Confidential relay types, WorkflowExecution proto fields, and package move by nadahalli · Pull Request #1903 · smartcontractkit/chainlink-common

nadahalli · 2026-03-17T14:52:14Z

Summary

Adds WorkflowOwner and WorkflowExecutionID to SecretsRequestParams. The relay DON handler needs these to build a valid vault secrets.get request (owner matching and execution ID validation).
Removes MasterPublicKey and Threshold from SecretsResponseResult. The enclave has both from its own config (EnclaveConfig.MasterPublicKey and EnclaveConfig.T, populated from on-chain DON config after DKG). The relay handler is a pass-through for encrypted shares only.
Bumps chainlink-protos (cre/go/v1alpha.23) and regenerates WorkflowExecution proto. Adds Owner and ExecutionId fields so workflow-level context flows inside the app-specific proto rather than the generic ComputeRequest type (per vreff's feedback on CC PR Add tests for reading an event #277).

Part of the remote-only secret fetching work where the enclave fetches secrets dynamically at runtime via enclave -> gateway -> relay DON -> VaultDON.

github-actions · 2026-03-17T14:52:27Z

👋 nadahalli, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

github-actions · 2026-03-17T14:53:30Z

⚠️ API Diff Results - `github.com/smartcontractkit/chainlink-common`

⚠️ Breaking Changes (1)

`package github` (1)

com/smartcontractkit/chainlink-common/pkg/capabilities/actions/confidentialrelay — 🗑️ Removed

✅ Compatible Changes (5)

`package github` (1)

com/smartcontractkit/chainlink-common/pkg/capabilities/v2/actions/confidentialrelay — ➕ Added

`pkg/capabilities/v2/actions/confidentialworkflow.(*WorkflowExecution)` (2)

GetExecutionId — ➕ Added
GetOwner — ➕ Added

`pkg/capabilities/v2/actions/confidentialworkflow.WorkflowExecution` (2)

ExecutionId — ➕ Added
Owner — ➕ Added

📄 View full apidiff report

Copilot

Pull request overview

Updates the confidential relay protocol request type so the relay DON handler can include workflow ownership and execution metadata when building a vault secrets.get request.

Changes:

Extend SecretsRequestParams with WorkflowOwner.
Extend SecretsRequestParams with WorkflowExecutionID.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/capabilities/actions/confidentialrelay/types.go

-	Attestation      string             `json:"attestation,omitempty"`
+	WorkflowID          string             `json:"workflow_id"`
+	WorkflowOwner       string             `json:"workflow_owner"`
+	WorkflowExecutionID string             `json:"workflow_execution_id"`


…ublicKey/Threshold from response SecretsRequestParams: added WorkflowOwner and WorkflowExecutionID. The relay DON handler needs these to build a valid vault secrets.get request (owner matching, execution ID validation). SecretsResponseResult: removed MasterPublicKey and Threshold. The enclave uses its own config for both (EnclaveConfig.MasterPublicKey and EnclaveConfig.T from on-chain DON config, populated after DKG). The relay handler is a pass-through for encrypted shares only.

prashantkumar1982 · 2026-03-17T22:26:49Z

pkg/capabilities/actions/confidentialrelay/types.go

-	EnclavePublicKey string             `json:"enclave_public_key"`
-	Attestation      string             `json:"attestation,omitempty"`
+	WorkflowID          string             `json:"workflow_id"`
+	WorkflowOwner       string             `json:"workflow_owner"`                // Ethereum address (hex, 0x-prefixed)


We explicitly removed Owner from SecretIdentifier.

Is this field accessible or settable by the customer/user?

This field should be only set by our internal framework, and not the user.

Further, going forward, we will change the workflow owner to org_id as owner, so even if we need this, i would prefer to name it as owner

This field is set by the enclave from attested workflow metadata. The user never touches it. The plumbing is: CRE engine populates WorkflowOwner from the on-chain workflow spec, the enclave includes it in the relay request, and VaultDON uses it to enforce that secret owners match (the check in capability.go lines 113-121 in core).

I can change the name to just owner if that's the preferred direction wrto the org_id migration. The semantics stay the same either way.

Yes, owner name is better going forward.

Adds Owner and ExecutionId fields to WorkflowExecution proto. These carry workflow-level context in the app-specific proto rather than the generic ComputeRequest type. chainlink-protos: cre/go/v1alpha.23

Aligns with confidentialworkflow which is already under v2/actions/. Downstream consumers (CC remote_dispatcher, chainlink relay handler) need to update their import paths.

vreff · 2026-03-19T12:25:11Z

Looks like there is failing CI. Also is this an action? Does it go in that folder?

nadahalli · 2026-03-19T12:26:25Z

Looks like there is failing CI. Also is this an action? Does it go in that folder?

failing CI is for some other unrelated thing. Not our changes. Not sure how to fix that.

nadahalli · 2026-03-19T12:27:45Z

Looks like there is failing CI. Also is this an action? Does it go in that folder?

And no, it's not an action. It stays in capabilities. If it has to move, it can be a TODO for after the release.

nadahalli requested a review from a team as a code owner March 17, 2026 14:52

Copilot AI review requested due to automatic review settings March 17, 2026 14:52

nadahalli temporarily deployed to integration March 17, 2026 14:52 — with GitHub Actions Inactive

product-security-plaid-production bot requested a review from ilija42 March 17, 2026 14:52

Copilot started reviewing on behalf of nadahalli March 17, 2026 14:53 View session

Copilot AI reviewed Mar 17, 2026

View reviewed changes

pkg/capabilities/actions/confidentialrelay/types.go Outdated

Attestation string `json:"attestation,omitempty"`

WorkflowID string `json:"workflow_id"`

WorkflowOwner string `json:"workflow_owner"`

WorkflowExecutionID string `json:"workflow_execution_id"`

nadahalli force-pushed the tejaswi/relay-secrets-params branch from 6ca4d25 to acb562e Compare March 17, 2026 15:05

nadahalli had a problem deploying to integration March 17, 2026 15:06 — with GitHub Actions Error

nadahalli changed the title ~~Add WorkflowOwner and WorkflowExecutionID to SecretsRequestParams~~ Update confidential relay protocol types for remote-only secret fetching Mar 17, 2026

nadahalli force-pushed the tejaswi/relay-secrets-params branch from acb562e to f480e53 Compare March 17, 2026 15:08

nadahalli requested a review from a team March 17, 2026 15:09

nadahalli temporarily deployed to integration March 17, 2026 15:09 — with GitHub Actions Inactive

pavel-raykov previously approved these changes Mar 17, 2026

View reviewed changes

DylanTinianov previously approved these changes Mar 17, 2026

View reviewed changes

prashantkumar1982 requested changes Mar 17, 2026

View reviewed changes

Bump chainlink-protos and regenerate confidential workflow types

266ee91

Adds Owner and ExecutionId fields to WorkflowExecution proto. These carry workflow-level context in the app-specific proto rather than the generic ComputeRequest type. chainlink-protos: cre/go/v1alpha.23

nadahalli dismissed stale reviews from DylanTinianov and pavel-raykov via 266ee91 March 18, 2026 23:52

nadahalli had a problem deploying to integration March 18, 2026 23:52 — with GitHub Actions Failure

nadahalli had a problem deploying to integration March 18, 2026 23:52 — with GitHub Actions Error

nadahalli had a problem deploying to integration March 18, 2026 23:57 — with GitHub Actions Error

nadahalli changed the title ~~Update confidential relay protocol types for remote-only secret fetching~~ Confidential relay types, WorkflowExecution proto fields, and package move Mar 18, 2026

nadahalli force-pushed the tejaswi/relay-secrets-params branch from 592cd48 to 6976732 Compare March 18, 2026 23:59

nadahalli had a problem deploying to integration March 19, 2026 00:00 — with GitHub Actions Error

nadahalli temporarily deployed to integration March 19, 2026 00:01 — with GitHub Actions Inactive

nadahalli had a problem deploying to integration March 19, 2026 00:01 — with GitHub Actions Error

Move confidentialrelay types to v2/actions/ for consistency

7ad0308

Aligns with confidentialworkflow which is already under v2/actions/. Downstream consumers (CC remote_dispatcher, chainlink relay handler) need to update their import paths.

nadahalli force-pushed the tejaswi/relay-secrets-params branch from 65d4840 to 7ad0308 Compare March 19, 2026 00:06

nadahalli requested review from a team as code owners March 19, 2026 00:06

product-security-plaid-production bot requested a review from fernandofederico1984 March 19, 2026 00:06

nadahalli temporarily deployed to integration March 19, 2026 00:06 — with GitHub Actions Inactive

nadahalli had a problem deploying to integration March 19, 2026 00:06 — with GitHub Actions Failure

prashantkumar1982 approved these changes Mar 19, 2026

View reviewed changes

DylanTinianov approved these changes Mar 19, 2026

View reviewed changes

Merge branch 'main' into tejaswi/relay-secrets-params

259a5a1

nadahalli had a problem deploying to integration March 19, 2026 09:00 — with GitHub Actions Failure

nadahalli temporarily deployed to integration March 19, 2026 09:00 — with GitHub Actions Inactive

vreff approved these changes Mar 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Confidential relay types, WorkflowExecution proto fields, and package move#1903

Confidential relay types, WorkflowExecution proto fields, and package move#1903
nadahalli wants to merge 5 commits intomainfrom
tejaswi/relay-secrets-params

nadahalli commented Mar 17, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

prashantkumar1982 Mar 17, 2026

Uh oh!

nadahalli Mar 18, 2026

Uh oh!

prashantkumar1982 Mar 18, 2026

Uh oh!

vreff commented Mar 19, 2026

Uh oh!

nadahalli commented Mar 19, 2026

Uh oh!

nadahalli commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

nadahalli commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

github-actions bot commented Mar 17, 2026

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ API Diff Results - github.com/smartcontractkit/chainlink-common

⚠️ Breaking Changes (1)

package github (1)

✅ Compatible Changes (5)

package github (1)

pkg/capabilities/v2/actions/confidentialworkflow.(*WorkflowExecution) (2)

pkg/capabilities/v2/actions/confidentialworkflow.WorkflowExecution (2)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

prashantkumar1982 Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

nadahalli Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

prashantkumar1982 Mar 18, 2026

Choose a reason for hiding this comment

Uh oh!

vreff commented Mar 19, 2026

Uh oh!

nadahalli commented Mar 19, 2026

Uh oh!

nadahalli commented Mar 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

nadahalli commented Mar 17, 2026 •

edited

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

⚠️ API Diff Results - `github.com/smartcontractkit/chainlink-common`

`package github` (1)

`package github` (1)

`pkg/capabilities/v2/actions/confidentialworkflow.(*WorkflowExecution)` (2)

`pkg/capabilities/v2/actions/confidentialworkflow.WorkflowExecution` (2)