE"
+        echo "    Bootnode appears contactable"
+        kill $POLKADOT_PID
+        # Delete the temporary chainspec file now we're done running the node
+        rm "$TMP_CHAINSPEC_FILE"
+        return 0
+      fi
+      sleep "$TIME_BETWEEN_POLLS"
+    done
+    kill $POLKADOT_PID
+    # Delete the temporary chainspec file now we're done running the node
+    rm "$TMP_CHAINSPEC_FILE"
+    echo "[!] No peers found for $BOOTNODE"
+    echo "    Bootnode appears unreachable"
+    return 1
+}

.gitlab/ensure-deps.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+
+# The script is meant to check if the rules regarding packages
+# dependencies are satisfied.
+# The general format is:
+# [top-lvl-dir] MESSAGE/[other-top-dir]
+
+# For instance no crate within `./client` directory
+# is allowed to import any crate with a directory path containing `frame`.
+# Such rule is just: `client crates must not depend on anything in /frame`.
+
+# The script should be run from the main repo directory!
+
+set -u
+
+# HARD FAILING
+MUST_NOT=(
+	"client crates must not depend on anything in /frame"
+	"client crates must not depend on anything in /node"
+	"frame crates must not depend on anything in /node"
+	"frame crates must not depend on anything in /client"
+	"primitives crates must not depend on anything in /frame"
+)
+
+# ONLY DISPLAYED, script still succeeds
+PLEASE_DONT=(
+	"primitives crates should not depend on anything in /client"
+)
+
+VIOLATIONS=()
+PACKAGES=()
+
+function check_rule() {
+	rule=$1
+	from=$(echo $rule | cut -f1 -d\ )
+	to=$(echo $rule | cut -f2 -d\/)
+
+	cd $from
+	echo "Checking rule '$rule'"
+	packages=$(find -name Cargo.toml | xargs grep -wn "path.*\.\.\/$to")
+	has_references=$(echo -n $packages | wc -c)
+	if [ "$has_references" != "0" ]; then
+		VIOLATIONS+=("$rule")
+		# Find packages that violate:
+		PACKAGES+=("$packages")
+	fi
+	cd - > /dev/null
+}
+
+for rule in "${MUST_NOT[@]}"
+do
+	check_rule "$rule";
+done
+
+# Only the MUST NOT will be counted towards failure
+HARD_VIOLATIONS=${#VIOLATIONS[@]}
+
+
+for rule in "${PLEASE_DONT[@]}"
+do
+	check_rule "$rule";
+done
+
+# Display violations and fail
+I=0
+for v in "${VIOLATIONS[@]}"
+do
+	cat << EOF
+
+===========================================
+======= Violation of rule: $v
+===========================================
+${PACKAGES[$I]}
+
+
+EOF
+	I=$I+1
+done
+
+exit $HARD_VIOLATIONS

.gitlab/lingua.dic

@@ -0,0 +1,342 @@
+150
+2D
+A&V
+accessor/MS
+AccountId
+activations
+acyclic
+adversary/SM
+allocator/SM
+annualised
+anonymize/D
+Apache-2.0/M
+API
+APIs
+arg/MS
+assignee/SM
+async
+asynchrony
+autogenerated
+backable
+backend/MS
+benchmark/DSMG
+BFT/M
+bitfield/MS
+bitwise
+blake2/MS
+blockchain/MS
+borked
+broadcast/UDSMG
+BTC/S
+canonicalization
+canonicalize/D
+CentOS
+CLI/MS
+codebase/SM
+codec/SM
+commit/D
+comparator
+computable
+conclude/UD
+config/MS
+could've
+crowdfund
+crowdloan/MSG
+crypto/MS
+CSM
+Cucumber/MS
+customizable/B
+DDoS
+Debian/M
+decodable/MS
+decrement
+deduplicated
+deduplication
+deinitializing
+dequeue/SD
+dequeuing
+deregister
+deserialize/G
+DHT
+disincentivize/D
+dispatchable/SM
+DLEQ
+DM
+DMP/SM
+DMQ
+DoS
+DOT
+DOTs
+ECDSA
+ed25519
+encodable
+enqueue/D
+enqueue/DMSG
+entrypoint/MS
+enum
+ERC-20
+ETH/S
+ethereum/MS
+externality/MS
+extrinsic
+extrinsics
+fedora/M
+finalize/B
+FRAME/MS
+FSMs
+functor
+fungibility
+gameable
+getter/MS
+GiB/S
+GKE
+GNUNet
+GPL/M
+GPLv3/M
+Grafana/MS
+Gurke/MS
+gurke/MS
+Handler/MS
+HMP/SM
+HRMP
+HSM
+https
+iff
+implementer/MS
+includable
+include/BG
+increment/DSMG
+inherent
+inherents
+initialize/CRG
+initializer
+instantiate/B
+instantiation/SM
+intrinsic
+intrinsics
+invariant/MS
+invariants
+inverter/MS
+invertible
+io
+IP/S
+isn
+isolatable
+isolate/BG
+iterable
+jaeger/MS
+js
+judgement/S
+keccak256/M
+keypair/MS
+keystore/MS
+Kovan
+KSM/S
+Kubernetes/MS
+kusama/S
+KYC/M
+lib
+libp2p
+lifecycle/MS
+liveness
+lookahead/MS
+lookup/MS
+LRU
+mainnet/MS
+malus/MS
+MB/M
+Mbit
+merkle/MS
+Merklized
+metadata/M
+middleware/MS
+Millau
+misbehavior/SM
+misbehaviors
+misvalidate/D
+MIT/M
+MMR
+modularity
+mpsc
+MPSC
+MQC/SM
+msg
+multisig/S
+multivalidator/SM
+mutators
+mutex
+natively
+NFA
+NFT/SM
+no_std
+nonces
+NPoS
+NTB
+offboard/DMSG
+onboard/DMSG
+oneshot/MS
+onwards
+OOM/S
+OPENISH
+others'
+ourself
+overseer/MS
+ownerless
+p2p
+parablock/MS
+parachain/MS
+ParaId
+parameterization
+parameterize/D
+parathread/MS
+participations
+passthrough
+PDK
+peerset/MS
+permission/D
+pessimization
+phragmen
+picosecond/SM
+PoA/MS
+polkadot/MS
+Polkadot/MS
+PoS/MS
+PoV/MS
+PoW/MS
+PR
+precheck
+prechecking
+preconfigured
+preimage/MS
+preopen
+prepend/G
+prevalidating
+prevalidation
+preverify/G
+programmatically
+prometheus/MS
+provisioner/MS
+proxy/DMSG
+proxy/G
+proxying
+PRs
+PVF/S
+querier
+README/MS
+redhat/M
+register/CD
+relayer
+repo/MS
+requesters
+reservable
+responder/SM
+retriability
+reverify
+ROC
+roundtrip/MS
+routable
+rpc
+RPC/MS
+runtime/MS
+rustc/MS
+SAFT
+scalability
+scalable
+Schnorr
+schnorrkel
+SDF
+sending/S
+sharding
+shareable
+Simnet/MS
+spawn/SR
+spawner
+sr25519
+SS58
+SSL
+startup/MS
+stateful
+Statemine
+str
+struct/MS
+subcommand/SM
+substream
+subsystem/MS
+subsystems'
+supermajority
+SURI
+sybil
+systemwide
+taskmanager/MS
+TCP
+teleport/D
+teleport/RG
+teleportation/SM
+teleporter/SM
+teleporters
+template/GSM
+testnet/MS
+tera/M
+teleports
+timeframe
+timestamp/MS
+topologies
+tradeoff
+transitionary
+trie/MS
+trustless/Y
+TTL
+tuple/SM
+typesystem
+ubuntu/M
+UDP
+UI
+unapplied
+unassign
+unconcluded
+unexpectable
+unfinalize/B
+unfinalized
+union/MSG
+unordered
+unreceived
+unreserve
+unreserving
+unroutable
+unservable/B
+untrusted
+untyped
+unvested
+URI
+utilize
+v0
+v1
+v2
+validator/SM
+ve
+vec
+verifier
+verify/R
+versa
+Versi
+version/DMSG
+versioned
+VMP/SM
+VPS
+VRF/SM
+w3f/MS
+wakeup
+wakeups
+warming/S
+wasm/M
+wasmtime
+Westend/M
+wildcard/MS
+WND/S
+Wococo
+WS
+XCM/S
+XCMP/M
+yeet
+yml
+zsh

.gitlab/pipeline/build.yml

@@ -0,0 +1,342 @@
+# This file is part of .gitlab-ci.yml
+# Here are all jobs that are executed during "build" stage
+
+# build jobs from polkadot
+
+build-linux-stable:
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    - .collect-artifacts
+  variables:
+    RUST_TOOLCHAIN: stable
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings"
+    # Ensure we run the UI tests.
+    RUN_UI_TESTS: 1
+  script:
+    - time cargo build --locked --profile testnet --features pyroscope,fast-runtime --bin polkadot
+    # pack artifacts
+    - mkdir -p ./artifacts
+    - VERSION="${CI_COMMIT_REF_NAME}" # will be tag or branch name
+    - mv ./target/testnet/polkadot ./artifacts/.
+    - pushd artifacts
+    - sha256sum polkadot | tee polkadot.sha256
+    - shasum -c polkadot.sha256
+    - popd
+    - EXTRATAG="${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHORT_SHA}"
+    - echo "Polkadot version = ${VERSION} (EXTRATAG = ${EXTRATAG})"
+    - echo -n ${VERSION} > ./artifacts/VERSION
+    - echo -n ${EXTRATAG} > ./artifacts/EXTRATAG
+    - echo -n ${CI_JOB_ID} > ./artifacts/BUILD_LINUX_JOB_ID
+    - RELEASE_VERSION=$(./artifacts/polkadot -V | awk '{print $2}'| awk -F "-" '{print $1}')
+    - echo -n "v${RELEASE_VERSION}" > ./artifacts/BUILD_RELEASE_VERSION
+    - cp -r docker/* ./artifacts
+
+build-test-collators:
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    - .collect-artifacts
+  script:
+    - time cargo build --locked --profile testnet --verbose -p test-parachain-adder-collator
+    - time cargo build --locked --profile testnet --verbose -p test-parachain-undying-collator
+    # pack artifacts
+    - mkdir -p ./artifacts
+    - mv ./target/testnet/adder-collator ./artifacts/.
+    - mv ./target/testnet/undying-collator ./artifacts/.
+    - echo -n "${CI_COMMIT_REF_NAME}" > ./artifacts/VERSION
+    - echo -n "${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHORT_SHA}" > ./artifacts/EXTRATAG
+    - echo "adder-collator version = $(cat ./artifacts/VERSION) (EXTRATAG = $(cat ./artifacts/EXTRATAG))"
+    - echo "undying-collator version = $(cat ./artifacts/VERSION) (EXTRATAG = $(cat ./artifacts/EXTRATAG))"
+    - cp -r ./docker/* ./artifacts
+
+build-malus:
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    - .collect-artifacts
+  script:
+    - time cargo build --locked --profile testnet --verbose -p polkadot-test-malus
+    # pack artifacts
+    - mkdir -p ./artifacts
+    - mv ./target/testnet/malus ./artifacts/.
+    - echo -n "${CI_COMMIT_REF_NAME}" > ./artifacts/VERSION
+    - echo -n "${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHORT_SHA}" > ./artifacts/EXTRATAG
+    - echo "polkadot-test-malus = $(cat ./artifacts/VERSION) (EXTRATAG = $(cat ./artifacts/EXTRATAG))"
+    - cp -r ./docker/* ./artifacts
+
+build-staking-miner:
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    - .collect-artifacts
+  script:
+    - time cargo build --locked --release --package staking-miner
+    # # pack artifacts
+    # - mkdir -p ./artifacts
+    # - mv ./target/release/staking-miner ./artifacts/.
+    # - echo -n "${CI_COMMIT_REF_NAME}" > ./artifacts/VERSION
+    # - echo -n "${CI_COMMIT_REF_NAME}-${CI_COMMIT_SHORT_SHA}" > ./artifacts/EXTRATAG
+    # - echo "staking-miner = $(cat ./artifacts/VERSION) (EXTRATAG = $(cat ./artifacts/EXTRATAG))"
+    # - cp -r ./scripts/* ./artifacts
+
+build-rustdoc:
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    SKIP_WASM_BUILD: 1
+  # artifacts:
+  #   name: "${CI_JOB_NAME}_${CI_COMMIT_REF_NAME}-doc"
+  #   when: on_success
+  #   expire_in: 1 days
+  #   paths:
+  #     - ./crate-docs/
+  script:
+    # FIXME: it fails with `RUSTDOCFLAGS="-Dwarnings"` and `--all-features`
+    # FIXME: return to stable when https://github.com/rust-lang/rust/issues/96937 gets into stable
+    - time cargo doc --workspace --verbose --no-deps
+    - rm -f ./target/doc/.lock
+    - mv ./target/doc ./crate-docs
+    # FIXME: remove me after CI image gets nonroot
+    - chown -R nonroot:nonroot ./crate-docs
+    - echo "<meta http-equiv=refresh content=0;url=polkadot_service/index.html>" > ./crate-docs/index.html
+
+build-implementers-guide:
+  stage: build
+  extends:
+    - .kubernetes-env
+    - .common-refs
+    - .run-immediately
+    # - .collect-artifacts
+  # git depth is set on purpose: https://github.com/paritytech/polkadot/issues/6284
+  variables:
+    GIT_STRATEGY: clone
+    GIT_DEPTH: 0
+    CI_IMAGE: paritytech/mdbook-utils:e14aae4a-20221123
+  script:
+    - mdbook build ./polkadot/roadmap/implementers-guide
+    - mkdir -p artifacts
+    - mv polkadot/roadmap/implementers-guide/book artifacts/
+
+build-short-benchmark:
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    - .collect-artifacts
+  script:
+    - cargo build --profile release --locked --features=runtime-benchmarks
+    - mkdir -p artifacts
+    - target/release/polkadot --version
+    - cp ./target/release/polkadot ./artifacts/
+
+# build jobs from cumulus
+
+build-linux-stable-cumulus:
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    - .collect-artifacts
+  variables:
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings"
+  script:
+    - echo "___Building a binary, please refrain from using it in production since it goes with the debug assertions.___"
+    - time cargo build --release --locked --bin polkadot-parachain
+    - echo "___Packing the artifacts___"
+    - mkdir -p ./artifacts
+    - mv ./target/release/polkadot-parachain ./artifacts/.
+    - echo "___The VERSION is either a tag name or the curent branch if triggered not by a tag___"
+    - echo ${CI_COMMIT_REF_NAME} | tee ./artifacts/VERSION
+
+build-test-parachain:
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    - .collect-artifacts
+  variables:
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings"
+  script:
+    - echo "___Building a binary, please refrain from using it in production since it goes with the debug assertions.___"
+    - time cargo build --release --locked --bin test-parachain
+    - echo "___Packing the artifacts___"
+    - mkdir -p ./artifacts
+    - mv ./target/release/test-parachain ./artifacts/.
+    - mkdir -p ./artifacts/zombienet
+    - mv ./target/release/wbuild/cumulus-test-runtime/wasm_binary_spec_version_incremented.rs.compact.compressed.wasm ./artifacts/zombienet/.
+
+# build runtime only if files in $RUNTIME_PATH/$RUNTIME_NAME were changed
+.build-runtime-template: &build-runtime-template
+  stage: build
+  extends:
+    - .docker-env
+    - .test-refs-no-trigger-prs-only
+    - .run-immediately
+  variables:
+    RUNTIME_PATH: "parachains/runtimes/assets"
+  script:
+    - cd ${RUNTIME_PATH}
+    - for directory in $(echo */); do
+      echo "_____Running cargo check for ${directory} ______";
+      cd ${directory};
+      pwd;
+      SKIP_WASM_BUILD=1 cargo check --locked;
+      cd ..;
+      done
+
+# DAG: build-runtime-assets -> build-runtime-collectives -> build-runtime-bridge-hubs
+# DAG: build-runtime-assets -> build-runtime-collectives -> build-runtime-contracts
+# DAG: build-runtime-assets -> build-runtime-starters -> build-runtime-testing
+build-runtime-assets:
+  <<: *build-runtime-template
+  variables:
+    RUNTIME_PATH: "cumulus/parachains/runtimes/assets"
+
+build-runtime-collectives:
+  <<: *build-runtime-template
+  variables:
+    RUNTIME_PATH: "cumulus/parachains/runtimes/collectives"
+  # this is an artificial job dependency, for pipeline optimization using GitLab's DAGs
+  needs:
+    - job: build-runtime-assets
+      artifacts: false
+
+build-runtime-bridge-hubs:
+  <<: *build-runtime-template
+  variables:
+    RUNTIME_PATH: "cumulus/parachains/runtimes/bridge-hubs"
+  # this is an artificial job dependency, for pipeline optimization using GitLab's DAGs
+  needs:
+    - job: build-runtime-collectives
+      artifacts: false
+
+build-runtime-contracts:
+  <<: *build-runtime-template
+  variables:
+    RUNTIME_PATH: "cumulus/parachains/runtimes/contracts"
+  # this is an artificial job dependency, for pipeline optimization using GitLab's DAGs
+  needs:
+    - job: build-runtime-collectives
+      artifacts: false
+
+build-runtime-starters:
+  <<: *build-runtime-template
+  variables:
+    RUNTIME_PATH: "cumulus/parachains/runtimes/starters"
+  # this is an artificial job dependency, for pipeline optimization using GitLab's DAGs
+  needs:
+    - job: build-runtime-assets
+      artifacts: false
+
+build-runtime-testing:
+  <<: *build-runtime-template
+  variables:
+    RUNTIME_PATH: "cumulus/parachains/runtimes/testing"
+  # this is an artificial job dependency, for pipeline optimization using GitLab's DAGs
+  needs:
+    - job: build-runtime-starters
+      artifacts: false
+
+# substrate
+
+build-linux-substrate:
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    - .collect-artifacts
+  variables:
+    # this variable gets overriden by "rusty-cachier environment inject", use the value as default
+    CARGO_TARGET_DIR: "$CI_PROJECT_DIR/target"
+  before_script:
+    - mkdir -p ./artifacts/substrate/
+    # tldr: we need to checkout the branch HEAD explicitly because of our dynamic versioning approach while building the substrate binary
+    # see https://github.com/paritytech/ci_cd/issues/682#issuecomment-1340953589
+    - git checkout -B "$CI_COMMIT_REF_NAME" "$CI_COMMIT_SHA"
+  script:
+    - WASM_BUILD_NO_COLOR=1 time cargo build --locked --release --verbose
+    - mv $CARGO_TARGET_DIR/release/substrate-node ./artifacts/substrate/substrate
+    - echo -n "Substrate version = "
+    - if [ "${CI_COMMIT_TAG}" ]; then
+      echo "${CI_COMMIT_TAG}" | tee ./artifacts/substrate/VERSION;
+      else
+      ./artifacts/substrate/substrate --version |
+      cut -d ' ' -f 2 | tee ./artifacts/substrate/VERSION;
+      fi
+    - sha256sum ./artifacts/substrate/substrate | tee ./artifacts/substrate/substrate.sha256
+    - cp -r ./docker/substrate_injected.Dockerfile ./artifacts/substrate/
+    # - printf '\n# building node-template\n\n'
+    # - ./scripts/ci/node-template-release.sh ./artifacts/substrate/substrate-node-template.tar.gz
+
+.build-subkey:
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    # - .collect-artifact
+  variables:
+    # this variable gets overriden by "rusty-cachier environment inject", use the value as default
+    CARGO_TARGET_DIR: "$CI_PROJECT_DIR/target"
+  before_script:
+    - mkdir -p ./artifacts/subkey
+  script:
+    - cd ./substrate/bin/utils/subkey
+    - SKIP_WASM_BUILD=1 time cargo build --locked --release --verbose
+    # - cd -
+    # - mv $CARGO_TARGET_DIR/release/subkey ./artifacts/subkey/.
+    # - echo -n "Subkey version = "
+    # - ./artifacts/subkey/subkey --version |
+    #   sed -n -E 's/^subkey ([0-9.]+.*)/\1/p' |
+    #   tee ./artifacts/subkey/VERSION;
+    # - sha256sum ./artifacts/subkey/subkey | tee ./artifacts/subkey/subkey.sha256
+    # - cp -r ./scripts/ci/docker/subkey.Dockerfile ./artifacts/subkey/
+
+build-subkey-linux:
+  extends: .build-subkey
+# tbd
+# build-subkey-macos:
+#   extends: .build-subkey
+#   # duplicating before_script & script sections from .build-subkey hidden job
+#   # to overwrite rusty-cachier integration as it doesn't work on macos
+#   before_script:
+#     # skip timestamp script, the osx bash doesn't support printf %()T
+#     - !reference [.job-switcher, before_script]
+#     - mkdir -p ./artifacts/subkey
+#   script:
+#     - cd ./bin/utils/subkey
+#     - SKIP_WASM_BUILD=1 time cargo build --locked --release --verbose
+#     - cd -
+#     - mv ./target/release/subkey ./artifacts/subkey/.
+#     - echo -n "Subkey version = "
+#     - ./artifacts/subkey/subkey --version |
+#       sed -n -E 's/^subkey ([0-9.]+.*)/\1/p' |
+#       tee ./artifacts/subkey/VERSION;
+#     - sha256sum ./artifacts/subkey/subkey | tee ./artifacts/subkey/subkey.sha256
+#     - cp -r ./scripts/ci/docker/subkey.Dockerfile ./artifacts/subkey/
+#   after_script: [""]
+#   tags:
+#     - osx
+

.gitlab/pipeline/check.yml

@@ -0,0 +1,198 @@
+cargo-clippy:
+  stage: check
+  extends:
+    - .docker-env
+    - .common-refs
+  script:
+    - SKIP_WASM_BUILD=1 env -u RUSTFLAGS cargo clippy --all-targets --locked --workspace
+  # fixme!
+  allow_failure: true
+
+check-try-runtime:
+  stage: check
+  extends:
+    - .docker-env
+    - .common-refs
+  script:
+    - time cargo check --locked --all --features try-runtime
+    # this is taken from cumulus
+    # Check that parachain-template will compile with `try-runtime` feature flag.
+    - time cargo check --locked -p parachain-template-node --features try-runtime
+    # add after https://github.com/paritytech/substrate/pull/14502 is merged
+    # experimental code may rely on try-runtime and vice-versa
+    # - time cargo check --locked --features try-runtime,experimental
+
+cargo-fmt-manifest:
+  stage: check
+  extends:
+    - .docker-env
+    - .common-refs
+  script:
+    - cargo install zepter --locked --version 0.10.0 -q -f --no-default-features && zepter --version
+    - echo "👉 Hello developer! If you see this CI check failing then it means that one of the your changes in a Cargo.toml file introduced ill-formatted or unsorted features. Please take a look at 'docs/STYLE_GUIDE.md#manifest-formatting' to find out more."
+    - zepter format features --check
+  allow_failure: true # Experimental
+
+cargo-deny-licenses:
+  stage: check
+  extends:
+    - .docker-env
+    - .test-pr-refs
+  variables:
+    CARGO_DENY_CMD: "cargo deny --all-features check licenses -c ./substrate/scripts/ci/deny.toml"
+  script:
+    - $CARGO_DENY_CMD --hide-inclusion-graph
+  after_script:
+    # - !reference [.rusty-cachier, after_script]
+    - echo "___The complete log is in the artifacts___"
+    - $CARGO_DENY_CMD 2> deny.log
+    - if [ $CI_JOB_STATUS != 'success' ]; then
+      echo 'Please check license of your crate or add an exception to scripts/ci/deny.toml';
+      fi
+  allow_failure: true
+  artifacts:
+    name: $CI_COMMIT_SHORT_SHA
+    expire_in: 3 days
+    when: always
+    paths:
+      - deny.log
+
+spellcheck:
+  stage: check
+  extends:
+    - .kubernetes-env
+    - .common-refs
+  script:
+    - cargo spellcheck --version
+    # compare with the commit parent to the PR, given it's from a default branch
+    - git fetch origin +${CI_DEFAULT_BRANCH}:${CI_DEFAULT_BRANCH}
+    - echo "___Spellcheck is going to check your diff___"
+    - cargo spellcheck list-files -vvv $(git diff --diff-filter=AM --name-only $(git merge-base ${CI_COMMIT_SHA} ${CI_DEFAULT_BRANCH} -- :^bridges))
+    - time cargo spellcheck check -vvv --cfg=.gitlab/spellcheck.toml --checkers hunspell --code 1
+      $(git diff --diff-filter=AM --name-only $(git merge-base ${CI_COMMIT_SHA} ${CI_DEFAULT_BRANCH} -- :^bridges))
+  allow_failure: true
+
+# from substrate
+# not sure if it's needed in monorepo
+check-dependency-rules:
+  stage: check
+  extends:
+    - .kubernetes-env
+    - .test-refs-no-trigger-prs-only
+  variables:
+    CI_IMAGE: "paritytech/tools:latest"
+  allow_failure: true
+  script:
+    - cd substrate/
+    - ../.gitlab/ensure-deps.sh
+
+test-rust-features:
+  stage: check
+  extends:
+    - .kubernetes-env
+    - .test-refs-no-trigger-prs-only
+  script:
+    - git clone
+      --depth=1
+      --branch="master"
+      https://github.com/paritytech/pipeline-scripts
+    - bash ./pipeline-scripts/rust-features.sh .
+
+job-starter:
+  stage: check
+  image: paritytech/tools:latest
+  extends:
+    - .kubernetes-env
+    - .common-refs
+  allow_failure: true
+  script:
+    - echo ok
+
+test-rust-feature-propagation:
+  stage: check
+  extends:
+    - .kubernetes-env
+    - .test-pr-refs
+  script:
+    - cargo install --locked --version 0.10.0 -q -f zepter && zepter --version
+    - echo "👉 Hello developer! If you see this CI check failing then it means that one of the crates is missing a feature for one of its dependencies. The output below tells you which feature needs to be added for which dependency to which crate. You can do this by modifying the Cargo.toml file. For more context see the MR where this check was introduced https://github.com/paritytech/substrate/pull/14660"
+    - zepter lint propagate-feature --feature try-runtime --left-side-feature-missing=ignore --workspace --feature-enables-dep="try-runtime:frame-try-runtime" --locked
+    - zepter lint propagate-feature --feature runtime-benchmarks --left-side-feature-missing=ignore --workspace --feature-enables-dep="runtime-benchmarks:frame-benchmarking" --locked
+    - zepter lint propagate-feature --feature std --left-side-feature-missing=ignore --workspace --locked
+  allow_failure: true # Experimental
+
+# More info can be found here: https://github.com/paritytech/polkadot/pull/5865
+.check-runtime-migration:
+  stage: check
+  extends:
+    - .docker-env
+    - .test-pr-refs
+  script:
+    - |
+      export RUST_LOG=remote-ext=debug,runtime=debug
+      echo "---------- Running try-runtime for ${NETWORK} ----------"
+      time cargo install --locked --git https://github.com/paritytech/try-runtime-cli --rev a93c9b5abe5d31a4cf1936204f7e5c489184b521
+      time cargo build --release --locked -p "$NETWORK"-runtime --features try-runtime
+      time try-runtime \
+          --runtime ./target/release/wbuild/"$NETWORK"-runtime/target/wasm32-unknown-unknown/release/"$NETWORK"_runtime.wasm \
+          on-runtime-upgrade --checks=pre-and-post live --uri wss://${NETWORK}-try-runtime-node.parity-chains.parity.io:443
+
+check-runtime-migration-polkadot:
+  stage: check
+  extends:
+    - .docker-env
+    - .test-pr-refs
+    - .check-runtime-migration
+  variables:
+    NETWORK: "polkadot"
+  allow_failure: true # FIXME https://github.com/paritytech/substrate/issues/13107
+
+check-runtime-migration-kusama:
+  stage: check
+  extends:
+    - .docker-env
+    - .test-pr-refs
+    - .check-runtime-migration
+  variables:
+    NETWORK: "kusama"
+  allow_failure: true # FIXME https://github.com/paritytech/substrate/issues/13107
+
+check-runtime-migration-westend:
+  stage: check
+  extends:
+    - .docker-env
+    - .test-pr-refs
+    - .check-runtime-migration
+  variables:
+    NETWORK: "westend"
+  allow_failure: true # FIXME https://github.com/paritytech/substrate/issues/13107
+
+check-runtime-migration-rococo:
+  stage: check
+  extends:
+    - .docker-env
+    - .test-pr-refs
+    - .check-runtime-migration
+  variables:
+    NETWORK: "rococo"
+  allow_failure: true # FIXME https://github.com/paritytech/substrate/issues/13107
+
+find-fail-ci-phrase:
+  stage: check
+  variables:
+    CI_IMAGE: "paritytech/tools:latest"
+    ASSERT_REGEX: "FAIL-CI"
+    GIT_DEPTH: 1
+  extends:
+    - .kubernetes-env
+    - .test-pr-refs
+  script:
+    - set +e
+    - rg --line-number --hidden --type rust --glob '!{.git,target}' "$ASSERT_REGEX" .; exit_status=$?
+    - if [ $exit_status -eq 0 ]; then
+      echo "$ASSERT_REGEX was found, exiting with 1";
+      exit 1;
+      else
+      echo "No $ASSERT_REGEX was found, exiting with 0";
+      exit 0;
+      fi

.gitlab/pipeline/publish.yml

@@ -0,0 +1,315 @@
+# This file is part of .gitlab-ci.yml
+# Here are all jobs that are executed during "publish" stage
+
+# cumulus
+
+.build-push-image:
+  image: $BUILDAH_IMAGE
+  variables:
+    DOCKERFILE: "" # docker/path-to.Dockerfile
+    IMAGE_NAME: "" # docker.io/paritypr/image_name
+  script:
+    # - test "$PARITYPR_USER" -a "$PARITYPR_PASS" ||
+    #   ( echo "no docker credentials provided"; exit 1 )
+    - $BUILDAH_COMMAND build
+      --format=docker
+      --build-arg VCS_REF="${CI_COMMIT_SHA}"
+      --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
+      --build-arg IMAGE_NAME="${IMAGE_NAME}"
+      --tag "$IMAGE_NAME:${DOCKER_IMAGES_VERSION}"
+      --file ${DOCKERFILE} .
+    - echo "$PARITYPR_PASS" |
+      buildah login --username "$PARITYPR_USER" --password-stdin docker.io
+    - $BUILDAH_COMMAND info
+    - $BUILDAH_COMMAND push --format=v2s2 "$IMAGE_NAME:${DOCKER_IMAGES_VERSION}"
+  after_script:
+    - buildah logout --all
+
+build-push-image-polkadot-parachain-debug:
+  stage: publish
+  extends:
+    - .kubernetes-env
+    - .common-refs
+    - .build-push-image
+  needs:
+    - job: build-linux-stable-cumulus
+      artifacts: true
+  variables:
+    DOCKERFILE: "docker/polkadot-parachain-debug_unsigned_injected.Dockerfile"
+    IMAGE_NAME: "docker.io/paritypr/polkadot-parachain-debug"
+
+build-push-image-test-parachain:
+  stage: publish
+  extends:
+    - .kubernetes-env
+    - .common-refs
+    - .build-push-image
+  needs:
+    - job: build-test-parachain
+      artifacts: true
+  variables:
+    DOCKERFILE: "docker/test-parachain_injected.Dockerfile"
+    IMAGE_NAME: "docker.io/paritypr/test-parachain"
+# publish-s3:
+#   stage: publish
+#   extends:
+#     - .kubernetes-env
+#     - .publish-refs
+#   image: paritytech/awscli:latest
+#   needs:
+#     - job: build-linux-stable-cumulus
+#       artifacts: true
+#   variables:
+#     GIT_STRATEGY: none
+#     BUCKET: "releases.parity.io"
+#     PREFIX: "cumulus/${ARCH}-${DOCKER_OS}"
+#   script:
+#     - echo "___Publishing a binary with debug assertions!___"
+#     - echo "___VERSION = $(cat ./artifacts/VERSION) ___"
+#     - aws s3 sync ./artifacts/ s3://${BUCKET}/${PREFIX}/$(cat ./artifacts/VERSION)/
+#     - echo "___Updating objects in latest path___"
+#     - aws s3 sync s3://${BUCKET}/${PREFIX}/$(cat ./artifacts/VERSION)/ s3://${BUCKET}/${PREFIX}/latest/
+#   after_script:
+#     - aws s3 ls s3://${BUCKET}/${PREFIX}/latest/
+#       --recursive --human-readable --summarize
+
+# publish-benchmarks-assets-s3: &publish-benchmarks
+#   stage: publish
+#   extends:
+#     - .kubernetes-env
+#     - .benchmarks-refs
+#   image: paritytech/awscli:latest
+#   needs:
+#     - job: benchmarks-assets
+#       artifacts: true
+#   variables:
+#     GIT_STRATEGY: none
+#     BUCKET: "releases.parity.io"
+#     PREFIX: "cumulus/$CI_COMMIT_REF_NAME/benchmarks-assets"
+#   script:
+#     - echo "___Publishing benchmark results___"
+#     - aws s3 sync ./artifacts/ s3://${BUCKET}/${PREFIX}/
+#   after_script:
+#     - aws s3 ls s3://${BUCKET}/${PREFIX}/ --recursive --human-readable --summarize
+
+# publish-benchmarks-collectives-s3:
+#   <<: *publish-benchmarks
+#   variables:
+#     GIT_STRATEGY: none
+#     BUCKET: "releases.parity.io"
+#     PREFIX: "cumulus/$CI_COMMIT_REF_NAME/benchmarks-collectives"
+#   needs:
+#     - job: benchmarks-collectives
+#       artifacts: true
+
+### Polkadot
+
+build-push-image-polkadot-debug:
+  stage: publish
+  extends:
+    - .kubernetes-env
+    - .common-refs
+    - .build-push-image
+  needs:
+    - job: build-linux-stable
+      artifacts: true
+  variables:
+    DOCKERFILE: "docker/polkadot_injected_debug.Dockerfile"
+    IMAGE_NAME: "docker.io/paritypr/polkadot-debug"
+
+build-push-image-colander:
+  stage: publish
+  extends:
+    - .kubernetes-env
+    - .common-refs
+    - .build-push-image
+  needs:
+    - job: build-test-collators
+      artifacts: true
+  variables:
+    DOCKERFILE: "docker/collator_injected.Dockerfile"
+    IMAGE_NAME: "docker.io/paritypr/colander"
+
+build-push-image-malus:
+  stage: publish
+  extends:
+    - .kubernetes-env
+    - .common-refs
+    - .build-push-image
+  needs:
+    - job: build-malus
+      artifacts: true
+  variables:
+    DOCKERFILE: "docker/malus_injected.Dockerfile"
+    IMAGE_NAME: "docker.io/paritypr/malus"
+
+build-push-image-substrate-pr:
+  stage: publish
+  extends:
+    - .kubernetes-env
+    - .common-refs
+    - .build-push-image
+  needs:
+    - job: build-linux-substrate
+      artifacts: true
+  variables:
+    DOCKERFILE: "docker/substrate_injected.Dockerfile"
+    IMAGE_NAME: "docker.io/paritypr/substrate"
+# old way
+
+# .build-push-image-polkadot:
+#   before_script:
+#     # - test -s ./artifacts/VERSION || exit 1
+#     # - test -s ./artifacts/EXTRATAG || exit 1
+#     - VERSION="$(cat ./artifacts/VERSION)"
+#     - EXTRATAG="$(cat ./artifacts/EXTRATAG)"
+#     - echo "Polkadot version = ${VERSION} (EXTRATAG = ${EXTRATAG})"
+#   script:
+#     # - test "$DOCKER_USER" -a "$DOCKER_PASS" ||
+#     #   ( echo "no docker credentials provided"; exit 1 )
+#     - cd ./artifacts
+#     - $BUILDAH_COMMAND build
+#       --format=docker
+#       --build-arg VCS_REF="${CI_COMMIT_SHA}"
+#       --build-arg BUILD_DATE="$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
+#       --build-arg IMAGE_NAME="${IMAGE_NAME}"
+#       --tag "$IMAGE_NAME:$VERSION"
+#       --tag "$IMAGE_NAME:$EXTRATAG"
+#       --file ${DOCKERFILE} .
+#     # The job will success only on the protected branch
+#     # - echo "$DOCKER_PASS" |
+#     #   buildah login --username "$DOCKER_USER" --password-stdin docker.io
+#     # - $BUILDAH_COMMAND info
+#     # - $BUILDAH_COMMAND push --format=v2s2 "$IMAGE_NAME:$VERSION"
+#     # - $BUILDAH_COMMAND push --format=v2s2 "$IMAGE_NAME:$EXTRATAG"
+#   after_script:
+#     - buildah logout --all
+
+# publish-polkadot-debug-image:
+#   stage: publish
+#   image: ${BUILDAH_IMAGE}
+#   extends:
+#     - .kubernetes-env
+#     - .build-push-image-polkadot
+#   rules:
+#     - if: $CI_PIPELINE_SOURCE == "web"
+#     - if: $CI_PIPELINE_SOURCE == "schedule"
+#     - if: $CI_COMMIT_REF_NAME == "master"
+#     - if: $CI_COMMIT_REF_NAME =~ /^[0-9]+$/ # PRs
+#     - if: $CI_COMMIT_REF_NAME =~ /^v[0-9]+\.[0-9]+.*$/ # i.e. v1.0, v2.1rc1
+#   variables:
+#     GIT_STRATEGY: none
+#     DOCKER_USER: ${PARITYPR_USER}
+#     DOCKER_PASS: ${PARITYPR_PASS}
+#     # scripts/ci/dockerfiles/polkadot_injected_debug.Dockerfile
+#     DOCKERFILE: polkadot_injected_debug.Dockerfile
+#     IMAGE_NAME: docker.io/paritypr/polkadot-debug
+#   needs:
+#     - job: build-linux-stable
+#       artifacts: true
+#   after_script:
+#     # pass artifacts to the zombienet-tests job
+#     # https://docs.gitlab.com/ee/ci/multi_project_pipelines.html#with-variable-inheritance
+#     - echo "PARACHAINS_IMAGE_NAME=${IMAGE_NAME}" > ./artifacts/parachains.env
+#     - echo "PARACHAINS_IMAGE_TAG=$(cat ./artifacts/EXTRATAG)" >> ./artifacts/parachains.env
+#   artifacts:
+#     reports:
+#       # this artifact is used in zombienet-tests job
+#       dotenv: ./artifacts/parachains.env
+#     expire_in: 1 days
+
+# publish-test-collators-image:
+#   # service image for zombienet
+#   stage: publish
+#   extends:
+#     - .kubernetes-env
+#     - .build-push-image-polkadot
+#     - .zombienet-refs
+#   variables:
+#     CI_IMAGE: ${BUILDAH_IMAGE}
+#     GIT_STRATEGY: none
+#     DOCKER_USER: ${PARITYPR_USER}
+#     DOCKER_PASS: ${PARITYPR_PASS}
+#     # scripts/ci/dockerfiles/collator_injected.Dockerfile
+#     DOCKERFILE: collator_injected.Dockerfile
+#     IMAGE_NAME: docker.io/paritypr/colander
+#   needs:
+#     - job: build-test-collators
+#       artifacts: true
+#   after_script:
+#     - buildah logout --all
+#     # pass artifacts to the zombienet-tests job
+#     - echo "COLLATOR_IMAGE_NAME=${IMAGE_NAME}" > ./artifacts/collator.env
+#     - echo "COLLATOR_IMAGE_TAG=$(cat ./artifacts/EXTRATAG)" >> ./artifacts/collator.env
+#   artifacts:
+#     reports:
+#       # this artifact is used in zombienet-tests job
+#       dotenv: ./artifacts/collator.env
+
+# publish-malus-image:
+#   # service image for Simnet
+#   stage: publish
+#   extends:
+#     - .kubernetes-env
+#     - .build-push-image-polkadot
+#     - .zombienet-refs
+#   variables:
+#     CI_IMAGE: ${BUILDAH_IMAGE}
+#     GIT_STRATEGY: none
+#     DOCKER_USER: ${PARITYPR_USER}
+#     DOCKER_PASS: ${PARITYPR_PASS}
+#     # scripts/ci/dockerfiles/malus_injected.Dockerfile
+#     DOCKERFILE: malus_injected.Dockerfile
+#     IMAGE_NAME: docker.io/paritypr/malus
+#   needs:
+#     - job: build-malus
+#       artifacts: true
+#   after_script:
+#     - buildah logout "$IMAGE_NAME"
+#     # pass artifacts to the zombienet-tests job
+#     - echo "MALUS_IMAGE_NAME=${IMAGE_NAME}" > ./artifacts/malus.env
+#     - echo "MALUS_IMAGE_TAG=$(cat ./artifacts/EXTRATAG)" >> ./artifacts/malus.env
+#   artifacts:
+#     reports:
+#       # this artifact is used in zombienet-tests job
+#       dotenv: ./artifacts/malus.env
+
+# publish-staking-miner-image:
+#   stage: publish
+#   extends:
+#     - .kubernetes-env
+#     - .build-push-image
+#     - .publish-refs
+#   variables:
+#     CI_IMAGE: ${BUILDAH_IMAGE}
+#     # scripts/ci/dockerfiles/staking-miner/staking-miner_injected.Dockerfile
+#     DOCKERFILE: ci/dockerfiles/staking-miner/staking-miner_injected.Dockerfile
+#     IMAGE_NAME: docker.io/paritytech/staking-miner
+#     GIT_STRATEGY: none
+#     DOCKER_USER: ${Docker_Hub_User_Parity}
+#     DOCKER_PASS: ${Docker_Hub_Pass_Parity}
+#   needs:
+#     - job: build-staking-miner
+#       artifacts: true
+
+# substrate
+
+# publish-substrate-image-pr:
+#   # service image for zombienet
+#   stage: publish
+#   extends:
+#     - .kubernetes-env
+#     - .build-push-image-polkadot
+#     - .zombienet-refs
+#   variables:
+#     CI_IMAGE: ${BUILDAH_IMAGE}
+#     GIT_STRATEGY: none
+#     DOCKER_USER: ${PARITYPR_USER}
+#     DOCKER_PASS: ${PARITYPR_PASS}
+#     DOCKERFILE: substrate_injected.Dockerfile
+#     IMAGE_NAME: docker.io/paritypr/substrate
+#   needs:
+#     - job: build-linux-substrate
+#       artifacts: true
+#   after_script:
+#     - buildah logout "$IMAGE_NAME"

.gitlab/pipeline/short-benchmarks.yml

@@ -0,0 +1,26 @@
+# This file is part of .gitlab-ci.yml
+# Here are all jobs that are executed during "short-benchmarks" stage
+
+# Run all pallet benchmarks only once to check if there are any errors
+short-benchmark-polkadot: &short-bench
+  stage: short-benchmarks
+  extends:
+    - .docker-env
+    - .common-refs
+  needs:
+    - job: build-short-benchmark
+      artifacts: true
+  variables:
+    RUNTIME: polkadot
+  script:
+    - ./artifacts/polkadot benchmark pallet --execution wasm --wasm-execution compiled --chain $RUNTIME-dev --pallet "*" --extrinsic "*" --steps 2 --repeat 1
+
+short-benchmark-kusama:
+  <<: *short-bench
+  variables:
+    RUNTIME: kusama
+
+short-benchmark-westend:
+  <<: *short-bench
+  variables:
+    RUNTIME: westend

.gitlab/pipeline/test.yml

@@ -0,0 +1,465 @@
+# this is an artificial job dependency, for pipeline optimization using GitLab's DAGs
+# the job can be found in check.yml
+.run-immediately:
+  needs:
+    - job: job-starter
+      artifacts: false
+
+test-linux-stable:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    RUST_TOOLCHAIN: stable
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings"
+  parallel: 3
+  script:
+    # Build all but only execute 'runtime' tests.
+    - echo "Node index - ${CI_NODE_INDEX}. Total amount - ${CI_NODE_TOTAL}"
+    # add experimental to features after https://github.com/paritytech/substrate/pull/14502 is merged
+    # "upgrade_version_checks_should_work" is currently failing
+    # "receive_rate_limit_is_enforced"and "benchmark_block_works" can be found in test-linux-stable-additional-tests
+    # they fail if run with other tests
+    # "rx::tests::sent_views_include_finalized_number_update", "follow_chain_works", "create_snapshot_works" and "block_execution_works"
+    # can be found in test-linux-stable-slow
+    - |
+      time cargo nextest run \
+        -E 'all() & !test(upgrade_version_checks_should_work) & !test(receive_rate_limit_is_enforced) & !test(benchmark_block_works) & !test(rx::tests::sent_views_include_finalized_number_update) & !test(follow_chain_works) & !test(create_snapshot_works) & !test(block_execution_works)' \
+        --workspace \
+        --locked \
+        --release \
+        --verbose \
+        --no-fail-fast \
+        --features runtime-benchmarks,try-runtime \
+        --partition count:${CI_NODE_INDEX}/${CI_NODE_TOTAL}
+    # run runtime-api tests with `enable-staging-api` feature on the 1st node
+    - if [ ${CI_NODE_INDEX} == 1 ]; then time cargo nextest run -p sp-api-test --features enable-staging-api; fi
+    # todo: add flacky-test collector
+
+test-linux-oldkernel-stable:
+  extends: test-linux-stable
+  tags:
+    - oldkernel-vm
+
+# can be used to run all tests
+# test-linux-stable-all:
+#   stage: test
+#   extends:
+#     - .docker-env
+#     - .common-refs
+#     - .run-immediately
+#   variables:
+#     RUST_TOOLCHAIN: stable
+#     # Enable debug assertions since we are running optimized builds for testing
+#     # but still want to have debug assertions.
+#     RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings"
+#   parallel: 3
+#   script:
+#     # Build all but only execute 'runtime' tests.
+#     - echo "Node index - ${CI_NODE_INDEX}. Total amount - ${CI_NODE_TOTAL}"
+#     - |
+#       time cargo nextest run \
+#         --workspace \
+#         --locked \
+#         --release \
+#         --verbose \
+#         --no-fail-fast \
+#         --features runtime-benchmarks,try-runtime \
+#         --partition count:${CI_NODE_INDEX}/${CI_NODE_TOTAL}
+#     # todo: add flacky-test collector
+
+# for some reasons these tests fail if run with all tests
+test-linux-stable-additional-tests:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    RUST_TOOLCHAIN: stable
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings"
+  script:
+    - |
+      time cargo nextest run \
+        -E 'test(receive_rate_limit_is_enforced) + test(benchmark_block_works)' \
+        --workspace \
+        --locked \
+        --release \
+        --verbose \
+        --features runtime-benchmarks,try-runtime
+  allow_failure: true
+
+# these ones can be really slow so it's better to run them separately
+test-linux-stable-slow:
+  stage: test
+  # remove after cache is setup
+  timeout: 2h
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    RUST_TOOLCHAIN: stable
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings"
+  script:
+    - |
+      time cargo nextest run \
+        -E 'test(rx::tests::sent_views_include_finalized_number_update) + test(follow_chain_works) + test(create_snapshot_works) + test(block_execution_works)' \
+        --workspace \
+        --locked \
+        --release \
+        --verbose \
+        --features runtime-benchmarks,try-runtime
+  allow_failure: true
+
+# takes about 1,5h without cache
+# can be used to check that nextest works correctly
+# test-linux-stable-polkadot:
+#   stage: test
+#   timeout: 2h
+#   extends:
+#     - .docker-env
+#     - .common-refs
+#     - .run-immediately
+#     - .collect-artifacts-short
+#   variables:
+#     RUST_TOOLCHAIN: stable
+#     # Enable debug assertions since we are running optimized builds for testing
+#     # but still want to have debug assertions.
+#     RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings"
+#   script:
+#     - mkdir -p artifacts
+#     - time cargo test --workspace
+#       --locked
+#       --profile testnet
+#       --features=runtime-benchmarks,runtime-metrics,try-runtime --
+#       --skip upgrade_version_checks_should_work
+
+test-doc:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings"
+  script:
+    - time cargo test --doc
+
+test-rustdoc:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    SKIP_WASM_BUILD: 1
+    RUSTDOCFLAGS: "-Dwarnings"
+  script:
+    - time cargo doc --workspace --all-features --verbose --no-deps
+  allow_failure: true
+
+cargo-check-all-benches:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  script:
+    - time cargo check --all --benches
+
+test-node-metrics:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    - .collect-artifacts-short
+  variables:
+    RUST_TOOLCHAIN: stable
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-Cdebug-assertions=y -Dwarnings"
+  script:
+    - mkdir -p artifacts
+    - time cargo test --profile testnet
+      --locked
+      --features=runtime-metrics -p polkadot-node-metrics > artifacts/log.txt
+  # FIXME!
+  allow_failure: true
+
+test-deterministic-wasm:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  script:
+    - .gitlab/test_deterministic_wasm.sh
+
+cargo-check-benches:
+  stage: test
+  variables:
+    CI_JOB_NAME: "cargo-check-benches"
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    - .collect-artifacts
+  before_script:
+    # TODO: DON'T FORGET TO CHANGE FOR PROD VALUES!!!
+    # merges in the master branch on PRs. skip if base is not master
+    - 'if [ $CI_COMMIT_REF_NAME != "master" ]; then
+      BASE=$(curl -s -H "Authorization: Bearer ${GITHUB_PR_TOKEN}" https://api.github.com/repos/paritytech-stg/polkadot-sdk/pulls/${CI_COMMIT_REF_NAME} | jq -r .base.ref);
+      printf "Merging base branch %s\n" "${BASE:=master}";
+      if [ $BASE != "master" ]; then
+      echo "$BASE is not master, skipping merge";
+      else
+      git config user.email "ci@gitlab.parity.io";
+      git fetch origin "refs/heads/${BASE}";
+      git merge --verbose --no-edit FETCH_HEAD;
+      fi
+      fi'
+  parallel: 2
+  script:
+    - mkdir -p ./artifacts/benches/$CI_COMMIT_REF_NAME-$CI_COMMIT_SHORT_SHA
+    # this job is executed in parallel on two runners
+    - echo "___Running benchmarks___";
+    - case ${CI_NODE_INDEX} in
+      1)
+      SKIP_WASM_BUILD=1 time cargo check --locked --benches --all;
+      cargo run --locked --release -p node-bench -- ::trie::read::small --json
+      | tee ./artifacts/benches/$CI_COMMIT_REF_NAME-$CI_COMMIT_SHORT_SHA/::trie::read::small.json;
+      echo "___Uploading cache for rusty-cachier___";
+      ;;
+      2)
+      cargo run --locked --release -p node-bench -- ::node::import::sr25519::transfer_keep_alive::paritydb::small --json
+      | tee ./artifacts/benches/$CI_COMMIT_REF_NAME-$CI_COMMIT_SHORT_SHA/::node::import::sr25519::transfer_keep_alive::paritydb::small.json
+      ;;
+      esac
+
+node-bench-regression-guard:
+  # it's not belong to `build` semantically, but dag jobs can't depend on each other
+  # within the single stage - https://gitlab.com/gitlab-org/gitlab/-/issues/30632
+  # more: https://github.com/paritytech/substrate/pull/8519#discussion_r608012402
+  stage: build
+  extends:
+    - .docker-env
+    - .common-refs
+  needs:
+    # this is a DAG
+    - job: cargo-check-benches
+      artifacts: true
+    # polls artifact from master to compare with current result
+    # need to specify both parallel jobs from master because of the bug
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/39063
+    - project: $CI_PROJECT_PATH
+      job: "cargo-check-benches 1/2"
+      ref: master
+      artifacts: true
+    - project: $CI_PROJECT_PATH
+      job: "cargo-check-benches 2/2"
+      ref: master
+      artifacts: true
+  variables:
+    CI_IMAGE: "paritytech/node-bench-regression-guard:latest"
+  before_script: [""]
+  script:
+    - echo "------- IMPORTANT -------"
+    - echo "node-bench-regression-guard depends on the results of a cargo-check-benches job"
+    - echo "In case of this job failure, check your pipeline's cargo-check-benches"
+    - "node-bench-regression-guard --reference artifacts/benches/master-*
+      --compare-with artifacts/benches/$CI_COMMIT_REF_NAME-$CI_COMMIT_SHORT_SHA"
+  after_script: [""]
+
+# if this fails (especially after rust version upgrade) run
+# ./substrate/.maintain/update-rust-stable.sh <rust_version>
+test-frame-support:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-C debug-assertions -D warnings"
+    RUST_BACKTRACE: 1
+    WASM_BUILD_NO_COLOR: 1
+    WASM_BUILD_RUSTFLAGS: "-C debug-assertions -D warnings"
+    # Ensure we run the UI tests.
+    RUN_UI_TESTS: 1
+  script:
+    - time cargo test --locked -p frame-support-test --features=frame-feature-testing,no-metadata-docs,try-runtime,experimental --manifest-path ./substrate/frame/support/test/Cargo.toml
+    - time cargo test --locked -p frame-support-test --features=frame-feature-testing,frame-feature-testing-2,no-metadata-docs,try-runtime,experimental --manifest-path ./substrate/frame/support/test/Cargo.toml
+    - SUBSTRATE_TEST_TIMEOUT=1 time cargo test -p substrate-test-utils --release --locked -- --ignored timeout
+    - cat /cargo_target_dir/debug/.fingerprint/memory_units-759eddf317490d2b/lib-memory_units.json || true
+
+# This job runs all benchmarks defined in the `/bin/node/runtime` once to check that there are no errors.
+quick-benchmarks:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-C debug-assertions -D warnings"
+    RUST_BACKTRACE: "full"
+    WASM_BUILD_NO_COLOR: 1
+    WASM_BUILD_RUSTFLAGS: "-C debug-assertions -D warnings"
+  script:
+    - time cargo run --locked --release --features runtime-benchmarks -- benchmark pallet --execution wasm --wasm-execution compiled --chain dev --pallet "*" --extrinsic "*" --steps 2 --repeat 1
+
+test-frame-examples-compile-to-wasm:
+  # into one job
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-C debug-assertions"
+    RUST_BACKTRACE: 1
+  script:
+    - cd ./substrate/frame/examples/offchain-worker/
+    - cargo build --locked --target=wasm32-unknown-unknown --no-default-features
+    - cd ../basic
+    - cargo build --locked --target=wasm32-unknown-unknown --no-default-features
+  # FIXME
+  allow_failure: true
+
+test-linux-stable-int:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-C debug-assertions -D warnings"
+    RUST_BACKTRACE: 1
+    WASM_BUILD_NO_COLOR: 1
+    WASM_BUILD_RUSTFLAGS: "-C debug-assertions -D warnings"
+    # Ensure we run the UI tests.
+    RUN_UI_TESTS: 1
+  script:
+    - WASM_BUILD_NO_COLOR=1
+      RUST_LOG=sync=trace,consensus=trace,client=trace,state-db=trace,db=trace,forks=trace,state_db=trace,storage_cache=trace
+      time cargo test -p node-cli --release --locked -- --ignored
+
+# more information about this job can be found here:
+# https://github.com/paritytech/substrate/pull/6916
+check-tracing:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  script:
+    # with-tracing must be explicitly activated, we run a test to ensure this works as expected in both cases
+    - time cargo test --locked --manifest-path ./substrate/primitives/tracing/Cargo.toml --no-default-features
+    - time cargo test --locked --manifest-path ./substrate/primitives/tracing/Cargo.toml --no-default-features --features=with-tracing
+
+# more information about this job can be found here:
+# https://github.com/paritytech/substrate/pull/3778
+test-full-crypto-feature:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    # Enable debug assertions since we are running optimized builds for testing
+    # but still want to have debug assertions.
+    RUSTFLAGS: "-C debug-assertions"
+    RUST_BACKTRACE: 1
+  script:
+    - cd substrate/primitives/core/
+    - time cargo build --locked --verbose --no-default-features --features full_crypto
+    - cd ../application-crypto
+    - time cargo build --locked --verbose --no-default-features --features full_crypto
+
+cargo-check-each-crate:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    # - .collect-artifacts
+  variables:
+    # $CI_JOB_NAME is set manually so that rusty-cachier can share the cache for all
+    # "cargo-check-each-crate I/N" jobs
+    CI_JOB_NAME: cargo-check-each-crate
+  timeout: 2h
+  script:
+    - PYTHONUNBUFFERED=x time .gitlab/check-each-crate.py "$CI_NODE_INDEX" "$CI_NODE_TOTAL"
+  parallel: 6
+
+cargo-check-each-crate-macos:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+    # - .collect-artifacts
+  before_script:
+    # skip timestamp script, the osx bash doesn't support printf %()T
+    - !reference [.job-switcher, before_script]
+    - !reference [.rust-info-script, script]
+    - !reference [.pipeline-stopper-vars, script]
+  variables:
+    SKIP_WASM_BUILD: 1
+  script:
+    # TODO: enable rusty-cachier once it supports Mac
+    # TODO: use parallel jobs, as per cargo-check-each-crate, once more Mac runners are available
+    # - time ./scripts/ci/gitlab/check-each-crate.py 1 1
+    - time cargo check --workspace --locked
+  tags:
+    - osx
+
+cargo-hfuzz:
+  stage: test
+  extends:
+    - .docker-env
+    - .common-refs
+    - .run-immediately
+  variables:
+    # max 10s per iteration, 60s per file
+    HFUZZ_RUN_ARGS: >
+      --exit_upon_crash
+      --exit_code_upon_crash 1
+      --timeout 10
+      --run_time 60
+    # use git version of honggfuzz-rs until v0.5.56 is out, we need a few recent changes:
+    # https://github.com/rust-fuzz/honggfuzz-rs/pull/75 to avoid breakage on debian
+    # https://github.com/rust-fuzz/honggfuzz-rs/pull/81 fix to the above pr
+    # https://github.com/rust-fuzz/honggfuzz-rs/pull/82 fix for handling rusty-cachier's absolute CARGO_TARGET_DIR
+    HFUZZ_BUILD_ARGS: >
+      --config=patch.crates-io.honggfuzz.git="https://github.com/altaua/honggfuzz-rs"
+      --config=patch.crates-io.honggfuzz.rev="205f7c8c059a0d98fe1cb912cdac84f324cb6981"
+  artifacts:
+    name: "hfuzz-$CI_COMMIT_SHORT_SHA"
+    expire_in: 7 days
+    when: on_failure
+    paths:
+      - substrate/primitives/arithmetic/fuzzer/hfuzz_workspace/
+  script:
+    - cd ./substrate/primitives/arithmetic/fuzzer
+    - cargo hfuzz build
+    - for target in $(cargo read-manifest | jq -r '.targets | .[] | .name'); do
+      cargo hfuzz run "$target" || { printf "fuzzing failure for %s\n" "$target"; exit 1; }; done

.gitlab/pipeline/zombienet.yml

@@ -0,0 +1,7 @@
+include:
+  # substrate tests
+  - .gitlab/pipeline/zombienet/substrate.yml
+  # cumulus tests
+  - .gitlab/pipeline/zombienet/cumulus.yml
+  # polkadot tests
+  - .gitlab/pipeline/zombienet/polkadot.yml

.gitlab/pipeline/zombienet/cumulus.yml

@@ -0,0 +1,143 @@
+# This file is part of .gitlab-ci.yml
+# Here are all jobs that are executed during "zombienet" stage
+
+.zombienet-before-script:
+  before_script:
+    - echo "Zombie-net Tests Config"
+    - echo "${ZOMBIENET_IMAGE}"
+    - echo "${RELAY_IMAGE}"
+    - echo "${COL_IMAGE}"
+    - echo "${GH_DIR}"
+    - echo "${LOCAL_DIR}"
+    - export DEBUG=zombie
+    - export RELAY_IMAGE=${POLKADOT_IMAGE}
+    - export COL_IMAGE=${COL_IMAGE}
+
+.zombienet-after-script:
+  after_script:
+    - mkdir -p ./zombienet-logs
+    - cp /tmp/zombie*/logs/* ./zombienet-logs/
+
+# common settings for all zombienet jobs
+.zombienet-cumulus-common:
+  stage: zombienet
+  image: "${ZOMBIENET_IMAGE}"
+  needs:
+    - job: build-push-image-test-parachain
+      artifacts: true
+  variables:
+    POLKADOT_IMAGE: "docker.io/paritypr/polkadot-debug:master"
+    GH_DIR: "https://github.com/paritytech/cumulus/tree/${CI_COMMIT_SHORT_SHA}/zombienet/tests"
+    LOCAL_DIR: "/builds/parity/mirrors/polkadot-sdk/cumulus/zombienet/tests"
+    COL_IMAGE: "docker.io/paritypr/test-parachain:${DOCKER_IMAGES_VERSION}"
+    FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR: 1
+  artifacts:
+    name: "${CI_JOB_NAME}_${CI_COMMIT_REF_NAME}"
+    when: always
+    expire_in: 2 days
+    paths:
+      - ./zombienet-logs
+  allow_failure: true
+  retry: 2
+  tags:
+    - zombienet-polkadot-integration-test
+
+zombienet-cumulus-0001-sync_blocks_from_tip_without_connected_collator:
+  extends:
+    - .zombienet-cumulus-common
+    - .zombienet-refs
+    - .zombienet-before-script
+    - .zombienet-after-script
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}"
+      --concurrency=1
+      --test="0001-sync_blocks_from_tip_without_connected_collator.zndsl"
+
+zombienet-cumulus-0002-pov_recovery:
+  extends:
+    - .zombienet-cumulus-common
+    - .zombienet-refs
+    - .zombienet-before-script
+    - .zombienet-after-script
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}"
+      --concurrency=1
+      --test="0002-pov_recovery.zndsl"
+
+zombienet-cumulus-0003-full_node_catching_up:
+  extends:
+    - .zombienet-cumulus-common
+    - .zombienet-refs
+    - .zombienet-before-script
+    - .zombienet-after-script
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}"
+      --concurrency=1
+      --test="0003-full_node_catching_up.zndsl"
+
+zombienet-cumulus-0004-runtime_upgrade:
+  extends:
+    - .zombienet-cumulus-common
+    - .zombienet-refs
+    - .zombienet-before-script
+    - .zombienet-after-script
+  needs:
+    - !reference [.zombienet-cumulus-common, needs]
+    - job: build-test-parachain
+      artifacts: true
+  before_script:
+    - ls -ltr *
+    - cp ./artifacts/zombienet/wasm_binary_spec_version_incremented.rs.compact.compressed.wasm /tmp/
+    - ls /tmp
+    - !reference [.zombienet-before-script, before_script]
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}"
+      --concurrency=1
+      --test="0004-runtime_upgrade.zndsl"
+
+zombienet-cumulus-0005-migrate_solo_to_para:
+  extends:
+    - .zombienet-cumulus-common
+    - .zombienet-refs
+    - .zombienet-before-script
+    - .zombienet-after-script
+  needs:
+    - !reference [.zombienet-cumulus-common, needs]
+    - job: build-test-parachain
+      artifacts: true
+  before_script:
+    - ls -ltr *
+    - !reference [.zombienet-before-script, before_script]
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}"
+      --concurrency=1
+      --test="0005-migrate_solo_to_para.zndsl"
+
+zombienet-cumulus-0006-rpc_collator_builds_blocks:
+  extends:
+    - .zombienet-cumulus-common
+    - .zombienet-refs
+    - .zombienet-before-script
+    - .zombienet-after-script
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}"
+      --concurrency=1
+      --test="0006-rpc_collator_builds_blocks.zndsl"
+
+zombienet-cumulus-0007-full_node_warp_sync:
+  extends:
+    - .zombienet-cumulus-common
+    - .zombienet-refs
+    - .zombienet-before-script
+    - .zombienet-after-script
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}"
+      --concurrency=1
+      --test="0007-full_node_warp_sync.zndsl"

.gitlab/pipeline/zombienet/polkadot.yml

@@ -0,0 +1,169 @@
+# This file is part of .gitlab-ci.yml
+# Here are all jobs that are executed during "zombienet" stage
+
+# common settings for all zombienet jobs
+.zombienet-polkadot-common:
+  before_script:
+    - export DEBUG=zombie,zombie::network-node
+    - export ZOMBIENET_INTEGRATION_TEST_IMAGE="${POLKADOT_IMAGE}":${PIPELINE_IMAGE_TAG}
+    - export COL_IMAGE="${COLANDER_IMAGE}":${PIPELINE_IMAGE_TAG}
+    - export MALUS_IMAGE="${MALUS_IMAGE}":${PIPELINE_IMAGE_TAG}
+    - echo "Zombienet Tests Config"
+    - echo "gh-dir ${GH_DIR}"
+    - echo "local-dir ${LOCAL_DIR}"
+    - echo "polkadot image ${ZOMBIENET_INTEGRATION_TEST_IMAGE}"
+    - echo "colander image ${COL_IMAGE}"
+    - echo "malus image ${MALUS_IMAGE}"
+  stage: zombienet
+  image: "${ZOMBIENET_IMAGE}"
+  needs:
+    - job: build-push-image-malus
+      artifacts: true
+    - job: build-push-image-polkadot-debug
+      artifacts: true
+    - job: build-push-image-colander
+      artifacts: true
+  extends:
+    - .kubernetes-env
+    - .zombienet-refs
+  variables:
+    PIPELINE_IMAGE_TAG: ${DOCKER_IMAGES_VERSION}
+    POLKADOT_IMAGE: "docker.io/paritypr/polkadot-debug"
+    COLANDER_IMAGE: "docker.io/paritypr/colander"
+    MALUS_IMAGE: "docker.io/paritypr/malus"
+    GH_DIR: "https://github.com/paritytech/substrate/tree/${CI_COMMIT_SHA}/zombienet"
+    LOCAL_DIR: "/builds/parity/mirrors/polkadot-sdk/polkadot/zombienet_tests"
+    FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR: 1
+  artifacts:
+    name: "${CI_JOB_NAME}_${CI_COMMIT_REF_NAME}"
+    when: always
+    expire_in: 2 days
+    paths:
+      - ./zombienet-logs
+  after_script:
+    - mkdir -p ./zombienet-logs
+    - cp /tmp/zombie*/logs/* ./zombienet-logs/
+  retry: 2
+  tags:
+    - zombienet-polkadot-integration-test
+
+zombienet-polkadot-functional-0001-parachains-pvf:
+  extends:
+    - .zombienet-polkadot-common
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/functional"
+      --test="0001-parachains-pvf.zndsl"
+
+zombienet-polkadot-functional-0002-parachains-disputes:
+  extends:
+    - .zombienet-polkadot-common
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/functional"
+      --test="0002-parachains-disputes.zndsl"
+
+zombienet-polkadot-functional-0003-parachains-disputes-garbage-candidate:
+  extends:
+    - .zombienet-polkadot-common
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/functional"
+      --test="0003-parachains-garbage-candidate.zndsl"
+
+zombienet-polkadot-functional-0004-beefy-and-mmr:
+  extends:
+    - .zombienet-polkadot-common
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/functional"
+      --test="0003-beefy-and-mmr.zndsl"
+
+zombienet-polkadot-smoke-0001-parachains-smoke-test:
+  extends:
+    - .zombienet-polkadot-common
+  before_script:
+    - export ZOMBIENET_INTEGRATION_TEST_IMAGE="${POLKADOT_IMAGE}":${PIPELINE_IMAGE_TAG}
+    - export COL_IMAGE="docker.io/paritypr/colander:4519" # The collator image is fixed
+    - echo "Zombienet Tests Config"
+    - echo "gh-dir ${GH_DIR}"
+    - echo "local-dir ${LOCAL_DIR}"
+    - echo "polkadot image ${ZOMBIENET_INTEGRATION_TEST_IMAGE}"
+    - echo "colander image ${COL_IMAGE}"
+    - echo "malus image ${MALUS_IMAGE}"
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/smoke"
+      --test="0001-parachains-smoke-test.zndsl"
+
+zombienet-polkadot-smoke-0002-parachains-parachains-upgrade-smoke:
+  extends:
+    - .zombienet-polkadot-common
+  before_script:
+    - export ZOMBIENET_INTEGRATION_TEST_IMAGE="${POLKADOT_IMAGE}":${PIPELINE_IMAGE_TAG}
+    - export COL_IMAGE="docker.io/parity/polkadot-collator:latest" # Use cumulus lastest image
+    - echo "Zombienet Tests Config"
+    - echo "gh-dir ${GH_DIR}"
+    - echo "local-dir ${LOCAL_DIR}"
+    - echo "polkadot image ${ZOMBIENET_INTEGRATION_TEST_IMAGE}"
+    - echo "colander image ${COL_IMAGE}"
+    - echo "malus image ${MALUS_IMAGE}"
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/smoke"
+      --test="0002-parachains-upgrade-smoke-test.zndsl"
+
+zombienet-polkadot-smoke-0003-deregister-register-validator:
+  extends:
+    - .zombienet-polkadot-common
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/smoke"
+      --test="0003-deregister-register-validator-smoke.zndsl"
+
+zombienet-polkadot-misc-0001-parachains-paritydb:
+  extends:
+    - .zombienet-polkadot-common
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/misc"
+      --test="0001-paritydb.zndsl"
+
+zombienet-polkadot-misc-0002-upgrade-node:
+  extends:
+    - .zombienet-polkadot-common
+  needs:
+    - job: build-push-image-malus
+      artifacts: true
+    - job: build-push-image-polkadot-debug
+      artifacts: true
+    - job: build-push-image-colander
+      artifacts: true
+    - job: build-linux-stable
+      artifacts: true
+  before_script:
+    - export ZOMBIENET_INTEGRATION_TEST_IMAGE="docker.io/parity/polkadot:latest"
+    - echo "Overrided poladot image ${ZOMBIENET_INTEGRATION_TEST_IMAGE}"
+    - export COL_IMAGE="${COLANDER_IMAGE}":${PIPELINE_IMAGE_TAG}
+    - BUILD_LINUX_JOB_ID="$(cat ./artifacts/BUILD_LINUX_JOB_ID)"
+    - export POLKADOT_PR_BIN_URL="https://gitlab-stg.parity.io/parity/mirrors/polkadot-sdk/-/jobs/${BUILD_LINUX_JOB_ID}/artifacts/raw/artifacts/polkadot"
+    - echo "Zombienet Tests Config"
+    - echo "gh-dir ${GH_DIR}"
+    - echo "local-dir ${LOCAL_DIR}"
+    - echo "polkadot image ${ZOMBIENET_INTEGRATION_TEST_IMAGE}"
+    - echo "colander image ${COL_IMAGE}"
+    - echo "malus image ${MALUS_IMAGE}"
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/misc"
+      --test="0002-upgrade-node.zndsl"
+
+zombienet-polkadot-malus-0001-dispute-valid:
+  extends:
+    - .zombienet-polkadot-common
+  variables:
+    LOCAL_DIR: "/builds/parity/mirrors/polkadot-sdk/polkadot/node/malus"
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/integrationtests"
+      --test="0001-dispute-valid-block.zndsl"

.gitlab/pipeline/zombienet/substrate.yml

@@ -0,0 +1,70 @@
+# This file is part of .gitlab-ci.yml
+# Here are all jobs that are executed during "zombienet" stage
+
+# common settings for all zombienet jobs
+.zombienet-substrate-common:
+  before_script:
+    - echo "Zombienet Tests Config"
+    - echo "${ZOMBIENET_IMAGE}"
+    - echo "${GH_DIR}"
+    - echo "${LOCAL_DIR}"
+    - export DEBUG=zombie,zombie::network-node
+    - export ZOMBIENET_INTEGRATION_TEST_IMAGE="${SUBSTRATE_IMAGE}":${SUBSTRATE_IMAGE_TAG}
+    - echo "${ZOMBIENET_INTEGRATION_TEST_IMAGE}"
+  stage: zombienet
+  image: "${ZOMBIENET_IMAGE}"
+  needs:
+    - job: build-push-image-substrate-pr
+  extends:
+    - .kubernetes-env
+    - .zombienet-refs
+  variables:
+    SUBSTRATE_IMAGE_TAG: ${DOCKER_IMAGES_VERSION}
+    SUBSTRATE_IMAGE: "docker.io/paritypr/substrate"
+    GH_DIR: "https://github.com/paritytech/substrate/tree/${CI_COMMIT_SHA}/zombienet"
+    LOCAL_DIR: "/builds/parity/mirrors/polkadot-sdk/substrate/zombienet"
+    FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR: 1
+  artifacts:
+    name: "${CI_JOB_NAME}_${CI_COMMIT_REF_NAME}"
+    when: always
+    expire_in: 2 days
+    paths:
+      - ./zombienet-logs
+  after_script:
+    - mkdir -p ./zombienet-logs
+    - cp /tmp/zombie*/logs/* ./zombienet-logs/
+  retry: 2
+  tags:
+    - zombienet-polkadot-integration-test
+
+zombienet-substrate-0000-block-building:
+  extends:
+    - .zombienet-substrate-common
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/0000-block-building"
+      --test="block-building.zndsl"
+
+zombienet-substrate-0001-basic-warp-sync:
+  extends:
+    - .zombienet-substrate-common
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/0001-basic-warp-sync"
+      --test="test-warp-sync.zndsl"
+
+zombienet-substrate-0002-validators-warp-sync:
+  extends:
+    - .zombienet-substrate-common
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/0002-validators-warp-sync"
+      --test="test-validators-warp-sync.zndsl"
+
+zombienet-substrate-0003-block-building-warp-sync:
+  extends:
+    - .zombienet-substrate-common
+  script:
+    - /home/nonroot/zombie-net/scripts/ci/run-test-local-env-manager.sh
+      --local-dir="${LOCAL_DIR}/0003-block-building-warp-sync"
+      --test="test-block-building-warp-sync.zndsl"

.gitlab/spellcheck.toml

@@ -0,0 +1,27 @@
+[hunspell]
+lang = "en_US"
+search_dirs = ["."]
+extra_dictionaries = ["lingua.dic"]
+skip_os_lookups = true
+use_builtin = true
+
+[hunspell.quirks]
+# He tagged it as 'TheGreatestOfAllTimes'
+transform_regex = [
+# `Type`'s
+	"^'([^\\s])'$",
+# 5x
+# 10.7%
+	"^[0-9_]+(?:\\.[0-9]*)?(x|%)$",
+# Transforms'
+	"^(.*)'$",
+# backslashes
+	"^\\+$",
+	"^[0-9]*+k|MB|Mb|ms|Mbit|nd|th|rd$",
+# single char `=` `>` `%` ..
+	"^=|>|<|%$",
+# 22_100
+	"^(?:[0-9]+_)+[0-9]+$"
+]
+allow_concatenation = true
+allow_dashes = true

.gitlab/test_deterministic_wasm.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+#shellcheck source=../common/lib.sh
+source "$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )/common/lib.sh"
+
+# build runtime
+WASM_BUILD_NO_COLOR=1 cargo build --verbose --release -p kusama-runtime -p polkadot-runtime -p westend-runtime
+# make checksum
+sha256sum target/release/wbuild/*-runtime/target/wasm32-unknown-unknown/release/*.wasm > checksum.sha256
+# clean up - FIXME: can we reuse some of the artifacts?
+cargo clean
+# build again
+WASM_BUILD_NO_COLOR=1 cargo build --verbose --release -p kusama-runtime -p polkadot-runtime -p westend-runtime
+# confirm checksum
+sha256sum -c checksum.sha256