ci: reuse bounded integration artifacts

Build target-specific nextest archives once and reuse each extraction across four host workers. Pin prebuilt tools and RISC Zero components, reduce duplicate cache writes, and preserve coverage checks.

.github/actions/build-integration-shard/action.yml

@@ -0,0 +1,69 @@
+name: Build integration test shard
+description: Builds and uploads one bounded nextest archive
+inputs:
+  shard:
+    description: Zero-based shard number
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Build integration test shard ${{ inputs.shard }}
+      env:
+        RISC0_DEV_MODE: "1"
+        SHARD: ${{ inputs.shard }}
+      run: |
+        if [[ ! "$SHARD" =~ ^[0-3]$ ]]; then
+          echo "Invalid integration test shard: $SHARD" >&2
+          exit 2
+        fi
+
+        shard_dir="$RUNNER_TEMP/integration-test-shards"
+        filter_file="$shard_dir/$SHARD.filter"
+        targets_file="$shard_dir/$SHARD.targets"
+        archive="$shard_dir/integration-tests-$SHARD.tar.zst"
+
+        target_args=()
+        while IFS= read -r target; do
+          [[ -n "$target" ]] && target_args+=(--test "$target")
+        done < "$targets_file"
+        if (( ${#target_args[@]} == 0 )); then
+          echo "Shard $SHARD has no integration test targets" >&2
+          exit 1
+        fi
+
+        cargo nextest archive \
+          -p integration_tests \
+          "${target_args[@]}" \
+          -E "$(cat "$filter_file")" \
+          --archive-file "$archive" \
+          --no-pager
+
+        archive_bytes="$(stat --format=%s "$archive")"
+        max_archive_bytes=$((512 * 1024 * 1024))
+        if (( archive_bytes > max_archive_bytes )); then
+          echo "Shard $SHARD archive is larger than the provisional 512 MiB limit" >&2
+          exit 1
+        fi
+
+        archive_size="$(du -h "$archive" | cut -f1)"
+        target_count="$(( ${#target_args[@]} / 2 ))"
+        echo "| $SHARD | $archive_size | $target_count |" >> "$GITHUB_STEP_SUMMARY"
+      shell: bash
+
+    - name: Upload integration test shard ${{ inputs.shard }}
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: integration-tests-${{ inputs.shard }}
+        path: |
+          ${{ runner.temp }}/integration-test-shards/integration-tests-${{ inputs.shard }}.tar.zst
+          ${{ runner.temp }}/integration-test-shards/${{ inputs.shard }}.targets
+        compression-level: 0
+        retention-days: 1
+        if-no-files-found: error
+
+    - name: Release integration archive disk
+      if: always()
+      env:
+        SHARD: ${{ inputs.shard }}
+      run: rm -f "$RUNNER_TEMP/integration-test-shards/integration-tests-$SHARD.tar.zst"
+      shell: bash

.github/actions/install-risc0/action.yml

@@ -1,10 +1,72 @@
 name: Install risc0
-description: Installs risc0 in the environment
+description: Installs pinned RISC Zero components in the environment
+inputs:
+  profile:
+    description: Components to install (build or runtime)
+    required: false
+    default: build
+  save-cache:
+    description: Save a missing cache from a trusted branch
+    required: false
+    default: "false"
 runs:
   using: "composite"
   steps:
-    - name: Install risc0
+    - name: Restore RISC Zero components
+      id: restore-risc0
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ~/.risc0
+        key: risc0-${{ runner.os }}-${{ runner.arch }}-${{ inputs.profile }}-rzup-0.5.0-r0vm-3.0.5-rust-1.94.1-cargo-risczero-3.0.5
+
+    - name: Install pinned RISC Zero components
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+        RISC0_PROFILE: ${{ inputs.profile }}
       run: |
-        curl -L https://risczero.com/install | bash
-        /home/runner/.risc0/bin/rzup install
+        risc0_home="${RISC0_HOME:-$HOME/.risc0}"
+        mkdir -p "$risc0_home/bin"
+
+        rzup="$risc0_home/bin/rzup"
+        rzup_sha256="7cdc1dd5d4b8ef38ea6170c45bd29ba65d389f0e96b365da61631d1fc5c6c1ca"
+        if ! echo "$rzup_sha256  $rzup" | sha256sum --check --status; then
+          rzup_download="$(mktemp)"
+          trap 'rm -f "$rzup_download"' EXIT
+          curl --proto '=https' --tlsv1.2 -fsSL \
+            https://risc0-artifacts.s3.us-west-2.amazonaws.com/rzup/prod/Linux-X64/rzup \
+            -o "$rzup_download"
+          echo "$rzup_sha256  $rzup_download" | sha256sum --check
+          install -m 0755 "$rzup_download" "$rzup"
+        fi
+
+        echo "$risc0_home/bin" >> "$GITHUB_PATH"
+        test "$("$rzup" --version)" = "rzup 0.5.0"
+
+        case "$RISC0_PROFILE" in
+          build)
+            "$rzup" install r0vm 3.0.5
+            "$rzup" install rust 1.94.1
+            "$rzup" install cargo-risczero 3.0.5
+            ;;
+          runtime)
+            "$rzup" install r0vm 3.0.5
+            ;;
+          *)
+            echo "Unsupported RISC Zero profile: $RISC0_PROFILE" >&2
+            exit 2
+            ;;
+        esac
+
+        "$rzup" show
       shell: bash
+
+    - name: Save RISC Zero components
+      if: >-
+        steps.restore-risc0.outputs.cache-hit != 'true' &&
+        inputs.save-cache == 'true' &&
+        github.event_name == 'push' &&
+        (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ~/.risc0
+        key: risc0-${{ runner.os }}-${{ runner.arch }}-${{ inputs.profile }}-rzup-0.5.0-r0vm-3.0.5-rust-1.94.1-cargo-risczero-3.0.5

.github/actions/restore-risc0-runtime/action.yml

@@ -0,0 +1,17 @@
+name: Restore RISC Zero runtime
+description: Restores the producer's pinned r0vm binary
+runs:
+  using: composite
+  steps:
+    - name: Download RISC Zero runtime
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      with:
+        name: risc0-runtime-3.0.5
+        path: ${{ runner.temp }}/risc0-runtime
+
+    - name: Install RISC Zero runtime
+      run: |
+        mkdir -p "$HOME/.cargo/bin"
+        install -m 0755 "$RUNNER_TEMP/risc0-runtime/r0vm" "$HOME/.cargo/bin/r0vm"
+        test "$(r0vm --version)" = "risc0-r0vm 3.0.5"
+      shell: bash

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/bench-regression.yml

@@ -2,8 +2,8 @@ on:
   pull_request:
     paths:
       - "tools/crypto_primitives_bench/**"
-      - "lez/key_protocol/**"
-      - "lee/core/**"
+      - "lee/key_protocol/**"
+      - "lee/state_machine/core/**"
       - ".github/workflows/bench-regression.yml"
 
 permissions:
@@ -12,27 +12,31 @@ permissions:
 
 name: bench-regression
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_INCREMENTAL: "0"
+
 jobs:
   crypto-primitives:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
           # criterion-compare-action checks out the base branch in a second
           # working tree, so we need the full history.
           fetch-depth: 0
 
       - uses: ./.github/actions/install-system-deps
 
-      - uses: ./.github/actions/install-risc0
-
       - name: Install active toolchain
-        run: rustup install
+        run: rustup install --profile minimal
 
       - name: Run criterion-compare against base branch
-        uses: boa-dev/criterion-compare-action@v3
+        uses: boa-dev/criterion-compare-action@adfd3a94634fe2041ce5613eb7df09d247555b87 # v3.2.4
         with:
           branchName: ${{ github.base_ref }}
           cwd: tools/crypto_primitives_bench

.github/workflows/ci.yml

@@ -1,3 +1,5 @@
+name: General
+
 on:
   push:
     branches:
@@ -14,49 +16,55 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
 
-name: General
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_INCREMENTAL: "0"
+  CARGO_PROFILE_TEST_DEBUG: "0"
+  NEXTEST_VERSION: "0.9.140"
 
 jobs:
   fmt-rs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Install nightly toolchain for rustfmt
-        run: rustup install nightly --profile minimal --component rustfmt
+        run: rustup install nightly-2026-04-14 --profile minimal --component rustfmt
 
       - name: Check Rust files are formatted
-        run: cargo +nightly fmt --check
+        run: cargo +nightly-2026-04-14 fmt --check
 
   fmt-toml:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Install taplo-cli
-        run: cargo install --locked taplo-cli
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: taplo-cli@0.10.0
+          fallback: none
 
       - name: Check TOML files are formatted
-        run: taplo fmt --check .
+        run: taplo fmt --check
 
   machete:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Install active toolchain
-        run: rustup install
+        run: rustup install --profile minimal
 
       - name: Install cargo-machete
-        run: cargo install cargo-machete
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: cargo-machete@0.9.2
+          fallback: none
 
       - name: Check for unused dependencies
         run: cargo machete
@@ -64,12 +72,13 @@ jobs:
   deny:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Install cargo-deny
-        run: cargo install --locked cargo-deny
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: cargo-deny@0.20.2
+          fallback: none
 
       - name: Check licenses and advisories
         run: cargo deny check
@@ -77,25 +86,20 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     timeout-minutes: 60
-
-    name: lint
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: ./.github/actions/install-system-deps
 
-      - uses: ./.github/actions/install-risc0
-
       - name: Install active toolchain
-        run: rustup install
+        run: rustup install --profile minimal --component clippy
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ci-rust-cache
-          save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }}
+          cache-bin: false
+          save-if: false
 
       - name: Lint workspace
         env:
@@ -107,202 +111,344 @@ jobs:
           RISC0_SKIP_BUILD: "1"
         run: cargo clippy -p "*program" -- -D warnings
 
+      - name: Check rustdoc links
+        env:
+          RISC0_SKIP_BUILD: "1"
+          RUSTDOCFLAGS: -D warnings
+        run: |
+          cargo doc \
+            --workspace \
+            --all-features \
+            --no-deps \
+            --exclude test_program_guests \
+            --exclude test_methods_guests
+
+          for package in test_program_guests test_methods_guests; do
+            cargo doc \
+              -p "$package" \
+              --all-features \
+              --no-deps \
+              --target-dir "$RUNNER_TEMP/rustdoc-$package"
+          done
+
   unit-tests:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: ./.github/actions/install-system-deps
 
+      - name: Install active toolchain
+        run: rustup install --profile minimal
+
       - uses: ./.github/actions/install-risc0
 
-      - name: Install active toolchain
-        run: rustup install
-
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ci-rust-cache
-          save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }}
+          cache-bin: false
+          save-if: false
 
       - name: Install nextest
-        run: cargo install --locked cargo-nextest
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: nextest@${{ env.NEXTEST_VERSION }}
+          fallback: none
 
       - name: Run tests
         env:
           RISC0_DEV_MODE: "1"
-          RUST_LOG: "info"
-        run: cargo nextest run --workspace --exclude integration_tests --exclude test_fixtures --all-features
+          RUST_LOG: info
+        run: cargo nextest run --workspace --exclude integration_tests --exclude test_fixtures --all-features --no-fail-fast
 
   test-fixtures-tests:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: ./.github/actions/install-system-deps
 
-      - uses: ./.github/actions/install-risc0
-
       - name: Install active toolchain
-        run: rustup install
+        run: rustup install --profile minimal
+
+      - uses: ./.github/actions/install-risc0
+        with:
+          profile: runtime
+          save-cache: "true"
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ci-rust-cache
-          save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }}
+          cache-bin: false
+          save-if: false
 
       - name: Install nextest
-        run: cargo install --locked cargo-nextest
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: nextest@${{ env.NEXTEST_VERSION }}
+          fallback: none
 
       - name: Run test_fixtures tests
         env:
           RISC0_DEV_MODE: "1"
-          RUST_LOG: "info"
-        run: cargo nextest run -p test_fixtures
+          RUST_LOG: info
+        run: cargo nextest run -p test_fixtures --no-fail-fast
 
-  integration-tests-prebuild:
-    runs-on: ubuntu-latest
-    outputs:
-      targets: ${{ steps.discover-targets.outputs.targets }}
+  integration-tests-prepare:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - uses: ./.github/actions/install-system-deps
 
-      - uses: ./.github/actions/install-risc0
-
       - name: Install active toolchain
-        run: rustup install
+        run: rustup install --profile minimal
+
+      - uses: ./.github/actions/install-risc0
+        with:
+          save-cache: "true"
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ci-rust-cache
+          cache-bin: false
           save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }}
 
       - name: Install nextest
-        run: cargo install --locked cargo-nextest
-
-      - name: Build integration test archive
-        env:
-          RISC0_DEV_MODE: "1"
-        run: cargo nextest archive -p integration_tests --archive-file integration-tests.tar.zst --no-pager
-
-      - name: Upload integration test archive
-        uses: actions/upload-artifact@v4
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
         with:
-          name: integration-tests-archive
-          path: integration-tests.tar.zst
+          tool: nextest@${{ env.NEXTEST_VERSION }}
+          fallback: none
 
-      - name: Discover integration test targets from archive
-        id: discover-targets
+      - name: Discover and validate integration test shards
         run: |
-          cargo nextest list \
-            --archive-file integration-tests.tar.zst \
-            --list-type binaries-only \
-            --message-format json \
-            --no-pager > integration-tests-binaries.json
+          shard_dir="$RUNNER_TEMP/integration-test-shards"
+          mkdir -p "$shard_dir"
 
-          targets_json="$(jq -c '[."rust-binaries" | to_entries[] | select(.value.kind == "test" and .value."binary-name" != "tps") | .value."binary-name"] | sort | unique' integration-tests-binaries.json)"
+          cargo metadata \
+            --no-deps \
+            --format-version 1 > "$shard_dir/metadata.json"
 
-          if [[ "$targets_json" == "[]" ]]; then
-            echo "No integration test targets were discovered." >&2
+          jq -r '
+            [.packages[]
+              | select(.name == "integration_tests")
+              | .targets[]
+              | select(.kind | index("test"))
+              | select(.name != "tps")
+              | .name]
+            | sort
+            | unique[]
+          ' "$shard_dir/metadata.json" > "$shard_dir/discovered.targets"
+
+          shard_targets=(
+            "indexer_ffi_state_consistency keys token indexer_block_batching indexer_test_run_ffi shared_accounts account"
+            "amm cross_zone_bridge pinata indexer_state_consistency_with_labels indexer_test_run vault program_deployment"
+            "indexer_ffi_state_consistency_with_labels ata auth_transfer indexer_stall indexer_ffi_block_batching private_pda block_size_limit cross_zone_state_machine"
+            "cross_zone_verified two_zone bridge indexer_state_consistency cross_zone_ping wallet_ffi config cross_zone_ingress_guard"
+          )
+
+          for shard in "${!shard_targets[@]}"; do
+            targets_file="$shard_dir/$shard.targets"
+            filter_file="$shard_dir/$shard.filter"
+            tr ' ' '\n' <<< "${shard_targets[$shard]}" > "$targets_file"
+            awk '
+              { printf "%s%s", separator, "binary(=" $0 ")"; separator = " | " }
+              END { print "" }
+            ' "$targets_file" > "$filter_file"
+          done
+
+          sort "$shard_dir"/[0-3].targets > "$shard_dir/assigned.targets"
+          if ! diff -u "$shard_dir/discovered.targets" "$shard_dir/assigned.targets"; then
+            echo "Every non-tps integration binary must belong to exactly one shard." >&2
             exit 1
           fi
 
-          echo "targets=$targets_json" >> "$GITHUB_OUTPUT"
-          echo "Discovered integration targets: $targets_json"
+          {
+            echo "### Integration archive shards"
+            echo
+            echo "| Shard | Archive size | Binaries |"
+            echo "| ---: | ---: | ---: |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - uses: ./.github/actions/build-integration-shard
+        with:
+          shard: "0"
+
+      - uses: ./.github/actions/build-integration-shard
+        with:
+          shard: "1"
+
+      - uses: ./.github/actions/build-integration-shard
+        with:
+          shard: "2"
+
+      - uses: ./.github/actions/build-integration-shard
+        with:
+          shard: "3"
+
+      - name: Stage RISC Zero runtime
+        run: |
+          mkdir -p "$RUNNER_TEMP/risc0-runtime"
+          install -m 0755 "$(command -v r0vm)" "$RUNNER_TEMP/risc0-runtime/r0vm"
+
+      - name: Upload RISC Zero runtime
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: risc0-runtime-3.0.5
+          path: ${{ runner.temp }}/risc0-runtime/r0vm
+          compression-level: 6
+          retention-days: 1
+          if-no-files-found: error
 
   integration-tests:
-    needs: [test-fixtures-tests, integration-tests-prebuild]
-    runs-on: ubuntu-latest
+    needs:
+      - test-fixtures-tests
+      - integration-tests-prepare
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     strategy:
       fail-fast: false
+      max-parallel: 4
       matrix:
-        target: ${{ fromJson(needs.integration-tests-prebuild.outputs.targets) }}
-    name: integration-tests (${{ matrix.target }})
+        shard: [0, 1, 2, 3]
+    name: integration-tests (shard ${{ matrix.shard }})
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - uses: ./.github/actions/install-system-deps
-
-      - uses: ./.github/actions/install-risc0
-
-      - name: Install active toolchain
-        run: rustup install
-
-      - name: Download integration test archive
-        uses: actions/download-artifact@v4
-        with:
-          name: integration-tests-archive
+      - uses: ./.github/actions/restore-risc0-runtime
 
       - name: Install nextest
-        run: cargo install --locked cargo-nextest
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: nextest@${{ env.NEXTEST_VERSION }}
+          fallback: none
 
-      - name: Run tests
+      - name: Download integration test shard
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: integration-tests-${{ matrix.shard }}
+          path: ${{ runner.temp }}/integration-test-shard
+
+      - name: Run integration test shard
         env:
           RISC0_DEV_MODE: "1"
-          RUST_LOG: "info"
-        run: cargo nextest run --archive-file integration-tests.tar.zst -E "binary(${{ matrix.target }})"
+          RUST_LOG: info
+        run: |
+          archive="$RUNNER_TEMP/integration-test-shard/integration-tests-${{ matrix.shard }}.tar.zst"
+          targets="$RUNNER_TEMP/integration-test-shard/${{ matrix.shard }}.targets"
+          extract_dir="$RUNNER_TEMP/nextest-shard"
+          mkdir -p "$extract_dir"
+          cargo-nextest nextest list \
+            --archive-file "$archive" \
+            --extract-to "$extract_dir" \
+            --workspace-remap "$GITHUB_WORKSPACE" \
+            --list-type binaries-only \
+            --message-format json \
+            --no-pager > /dev/null
+          rm -f "$archive"
+
+          available_kib="$(df --output=avail -k "$RUNNER_TEMP" | tail -n 1 | tr -d ' ')"
+          minimum_free_kib=$((6 * 1024 * 1024))
+          if (( available_kib < minimum_free_kib )); then
+            echo "Less than 6 GiB remains after shard extraction." >&2
+            df -h "$RUNNER_TEMP" >&2
+            exit 1
+          fi
+
+          common_args=(
+            --cargo-metadata "$extract_dir/target/nextest/cargo-metadata.json"
+            --binaries-metadata "$extract_dir/target/nextest/binaries-metadata.json"
+            --target-dir-remap "$extract_dir/target"
+            --workspace-remap "$GITHUB_WORKSPACE"
+            --no-fail-fast
+          )
+
+          failed=0
+          while IFS= read -r binary; do
+            echo "::group::integration binary: $binary"
+            if ! cargo-nextest nextest run "${common_args[@]}" -E "binary(=$binary)"; then
+              failed=1
+            fi
+            echo "::endgroup::"
+          done < "$targets"
+
+          exit "$failed"
 
   valid-proof-test:
-    runs-on: ubuntu-latest
+    needs: integration-tests-prepare
+    runs-on: ubuntu-24.04
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - uses: ./.github/actions/restore-risc0-runtime
+
+      - name: Install nextest
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+          tool: nextest@${{ env.NEXTEST_VERSION }}
+          fallback: none
 
-      - uses: ./.github/actions/install-system-deps
-
-      - uses: ./.github/actions/install-risc0
-
-      - name: Install active toolchain
-        run: rustup install
-
-      - name: Restore Rust cache
-        uses: Swatinem/rust-cache@v2
+      - name: Download integration test shard
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
-          shared-key: ci-rust-cache
-          save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }}
+          name: integration-tests-2
+          path: ${{ runner.temp }}/integration-test-shard
 
       - name: Test valid proof
         env:
-          RUST_LOG: "info"
-        run: cargo test -p integration_tests -- --exact private::private_transfer_to_owned_account
+          RUST_LOG: info
+        run: |
+          archive="$RUNNER_TEMP/integration-test-shard/integration-tests-2.tar.zst"
+          extract_dir="$RUNNER_TEMP/nextest-shard"
+          mkdir -p "$extract_dir"
+          cargo-nextest nextest list \
+            --archive-file "$archive" \
+            --extract-to "$extract_dir" \
+            --workspace-remap "$GITHUB_WORKSPACE" \
+            --list-type binaries-only \
+            --message-format json \
+            --no-pager > /dev/null
+          rm -f "$archive"
+
+          cargo-nextest nextest run \
+            --cargo-metadata "$extract_dir/target/nextest/cargo-metadata.json" \
+            --binaries-metadata "$extract_dir/target/nextest/binaries-metadata.json" \
+            --target-dir-remap "$extract_dir/target" \
+            --workspace-remap "$GITHUB_WORKSPACE" \
+            -E 'binary(=auth_transfer) & test(=private::private_transfer_to_owned_account)'
 
   artifacts:
     runs-on: ubuntu-latest
     timeout-minutes: 60
-
-    name: artifacts
     steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.head_ref }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Install active toolchain
+        run: rustup install --profile minimal
 
       - uses: ./.github/actions/install-risc0
+        with:
+          profile: build
 
       - name: Restore Rust cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           shared-key: ci-rust-cache
-          save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }}
+          cache-bin: false
+          save-if: false
 
       - name: Install just
-        run: cargo install --locked just
+        uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2
+        with:
+          tool: just@1.56.0
+          fallback: none
 
       - name: Build artifacts
         run: just build-artifacts

.github/workflows/publish_images.yml

@@ -15,20 +15,20 @@ jobs:
   risc0_base:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Log in to registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push risc0 base image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
           file: ./lez/docker/risc0-base.Dockerfile
@@ -58,13 +58,13 @@ jobs:
             dockerfile: ./lez/explorer_service/Dockerfile
             build_args: ""
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Log in to registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKER_USERNAME }}
@@ -72,7 +72,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
         with:
           images: ${{ secrets.DOCKER_REGISTRY }}/${{ github.repository }}/${{ matrix.name }}
           tags: |
@@ -85,7 +85,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
           file: ${{ matrix.dockerfile }}
@@ -94,5 +94,5 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: ${{ matrix.build_args }}
           build-contexts: risc0_base=docker-image://${{ secrets.DOCKER_REGISTRY }}/${{ github.repository }}/risc0_base:sha-${{ github.sha }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=${{ matrix.name }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.name }}

lee/state_machine/core/src/encryption/shared_key_derivation.rs

@@ -110,9 +110,9 @@ impl SharedSecretKey {
 
     /// Receiver: decapsulate the shared secret from a KEM ciphertext.
     ///
-    /// Returns `None` if the `EphemeralPublicKey` is not exactly [`ML_KEM_768_CIPHERTEXT_LEN`]
-    /// bytes — callers on the wallet scan path should skip the output rather than panic on
-    /// malformed chain data.
+    /// Returns `None` if the `EphemeralPublicKey` is not exactly
+    /// [`crate::ML_KEM_768_CIPHERTEXT_LEN`] bytes — callers on the wallet scan path should skip
+    /// the output rather than panic on malformed chain data.
     ///
     /// `d` and `z` are the two 32-byte halves of the FIPS 203 `ViewingSecretKey` seed.
     #[must_use]

lez/programs/src/lib.rs

@@ -1,4 +1,4 @@
-//! This crate provides [`Program`]s and associated utilities used by LEZ.
+//! This crate provides LEZ [`Program`](lee::program::Program) artifacts and related utilities.
 
 #[cfg(feature = "artifacts")]
 pub use inner::*;