Support ICA MsgRequestAction (app_pubkey validation, signature verification, and action_id/status responses)

.github/workflows/release.yml

@@ -155,7 +155,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
 
@@ -195,7 +195,7 @@ jobs:
           echo "tarball_prefix=${repo_name}_${{ steps.tag_info.outputs.tag_name }}" >> $GITHUB_OUTPUT
 
       - name: Download Release Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v6
         with:
           name: release-artifacts
           path: release
@@ -205,7 +205,7 @@ jobs:
           ls -R release
 
       - name: Publish the Release
-        uses: softprops/action-gh-release@v0.1.15
+        uses: softprops/action-gh-release@v2
         if: success()
         with:
           tag_name: ${{ steps.tag_info.outputs.tag_name }}

.github/workflows/systemtests.yaml

@@ -13,29 +13,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
 
       - name: Configure Git Safe Directory
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
-      - name: Get Go version from toolchain
-        id: go-version
-        run: |
-          TOOLCHAIN_VERSION=$(grep -E '^toolchain go[0-9]+\.[0-9]+(\.[0-9]+)?$' go.mod | cut -d ' ' -f 2 | sed 's/^go//')
-          if [ -n "$TOOLCHAIN_VERSION" ]; then
-            echo "version=$TOOLCHAIN_VERSION" >> "$GITHUB_OUTPUT"
-          else
-            GO_VERSION=$(grep -E '^go [0-9]+\.[0-9]+(\.[0-9]+)?$' go.mod | cut -d ' ' -f 2)
-            echo "version=$GO_VERSION" >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: ${{ steps.go-version.outputs.version }}
-          cache: true
+        uses: ./.github/actions/setup-go
 
       - name: Install Specific Ignite CLI Version
         run: |
@@ -56,8 +42,7 @@ jobs:
           chmod +x ignite
           # Ignite CLI is now available at ./ignite
 
-      - name: Build Chain 
-
+      - name: Build Chain
         run: |
           ./ignite chain build -y -t linux:amd64
         env:

.github/workflows/test.yml

@@ -14,12 +14,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.24.4'
+        uses: ./.github/actions/setup-go
 
       - name: Copy claims.csv to home directory
         run: cp claims.csv $HOME/
@@ -42,12 +40,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.24.4'
+        uses: ./.github/actions/setup-go
 
       - name: Copy claims.csv to home directory
         run: cp claims.csv $HOME/
@@ -71,12 +67,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: '1.24.4'
+        uses: ./.github/actions/setup-go
 
       - name: Copy claims.csv to home directory
         run: cp claims.csv $HOME/
@@ -95,4 +89,4 @@ jobs:
           GOMAXPROCS: 2
           IGNITE_TELEMETRY_CONSENT: "no"
         run: |
-          go test -v -benchmem -run=^$ -bench ^BenchmarkSimulation -cpuprofile cpu.out ./app -Commit=true
+          go test -v -benchmem -run=^$ -bench ^BenchmarkSimulation -cpuprofile cpu.out ./app -Commit=true

Makefile

@@ -9,6 +9,7 @@ BUF ?= buf
 GOLANGCI_LINT ?= golangci-lint
 BUILD_DIR ?= build
 RELEASE_DIR ?= release
+GOPROXY ?= https://proxy.golang.org,direct
 
 module_version = $(strip $(shell EMSDK_QUIET=1 ${GO} list -m -f '{{.Version}}' $1 | tail -n 1))
 IGNITE_INSTALL_SCRIPT ?= https://get.ignite.com/cli!
@@ -25,6 +26,8 @@ GRPC_GATEWAY_V2_VERSION := $(call module_version,github.com/grpc-ecosystem/grpc-
 GO_TOOLS_VERSION := $(call module_version,golang.org/x/tools)
 GRPC_VERSION := $(call module_version,google.golang.org/grpc)
 PROTOBUF_VERSION := $(call module_version,google.golang.org/protobuf)
+GOCACHE := $(shell ${GO} env GOCACHE)
+GOMODCACHE := $(shell ${GO} env GOMODCACHE)
 
 TOOLS := \
 	github.com/bufbuild/buf/cmd/buf@latest \
@@ -66,7 +69,8 @@ clean-cache:
 	${BUF} clean || true
 	rm -rf ~/.cache/buf || true
 	@echo "Cleaning Go build cache..."
-	${GO} clean -cache -modcache -i -r
+	${GO} clean -cache -modcache -i -r || true
+	rm -rf ${GOCACHE} ${GOMODCACHE} || true
 
 PROTO_SRC := $(shell find proto -name "*.proto")
 GO_SRC := $(shell find app -name "*.go") \
@@ -75,7 +79,7 @@ GO_SRC := $(shell find app -name "*.go") \
 	$(shell find config -name "*.go") \
 	$(shell find x -name "*.go")
 
-build-proto: clean-proto clean-cache $(PROTO_SRC)
+build-proto: clean-proto $(PROTO_SRC)
 	@echo "Processing proto files..."
 	${BUF} generate --template proto/buf.gen.gogo.yaml --verbose
 	${BUF} generate --template proto/buf.gen.swagger.yaml --verbose
@@ -85,8 +89,8 @@ build: build/lumerad
 
 go.sum: go.mod
 	@echo "Verifying and tidying go modules..."
-	${GO} mod verify
-	${GO} mod tidy
+	GOPROXY=${GOPROXY} ${GO} mod verify
+	GOPROXY=${GOPROXY} ${GO} mod tidy
 
 build/lumerad: $(GO_SRC) go.sum Makefile
 	@echo "Building lumerad binary..."

app/ibc.go

@@ -1,21 +1,27 @@
 package app
 
 import (
+	"context"
 	"errors"
 
-	"cosmossdk.io/core/appmodule"	
+	"cosmossdk.io/core/appmodule"
 	storetypes "cosmossdk.io/store/types"
 
 	"github.com/cosmos/cosmos-sdk/codec"
 	"github.com/cosmos/cosmos-sdk/runtime"
 	servertypes "github.com/cosmos/cosmos-sdk/server/types"
+	sdk "github.com/cosmos/cosmos-sdk/types"
 	"github.com/cosmos/cosmos-sdk/types/module"
+	authkeeper "github.com/cosmos/cosmos-sdk/x/auth/keeper"
 	authtypes "github.com/cosmos/cosmos-sdk/x/auth/types"
 	govtypes "github.com/cosmos/cosmos-sdk/x/gov/types"
 	paramstypes "github.com/cosmos/cosmos-sdk/x/params/types"
 
 	lcfg "github.com/LumeraProtocol/lumera/config"
 
+	pfm "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v10/packetforward"
+	pfmkeeper "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v10/packetforward/keeper"
+	pfmtypes "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v10/packetforward/types"
 	icamodule "github.com/cosmos/ibc-go/v10/modules/apps/27-interchain-accounts"
 	icacontroller "github.com/cosmos/ibc-go/v10/modules/apps/27-interchain-accounts/controller"
 	icacontrollerkeeper "github.com/cosmos/ibc-go/v10/modules/apps/27-interchain-accounts/controller/keeper"
@@ -37,15 +43,12 @@ import (
 	ibcapi "github.com/cosmos/ibc-go/v10/modules/core/api"
 	ibcexported "github.com/cosmos/ibc-go/v10/modules/core/exported"
 	ibckeeper "github.com/cosmos/ibc-go/v10/modules/core/keeper"
-	pfm "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v10/packetforward"
-	pfmkeeper "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v10/packetforward/keeper"
-	pfmtypes "github.com/cosmos/ibc-apps/middleware/packet-forward-middleware/v10/packetforward/types"
 	solomachine "github.com/cosmos/ibc-go/v10/modules/light-clients/06-solomachine"
 	ibctm "github.com/cosmos/ibc-go/v10/modules/light-clients/07-tendermint"
 
 	// this line is used by starport scaffolding # ibc/app/import
-	wasmtypes "github.com/CosmWasm/wasmd/x/wasm/types"
 	wasmkeeper "github.com/CosmWasm/wasmd/x/wasm/keeper"
+	wasmtypes "github.com/CosmWasm/wasmd/x/wasm/types"
 )
 
 // registerIBCModules register IBC keepers and non dependency inject modules.
@@ -150,10 +153,10 @@ func (app *App) registerIBCModules(
 	// Create Transfer Stack
 	var ibcv1transferStack ibcporttypes.IBCModule
 	ibcv1transferStack = ibctransfer.NewIBCModule(app.TransferKeeper)
-    // callbacks wraps the transfer stack as its base app, and uses PacketForwardKeeper as the ICS4Wrapper
-    // i.e. packet-forward-middleware is higher on the stack and sits between callbacks and the ibc channel keeper
-    // Since this is the lowest level middleware of the transfer stack, it should be the first entrypoint for transfer keeper's
-    // WriteAcknowledgement.	
+	// callbacks wraps the transfer stack as its base app, and uses PacketForwardKeeper as the ICS4Wrapper
+	// i.e. packet-forward-middleware is higher on the stack and sits between callbacks and the ibc channel keeper
+	// Since this is the lowest level middleware of the transfer stack, it should be the first entrypoint for transfer keeper's
+	// WriteAcknowledgement.
 	ibccbStack := ibccallbacks.NewIBCMiddleware(
 		ibcv1transferStack,
 		app.PacketForwardKeeper,
@@ -205,8 +208,8 @@ func (app *App) registerIBCModules(
 		AddRoute(wasmtypes.ModuleName, wasmStackIBCHandler).
 		AddRoute(icacontrollertypes.SubModuleName, icaControllerStack).
 		AddRoute(icahosttypes.SubModuleName, icaHostStack)
-// TODO: Uncomment the following line when the IBC module for the action module is implemented
-//		AddRoute(actiontypes.ModuleName, actionIBCModule)
+		// TODO: Uncomment the following line when the IBC module for the action module is implemented
+		//		AddRoute(actiontypes.ModuleName, actionIBCModule)
 
 	// Additional IBC modules can be registered here
 	if v := appOpts.Get(IBCModuleRegisterFnOption); v != nil {
@@ -268,3 +271,19 @@ func RegisterIBC(cdc codec.Codec) map[string]appmodule.AppModule {
 
 	return modules
 }
+
+// isInterchainAccount reports whether the provided account is an ICA account.
+// Useful for modules that need to branch behavior for ICS-27-controlled accounts.
+func isInterchainAccount(account sdk.AccountI) bool {
+	_, ok := account.(*icatypes.InterchainAccount)
+	return ok
+}
+
+// isInterchainAccountAddr reports whether the address resolves to an ICA account.
+func isInterchainAccountAddr(ctx context.Context, ak authkeeper.AccountKeeper, addr sdk.AccAddress) bool {
+	acct := ak.GetAccount(ctx, addr)
+	if acct == nil {
+		return false
+	}
+	return isInterchainAccount(acct)
+}

app/ibc_test.go

@@ -0,0 +1,85 @@
+package app
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"cosmossdk.io/log"
+	"cosmossdk.io/store"
+	"cosmossdk.io/store/metrics"
+	storetypes "cosmossdk.io/store/types"
+	testaccounts "github.com/LumeraProtocol/lumera/testutil/accounts"
+	cmtproto "github.com/cometbft/cometbft/proto/tendermint/types"
+	dbm "github.com/cosmos/cosmos-db"
+	"github.com/cosmos/cosmos-sdk/codec"
+	sdkaddress "github.com/cosmos/cosmos-sdk/codec/address"
+	codectypes "github.com/cosmos/cosmos-sdk/codec/types"
+	"github.com/cosmos/cosmos-sdk/runtime"
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	authkeeper "github.com/cosmos/cosmos-sdk/x/auth/keeper"
+	authtypes "github.com/cosmos/cosmos-sdk/x/auth/types"
+	icatypes "github.com/cosmos/ibc-go/v10/modules/apps/27-interchain-accounts/types"
+)
+
+func TestIsInterchainAccount(t *testing.T) {
+	// Non-ICA account should be false
+	baseAcc := authtypes.NewBaseAccountWithAddress(sdk.MustAccAddressFromBech32(testaccounts.TestAddress1))
+	require.False(t, isInterchainAccount(baseAcc))
+
+	// ICA account should be true
+	ica := icatypes.NewInterchainAccount(baseAcc, "owner")
+	require.True(t, isInterchainAccount(ica))
+}
+
+func TestIsInterchainAccountAddr(t *testing.T) {
+	// build a minimal auth keeper with two accounts: one regular, one ICA
+	ctx, ak := makeTestAccountKeeper(t)
+
+	// add an ICA account
+	icaBase := authtypes.NewBaseAccountWithAddress(sdk.MustAccAddressFromBech32(testaccounts.TestAddress2))
+	_ = ak.NewAccount(ctx, icaBase)
+	ica := icatypes.NewInterchainAccount(icaBase, "owner")
+	ak.SetAccount(ctx, ica)
+	// add a regular account
+	regAcc := authtypes.NewBaseAccountWithAddress(sdk.MustAccAddressFromBech32(testaccounts.TestAddress1))
+	_ = ak.NewAccount(ctx, regAcc)
+	ak.SetAccount(ctx, regAcc)
+
+	// regular account: false
+	require.False(t, isInterchainAccountAddr(ctx, ak, sdk.MustAccAddressFromBech32(testaccounts.TestAddress1)))
+	// ICA account: true
+	require.True(t, isInterchainAccountAddr(ctx, ak, sdk.MustAccAddressFromBech32(testaccounts.TestAddress2)))
+	// unknown address: false
+	require.False(t, isInterchainAccountAddr(ctx, ak, sdk.AccAddress("unknown-addr-0000000000")))
+}
+
+func makeTestAccountKeeper(t *testing.T) (sdk.Context, authkeeper.AccountKeeper) {
+	t.Helper()
+
+	storeKey := storetypes.NewKVStoreKey(authtypes.StoreKey)
+	db := dbm.NewMemDB()
+	cms := store.NewCommitMultiStore(db, log.NewNopLogger(), metrics.NewNoOpMetrics())
+	cms.MountStoreWithDB(storeKey, storetypes.StoreTypeIAVL, db)
+	require.NoError(t, cms.LoadLatestVersion())
+
+	storeService := runtime.NewKVStoreService(storeKey)
+
+	ir := codectypes.NewInterfaceRegistry()
+	authtypes.RegisterInterfaces(ir)
+	icatypes.RegisterInterfaces(ir)
+	cdc := codec.NewProtoCodec(ir)
+
+	ak := authkeeper.NewAccountKeeper(
+		cdc,
+		storeService,
+		authtypes.ProtoBaseAccount,
+		map[string][]string{},
+		sdkaddress.NewBech32Codec("lumera"),
+		"lumera",
+		"",
+	)
+
+	ctx := sdk.NewContext(cms, cmtproto.Header{}, false, log.NewNopLogger())
+	return ctx, ak
+}