From 0fcc71745aeca71095dbe03fd012b75967615ea1 Mon Sep 17 00:00:00 2001
From: Alejandro Cabeza Romero <alex93cabeza@gmail.com>
Date: Wed, 22 Apr 2026 16:42:48 +0200
Subject: [PATCH] Pin circom version.

---
 .github/workflows/build-circuits.yml | 13 ++++++++-----
 justfile                             | 18 ++++++++++++------
 2 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/build-circuits.yml b/.github/workflows/build-circuits.yml
index e89896f..906099b 100644
--- a/.github/workflows/build-circuits.yml
+++ b/.github/workflows/build-circuits.yml
@@ -13,6 +13,9 @@ on:
         description: "Tag to release. Must follow the format of 'vX.Y.Z'."
         required: true
 
+env:
+  CIRCOM_TAG: v2.2.2
+
 jobs:
   setup:
     name: Configure Environment
@@ -87,7 +90,7 @@ jobs:
 
       - name: Install Circom
         run: |
-          git clone https://github.com/iden3/circom.git
+          git clone --branch ${{ env.CIRCOM_TAG }} --depth 1 https://github.com/iden3/circom.git
           cd circom
           RUSTFLAGS="-A dead_code" cargo build --release
           RUSTFLAGS="-A dead_code" cargo install --path circom
@@ -158,7 +161,7 @@ jobs:
 
       - name: Install Circom
         run: |
-          git clone https://github.com/iden3/circom.git
+          git clone --branch ${{ env.CIRCOM_TAG }} --depth 1 https://github.com/iden3/circom.git
           cd circom
           RUSTFLAGS="-A dead_code" cargo build --release
           RUSTFLAGS="-A dead_code" cargo install --path circom
@@ -394,7 +397,7 @@ jobs:
 
       - name: Install Circom
         run: |
-          git clone https://github.com/iden3/circom.git
+          git clone --branch ${{ env.CIRCOM_TAG }} --depth 1 https://github.com/iden3/circom.git
           cd circom
           RUSTFLAGS="-A dead_code" cargo build --release
           RUSTFLAGS="-A dead_code" cargo install --path circom
@@ -642,7 +645,7 @@ jobs:
 
       - name: Install Circom
         run: |
-          git clone https://github.com/iden3/circom.git
+          git clone --branch ${{ env.CIRCOM_TAG }} --depth 1 https://github.com/iden3/circom.git
           cd circom
           $env:RUSTFLAGS="-A dead_code"; cargo build --release
           $env:RUSTFLAGS="-A dead_code"; cargo install --path circom
@@ -907,7 +910,7 @@ jobs:
 
       - name: Install Circom
         run: |
-          git clone https://github.com/iden3/circom.git
+          git clone --branch ${{ env.CIRCOM_TAG }} --depth 1 https://github.com/iden3/circom.git
           cd circom
           RUSTFLAGS="-A dead_code" cargo build --release
           RUSTFLAGS="-A dead_code" cargo install --path circom
diff --git a/justfile b/justfile
index 29a3a05..ebfcfab 100644
--- a/justfile
+++ b/justfile
@@ -1,9 +1,15 @@
-src          := justfile_directory() + "/src"
-ci_makefile  := justfile_directory() + "/.github/resources/witness-generator/Makefile"
+src             := justfile_directory() + "/src"
+ci_makefile     := justfile_directory() + "/.github/resources/witness-generator/Makefile"
+circom_version  := "2.2.2" # This version must match the version used in the CI
 
 os := `uname -s`
 sed_i := if os == "Darwin" { "sed -i ''" } else { "sed -i" }
 
+# Verify the installed circom matches the pinned version.
+check-circom:
+    @circom --version | grep -qF "{{circom_version}}" || \
+        (echo "circom {{circom_version}} required; got: $(circom --version 2>&1)" >&2; exit 1)
+
 prettify:
     nix shell nixpkgs#clang-tools -c clang-format -i src/**.cpp src/**.hpp
 
@@ -18,7 +24,7 @@ sage-run script +args='':
         sagemath/sagemath sage "$(basename '{{script}}')" {{args}}
 
 # Build the PoQ circuit and its C++ witness generator, equivalent to the CI build.
-poq:
+poq: check-circom
     circom blend/poq.circom --c --r1cs --no_asm --O2 --output blend
     # circom-generated main() has no return on the success path; patch it before -O3 turns it into an infinite loop
     {{sed_i}} ':a;N;$!ba;s/\n}\n\n*$/\n  return 0;\n}/' blend/poq_cpp/main.cpp
@@ -34,7 +40,7 @@ test-poq: poq
     cd blend/poq_cpp && ./test_ffi
 
 # Build the PoL circuit and its C++ witness generator, equivalent to the CI build.
-pol:
+pol: check-circom
     circom mantle/pol.circom --c --r1cs --no_asm --O2 --output mantle
     # circom-generated main() has no return on the success path; patch it before -O3 turns it into an infinite loop
     {{sed_i}} ':a;N;$!ba;s/\n}\n\n*$/\n  return 0;\n}/' mantle/pol_cpp/main.cpp
@@ -50,7 +56,7 @@ test-pol: pol
     cd mantle/pol_cpp && ./test_pol
 
 # Build the PoC circuit and its C++ witness generator, equivalent to the CI build.
-poc:
+poc: check-circom
     circom mantle/poc.circom --c --r1cs --no_asm --O2 --output mantle
     # circom-generated main() has no return on the success path; patch it before -O3 turns it into an infinite loop
     {{sed_i}} ':a;N;$!ba;s/\n}\n\n*$/\n  return 0;\n}/' mantle/poc_cpp/main.cpp
@@ -66,7 +72,7 @@ test-poc: poc
     cd mantle/poc_cpp && ./test_poc
 
 # Build the signature circuit and its C++ witness generator, equivalent to the CI build.
-signature:
+signature: check-circom
     circom mantle/signature.circom --c --r1cs --no_asm --O2 --output mantle
     # circom-generated main() has no return on the success path; patch it before -O3 turns it into an infinite loop
     {{sed_i}} ':a;N;$!ba;s/\n}\n\n*$/\n  return 0;\n}/' mantle/signature_cpp/main.cpp