From 8718a7a43c9a8689a33aa88117ad53015f24efcd Mon Sep 17 00:00:00 2001
From: Jordan Krage <jmank88@gmail.com>
Date: Mon, 25 Nov 2024 17:11:16 -0600
Subject: [PATCH 1/2] deployment: add context lint rules

---
 deployment/.golangci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/deployment/.golangci.yml b/deployment/.golangci.yml
index 0268ba7beaa..4a2e2b4a47c 100644
--- a/deployment/.golangci.yml
+++ b/deployment/.golangci.yml
@@ -10,6 +10,9 @@ linters:
     - misspell
     - rowserrcheck
     - errorlint
+    - containedctx
+    - fatcontext
+    - noctx
 linters-settings:
   exhaustive:
     default-signifies-exhaustive: true

From d037ce60e63cd4db2fa567550dd9050c540aaff3 Mon Sep 17 00:00:00 2001
From: Alexandr Yepishev <alexandr.yepishev@smartcontract.com>
Date: Tue, 26 Nov 2024 10:08:29 +0000
Subject: [PATCH 2/2] Update golanci-lint-action to scan all affected
 directories and correctly upload reports

Update golangci-lint action to go through all dirs if no working directory set

Update paths to linter reports

Restore producing test coverage report for each unit test run

Remove test files fail_test.go and polished the workflows

Get list of affected files

Map affected files to modules

Update lint working directory for uploading step

Update lint working directory for uploading step

Removed duplicated runs of golangci-lint

Move running tests for core/scripts module to ci-core.yaml workflow

Remove test files

Move validation of golangci results to a non-matrix job

Add filter for affected files in core/scripts. Move related tests to a separate job

Update SonarQube to pick up coverage reports for core/scripts test runs
---
 .github/actions/golangci-lint/action.yml      |  60 +++++--
 .../scripts/map-affected-files-to-modules.sh  |  50 ++++++
 .github/workflows/ci-core.yml                 | 147 ++++++++++++++----
 .github/workflows/ci-scripts.yml              |  41 -----
 .github/workflows/integration-tests.yml       |  50 +-----
 ...cability.yml => solidity-traceability.yml} |   2 +-
 .gitignore                                    |   3 +-
 .golangci.yml                                 |   1 +
 .tool-versions                                |   3 +-
 GNUmakefile                                   |   2 +-
 tools/bin/go_core_scripts_tests               |  36 +++++
 tools/bin/go_core_tests                       |   2 +-
 12 files changed, 262 insertions(+), 135 deletions(-)
 create mode 100755 .github/scripts/map-affected-files-to-modules.sh
 delete mode 100644 .github/workflows/ci-scripts.yml
 rename .github/workflows/{solidity-tracability.yml => solidity-traceability.yml} (99%)
 create mode 100755 tools/bin/go_core_scripts_tests

diff --git a/.github/actions/golangci-lint/action.yml b/.github/actions/golangci-lint/action.yml
index 20ad2689deb..22a35682c2d 100644
--- a/.github/actions/golangci-lint/action.yml
+++ b/.github/actions/golangci-lint/action.yml
@@ -27,11 +27,13 @@ runs:
       if: github.event_name == 'merge_group'
       with:
         fetch-depth: 0
+
     - name: Checkout repo
       uses: actions/checkout@v4.2.1
       if: github.event_name != 'merge_group'
       with:
         fetch-depth: 1
+
     - name: Setup Go
       uses: ./.github/actions/setup-go
       with:
@@ -39,38 +41,66 @@ runs:
         cache-version: ${{ inputs.cache-version }}
         go-version-file: ${{ inputs.go-version-file }}
         go-module-file: ${{ inputs.go-module-file }}
+
     - name: Touching core/web/assets/index.html
       shell: bash
       run: mkdir -p core/web/assets && touch core/web/assets/index.html
-    - name: Build binary
-      working-directory: ${{ inputs.go-directory }}
-      shell: bash
-      run: go build ./...
-    - name: Set golangci-lint working directory
+
+    - name: Set Golangci-lint working directory
       shell: bash
       id: set-working-directory
       # XXX: Don't use `.` default working directory here due to issues with the golangci-lint-action.
       run: |
         if [ "${{ inputs.go-directory }}" == "." ]; then
-          echo "golangci-lint-working-directory=" | tee -a $GITHUB_OUTPUT
+          echo "golangci-lint-working-directory=" >> $GITHUB_OUTPUT
         else
-          echo "golangci-lint-working-directory=${{ inputs.go-directory }}" | tee -a $GITHUB_OUTPUT
+          echo "golangci-lint-working-directory=${{ inputs.go-directory }}/" >> $GITHUB_OUTPUT
         fi
-    - name: golangci-lint
+
+    - name: Golangci-lint
       uses: golangci/golangci-lint-action@38e1018663fa5173f3968ea0777460d3de38f256 # v5.3.0
       with:
-        version: v1.61.0
+        version: v1.62.2
         only-new-issues: true
         args: --out-format colored-line-number,checkstyle:golangci-lint-report.xml
         working-directory: ${{ steps.set-working-directory.outputs.golangci-lint-working-directory }}
-    - name: Print lint report artifact
+
+    - name: Print Golangci-lint report results
       if: failure()
       shell: bash
-      run: cat ${{ inputs.go-directory }}/golangci-lint-report.xml
-    - name: Store lint report artifact
+      run: cat ./${{ steps.set-working-directory.outputs.golangci-lint-working-directory }}golangci-lint-report.xml
+
+      # Get a valid name for the upload-artifact step.
+      # Avoid error: `The artifact name is not valid: <path>/<to>/<artifact>/` caused by `/`.
+      # Remove trailing `/` from the directory name: `core/scripts/` -> `core/scripts`.
+      # Replace remaining `/` with `-`: `core/scripts` -> `core-scripts`.
+      # Assign `root` if the directory name is empty (ref: step.id: set-working-directory).
+    - name: Get valid suffix for artifact name
+      if: always()
+      id: suffix
+      shell: bash
+      run: |
+        go_directory=${{ steps.set-working-directory.outputs.golangci-lint-working-directory }}
+        echo "Validating if directory name '$go_directory' is empty or has slashes"
+        
+        if [[ $go_directory == *\/* ]]; then
+            suffix=$(echo "$go_directory" | sed 's:\/$::' | tr '/' '-')
+            echo "Directory name with slashes '$go_directory' updated to a valid artifact suffix '$suffix'"
+        elif [[ $go_directory == "" ]]; then
+          suffix="root"
+          echo "Root directory (empty string) updated to a valid artifact suffix '$suffix'"
+        else
+          suffix="$go_directory"
+          echo "Directory name is valid for the artifact suffix: '$suffix'"
+        fi
+
+        echo "suffix=${suffix}" >> $GITHUB_OUTPUT
+
+    - name: Store Golangci-lint report artifact
       if: always()
       uses: actions/upload-artifact@v4.4.3
       with:
-        name: golangci-lint-report
-        path: ${{ inputs.go-directory }}/golangci-lint-report.xml
-        retention-days: 7
+        # Use a unique suffix for each lint report artifact to avoid duplication errors
+        name: golangci-lint-report-${{ steps.suffix.outputs.suffix }}
+        # N/B: value may be empty (no slash) OR `<path>/<to>/<module>/` (with slash tat the end)
+        path: ./${{ steps.set-working-directory.outputs.golangci-lint-working-directory }}golangci-lint-report.xml
diff --git a/.github/scripts/map-affected-files-to-modules.sh b/.github/scripts/map-affected-files-to-modules.sh
new file mode 100755
index 00000000000..a12e5306894
--- /dev/null
+++ b/.github/scripts/map-affected-files-to-modules.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+set -e
+
+# This script:
+# 1. Finds all modules.
+# 2. Maps changed files (passed as a param) to found modules.
+# 3. Prints out the affected modules.
+# 4. Output the result (as JSON) to a GitHub Actions environment variable.
+
+# Get the list of changed files as parameter (from JSON array)
+changed_files=$(echo "$1" | jq -r '.[]')
+echo "Changed files: $changed_files"
+
+# 1. Find all modules in the repository, 
+# - Strip the leading './' from the path 
+# (necessary for comparison, affected files do not have leading './')
+modules=$(find . -name 'go.mod' -exec dirname {} \; | sed 's|^./||' | uniq)
+echo "Found modules: $modules"
+
+# Use a Bash associative array to track unique modules
+declare -A unique_modules
+
+for path_to_file in $changed_files; do
+	echo "Resolving a module affected by a file: '$path_to_file'"
+  for module in $modules; do
+    echo "Validating against module: '$module'"
+
+    # if no slash in the path, it is the root 
+    # (i.e. `main.go`, `.gitignore` vs `core/main.go`)
+    if [[ ! $path_to_file =~ \/ ]]; then
+      echo "File '$path_to_file' mapped to the "root" module."
+      unique_modules["."]="."
+      break
+    # if a module's name matches with a file path 
+    # add it, to the affected modules array, skipping the root (`.`) 
+    elif [[ $module != "." && $path_to_file =~ ^$module* ]]; then
+      echo "File '$path_to_file' mapped the module '$module'"
+      unique_modules["$module"]="$module"
+      break
+    fi
+	done
+done
+
+# Convert keys (module names) of the associative array to an indexed array
+affected_modules=("${!unique_modules[@]}")
+echo "Affected modules: ${affected_modules[@]}"
+
+# Convert bash array to a JSON array for GitHub Actions
+json_array=$(printf '%s\n' "${affected_modules[@]}" | jq -R . | jq -s . | jq -c)
+echo "module_names=$json_array" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/ci-core.yml b/.github/workflows/ci-core.yml
index 9134a8c9b56..e3c9bb1205c 100644
--- a/.github/workflows/ci-core.yml
+++ b/.github/workflows/ci-core.yml
@@ -33,7 +33,9 @@ jobs:
     permissions:
       pull-requests: read
     outputs:
+      affected-packages: ${{ steps.resolved-modules.outputs.module_names }}
       deployment-changes: ${{ steps.match-some.outputs.deployment == 'true' }}
+      scripts-changes: ${{ steps.match-some.outputs.scripts == 'true' }}
       should-run-ci-core: ${{ steps.match-some.outputs.core-ci == 'true' || steps.match-every.outputs.non-ignored == 'true' ||  github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
       should-run-golangci: ${{ steps.match-some.outputs.golang-ci == 'true' || steps.match-every.outputs.non-ignored == 'true' || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
@@ -47,7 +49,8 @@ jobs:
         with:
           # "if any changed file matches one or more of the conditions" (https://github.com/dorny/paths-filter/issues/225)
           predicate-quantifier: some
-          # deployment - any changes to files in `deployments/`
+          # deployment - any changes to files in the `deployments/`
+          # scripts - any changes to files in the `core/scripts/`
           # core-ci - any changes that could affect this workflow definition
           # golang-ci - any changes that could affect the linting result
           filters: |
@@ -60,6 +63,8 @@ jobs:
               - '.golangci.yml'
               - '.github/workflows/ci-core.yml'
               - '.github/actions/**'
+            scripts:
+              - 'core/scripts/**'
       - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: match-every
         with:
@@ -67,14 +72,18 @@ jobs:
           predicate-quantifier: every
           # non-integration-tests - only changes made outside of the `integration-tests` directory
           # non-ignored - only changes except for the negated ones
+          # all - changes in any directory
           #  - This is opt-in on purpose. To be safe, new files are assumed to have an affect on CI Core unless listed here specifically.
+          # Enable listing of files matching each filter.
+          # Paths to files will be available in `${FILTER_NAME}_files` output variable.
+          # Paths will be formatted as JSON array
+          list-files: json
           filters: |
             non-integration-tests:
               - '**'
               - '!integration-tests/**'
             non-ignored:
               - '**'
-              - '!docs/**'
               - '!integration-tests/**'
               - '!tools/secrets/**'
               - '!tools/goreleaser-config/**'
@@ -91,24 +100,39 @@ jobs:
               - '!nix-darwin-shell-hook.sh'
               - '!LICENSE'
               - '!.github/**'
-    
+            all:
+              - '**'
+
+      - name: Resolve affected files to affected modules
+        id: resolved-modules
+        shell: bash
+        run: |
+          # Ensure the step uses `with.list-files: json` to get the list of files in JSON format
+          bash ./.github/scripts/map-affected-files-to-modules.sh '${{ steps.match-every.outputs.all_files }}'
+  
   golangci:
-    # We don't directly merge dependabot PRs, so let's not waste the resources
+    name: GolangCI Lint
+    needs: [filter, run-frequency]
+    # We don't directly merge dependabot PRs to not waste the resources.
     if: ${{ (github.event_name == 'pull_request' ||  github.event_name == 'schedule') && github.actor != 'dependabot[bot]' }}
-    name: lint
     permissions:
-      # For golangci-lint-actions to annotate code in the PR.
+      # To annotate code in the PR.
       checks: write
       contents: read
       # For golangci-lint-action's `only-new-issues` option.
       pull-requests: read
     runs-on: ubuntu-24.04-8cores-32GB-ARM
-    needs: [filter, run-frequency]
+    strategy:
+      fail-fast: false
+      matrix:
+        modules: ${{ fromJson(needs.filter.outputs.affected-packages) }}
     steps:
-      - uses: actions/checkout@v4.2.1
-      - name: Golang Lint
+      - name: Checkout
+        uses: actions/checkout@v4.2.1
+      - name: Golang Lint (${{ matrix.modules }})
         uses: ./.github/actions/golangci-lint
-        if: ${{ needs.filter.outputs.should-run-golangci == 'true' }}
+        with: 
+          go-directory: ${{ matrix.modules }}
       - name: Notify Slack
         if: ${{ failure() && needs.run-frequency.outputs.one-per-day-frequency == 'true' }}
         uses: slackapi/slack-github-action@6c661ce58804a1a20f6dc5fbee7f0381b469e001 # v1.25.0
@@ -117,6 +141,21 @@ jobs:
         with:
           channel-id: "#team-core"
           slack-message: "golangci-lint failed: \n${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}"
+  
+  # Fails if any golangci-lint matrix jobs fails and silently succeeds otherwise
+  # Consolidates golangci-lint matrix job results under one required `lint` check
+  # Inclusive check: all (new) modules are analyzed, but no need to enable "required" checks for each one
+  golangci-matrix-results-validation:
+    name: lint
+    needs: [golangci]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Golangci-lint Matrix Results
+        if: ${{ needs.golangci.result != 'success' }}
+        run: |
+          echo "At least one 'GolangCI Lint' matrix job failed. Check the failed lint jobs."
+          exit 1
 
   core:
     env:
@@ -136,11 +175,11 @@ jobs:
           - cmd: go_core_ccip_deployment_tests
             os: ubuntu22.04-32cores-128GB
             printResults: true
+          - cmd: go_core_fuzz
+            os: ubuntu22.04-8cores-32GB
           - cmd: go_core_race_tests
             # use 64cores for certain scheduled runs only
             os: ${{ needs.run-frequency.outputs.two-per-day-frequency == 'true' && 'ubuntu-latest-64cores-256GB' || 'ubuntu-latest-32cores-128GB' }}
-          - cmd: go_core_fuzz
-            os: ubuntu22.04-8cores-32GB
     name: Core Tests (${{ matrix.type.cmd }})
     # We don't directly merge dependabot PRs, so let's not waste the resources
     if: ${{ github.actor != 'dependabot[bot]' }}
@@ -285,8 +324,38 @@ jobs:
           channel-id: "#topic-data-races"
           slack-message: "Race tests failed: \n${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}"
 
+  core-scripts-tests:
+    name: test-scripts
+    needs: [filter]
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'schedule' || needs.filter.outputs.scripts-changes == 'true' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.2.1
+
+      - name: Setup Go
+        uses: ./.github/actions/setup-go
+        with:
+          go-version-file: core/scripts/go.mod
+          go-module-file: core/scripts/go.sum
+      
+      - name: Run Tests
+        env:
+          OUTPUT_FILE: ./output.txt
+        run: ./tools/bin/go_core_scripts_tests ./...
+
+      - name: Store test report artifacts
+        if: ${{ always() && needs.filter.outputs.should-run-ci-core == 'true' }}
+        uses: actions/upload-artifact@v4.4.3
+        with:
+          name: go_core_scripts_tests_logs
+          path: |
+            ./output.txt
+            ./coverage.txt
+          retention-days: 7 
+
   detect-flakey-tests:
-    needs: [filter, core]
+    needs: [filter, core, core-scripts-tests]
     name: Flakey Test Detection
     runs-on: ubuntu-latest
     if: always() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
@@ -375,8 +444,8 @@ jobs:
 
   scan:
     name: SonarQube Scan
-    needs: [core, run-frequency]
-    if: ${{ always() && needs.run-frequency.outputs.four-per-day-frequency == 'true' && github.actor != 'dependabot[bot]' }}
+    needs: [golangci, core, core-scripts-tests]
+    if: ${{ always() && github.actor != 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repo
@@ -384,37 +453,61 @@ jobs:
         with:
           fetch-depth: 0 # fetches all history for all tags and branches to provide more metadata for sonar reports
 
-      - name: Download all workflow run artifacts
+      - name: Download all workflow artifacts
         uses: actions/download-artifact@v4.1.8
 
       - name: Check and Set SonarQube Report Paths
         shell: bash
         run: |
           # Check and assign paths for coverage/test reports in go_core_tests_logs
-          if [ -d "go_core_tests_logs" ]; then
-            sonarqube_coverage_report_paths=$(find go_core_tests_logs -name coverage.txt | paste -sd "," -)
-            sonarqube_tests_report_paths=$(find go_core_tests_logs -name output.txt | paste -sd "," -)
+          core_artifact="go_core_tests_logs"
+          if [ -d "$core_artifact" ]; then
+            echo "Found $core_artifact"
+            sonarqube_coverage_report_paths=$(find "$core_artifact" -name coverage.txt | paste -sd "," -)
+            sonarqube_tests_report_paths=$(find "$core_artifact" -name output.txt | paste -sd "," -)
+            echo "Coverage report paths: $sonarqube_coverage_report_paths"
+            echo "Tests report paths: $sonarqube_tests_report_paths"
           else
+            echo "Did not find $core_artifact"
             sonarqube_coverage_report_paths=""
             sonarqube_tests_report_paths=""
           fi
 
           # Check and assign paths for coverage/test reports in go_core_tests_integration_logs
-          if [ -d "go_core_tests_integration_logs" ]; then
-            integration_coverage_paths=$(find go_core_tests_integration_logs -name coverage.txt | paste -sd "," -)
-            integration_tests_paths=$(find go_core_tests_integration_logs -name output.txt | paste -sd "," -)
+          integration_tests_artifact="go_core_tests_integration_logs"
+          if [ -d "$integration_tests_artifact" ]; then
+            echo "Found $integration_tests_artifact"
+            integration_coverage_paths=$(find "$integration_tests_artifact" -name coverage.txt | paste -sd "," -)
+            integration_tests_paths=$(find "$integration_tests_artifact" -name output.txt | paste -sd "," -)
+            
             # Append to existing paths if they are set, otherwise assign directly
             sonarqube_coverage_report_paths="${sonarqube_coverage_report_paths:+$sonarqube_coverage_report_paths,}$integration_coverage_paths"
             sonarqube_tests_report_paths="${sonarqube_tests_report_paths:+$sonarqube_tests_report_paths,}$integration_tests_paths"
           fi
 
-          # Check and assign paths for lint reports
-          if [ -d "golangci-lint-report" ]; then
-            sonarqube_lint_report_paths=$(find golangci-lint-report -name golangci-lint-report.xml | paste -sd "," -)
-          else
-            sonarqube_lint_report_paths=""
+          # Check and assign paths for coverage/test reports in go_core_scripts_tests_logs
+          scripts_tests_artifact="go_core_scripts_tests_logs"
+          if [ -d "$scripts_tests_artifact" ]; then
+              echo "Found $scripts_tests_artifact"
+              scripts_coverage_paths=$(find "$scripts_tests_artifact" -name coverage.txt | paste -sd "," -)
+              scripts_tests_paths=$(find "$scripts_tests_artifact" -name output.txt | paste -sd "," -)
+    
+              # Append to existing paths if they are set, otherwise assign directly
+              sonarqube_coverage_report_paths="${sonarqube_coverage_report_paths:+$sonarqube_coverage_report_paths,}$scripts_coverage_paths"
+              sonarqube_tests_report_paths="${sonarqube_tests_report_paths:+$sonarqube_tests_report_paths,}$scripts_tests_paths"
           fi
 
+          # Check and assign paths for lint reports
+          # To find reports in the folders named differently (because of the matrix strategy), 
+          # We need to loop through the artifacts. It allows usage of RegExp folders (skipped if not found).
+          for golang_lint_artifact in golangci-lint-report*
+          do
+              echo "Found golangci-lint-report artifacts"
+              sonarqube_lint_report_paths=$(find -type f -name 'golangci-lint-report.xml' -printf "%p,")
+              echo "Lint report paths: $sonarqube_lint_report_paths"
+              break
+          done
+
           ARGS=""
           if [[ -z "$sonarqube_tests_report_paths" ]]; then
             echo "::warning::No test report paths found, will not pass to sonarqube"
diff --git a/.github/workflows/ci-scripts.yml b/.github/workflows/ci-scripts.yml
deleted file mode 100644
index 5683641f26b..00000000000
--- a/.github/workflows/ci-scripts.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-name: CI Scripts
-
-on:
-  merge_group:
-  pull_request:
-
-jobs:
-  lint-scripts:
-    # We don't directly merge dependabot PRs, so let's not waste the resources
-    if: ${{ (github.event_name == 'pull_request' ||  github.event_name == 'schedule') && github.actor != 'dependabot[bot]' }}
-    runs-on: ubuntu-latest
-    permissions:
-      # For golangci-lint-actions to annotate code in the PR.
-      checks: write
-      contents: read
-      # For golangci-lint-action's `only-new-issues` option.
-      pull-requests: read
-    steps:
-      - uses: actions/checkout@v4.2.1
-      - name: Golang Lint
-        uses: ./.github/actions/golangci-lint
-        with:
-          id: scripts
-          name: lint-scripts
-          go-directory: core/scripts
-          go-version-file: core/scripts/go.mod
-          go-module-file: core/scripts/go.sum
-
-  test-scripts:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4.2.1
-      - name: Setup Go
-        uses: ./.github/actions/setup-go
-        with:
-          go-version-file: core/scripts/go.mod
-          go-module-file: core/scripts/go.sum
-      - name: Run Tests
-        shell: bash
-        working-directory: core/scripts
-        run: go test ./...
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index 27bdfa52243..e79956cc253 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -1,3 +1,5 @@
+# N/B: ci-core, which runs on PRs, will trigger linting for affected directories/modules
+# no need to run lint twice
 name: Integration Tests
 run-name: Integration Tests ${{ inputs.distinct_run_name && inputs.distinct_run_name || '' }}
 on:
@@ -116,47 +118,6 @@ jobs:
       core_changes: ${{ steps.ignore-filter.outputs.changes || steps.changes.outputs.core_changes }}
       ccip_changes: ${{ steps.ignore-filter.outputs.changes || steps.changes.outputs.ccip_changes }}
 
-  lint-integration-tests:
-    name: Lint ${{ matrix.project.name }}
-    runs-on: ubuntu-24.04-8cores-32GB-ARM
-    # We don't directly merge dependabot PRs, so let's not waste the resources
-    if: github.actor != 'dependabot[bot]'
-    strategy:
-      matrix:
-        project:
-          - name: integration-tests
-            id: e2e-tests
-            path: ./integration-tests
-            cache_id: e2e-tests
-          - name: load
-            id: load
-            path: ./integration-tests/load
-            cache_id: load
-    steps:
-      - name: Checkout the repo
-        uses: actions/checkout@v4.2.1
-        with:
-          repository: smartcontractkit/chainlink
-          ref: ${{ inputs.cl_ref }}
-      - name: Setup Go
-        uses: smartcontractkit/.github/actions/ctf-setup-go@b0d756c57fcdbcff187e74166562a029fdd5d1b9 # ctf-setup-go@0.0.0
-        with:
-          test_download_vendor_packages_command: cd ${{ matrix.project.path }} && go mod download
-          go_mod_path: ${{ matrix.project.path }}/go.mod
-          cache_key_id: ${{ matrix.project.cache_id }}
-          cache_restore_only: "true"
-      - name: Lint Go
-        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
-        with:
-          version: v1.62.0
-          # We already cache these directories in setup-go
-          skip-pkg-cache: true
-          skip-build-cache: true
-          # only-new-issues is only applicable to PRs, otherwise it is always set to false
-          only-new-issues: false # disabled for PRs due to unreliability
-          args: --out-format colored-line-number,checkstyle:golangci-lint-report.xml
-          working-directory: ${{ matrix.project.path }}
-
   build-chainlink:
     environment: integration
     permissions:
@@ -171,6 +132,7 @@ jobs:
           - name: (plugins)
             dockerfile: plugins/chainlink.Dockerfile
             tag-suffix: -plugins
+
     name: Build Chainlink Image ${{ matrix.image.name }}
     runs-on: ubuntu22.04-8cores-32GB
     needs: [changes, enforce-ctf-version]
@@ -374,7 +336,7 @@ jobs:
     if: always()
     name: ETH Smoke Tests
     runs-on: ubuntu-latest
-    needs: [lint-integration-tests, run-core-e2e-tests-for-pr, run-ccip-e2e-tests-for-pr, run-core-e2e-tests-for-merge-queue, run-ccip-e2e-tests-for-merge-queue]
+    needs: [run-core-e2e-tests-for-pr, run-ccip-e2e-tests-for-pr, run-core-e2e-tests-for-merge-queue, run-ccip-e2e-tests-for-merge-queue]
     steps:
       - name: Check Core test results
         id: check_core_results
@@ -414,10 +376,6 @@ jobs:
         if: always() && needs.run-core-e2e-tests-for-merge-queue.result == 'failure'
         run: exit 1
 
-      - name: Fail the job if lint not successful
-        if: always() && needs.lint-integration-tests.result == 'failure'
-        run: exit 1
-
   cleanup:
     name: Clean up integration environment deployments
     if: always()
diff --git a/.github/workflows/solidity-tracability.yml b/.github/workflows/solidity-traceability.yml
similarity index 99%
rename from .github/workflows/solidity-tracability.yml
rename to .github/workflows/solidity-traceability.yml
index f0b1166807f..caa233ea8bb 100644
--- a/.github/workflows/solidity-tracability.yml
+++ b/.github/workflows/solidity-traceability.yml
@@ -1,5 +1,5 @@
 # This workflow handles the enforcement of code Traceability via changesets and jira issue linking for our Solidity codebase.
-name: Solidity Tracability
+name: Solidity Traceability
 
 on:
   merge_group:
diff --git a/.gitignore b/.gitignore
index 34d25ebb472..af19562c928 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,9 +48,8 @@ cl_backup_*.tar.gz
 
 # Test artifacts
 core/cmd/TestClient_ImportExportP2PKeyBundle_test_key.json
-output.txt
 race.*
-golangci-lint-output.txt
+*output.txt
 /golangci-lint/
 .covdata
 core/services/job/testdata/wasm/testmodule.wasm
diff --git a/.golangci.yml b/.golangci.yml
index ca8cf4dade5..a7928ee97de 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,5 +1,6 @@
 run:
   timeout: 15m0s
+  allow-parallel-runners: true
 linters:
   enable:
     - containedctx
diff --git a/.tool-versions b/.tool-versions
index 49f7ef749d1..bdf11a7ed21 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -4,6 +4,7 @@ nodejs 20.13.1
 pnpm 9.4.0
 postgres 15.1
 helm 3.10.3
-golangci-lint 1.61.0
+golangci-lint 1.62.2
 protoc 25.1
 python 3.10.5
+act 0.2.30
diff --git a/GNUmakefile b/GNUmakefile
index 336efd326a7..5ae7ee4acd0 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -180,7 +180,7 @@ config-docs: ## Generate core node configuration documentation
 .PHONY: golangci-lint
 golangci-lint: ## Run golangci-lint for all issues.
 	[ -d "./golangci-lint" ] || mkdir ./golangci-lint && \
-	docker run --rm -v $(shell pwd):/app -w /app golangci/golangci-lint:v1.61.0 golangci-lint run --max-issues-per-linter 0 --max-same-issues 0 | tee ./golangci-lint/$(shell date +%Y-%m-%d_%H:%M:%S).txt
+	docker run --rm -v $(shell pwd):/app -w /app golangci/golangci-lint:v1.62.2 golangci-lint run --max-issues-per-linter 0 --max-same-issues 0 | tee ./golangci-lint/$(shell date +%Y-%m-%d_%H:%M:%S).txt
 
 .PHONY: modgraph
 modgraph:
diff --git a/tools/bin/go_core_scripts_tests b/tools/bin/go_core_scripts_tests
new file mode 100755
index 00000000000..e4380264215
--- /dev/null
+++ b/tools/bin/go_core_scripts_tests
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -o pipefail
+set +e
+
+SCRIPT_PATH=`dirname "$0"`; SCRIPT_PATH=`eval "cd \"$SCRIPT_PATH\" && pwd"`
+OUTPUT_FILE=${OUTPUT_FILE:-"./output.txt"}
+EXTRA_FLAGS=""
+
+cd ./core/scripts || exit
+go mod download
+echo "Test execution results: ---------------------"
+echo ""
+
+if [[ $GITHUB_EVENT_NAME == "schedule" ]]; then
+  EXTRA_FLAGS="-covermode=atomic -coverpkg=./... -coverprofile=coverage.txt"
+fi
+go test ./... $EXTRA_FLAGS | tee $OUTPUT_FILE | grep -Ev '\[no test files\]|\[no tests to run\]'
+EXITCODE=${PIPESTATUS[0]}
+
+# Assert no known sensitive strings present in test logger output
+printf "\n----------------------------------------------\n\n"
+echo "Beginning check of output logs for sensitive strings"
+$SCRIPT_PATH/scrub_logs $OUTPUT_FILE
+cd ..
+if [[ $? != 0 ]]; then
+  exit 1
+fi
+
+echo "Exit code: $EXITCODE"
+if [[ $EXITCODE != 0 ]]; then
+  echo "Encountered test failures."
+else
+  echo "All tests passed!"
+fi
+echo "go_core_scripts_tests exiting with code $EXITCODE"
+exit $EXITCODE
diff --git a/tools/bin/go_core_tests b/tools/bin/go_core_tests
index 76c15fccd07..3679988a896 100755
--- a/tools/bin/go_core_tests
+++ b/tools/bin/go_core_tests
@@ -29,4 +29,4 @@ else
   echo "All tests passed!"
 fi
 echo "go_core_tests exiting with code $EXITCODE"
-exit $EXITCODE
+exit $EXITCODE
\ No newline at end of file