Restructure ConfidentialWorkflow proto additively (no Go API break)#376
Merged
nadahalli merged 2 commits intoMay 26, 2026
Merged
Conversation
Supersedes the destructive changes in #365 and #363. Re-applies the binary_url-out-of-hash fix and the TEE additions as pure appends to the original proto, so the generated Go API is preserved and existing chainlink consumers compile unchanged. - ConfidentialWorkflowRequest.binary_url (field 3): per-node URL outside the hash envelope (the #365 fix), without dropping WorkflowExecution.binary_url, vault_don_secrets, or the SecretIdentifier message. - WorkflowExecution.requirements (field 8), ProvidedTees rpc, and ProvidedTeesResponse: additive TEE surface (from #363). - execute_request and execution_result stay bytes (no retyping). See PRIV-389.
Restores the structured sdk.v1alpha.ExecuteRequest / ExecutionResult from #363 as new fields alongside the retained bytes fields, so typed and legacy consumers coexist without an API break: - WorkflowExecution.sdk_execute_request (field 9) - ConfidentialWorkflowResponse.sdk_execution_result (field 2) Field names mirror their message types. The bytes fields (execute_request=4, execution_result=1) are unchanged, so chainlink compiles as-is. The typed and bytes fields are independent on the wire; producers populate whichever their consumer reads.
|
product-security-plaid-production
Bot
requested review from
gustavogama-cll,
jmank88 and
yashnevatia
|
The latest Buf updates on your PR. Results from workflow Regenerate Protobuf Files / buf (pull_request).
|
prashantkumar1982
approved these changes
May 26, 2026
jmank88
approved these changes
May 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-does the ConfidentialWorkflow proto changes from #365 and #363 as pure additions, so the generated Go API is preserved and existing chainlink consumers compile unchanged.
#365 and #363 renumbered and retyped fields (moved binary_url out of WorkflowExecution, dropped SecretIdentifier and vault_don_secrets, retyped execute_request/execution_result from bytes to messages). That broke the chainlink build, which cannot migrate to the new API in the available window.
This keeps the original pre-#365 shape and only appends:
execute_request (4) and execution_result (1) stay bytes. All field numbers are append-only relative to the original proto, so the wire stays compatible.
See PRIV-389.