ci: test exact filecoin-services release candidates

.github/workflows/ci_nightly.yml

@@ -1,9 +1,10 @@
 ---
 # Runs on a nightly schedule (and optionally via manual dispatch).
 #
-# Executes the full CI matrix: stability (latest tags) and frontier
-# (latest branches). Both runs file GitHub issues with their results
-# unless manually suppressed via workflow_dispatch inputs.
+# Executes the full CI matrix: stability (latest tags), frontier
+# (latest branches), and manifest-declared mixed profiles. Runs file GitHub
+# issues with their results unless manually suppressed via workflow_dispatch
+# inputs.
 
 name: CI (Nightly)
 
@@ -13,6 +14,11 @@ on:
     - cron: '0 3 * * *'
   workflow_dispatch:
     inputs:
+      filecoin_services_commit:
+        description: 'Exact filecoin-services commit to test with the stability-frontier-filecoin-services profile'
+        type: string
+        required: false
+        default: ''
       reporting:
         description: 'Create GitHub issue with scenario report'
         type: boolean
@@ -24,6 +30,7 @@ on:
 
 jobs:
   foc-devnet-test:
+    if: github.event_name != 'workflow_dispatch' || inputs.filecoin_services_commit == ''
     strategy:
       fail-fast: false
       max-parallel: 1
@@ -35,6 +42,18 @@ jobs:
           - name: frontier
             issue_label: scenarios-run-frontier
             issue_title: "FOC Devnet scenarios run report (frontier)"
+          - name: stability-frontier-lotus
+            issue_label: scenarios-run-stability-frontier-lotus
+            issue_title: "FOC Devnet scenarios run report (stability-frontier-lotus)"
+          - name: stability-frontier-curio
+            issue_label: scenarios-run-stability-frontier-curio
+            issue_title: "FOC Devnet scenarios run report (stability-frontier-curio)"
+          - name: stability-frontier-filecoin-services
+            issue_label: scenarios-run-stability-frontier-filecoin-services
+            issue_title: "FOC Devnet scenarios run report (stability-frontier-filecoin-services)"
+          - name: stability-frontier-pdp
+            issue_label: scenarios-run-stability-frontier-pdp
+            issue_title: "FOC Devnet scenarios run report (stability-frontier-pdp)"
     uses: ./.github/workflows/ci_run.yml
     with:
       name: ${{ matrix.name }}
@@ -49,3 +68,16 @@ jobs:
       issue_label: ${{ matrix.issue_label }}
       issue_title: ${{ matrix.issue_title }}
     secrets: inherit
+
+  filecoin-services-release-candidate:
+    if: github.event_name == 'workflow_dispatch' && inputs.filecoin_services_commit != ''
+    uses: ./.github/workflows/ci_run.yml
+    with:
+      name: filecoin-services-release-candidate
+      profile: stability-frontier-filecoin-services
+      filecoin_services_commit: ${{ inputs.filecoin_services_commit }}
+      enable_reporting: ${{ inputs.reporting }}
+      skip_report_on_pass: ${{ inputs.skip_report_on_pass }}
+      issue_label: scenarios-run-stability-frontier-filecoin-services
+      issue_title: "FOC Devnet scenarios run report (filecoin-services release candidate)"
+    secrets: inherit

.github/workflows/ci_run.yml

@@ -2,7 +2,7 @@
 # Reusable workflow: a single foc-devnet CI run.
 #
 # Called by ci_pull_request.yml (default config, no reporting) and
-# ci_nightly.yml (stability / frontier matrix, issue reporting enabled).
+# ci_nightly.yml (manifest-declared nightly profiles, issue reporting enabled).
 #
 # The dependency profile controls the versions of compatibility-sensitive
 # server and client components used by the run.
@@ -13,13 +13,18 @@ on:
   workflow_call:
     inputs:
       name:
-        description: 'Human-readable run name (e.g. default, stability, frontier)'
+        description: 'Human-readable run name (e.g. default, stability, frontier, stability-frontier-curio)'
         required: true
         type: string
       profile:
-        description: 'Dependency profile: default, stability, or frontier'
+        description: 'Dependency profile declared in ci/dependency-profiles.json'
         required: true
         type: string
+      filecoin_services_commit:
+        description: 'Optional exact filecoin-services commit for release-candidate validation'
+        required: false
+        type: string
+        default: ''
       enable_reporting:
         description: 'When true, file a GitHub issue with the scenario report'
         required: false
@@ -130,13 +135,20 @@ jobs:
 
     - name: "CHECK: {Resolve dependency profile}"
       id: dependencies
+      env:
+        FILECOIN_SERVICES_COMMIT: ${{ inputs.filecoin_services_commit }}
       run: |
         METADATA="$RUNNER_TEMP/ci-dependencies.json"
+        CANDIDATE_ARGS=()
+        if [[ -n "$FILECOIN_SERVICES_COMMIT" ]]; then
+          CANDIDATE_ARGS+=(--filecoin-services-commit "$FILECOIN_SERVICES_COMMIT")
+        fi
         python3 scripts/resolve-ci-dependencies.py resolve \
           --profile '${{ inputs.profile }}' \
           --output "$METADATA" \
           --github-output "$GITHUB_OUTPUT" \
-          --github-env "$GITHUB_ENV"
+          --github-env "$GITHUB_ENV" \
+          "${CANDIDATE_ARGS[@]}"
 
     # Docker images do not contain Lotus/Curio binaries, so their cache identity
     # depends only on the Docker build inputs.

README_ADVANCED.md

@@ -1333,10 +1333,14 @@ Scenarios run automatically in CI after the devnet starts. On nightly runs (or m
 CI resolves compatibility-sensitive dependencies from `ci/dependency-profiles.json`.
 Pull requests use the pinned `default` profile, while nightly `stability` runs use
 the latest final releases and nightly `frontier` runs pin current development
-branch heads to immutable commits. In `stability`, PDP comes from the stable
-filecoin-services checkout's bundled submodule; in `frontier`, PDP is pinned as
-an independent repo. The resolved metadata path is exposed to scenarios as
-`CI_DEPENDENCY_METADATA`; Synapse SDK and filecoin-pin also receive their exact
-source, version/ref, and commit through `SYNAPSE_SDK_*` and `FILECOIN_PIN_*`
-environment variables. PDP receives `PDP_SOURCE`, `PDP_REF`, and `PDP_COMMIT`
-when dependency profiles are resolved.
+branch heads to immutable commits. Nightly CI also runs manifest-declared mixed
+profiles such as `stability-frontier-curio`, where all dependencies come from
+`stability` except the named component, which comes from `frontier`. In
+`stability`, PDP is pinned to the git submodule bundled with the selected
+filecoin-services stability tag; in `frontier`, PDP is pinned as an independent
+repo. Mixed profiles that override filecoin-services keep that PDP pin instead
+of implicitly taking the overridden filecoin-services submodule. The resolved
+metadata path is exposed to scenarios as `CI_DEPENDENCY_METADATA`; Synapse SDK
+and filecoin-pin also receive their exact source, version/ref, and commit
+through `SYNAPSE_SDK_*` and `FILECOIN_PIN_*` environment variables. PDP receives
+`PDP_SOURCE`, `PDP_REF`, and `PDP_COMMIT` when dependency profiles are resolved.

ci/README.md

@@ -5,13 +5,56 @@ Its resolver is located in `scripts/resolve-ci-dependencies.py`.
 
 ## Profiles
 
-The manifest currently supports three profiles:
+The manifest declares valid profiles in its top-level `profiles` object:
 
 - `default`: used by PR CI, a known-working set of client versions.
 - `stability`: used by nightly CI to test stable releases.
 - `frontier`: used by nightly CI to test branch heads.
+- `stability-frontier-lotus`: used by nightly CI to test stable releases
+  except Lotus, which is resolved from `frontier`.
+- `stability-frontier-curio`: used by nightly CI to test stable releases
+  except Curio, which is resolved from `frontier`.
+- `stability-frontier-filecoin-services`: used by nightly CI to test stable
+  releases except filecoin-services, which is resolved from `frontier`.
+- `stability-frontier-pdp`: used by nightly CI to test stable releases except
+  PDP, which is resolved from `frontier`.
+
+Each component must define a selection for every component profile referenced by
+the top-level profile definitions. Today those component selections are
+`default`, `stability`, and `frontier`.
+
+Top-level profile definitions have a `base` component profile and can override
+specific components:
 
-Each component must define a selection for each profile.
+```json
+{
+  "stability-frontier-curio": {
+    "base": "stability",
+    "components": {
+      "curio": "frontier"
+    }
+  }
+}
+```
+
+In that example, Curio resolves from its `frontier` selection while every other
+component resolves from `stability`. A profile is valid only if it is explicitly
+declared in `profiles`; for example, `stability-frontier-filecoin-pin` does not
+exist unless added there.
+
+### Exact filecoin-services release candidates
+
+Before tagging a filecoin-services release, manually dispatch `CI (Nightly)`
+with `filecoin_services_commit` set to the full 40-character lowercase commit
+SHA. When this input is set, the workflow runs only the
+`stability-frontier-filecoin-services` profile and replaces that profile's
+filecoin-services branch selection with the requested immutable commit. All
+other selections remain on `stability`, including the independently resolved
+PDP gitlink.
+
+Run this validation before creating the new filecoin-services tag. The stable
+PDP selection is derived from the latest stable filecoin-services tag, so
+tagging first would change the compatibility baseline being tested.
 
 ## Component Fields
 
@@ -20,7 +63,7 @@ Top-level component fields:
 - `repository`: Git repository URL.
 - `npm_package`: npm package name, for components that are resolved through npm
   metadata.
-- `default`, `stability`, `frontier`: profile selections.
+- `default`, `stability`, `frontier`: component profile selections.
 
 Profile selections always have a `strategy`. Some strategies require additional
 fields.
@@ -91,6 +134,25 @@ By default, pattern selections exclude prerelease tags such as `-rc`, `-alpha`,
 }
 ```
 
+### `git_submodule`
+
+Resolve a git submodule gitlink from a tag or tag pattern in another repository.
+
+```json
+{
+  "strategy": "git_submodule",
+  "repository": "https://github.com/FilOzone/filecoin-services.git",
+  "tag": "v*",
+  "path": "service_contracts/lib/pdp"
+}
+```
+
+The resolver first resolves `repository` and `tag` with the same rules as
+`git_tag`, then reads `path` from that tree and records the submodule gitlink SHA
+as the selected component commit. PDP uses this to pin the same bundled PDP
+gitlink as the selected filecoin-services stability tag, even in mixed profiles
+that override filecoin-services itself.
+
 ### `npm_version`
 
 Resolve an npm version, range, or dist-tag to a concrete package version.

ci/dependency-profiles.json

@@ -1,5 +1,40 @@
 {
-  "schema_version": 1,
+  "schema_version": 2,
+  "profiles": {
+    "default": {
+      "base": "default"
+    },
+    "stability": {
+      "base": "stability"
+    },
+    "frontier": {
+      "base": "frontier"
+    },
+    "stability-frontier-lotus": {
+      "base": "stability",
+      "components": {
+        "lotus": "frontier"
+      }
+    },
+    "stability-frontier-curio": {
+      "base": "stability",
+      "components": {
+        "curio": "frontier"
+      }
+    },
+    "stability-frontier-filecoin-services": {
+      "base": "stability",
+      "components": {
+        "filecoin-services": "frontier"
+      }
+    },
+    "stability-frontier-pdp": {
+      "base": "stability",
+      "components": {
+        "pdp": "frontier"
+      }
+    }
+  },
   "components": {
     "lotus": {
       "repository": "https://github.com/filecoin-project/lotus.git",
@@ -49,7 +84,10 @@
         "strategy": "config_default"
       },
       "stability": {
-        "strategy": "config_default"
+        "strategy": "git_submodule",
+        "repository": "https://github.com/FilOzone/filecoin-services.git",
+        "tag": "v*",
+        "path": "service_contracts/lib/pdp"
       },
       "frontier": {
         "strategy": "git_branch",