Merge branch 'main' into feat/gasless-vote-relay

# Conflicts:
#	.env.example
#	src/components/transactions/GovVote/GovVoteActions.tsx

Author: JoaquinBattilana

.github/actions/build/action.yml

@@ -1,8 +1,8 @@
 name: Build app and static
 description: Build nextjs app and export static files
 inputs:
-  YARN_COMMAND:
-    description: yarn command to run
+  COMMAND:
+    description: command to run
     required: false
     default: 'build:static'
   NEXT_PUBLIC_ENV:
@@ -53,14 +53,16 @@ inputs:
 runs:
   using: 'composite'
   steps:
+    - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+
     - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
         node-version-file: '.nvmrc'
-        cache: 'yarn'
+        cache: 'pnpm'
 
     - name: install
       shell: sh
-      run: yarn --frozen-lockfile --prefer-offline
+      run: pnpm install --frozen-lockfile --prefer-offline
 
     - name: Restore next cache
       uses: actions/cache@v4
@@ -76,7 +78,7 @@ runs:
 
     - name: build
       shell: sh
-      run: yarn ${{ inputs.YARN_COMMAND }}
+      run: pnpm run ${{ inputs.COMMAND }}
       env:
         NEXT_PUBLIC_ENV: '${{ inputs.NEXT_PUBLIC_ENV }}'
         NEXT_PUBLIC_ENABLE_GOVERNANCE: 'true'

.github/actions/cypress/action.yml

@@ -10,22 +10,29 @@ inputs:
   CYPRESS_TENDERLY_PROJECT:
     description: tenderly porject name
     required: true
-  YARN_TEST_COMMAND:
-    description: yarn command to run test
+  TEST_COMMAND:
+    description: command to run for tests
     required: true
 runs:
   using: 'composite'
   steps:
+    - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+
     - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
       with:
         node-version-file: '.nvmrc'
-        cache: 'yarn'
+        cache: 'pnpm'
 
     - name: install
       shell: sh
       run: |
-        yarn --frozen-lockfile --prefer-offline
-        yarn add serve
+        pnpm install --frozen-lockfile --prefer-offline
+        pnpm add serve
+        # pnpm doesn't reliably repopulate the Cypress binary cache
+        # (~/.cache/Cypress) on warm CI runs the way yarn did, and that dir
+        # isn't part of the pnpm store cache. Download it explicitly so the
+        # `install: false` step below finds the binary. Idempotent.
+        pnpm exec cypress install
 
     - name: download build
       if: github.event_name != 'workflow_run'
@@ -50,9 +57,9 @@ runs:
         headless: true
         install: false
         record: false
-        start: yarn serve:static
+        start: pnpm serve:static
         wait-on: 'http://localhost:3000'
-        command: ${{ inputs.YARN_TEST_COMMAND }}
+        command: ${{ inputs.TEST_COMMAND }}
       env:
         CYPRESS_URL: 'http://localhost:3000'
         CYPRESS_TENDERLY_ACCOUNT: ${{ inputs.CYPRESS_TENDERLY_ACCOUNT }}

.github/workflows/build-fork.yml

@@ -8,6 +8,9 @@ on:
   pull_request:
     branches: ['main']
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/build-test-deploy-dev.yml

@@ -8,6 +8,10 @@ on:
   pull_request:
     branches: ['main']
 
+# Default least-privilege token; jobs that comment on PRs elevate below.
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -70,11 +74,14 @@ jobs:
           CYPRESS_TENDERLY_ACCOUNT: ${{ secrets.TENDERLY_ACCOUNT }}
           CYPRESS_TENDERLY_KEY: ${{ secrets.TENDERLY_KEY }}
           CYPRESS_TENDERLY_PROJECT: ${{ secrets.TENDERLY_PROJECT }}
-          YARN_TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/v3-markets/${{ matrix.market }}-v3-smoke.config.ts
+          TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/v3-markets/${{ matrix.market }}-v3-smoke.config.ts
 
   next_js_analyze:
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      contents: read
+      pull-requests: write # posts bundle-analysis comment on the PR
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
@@ -93,6 +100,9 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - build
+    permissions:
+      contents: read
+      pull-requests: write # pinata-action comments the IPFS hash on the PR
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
@@ -144,7 +154,7 @@ jobs:
           CYPRESS_TENDERLY_ACCOUNT: ${{ secrets.TENDERLY_ACCOUNT }}
           CYPRESS_TENDERLY_KEY: ${{ secrets.TENDERLY_KEY }}
           CYPRESS_TENDERLY_PROJECT: ${{ secrets.TENDERLY_PROJECT }}
-          YARN_TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/v3-markets/${{ matrix.market }}-v3-full.config.ts
+          TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/v3-markets/${{ matrix.market }}-v3-full.config.ts
 
   cypress_app_functionality:
     runs-on: ubuntu-latest
@@ -169,4 +179,4 @@ jobs:
           CYPRESS_TENDERLY_ACCOUNT: ${{ secrets.TENDERLY_ACCOUNT }}
           CYPRESS_TENDERLY_KEY: ${{ secrets.TENDERLY_KEY }}
           CYPRESS_TENDERLY_PROJECT: ${{ secrets.TENDERLY_PROJECT }}
-          YARN_TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/${{ matrix.scoupe }}.config.ts
+          TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/${{ matrix.scoupe }}.config.ts

.github/workflows/build-test-deploy.yml

@@ -8,6 +8,10 @@ on:
   push:
     branches: ['main']
 
+# Default least-privilege token; jobs that comment or release elevate below.
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -31,9 +35,6 @@ jobs:
         uses: ./.github/actions/build
         with:
           NEXT_PUBLIC_ENV: 'prod'
-          NEXT_PUBLIC_FORK_BASE_CHAIN_ID: ${{ secrets[format('FORK_BASE_CHAIN_ID_{0}', github.event.pull_request.number)] }}
-          NEXT_PUBLIC_FORK_CHAIN_ID: ${{ secrets[format('FORK_CHAIN_ID_{0}', github.event.pull_request.number)]  }}
-          NEXT_PUBLIC_FORK_URL_RPC: ${{ secrets[format('FORK_URL_RPC_{0}', github.event.pull_request.number)]  }}
           NEXT_PUBLIC_MIXPANEL: ${{ secrets.NEXT_PUBLIC_MIXPANEL }}
           NEXT_PUBLIC_FIAT_ON_RAMP: 'false'
           NEXT_PUBLIC_WALLET_CONNECT_PROJECT_ID: ${{ secrets.WALLET_CONNECT_PROJECT_ID }}
@@ -92,11 +93,14 @@ jobs:
           CYPRESS_TENDERLY_ACCOUNT: ${{ secrets.TENDERLY_ACCOUNT }}
           CYPRESS_TENDERLY_KEY: ${{ secrets.TENDERLY_KEY }}
           CYPRESS_TENDERLY_PROJECT: ${{ secrets.TENDERLY_PROJECT }}
-          YARN_TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/v3-markets/${{ matrix.market }}-v3-smoke.config.ts
+          TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/v3-markets/${{ matrix.market }}-v3-smoke.config.ts
 
   next_js_analyze:
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      contents: read
+      pull-requests: write # posts bundle-analysis comment
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
@@ -118,6 +122,8 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - build
+    permissions:
+      contents: write # pinata-action leaves a commit comment on push events
     outputs:
       pinata_hash: '${{ steps.pinata.outputs.hash }}'
     steps:
@@ -162,7 +168,7 @@ jobs:
           CYPRESS_TENDERLY_ACCOUNT: ${{ secrets.TENDERLY_ACCOUNT }}
           CYPRESS_TENDERLY_KEY: ${{ secrets.TENDERLY_KEY }}
           CYPRESS_TENDERLY_PROJECT: ${{ secrets.TENDERLY_PROJECT }}
-          YARN_TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/v3-markets/${{ matrix.market }}-v3-full.config.ts
+          TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/v3-markets/${{ matrix.market }}-v3-full.config.ts
 
   cypress_app_functionality:
     runs-on: ubuntu-latest
@@ -187,7 +193,7 @@ jobs:
           CYPRESS_TENDERLY_ACCOUNT: ${{ secrets.TENDERLY_ACCOUNT }}
           CYPRESS_TENDERLY_KEY: ${{ secrets.TENDERLY_KEY }}
           CYPRESS_TENDERLY_PROJECT: ${{ secrets.TENDERLY_PROJECT }}
-          YARN_TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/${{ matrix.scoupe }}.config.ts
+          TEST_COMMAND: npx cypress-repeat run -n 2 --rerun-failed-only --config-file ./cypress/configs/${{ matrix.scoupe }}.config.ts
 
   prepare_release:
     if: |
@@ -199,6 +205,8 @@ jobs:
       - build_staging
       - cypress_full_v3
       - cypress_app_functionality
+    permissions:
+      contents: write # reusable workflow creates a GitHub release
     uses: ./.github/workflows/update-prod-staging.yml
     with:
       PINATA_HASH: '${{ needs.deploy.outputs.pinata_hash }}'
@@ -212,6 +220,8 @@ jobs:
     needs:
       - deploy
       - build_staging
+    permissions:
+      contents: write # reusable workflow creates a GitHub release
     uses: ./.github/workflows/update-prod-staging.yml
     with:
       PINATA_HASH: '${{ needs.deploy.outputs.pinata_hash }}'

.github/workflows/crowdin-download.yml

@@ -9,6 +9,10 @@ on:
     - cron: '0 */6 * * *'
   workflow_dispatch:
 
+# Checkout + git push both authenticate with BOT_TOKEN, so GITHUB_TOKEN only needs read.
+permissions:
+  contents: read
+
 jobs:
   download-from-crowdin:
     name: Download sources from Crowdin
@@ -21,10 +25,12 @@ jobs:
         with:
           token: ${{ secrets.BOT_TOKEN }}
 
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+
       - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version-file: '.nvmrc'
-          cache: 'yarn'
+          cache: 'pnpm'
 
       - name: crowdin action
         uses: crowdin/github-action@60debf382ee245b21794321190ad0501db89d8c1 # v2.13.0
@@ -46,8 +52,8 @@ jobs:
           then
             echo "tree is clean"
           else
-            yarn --frozen-lockfile
-            yarn i18n:compile
+            pnpm install --frozen-lockfile
+            pnpm i18n:compile
             git add .
             git config --global user.name 'Crowdin bot'
             git config --global user.email 'crowdin-bot@aave.com'

.github/workflows/crowdin-upload.yml

@@ -6,6 +6,10 @@ on:
     branches:
       - main
 
+# Crowdin sync authenticates with BOT_TOKEN, so GITHUB_TOKEN only needs read.
+permissions:
+  contents: read
+
 jobs:
   upload-to-crowdin:
     name: Upload sources to Crowdin
@@ -15,10 +19,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+
       - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version-file: '.nvmrc'
-          cache: 'yarn'
+          cache: 'pnpm'
 
       - name: Synchronize
         uses: crowdin/github-action@60debf382ee245b21794321190ad0501db89d8c1 # v2.13.0

.github/workflows/dependency-review.yml

@@ -17,3 +17,5 @@ jobs:
           comment-summary-in-pr: on-failure
           fail-on-severity: moderate
           license-check: false
+          show-openssf-scorecard: false
+          show-patched-versions: true

.github/workflows/i18n-check.yml

@@ -10,6 +10,9 @@ on:
   push:
     branches: ['main']
 
+permissions:
+  contents: read
+
 jobs:
   i18n-check:
     runs-on: ubuntu-latest
@@ -19,7 +22,7 @@ jobs:
       - name: i18n compile
         uses: ./.github/actions/build
         with:
-          YARN_COMMAND: i18n
+          COMMAND: i18n
           USE_NEXT_CACHE: 'false'
 
       - name: check diff
@@ -28,7 +31,7 @@ jobs:
           then
             echo "i18n up to date"
           else
-          	echo "please run yarn i18n"
+          	echo "please run pnpm i18n"
             exit 1
           exit
           fi