diff --git a/.github/actions/build-integration-shard/action.yml b/.github/actions/build-integration-shard/action.yml new file mode 100644 index 00000000..3a5bc8e9 --- /dev/null +++ b/.github/actions/build-integration-shard/action.yml @@ -0,0 +1,69 @@ +name: Build integration test shard +description: Builds and uploads one bounded nextest archive +inputs: + shard: + description: Zero-based shard number + required: true +runs: + using: composite + steps: + - name: Build integration test shard ${{ inputs.shard }} + env: + RISC0_DEV_MODE: "1" + SHARD: ${{ inputs.shard }} + run: | + if [[ ! "$SHARD" =~ ^[0-3]$ ]]; then + echo "Invalid integration test shard: $SHARD" >&2 + exit 2 + fi + + shard_dir="$RUNNER_TEMP/integration-test-shards" + filter_file="$shard_dir/$SHARD.filter" + targets_file="$shard_dir/$SHARD.targets" + archive="$shard_dir/integration-tests-$SHARD.tar.zst" + + target_args=() + while IFS= read -r target; do + [[ -n "$target" ]] && target_args+=(--test "$target") + done < "$targets_file" + if (( ${#target_args[@]} == 0 )); then + echo "Shard $SHARD has no integration test targets" >&2 + exit 1 + fi + + cargo nextest archive \ + -p integration_tests \ + "${target_args[@]}" \ + -E "$(cat "$filter_file")" \ + --archive-file "$archive" \ + --no-pager + + archive_bytes="$(stat --format=%s "$archive")" + max_archive_bytes=$((512 * 1024 * 1024)) + if (( archive_bytes > max_archive_bytes )); then + echo "Shard $SHARD archive is larger than the provisional 512 MiB limit" >&2 + exit 1 + fi + + archive_size="$(du -h "$archive" | cut -f1)" + target_count="$(( ${#target_args[@]} / 2 ))" + echo "| $SHARD | $archive_size | $target_count |" >> "$GITHUB_STEP_SUMMARY" + shell: bash + + - name: Upload integration test shard ${{ inputs.shard }} + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: integration-tests-${{ inputs.shard }} + path: | + ${{ runner.temp }}/integration-test-shards/integration-tests-${{ inputs.shard }}.tar.zst + ${{ runner.temp }}/integration-test-shards/${{ inputs.shard }}.targets + compression-level: 0 + retention-days: 1 + if-no-files-found: error + + - name: Release integration archive disk + if: always() + env: + SHARD: ${{ inputs.shard }} + run: rm -f "$RUNNER_TEMP/integration-test-shards/integration-tests-$SHARD.tar.zst" + shell: bash diff --git a/.github/actions/install-risc0/action.yml b/.github/actions/install-risc0/action.yml index fef3a467..76c7247d 100644 --- a/.github/actions/install-risc0/action.yml +++ b/.github/actions/install-risc0/action.yml @@ -1,10 +1,72 @@ name: Install risc0 -description: Installs risc0 in the environment +description: Installs pinned RISC Zero components in the environment +inputs: + profile: + description: Components to install (build or runtime) + required: false + default: build + save-cache: + description: Save a missing cache from a trusted branch + required: false + default: "false" runs: using: "composite" steps: - - name: Install risc0 + - name: Restore RISC Zero components + id: restore-risc0 + uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + with: + path: ~/.risc0 + key: risc0-${{ runner.os }}-${{ runner.arch }}-${{ inputs.profile }}-rzup-0.5.0-r0vm-3.0.5-rust-1.94.1-cargo-risczero-3.0.5 + + - name: Install pinned RISC Zero components + env: + GITHUB_TOKEN: ${{ github.token }} + RISC0_PROFILE: ${{ inputs.profile }} run: | - curl -L https://risczero.com/install | bash - /home/runner/.risc0/bin/rzup install + risc0_home="${RISC0_HOME:-$HOME/.risc0}" + mkdir -p "$risc0_home/bin" + + rzup="$risc0_home/bin/rzup" + rzup_sha256="7cdc1dd5d4b8ef38ea6170c45bd29ba65d389f0e96b365da61631d1fc5c6c1ca" + if ! echo "$rzup_sha256 $rzup" | sha256sum --check --status; then + rzup_download="$(mktemp)" + trap 'rm -f "$rzup_download"' EXIT + curl --proto '=https' --tlsv1.2 -fsSL \ + https://risc0-artifacts.s3.us-west-2.amazonaws.com/rzup/prod/Linux-X64/rzup \ + -o "$rzup_download" + echo "$rzup_sha256 $rzup_download" | sha256sum --check + install -m 0755 "$rzup_download" "$rzup" + fi + + echo "$risc0_home/bin" >> "$GITHUB_PATH" + test "$("$rzup" --version)" = "rzup 0.5.0" + + case "$RISC0_PROFILE" in + build) + "$rzup" install r0vm 3.0.5 + "$rzup" install rust 1.94.1 + "$rzup" install cargo-risczero 3.0.5 + ;; + runtime) + "$rzup" install r0vm 3.0.5 + ;; + *) + echo "Unsupported RISC Zero profile: $RISC0_PROFILE" >&2 + exit 2 + ;; + esac + + "$rzup" show shell: bash + + - name: Save RISC Zero components + if: >- + steps.restore-risc0.outputs.cache-hit != 'true' && + inputs.save-cache == 'true' && + github.event_name == 'push' && + (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') + uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + with: + path: ~/.risc0 + key: risc0-${{ runner.os }}-${{ runner.arch }}-${{ inputs.profile }}-rzup-0.5.0-r0vm-3.0.5-rust-1.94.1-cargo-risczero-3.0.5 diff --git a/.github/actions/restore-risc0-runtime/action.yml b/.github/actions/restore-risc0-runtime/action.yml new file mode 100644 index 00000000..5a6880c0 --- /dev/null +++ b/.github/actions/restore-risc0-runtime/action.yml @@ -0,0 +1,17 @@ +name: Restore RISC Zero runtime +description: Restores the producer's pinned r0vm binary +runs: + using: composite + steps: + - name: Download RISC Zero runtime + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + with: + name: risc0-runtime-3.0.5 + path: ${{ runner.temp }}/risc0-runtime + + - name: Install RISC Zero runtime + run: | + mkdir -p "$HOME/.cargo/bin" + install -m 0755 "$RUNNER_TEMP/risc0-runtime/r0vm" "$HOME/.cargo/bin/r0vm" + test "$(r0vm --version)" = "risc0-r0vm 3.0.5" + shell: bash diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..e38985c1 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +version: 2 + +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + github-actions: + patterns: + - "*" diff --git a/.github/workflows/bench-regression.yml b/.github/workflows/bench-regression.yml index d82c0f11..16a57947 100644 --- a/.github/workflows/bench-regression.yml +++ b/.github/workflows/bench-regression.yml @@ -2,8 +2,8 @@ on: pull_request: paths: - "tools/crypto_primitives_bench/**" - - "lez/key_protocol/**" - - "lee/core/**" + - "lee/key_protocol/**" + - "lee/state_machine/core/**" - ".github/workflows/bench-regression.yml" permissions: @@ -12,27 +12,31 @@ permissions: name: bench-regression +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +env: + CARGO_INCREMENTAL: "0" + jobs: crypto-primitives: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} # criterion-compare-action checks out the base branch in a second # working tree, so we need the full history. fetch-depth: 0 - uses: ./.github/actions/install-system-deps - - uses: ./.github/actions/install-risc0 - - name: Install active toolchain - run: rustup install + run: rustup install --profile minimal - name: Run criterion-compare against base branch - uses: boa-dev/criterion-compare-action@v3 + uses: boa-dev/criterion-compare-action@adfd3a94634fe2041ce5613eb7df09d247555b87 # v3.2.4 with: branchName: ${{ github.base_ref }} cwd: tools/crypto_primitives_bench diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 194646f3..fbd3f26c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,3 +1,5 @@ +name: General + on: push: branches: @@ -14,49 +16,55 @@ on: permissions: contents: read - pull-requests: read -name: General +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +env: + CARGO_INCREMENTAL: "0" + CARGO_PROFILE_TEST_DEBUG: "0" + NEXTEST_VERSION: "0.9.140" jobs: fmt-rs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - name: Install nightly toolchain for rustfmt - run: rustup install nightly --profile minimal --component rustfmt + run: rustup install nightly-2026-04-14 --profile minimal --component rustfmt - name: Check Rust files are formatted - run: cargo +nightly fmt --check + run: cargo +nightly-2026-04-14 fmt --check fmt-toml: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - name: Install taplo-cli - run: cargo install --locked taplo-cli + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 + with: + tool: taplo-cli@0.10.0 + fallback: none - name: Check TOML files are formatted - run: taplo fmt --check . + run: taplo fmt --check machete: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - name: Install active toolchain - run: rustup install + run: rustup install --profile minimal - name: Install cargo-machete - run: cargo install cargo-machete + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 + with: + tool: cargo-machete@0.9.2 + fallback: none - name: Check for unused dependencies run: cargo machete @@ -64,12 +72,13 @@ jobs: deny: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - name: Install cargo-deny - run: cargo install --locked cargo-deny + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 + with: + tool: cargo-deny@0.20.2 + fallback: none - name: Check licenses and advisories run: cargo deny check @@ -77,25 +86,20 @@ jobs: lint: runs-on: ubuntu-latest timeout-minutes: 60 - - name: lint steps: - - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - uses: ./.github/actions/install-system-deps - - uses: ./.github/actions/install-risc0 - - name: Install active toolchain - run: rustup install + run: rustup install --profile minimal --component clippy - name: Restore Rust cache - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: shared-key: ci-rust-cache - save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }} + cache-bin: false + save-if: false - name: Lint workspace env: @@ -107,202 +111,344 @@ jobs: RISC0_SKIP_BUILD: "1" run: cargo clippy -p "*program" -- -D warnings + - name: Check rustdoc links + env: + RISC0_SKIP_BUILD: "1" + RUSTDOCFLAGS: -D warnings + run: | + cargo doc \ + --workspace \ + --all-features \ + --no-deps \ + --exclude test_program_guests \ + --exclude test_methods_guests + + for package in test_program_guests test_methods_guests; do + cargo doc \ + -p "$package" \ + --all-features \ + --no-deps \ + --target-dir "$RUNNER_TEMP/rustdoc-$package" + done + unit-tests: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - uses: ./.github/actions/install-system-deps + - name: Install active toolchain + run: rustup install --profile minimal + - uses: ./.github/actions/install-risc0 - - name: Install active toolchain - run: rustup install - - name: Restore Rust cache - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: shared-key: ci-rust-cache - save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }} + cache-bin: false + save-if: false - name: Install nextest - run: cargo install --locked cargo-nextest + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 + with: + tool: nextest@${{ env.NEXTEST_VERSION }} + fallback: none - name: Run tests env: RISC0_DEV_MODE: "1" - RUST_LOG: "info" - run: cargo nextest run --workspace --exclude integration_tests --exclude test_fixtures --all-features + RUST_LOG: info + run: cargo nextest run --workspace --exclude integration_tests --exclude test_fixtures --all-features --no-fail-fast test-fixtures-tests: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - uses: ./.github/actions/install-system-deps - - uses: ./.github/actions/install-risc0 - - name: Install active toolchain - run: rustup install + run: rustup install --profile minimal + + - uses: ./.github/actions/install-risc0 + with: + profile: runtime + save-cache: "true" - name: Restore Rust cache - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: shared-key: ci-rust-cache - save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }} + cache-bin: false + save-if: false - name: Install nextest - run: cargo install --locked cargo-nextest + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 + with: + tool: nextest@${{ env.NEXTEST_VERSION }} + fallback: none - name: Run test_fixtures tests env: RISC0_DEV_MODE: "1" - RUST_LOG: "info" - run: cargo nextest run -p test_fixtures + RUST_LOG: info + run: cargo nextest run -p test_fixtures --no-fail-fast - integration-tests-prebuild: - runs-on: ubuntu-latest - outputs: - targets: ${{ steps.discover-targets.outputs.targets }} + integration-tests-prepare: + runs-on: ubuntu-24.04 + timeout-minutes: 60 steps: - - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - uses: ./.github/actions/install-system-deps - - uses: ./.github/actions/install-risc0 - - name: Install active toolchain - run: rustup install + run: rustup install --profile minimal + + - uses: ./.github/actions/install-risc0 + with: + save-cache: "true" - name: Restore Rust cache - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: shared-key: ci-rust-cache + cache-bin: false save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }} - name: Install nextest - run: cargo install --locked cargo-nextest - - - name: Build integration test archive - env: - RISC0_DEV_MODE: "1" - run: cargo nextest archive -p integration_tests --archive-file integration-tests.tar.zst --no-pager - - - name: Upload integration test archive - uses: actions/upload-artifact@v4 + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 with: - name: integration-tests-archive - path: integration-tests.tar.zst + tool: nextest@${{ env.NEXTEST_VERSION }} + fallback: none - - name: Discover integration test targets from archive - id: discover-targets + - name: Discover and validate integration test shards run: | - cargo nextest list \ - --archive-file integration-tests.tar.zst \ - --list-type binaries-only \ - --message-format json \ - --no-pager > integration-tests-binaries.json + shard_dir="$RUNNER_TEMP/integration-test-shards" + mkdir -p "$shard_dir" - targets_json="$(jq -c '[."rust-binaries" | to_entries[] | select(.value.kind == "test" and .value."binary-name" != "tps") | .value."binary-name"] | sort | unique' integration-tests-binaries.json)" + cargo metadata \ + --no-deps \ + --format-version 1 > "$shard_dir/metadata.json" - if [[ "$targets_json" == "[]" ]]; then - echo "No integration test targets were discovered." >&2 + jq -r ' + [.packages[] + | select(.name == "integration_tests") + | .targets[] + | select(.kind | index("test")) + | select(.name != "tps") + | .name] + | sort + | unique[] + ' "$shard_dir/metadata.json" > "$shard_dir/discovered.targets" + + shard_targets=( + "indexer_ffi_state_consistency keys token indexer_block_batching indexer_test_run_ffi shared_accounts account" + "amm cross_zone_bridge pinata indexer_state_consistency_with_labels indexer_test_run vault program_deployment" + "indexer_ffi_state_consistency_with_labels ata auth_transfer indexer_stall indexer_ffi_block_batching private_pda block_size_limit cross_zone_state_machine" + "cross_zone_verified two_zone bridge indexer_state_consistency cross_zone_ping wallet_ffi config cross_zone_ingress_guard" + ) + + for shard in "${!shard_targets[@]}"; do + targets_file="$shard_dir/$shard.targets" + filter_file="$shard_dir/$shard.filter" + tr ' ' '\n' <<< "${shard_targets[$shard]}" > "$targets_file" + awk ' + { printf "%s%s", separator, "binary(=" $0 ")"; separator = " | " } + END { print "" } + ' "$targets_file" > "$filter_file" + done + + sort "$shard_dir"/[0-3].targets > "$shard_dir/assigned.targets" + if ! diff -u "$shard_dir/discovered.targets" "$shard_dir/assigned.targets"; then + echo "Every non-tps integration binary must belong to exactly one shard." >&2 exit 1 fi - echo "targets=$targets_json" >> "$GITHUB_OUTPUT" - echo "Discovered integration targets: $targets_json" + { + echo "### Integration archive shards" + echo + echo "| Shard | Archive size | Binaries |" + echo "| ---: | ---: | ---: |" + } >> "$GITHUB_STEP_SUMMARY" + + - uses: ./.github/actions/build-integration-shard + with: + shard: "0" + + - uses: ./.github/actions/build-integration-shard + with: + shard: "1" + + - uses: ./.github/actions/build-integration-shard + with: + shard: "2" + + - uses: ./.github/actions/build-integration-shard + with: + shard: "3" + + - name: Stage RISC Zero runtime + run: | + mkdir -p "$RUNNER_TEMP/risc0-runtime" + install -m 0755 "$(command -v r0vm)" "$RUNNER_TEMP/risc0-runtime/r0vm" + + - name: Upload RISC Zero runtime + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + with: + name: risc0-runtime-3.0.5 + path: ${{ runner.temp }}/risc0-runtime/r0vm + compression-level: 6 + retention-days: 1 + if-no-files-found: error integration-tests: - needs: [test-fixtures-tests, integration-tests-prebuild] - runs-on: ubuntu-latest + needs: + - test-fixtures-tests + - integration-tests-prepare + runs-on: ubuntu-24.04 timeout-minutes: 90 strategy: fail-fast: false + max-parallel: 4 matrix: - target: ${{ fromJson(needs.integration-tests-prebuild.outputs.targets) }} - name: integration-tests (${{ matrix.target }}) + shard: [0, 1, 2, 3] + name: integration-tests (shard ${{ matrix.shard }}) steps: - - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - - uses: ./.github/actions/install-system-deps - - - uses: ./.github/actions/install-risc0 - - - name: Install active toolchain - run: rustup install - - - name: Download integration test archive - uses: actions/download-artifact@v4 - with: - name: integration-tests-archive + - uses: ./.github/actions/restore-risc0-runtime - name: Install nextest - run: cargo install --locked cargo-nextest + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 + with: + tool: nextest@${{ env.NEXTEST_VERSION }} + fallback: none - - name: Run tests + - name: Download integration test shard + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + with: + name: integration-tests-${{ matrix.shard }} + path: ${{ runner.temp }}/integration-test-shard + + - name: Run integration test shard env: RISC0_DEV_MODE: "1" - RUST_LOG: "info" - run: cargo nextest run --archive-file integration-tests.tar.zst -E "binary(${{ matrix.target }})" + RUST_LOG: info + run: | + archive="$RUNNER_TEMP/integration-test-shard/integration-tests-${{ matrix.shard }}.tar.zst" + targets="$RUNNER_TEMP/integration-test-shard/${{ matrix.shard }}.targets" + extract_dir="$RUNNER_TEMP/nextest-shard" + mkdir -p "$extract_dir" + cargo-nextest nextest list \ + --archive-file "$archive" \ + --extract-to "$extract_dir" \ + --workspace-remap "$GITHUB_WORKSPACE" \ + --list-type binaries-only \ + --message-format json \ + --no-pager > /dev/null + rm -f "$archive" + + available_kib="$(df --output=avail -k "$RUNNER_TEMP" | tail -n 1 | tr -d ' ')" + minimum_free_kib=$((6 * 1024 * 1024)) + if (( available_kib < minimum_free_kib )); then + echo "Less than 6 GiB remains after shard extraction." >&2 + df -h "$RUNNER_TEMP" >&2 + exit 1 + fi + + common_args=( + --cargo-metadata "$extract_dir/target/nextest/cargo-metadata.json" + --binaries-metadata "$extract_dir/target/nextest/binaries-metadata.json" + --target-dir-remap "$extract_dir/target" + --workspace-remap "$GITHUB_WORKSPACE" + --no-fail-fast + ) + + failed=0 + while IFS= read -r binary; do + echo "::group::integration binary: $binary" + if ! cargo-nextest nextest run "${common_args[@]}" -E "binary(=$binary)"; then + failed=1 + fi + echo "::endgroup::" + done < "$targets" + + exit "$failed" valid-proof-test: - runs-on: ubuntu-latest + needs: integration-tests-prepare + runs-on: ubuntu-24.04 timeout-minutes: 90 steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - uses: ./.github/actions/restore-risc0-runtime + + - name: Install nextest + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + tool: nextest@${{ env.NEXTEST_VERSION }} + fallback: none - - uses: ./.github/actions/install-system-deps - - - uses: ./.github/actions/install-risc0 - - - name: Install active toolchain - run: rustup install - - - name: Restore Rust cache - uses: Swatinem/rust-cache@v2 + - name: Download integration test shard + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: - shared-key: ci-rust-cache - save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }} + name: integration-tests-2 + path: ${{ runner.temp }}/integration-test-shard - name: Test valid proof env: - RUST_LOG: "info" - run: cargo test -p integration_tests -- --exact private::private_transfer_to_owned_account + RUST_LOG: info + run: | + archive="$RUNNER_TEMP/integration-test-shard/integration-tests-2.tar.zst" + extract_dir="$RUNNER_TEMP/nextest-shard" + mkdir -p "$extract_dir" + cargo-nextest nextest list \ + --archive-file "$archive" \ + --extract-to "$extract_dir" \ + --workspace-remap "$GITHUB_WORKSPACE" \ + --list-type binaries-only \ + --message-format json \ + --no-pager > /dev/null + rm -f "$archive" + + cargo-nextest nextest run \ + --cargo-metadata "$extract_dir/target/nextest/cargo-metadata.json" \ + --binaries-metadata "$extract_dir/target/nextest/binaries-metadata.json" \ + --target-dir-remap "$extract_dir/target" \ + --workspace-remap "$GITHUB_WORKSPACE" \ + -E 'binary(=auth_transfer) & test(=private::private_transfer_to_owned_account)' artifacts: runs-on: ubuntu-latest timeout-minutes: 60 - - name: artifacts steps: - - uses: actions/checkout@v5 - with: - ref: ${{ github.event.pull_request.head.sha || github.head_ref }} + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Install active toolchain + run: rustup install --profile minimal - uses: ./.github/actions/install-risc0 + with: + profile: build - name: Restore Rust cache - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 with: shared-key: ci-rust-cache - save-if: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }} + cache-bin: false + save-if: false - name: Install just - run: cargo install --locked just + uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2.83.2 + with: + tool: just@1.56.0 + fallback: none - name: Build artifacts run: just build-artifacts diff --git a/.github/workflows/publish_images.yml b/.github/workflows/publish_images.yml index 28abb67c..4a3821c9 100644 --- a/.github/workflows/publish_images.yml +++ b/.github/workflows/publish_images.yml @@ -15,20 +15,20 @@ jobs: risc0_base: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ${{ secrets.DOCKER_REGISTRY }} username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - name: Build and push risc0 base image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 with: context: . file: ./lez/docker/risc0-base.Dockerfile @@ -58,13 +58,13 @@ jobs: dockerfile: ./lez/explorer_service/Dockerfile build_args: "" steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - name: Log in to registry - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: registry: ${{ secrets.DOCKER_REGISTRY }} username: ${{ secrets.DOCKER_USERNAME }} @@ -72,7 +72,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 with: images: ${{ secrets.DOCKER_REGISTRY }}/${{ github.repository }}/${{ matrix.name }} tags: | @@ -85,7 +85,7 @@ jobs: type=raw,value=latest,enable={{is_default_branch}} - name: Build and push Docker image - uses: docker/build-push-action@v5 + uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 with: context: . file: ${{ matrix.dockerfile }} @@ -94,5 +94,5 @@ jobs: labels: ${{ steps.meta.outputs.labels }} build-args: ${{ matrix.build_args }} build-contexts: risc0_base=docker-image://${{ secrets.DOCKER_REGISTRY }}/${{ github.repository }}/risc0_base:sha-${{ github.sha }} - cache-from: type=gha - cache-to: type=gha,mode=max + cache-from: type=gha,scope=${{ matrix.name }} + cache-to: type=gha,mode=max,scope=${{ matrix.name }} diff --git a/lee/state_machine/core/src/encryption/shared_key_derivation.rs b/lee/state_machine/core/src/encryption/shared_key_derivation.rs index 3255080b..c8862603 100644 --- a/lee/state_machine/core/src/encryption/shared_key_derivation.rs +++ b/lee/state_machine/core/src/encryption/shared_key_derivation.rs @@ -110,9 +110,9 @@ impl SharedSecretKey { /// Receiver: decapsulate the shared secret from a KEM ciphertext. /// - /// Returns `None` if the `EphemeralPublicKey` is not exactly [`ML_KEM_768_CIPHERTEXT_LEN`] - /// bytes — callers on the wallet scan path should skip the output rather than panic on - /// malformed chain data. + /// Returns `None` if the `EphemeralPublicKey` is not exactly + /// [`crate::ML_KEM_768_CIPHERTEXT_LEN`] bytes — callers on the wallet scan path should skip + /// the output rather than panic on malformed chain data. /// /// `d` and `z` are the two 32-byte halves of the FIPS 203 `ViewingSecretKey` seed. #[must_use] diff --git a/lez/programs/src/lib.rs b/lez/programs/src/lib.rs index fb448038..4d3d72a4 100644 --- a/lez/programs/src/lib.rs +++ b/lez/programs/src/lib.rs @@ -1,4 +1,4 @@ -//! This crate provides [`Program`]s and associated utilities used by LEZ. +//! This crate provides LEZ [`Program`](lee::program::Program) artifacts and related utilities. #[cfg(feature = "artifacts")] pub use inner::*;