Aditya's review PR [DO NOT MERGE]

.github/dependabot.yml

@@ -7,33 +7,12 @@ updates:
     open-pull-requests-limit: 10
 
   - package-ecosystem: gomod
-    directory: "/"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 10
-    labels:
-      - dependencies
-
-  - package-ecosystem: gomod
-    directory: "/e2e"
+    directories:
+      - "/"
+      - "/modules/light-clients/08-wasm"
+      - "/e2e"
+      - "/simapp"
     schedule:
       interval: daily
-    open-pull-requests-limit: 10
-    labels:
-      - dependencies
-
-  - package-ecosystem: gomod
-    directory: "/modules/light-clients/08-wasm"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 10
-    labels:
-      - dependencies
-
-  - package-ecosystem: gomod
-    directory: "/simapp"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 10
     labels:
       - dependencies

.github/mergify.yml

@@ -14,38 +14,6 @@ queue_rules:
     merge_method: squash
 
 pull_request_rules:
-  - name: backport patches to v0.2.x callbacks ibc-go v7.3.x branch
-    conditions:
-      - base=main
-      - label=backport-callbacks-to-v0.2.x+ibc-go-v7.3.x
-    actions:
-      backport:
-        branches:
-          - callbacks/release/v0.2.x+ibc-go-v7.3.x
-  - name: backport patches to v0.2.x callbacks ibc-go v8.0.x branch
-    conditions:
-      - base=main
-      - label=backport-callbacks-to-v0.2.x+ibc-go-v8.0.x
-    actions:
-      backport:
-        branches:
-          - callbacks/release/v0.2.x+ibc-go-v8.0.x
-  - name: backport patches to v0.4.x wasm ibc-go v7.4.x & wasmvm 1.5.x branch
-    conditions:
-      - base=main
-      - label=backport-wasm-v0.4.x+ibc-go-v7.4.x-wasmvm-v1.5.x
-    actions:
-      backport:
-        branches:
-          - 08-wasm/release/v0.4.x+ibc-go-v7.4.x-wasmvm-v1.5.x
-  - name: backport patches to v0.5.x wasm ibc-go v8.4.x & wasmvm 2.1.x branch
-    conditions:
-      - base=main
-      - label=backport-wasm-v0.5.x+ibc-go-v8.4.x-wasmvm-v2.1.x
-    actions:
-      backport:
-        branches:
-          - 08-wasm/release/v0.5.x+ibc-go-v8.4.x-wasmvm-v2.1.x
   - name: backport patches to v7.10.x branch
     conditions:
       - base=main
@@ -54,30 +22,22 @@ pull_request_rules:
       backport:
         branches:
           - release/v7.10.x
-  - name: backport patches to v8.7.x branch
-    conditions:
-      - base=main
-      - label=backport-to-v8.7.x
-    actions:
-      backport:
-        branches:
-          - release/v8.7.x
-  - name: backport patches to v10.2.x branch
+  - name: backport patches to v8.8.x branch
     conditions:
       - base=main
-      - label=backport-to-v10.2.x
+      - label=backport-to-v8.8.x
     actions:
       backport:
         branches:
-          - release/v10.2.x
-  - name: backport patches to v10.3.x branch
+          - release/v8.8.x
+  - name: backport patches to v10.4.x branch
     conditions:
       - base=main
-      - label=backport-to-v10.3.x
+      - label=backport-to-v10.4.x
     actions:
       backport:
         branches:
-          - release/v10.3.x
+          - release/v10.4.x
   - name: automerge to main with label automerge and branch protection passing
     conditions: []
     actions:

.github/workflows/build-simd-image-from-tag.yml

@@ -19,17 +19,17 @@ env:
 
 jobs:
     build-image-at-tag:
-      runs-on: depot-ubuntu-22.04-4
+      runs-on: depot-ubuntu-24.04-4
       permissions:
         packages: write
         contents: read
       steps:
-         - uses: actions/checkout@v4
+         - uses: actions/checkout@v5
            with:
             ref: "${{ env.GIT_TAG }}"
             fetch-depth: 0
          - name: Log in to the Container registry
-           uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+           uses: docker/login-action@v3
            with:
               registry: ${{ env.REGISTRY }}
               username: ${{ github.actor }}

.github/workflows/build-wasm-simd-image-from-tag.yml

@@ -28,13 +28,13 @@ jobs:
             platform: linux/arm64
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
          ref: "${{ env.GIT_TAG }}"
          fetch-depth: 0
 
       # TODO: #7885 Get rid of this script, it is super unecessary and can probably be done in the Dockerfile or a bash script
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.10'
       - name: Install dependencies
@@ -46,7 +46,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to the Container registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+        uses: docker/login-action@v3
         with:
            registry: ${{ env.REGISTRY }}
            username: ${{ github.actor }}
@@ -68,23 +68,23 @@ jobs:
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: digests-${{ matrix.os }} # If we end up running more builds on the same OS, we need to differentiate more here
           path: ${{ runner.temp }}/digests/*
           if-no-files-found: error
           retention-days: 1
 
   merge:
-    runs-on: depot-ubuntu-22.04-4
+    runs-on: depot-ubuntu-24.04-4
     permissions:
       packages: write
       contents: read
     needs:
       - build-image-at-tag
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           path: ${{ runner.temp }}/digests
           pattern: digests-*
@@ -96,7 +96,7 @@ jobs:
         run: echo "DOCKER_TAG=$(echo $GIT_TAG | sed 's/[^a-zA-Z0-9\.]/-/g')" >> $GITHUB_ENV
 
       - name: Log in to the Container registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
+        uses: docker/login-action@v3
         with:
            registry: ${{ env.REGISTRY }}
            username: ${{ github.actor }}

.github/workflows/codeql-analysis.yml

@@ -23,7 +23,7 @@ on:
 jobs:
   analyze:
     name: Analyze
-    runs-on: depot-ubuntu-22.04-4
+    runs-on: depot-ubuntu-24.04-4
     permissions:
       actions: read
       contents: read
@@ -39,7 +39,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - uses: technote-space/[email protected]
       with:
         PATTERNS: |
@@ -49,7 +49,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -62,7 +62,7 @@ jobs:
     # If this step fails, then you should remove it and run the build manually (see below)
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4
       if: env.GIT_DIFF
 
     # ℹ️ Command-line programs to run using the OS shell.
@@ -77,5 +77,5 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
       if: env.GIT_DIFF

.github/workflows/dependabot-tidy.yml

@@ -0,0 +1,47 @@
+name: Dependabot Tidy
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+
+jobs:
+  tidy:
+    if: github.actor == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
+    runs-on: depot-ubuntu-24.04-4
+    steps:
+      - name: Check out PR
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ secrets.DEPENDABOT_PUSH_PAT }}
+          fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
+
+      - name: Run make tidy-all
+        run: make tidy-all
+
+      - name: Commit changes if any
+        id: commit
+        run: |
+          if ! git diff --quiet; then
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git add .
+            git commit -m "chore: run make tidy-all"
+            echo "changed=true" >> $GITHUB_OUTPUT
+          else
+            echo "No changes after make tidy-all"
+            echo "changed=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Push changes if any
+        if: ${{ steps.commit.outputs.changed == 'true' }}
+        uses: ad-m/github-push-action@master
+        with:
+          github_token: ${{ secrets.DEPENDABOT_PUSH_PAT }}
+          branch: ${{ github.event.pull_request.head.ref }}
+          force_with_lease: true