Add data feeds cache and proxy bindings

.gitattributes

@@ -2,3 +2,9 @@
 # Mark as generated and suppress line-by-line diffs so PRs stay reviewable
 # when auth trees or call graphs change (snapshots still run in CI unchanged).
 **/test_snapshots/** linguist-generated=true -diff merge=binary
+
+# Generated Go bindings and vendored generated Rust interfaces
+# (`make generate-bindings`; check-generated CI enforces they match the
+# generator). Collapsed in PR review — review the generator instead.
+bindings/contracts/** linguist-generated=true
+contracts/common/interfaces/src/*.rs linguist-generated=true

.github/actions/setup-rust-toolchain/action.yml

@@ -1,8 +1,12 @@
-# Pin Rust for GitHub Actions. Bump `toolchain` below and align rust-toolchain.toml when upgrading.
+# Pin Rust for GitHub Actions. Bump the `toolchain` default below and align rust-toolchain.toml when upgrading.
 name: Setup Rust toolchain
-description: Install pinned Rust toolchain with optional wasm target and rustfmt.
+description: Install pinned Rust toolchain with optional wasm target, rustfmt, and clippy.
 
 inputs:
+  toolchain:
+    description: Rust toolchain version
+    required: false
+    default: "1.93.1"
   wasm32-target:
     description: Also install wasm32v1-none target (Soroban contracts)
     required: false
@@ -11,19 +15,27 @@ inputs:
     description: Also install rustfmt component
     required: false
     default: "false"
+  clippy:
+    description: Also install clippy component
+    required: false
+    default: "false"
 
 runs:
   using: composite
   steps:
     - name: Install Rust toolchain
       uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9
       with:
-        toolchain: "1.93.1"
+        toolchain: ${{ inputs.toolchain }}
     - name: Add wasm32v1-none target
       if: ${{ inputs.wasm32-target == 'true' }}
       shell: bash
-      run: rustup target add wasm32v1-none
+      run: rustup target add wasm32v1-none --toolchain ${{ inputs.toolchain }}
     - name: Add rustfmt
       if: ${{ inputs.rustfmt == 'true' }}
       shell: bash
-      run: rustup component add rustfmt
+      run: rustup component add rustfmt --toolchain ${{ inputs.toolchain }}
+    - name: Add clippy
+      if: ${{ inputs.clippy == 'true' }}
+      shell: bash
+      run: rustup component add clippy --toolchain ${{ inputs.toolchain }}

.github/actions/setup-stellar-cli/action.yml

@@ -1,20 +1,30 @@
 # Install Stellar CLI from official GitHub releases (Linux x86_64 tarball).
 # The tarball is verified against a pinned SHA256 before extraction
 # (trust-on-first-use — stellar-cli publishes no per-asset checksums).
-# Bump VERSION and SHASUM together when upgrading; keep them aligned with
-# scripts/update_cre_artifacts.sh.
+# The version/shasum pair can be overridden per workflow, but must always be
+# bumped together; keep the defaults aligned with scripts/update_cre_artifacts.sh.
 name: Setup Stellar CLI
 description: Install stellar-cli for CI (Linux x86_64).
 
+inputs:
+  version:
+    description: stellar-cli version
+    required: false
+    default: "25.1.0"
+  shasum:
+    description: SHA256 of the release tarball for the requested version
+    required: false
+    default: "e6fac619b2ae9b3ecb843a9e8e3bfc94dce79e0b73c63cb1cbbd08682bb0a0ba"
+
 runs:
   using: composite
   steps:
     - name: Install Stellar CLI
       shell: bash
       run: |
         set -euo pipefail
-        VERSION="25.1.0"
-        SHASUM="e6fac619b2ae9b3ecb843a9e8e3bfc94dce79e0b73c63cb1cbbd08682bb0a0ba"
+        VERSION="${{ inputs.version }}"
+        SHASUM="${{ inputs.shasum }}"
         echo "Installing Stellar CLI ${VERSION}"
         URL="https://github.com/stellar/stellar-cli/releases/download/v${VERSION}/stellar-cli-${VERSION}-x86_64-unknown-linux-gnu.tar.gz"
         curl --fail --silent --show-error --location \

.github/workflows/check-generated.yaml

@@ -45,6 +45,25 @@ jobs:
             echo "changed=false" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Detect data feeds artifact input changes
+        id: df_changes
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before }}
+        run: |
+          set -euo pipefail
+          if [ -z "$BASE_SHA" ] || ! git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if git diff --name-only "$BASE_SHA...HEAD" -- \
+              contracts/data-feeds/ \
+              deployment/data-feeds/artifacts/ scripts/update_data_feeds_artifacts.sh \
+              | grep -q .; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Setup Rust toolchain
         uses: ./.github/actions/setup-rust-toolchain
         with:
@@ -69,9 +88,20 @@ jobs:
         if: steps.cre_changes.outputs.changed == 'true'
         run: make update-cre-artifacts
 
+      - name: Rebuild embedded data feeds contract artifacts
+        if: steps.df_changes.outputs.changed == 'true'
+        run: make update-data-feeds-artifacts
+
       - name: Check for uncommitted changes
         run: |
+          # --intent-to-add so a brand-new, untracked blob is a diff rather than
+          # invisible to git diff --exit-code.
+          git add --intent-to-add \
+            contracts/common/interfaces/ bindings/contracts/ \
+            deployment/cre/artifacts/ deployment/data-feeds/artifacts/
           git diff --exit-code -- contracts/common/interfaces/ bindings/contracts/ || \
             (echo "Generated code is out of date. Run 'make generate-bindings' and commit the result." && exit 1)
           git diff --exit-code -- deployment/cre/artifacts/ || \
             (echo "Embedded CRE contract WASM is out of date. Run 'make update-cre-artifacts' and commit the result." && exit 1)
+          git diff --exit-code -- deployment/data-feeds/artifacts/ || \
+            (echo "Embedded data feeds contract WASM is out of date. Run 'make update-data-feeds-artifacts' and commit the result." && exit 1)

.github/workflows/data-feeds-contracts.yaml

@@ -0,0 +1,98 @@
+name: Data Feeds Contracts
+
+on:
+  merge_group:
+  pull_request:
+    paths:
+      - contracts/data-feeds/**
+      - .github/workflows/data-feeds-contracts.yaml
+      - .github/actions/setup-rust-toolchain/**
+      - .github/actions/setup-stellar-cli/**
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  test:
+    name: Unit Tests
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: contracts/data-feeds
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+
+      - name: Cache Cargo artifacts
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+        with:
+          workspaces: contracts/data-feeds
+
+      - name: Install Just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Run tests
+        run: just test
+
+  lint:
+    name: Lint and Format
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: contracts/data-feeds
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+
+      - name: Cache Cargo artifacts
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+        with:
+          workspaces: contracts/data-feeds
+
+      - name: Install Just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Check formatting
+        run: just fmt-check
+
+      - name: Run clippy
+        run: just lint
+
+  build-wasm:
+    name: Build WASM
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: contracts/data-feeds
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+
+      - name: Cache Cargo artifacts
+        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
+        with:
+          workspaces: contracts/data-feeds
+
+      - name: Install Just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Install Stellar CLI
+        uses: ./.github/actions/setup-stellar-cli
+        with:
+          version: "27.0.0"
+          shasum: "357bf712f6353c28cd33c794402a3c87231757a5b305e6ef1604365af4fdd556"
+
+      - name: Build contract WASMs
+        run: just build

.github/workflows/test-coverage-report.yaml

@@ -57,6 +57,10 @@ jobs:
         run: |
           just test-coverage coverage.out short
 
+      - name: Run bindings tests
+        run: |
+          just test-go-bindings
+
       - name: Coverage on target branch
         if: github.event_name == 'pull_request'
         run: |

Justfile

@@ -8,17 +8,22 @@ COVERAGE_EXCLUDE_REGEX := '(/mock_.*\\.go:|/_mocks/.*:|/mocks/.*:)'
 # Host target triple (needed to override .cargo/config.toml wasm target for tests)
 host_target := `rustc -vV | grep host | awk '{print $2}'`
 
+mod data_feeds 'contracts/data-feeds/Justfile'
+
 # Run all Soroban contract tests
 test-contracts:
     cargo test --workspace --target {{host_target}} --verbose
+    just data_feeds test
 
 # Check all contracts compile (faster than full test)
 check-contracts:
     cargo check --workspace --target {{host_target}}
+    just data_feeds check
 
 # Build all contract WASMs
 build-contracts:
     stellar contract build
+    just data_feeds build
 
 # Rebuild the embedded CRE contract WASM committed under deployment/cre/artifacts/
 # (served to Go consumers via deployment/cre.Artifact). CI fails if out of sync.
@@ -30,10 +35,16 @@ update-cre-artifacts:
 # Format all Rust code
 fmt-contracts:
     cargo fmt --all
+    just data_feeds fmt
 
 # Check Rust formatting (CI mode, no changes)
 fmt-contracts-check:
     cargo fmt --all -- --check
+    just data_feeds fmt-check
+
+# Run contract linters
+lint-contracts:
+    just data_feeds lint
 
 # Run Go unit tests (root module) with coverage; optional second arg "short" runs -short tests only.
 # Excludes tests/e2e (requires running devenv; same idea as chainlink-ccv -short for heavy tests).
@@ -77,9 +88,10 @@ mock:
 # Run all tests (contracts + Go)
 test-all: test-contracts test-go-all
 
-# Full pipeline: build WASM, make generate-interfaces + generate-bindings, fmt, test-all
+# Full pipeline: build WASM, make generate-interfaces + generate-bindings, fmt, lint, test-all
 all: build-contracts
     make generate-interfaces
     make generate-bindings
     just fmt-contracts
+    just lint-contracts
     just test-all

Makefile

@@ -6,7 +6,7 @@ WASM_DIR := target/wasm32v1-none/release
 # lives elsewhere, e.g. `make docker-ccv-dev CCV_REPO=$HOME/code/chainlink-ccv`.
 CCV_REPO ?= ../chainlink-ccv
 
-.PHONY: build test test-e2e check fmt clean generate-interfaces generate-bindings update-cre-artifacts docker-verifier docker-executor docker-ccv-dev restart-verifier restart-executor restart-verifier-executor
+.PHONY: build test test-e2e check fmt clean generate-interfaces generate-bindings update-cre-artifacts update-data-feeds-artifacts docker-verifier docker-executor docker-ccv-dev restart-verifier restart-executor restart-verifier-executor
 
 build:
 	stellar contract build
@@ -19,6 +19,13 @@ build:
 update-cre-artifacts:
 	./scripts/update_cre_artifacts.sh
 
+# Same contract for the data feeds contracts, whose blobs live under
+# deployment/data-feeds/artifacts/ (served via deployment/data-feeds.Artifact).
+# Separate from update-cre-artifacts because the nested contracts/data-feeds
+# workspace pins its own rust and stellar-cli versions. Requires docker.
+update-data-feeds-artifacts:
+	./scripts/update_data_feeds_artifacts.sh
+
 test-e2e:
 	go test -v -timeout 30m ./tests/e2e/...