feat(ic-admin): Added propose-to-update-standard-engine-replica-version subcommand.

[daniel-wong-dfinity-org-twin]

👈 Previous PR

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to a514985.

Security Overview

• 🔎 Scanned files: 1 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/f975f1a5-0a47-4a3b-b7f0-a55609e90390?scanId=d02b8212-f49f-492b-ac23-3c2b1f83d77e&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► rs/registry/admin/bin/main.rs     Add ProposeToUpdateStandardEngineReplicaVersion sub-command and related CLI parsing ► rs/registry/admin/bin/main.rs     Handle ProposeToUpdateStandardEngineReplicaVersion in main match and action routing ► rs/registry/admin/bin/main.rs     Implement ProposeToUpdateStandardEngineReplicaVersionCmd with fields new_replica_version_id, old_replica_version_id, deployment_progress ► rs/registry/admin/bin/main.rs     Provide ProposalTitle implementation for the new sub-command ► rs/registry/admin/bin/main.rs     Provide ProposalAction implementation to construct UpdateStandardEngineReplicaVersion action

Only tool changed, no canister behavior change.

[Copilot]

Pull request overview

Adds support in ic-admin for submitting the new governance proposal type UpdateStandardEngineReplicaVersion, enabling operators to propose rolling out a new replica version across a fraction of Cloud Engines.

Changes:

• Introduces a new ic-admin subcommand: propose-to-update-standard-engine-replica-version.
• Implements default proposal title generation and maps CLI flags into ProposalActionRequest::UpdateStandardEngineReplicaVersion.
• Wires the new subcommand into the main CLI dispatch.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bjoernek]

title() — deployment_progress * 100.0 is interpolated with {}, so some inputs render with float noise in the voter-facing title: 0.07 → "7.000000000000001%", 0.29 → "28.999999999999996%", 0.55 → "55.00000000000001%". Since this becomes the on-chain proposal title (used whenever --proposal-title isn't supplied), suggest {:.1} (→ "7.0", "29.0", "55.0") or {:.0}.

[bjoernek]

Should ProposeToUpdateStandardEngineReplicaVersion also be added to the secret_key_pem / use_hsm allowlist (the match at main.rs:4602, alongside e.g. ProposeToFulfillSubnetRentalRequest)? As far as I can tell, invoking the new command with either production signing method would fall through to the wildcard panic! ("...only supported for methods that interact with NNS handlers"), and an anonymous invocation can't submit a proposal, so I'm not sure how it would be used outside test-neuron flows. Am I missing something?

Somewhat related: ProposeToBlessAlternativeGuestOsVersion looks like it's also absent from that allowlist on master, so maybe these newer commands are intentionally meant to bypass it? Would be good to understand the intended invocation path.

[daniel-wong-dfinity-org-twin]

re formatting: Done.

[daniel-wong-dfinity-org-twin]

re allowlist: Done.

[daniel-wong-dfinity-org-twin]

Now that the previous PR is in, I rebased and force pushed this. Will set to merge when ready after stripping DO NOT MERGE from the title.