chore: bump wormhole sdk to latest version

[M-Picco]

• Clean up deprecated chains' code
• Move cli related logic from build action to its own build-cli action triggered when modifying its files. This should prevent from running the ci on PRs unrelated to it

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​wormhole-foundation/​sdk-base@​0.9.0 ⏵ 6.1.5				+2
	npm/​@​wormhole-foundation/​sdk-cosmwasm@​0.9.0 ⏵ 6.1.5	+2			+2
	npm/​@​injectivelabs/​networks@​1.14.13 ⏵ 1.20.34	+8
	npm/​@​injectivelabs/​utils@​1.14.13 ⏵ 1.20.34	+7		+1
	npm/​@​wormhole-foundation/​sdk-definitions@​0.9.0 ⏵ 6.1.5				+2
	npm/​js-base64@​3.9.2
	npm/​@​wormhole-foundation/​sdk@​0.9.0 ⏵ 6.1.5	+1			+2
	npm/​@​injectivelabs/​sdk-ts@​1.14.13 ⏵ 1.20.34	+6		+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @injectivelabs/core-proto-ts-v2 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: clients/js/package-lock.json → npm/@injectivelabs/sdk-ts@1.20.34 → npm/@injectivelabs/core-proto-ts-v2@1.20.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@injectivelabs/core-proto-ts-v2@1.20.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm stream-json is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: clients/js/package-lock.json → npm/@certusone/wormhole-sdk@0.10.18 → npm/@solana/web3.js@1.98.4 → npm/stream-json@1.9.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/stream-json@1.9.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[johnsaigle]

• Would you be able to explain more the decision to remove the IBC relayer tests? From my understanding this is still a live path on Wormhole via Gateway/Wormchain. So, it's something we should be running in CI. I know the standard relayer was deprecated in favour of the Executor, but I'm not aware that the IBC relayer is also replaced or deprecated.

• Also, we should be careful with removing the Terra2 tests. I don't have a full understanding of the impact but I remember Bruce flagged this when I tried to remove Terra2 things before. IMO it's worth reviewing this Issue and the related PRs to get a sense of the impact here. #4473 (comment).

• Can you regenerate the package-lock.json file? It is missing the integrity hashes that we need in order to safely use npm ci (see here: https://github.com/wormhole-foundation/wormhole/blob/main/CONTRIBUTING.md#working-with-node-dependencies). AFAICT this can happen if you re-generate the lockfile without first deleting node_modules/ locally.

[M-Picco]

@johnsaigle Thanks for the feedback.

Would you be able to explain more the decision to remove the IBC relayer tests?

The rationale for the skip was the Terra2 deprecation. I thought about replacing Terra2 with a different Cosmos chain but I feared the PR scope would increase too much. Forgot to mention that on the PR description.

I hadn't considered the coverage angle, which makes sense. I'll lean towards covering the worm cli/wh sdk gap and leave the Terra2 removal for later.

IMO it's worth reviewing this Issue and the related PRs to get a sense of the impact here. #4473 (comment)

Thanks for the referenced issue too, I was not a aware of it

Can you regenerate the package-lock.json file?

Will do, thanks for the pointer

[M-Picco]

@johnsaigle I've reverted the Terra2 removal from the test harness and added the support for Terra2 at the worm cli now that it was deprecated from the wh sdk. I've also regenerated the package-lock.json according to the contributing guidelines.

Thanks for the feedback and let me know if there's anything else you think is missing.

[M-Picco]

@johnsaigle Addressed your comments from last review (diff). I've also noticed that some commands where failing when deprecated chains were present on the on-chain state (e.g. TB registrations), so added support for them as well. They should not be allowed for normal commands though.

[djb15]

Thanks for keeping the Terra2 Tilt tests around for now

[M-Picco]

Closing in favor of #4953