chore(op-reth): merge upstream v2.4.3

.circleci/AGENTS.md

@@ -0,0 +1 @@
+../docs/ai/ci-config-review.md

.circleci/CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

.circleci/config.yml

@@ -11,11 +11,11 @@ parameters:
   default_docker_image:
     type: string
     default: cimg/base:2026.03
-  # Pinned ci-base-clang image (cimg/base + clang/llvm-dev/libclang-dev + protobuf-compiler) for Rust jobs.
+  # Pinned Wolfi Rust base image (clang/libclang, mold, sccache, Go, Rust) for Rust jobs.
   # Provenance is verified by .github/workflows/security.yml.
   rust_base_image:
     type: string
-    default: us-docker.pkg.dev/oplabs-tools-artifacts/images/ci-base-clang@sha256:873a6709dd48d7706b0baee139300f18ab7babf4a66f982b2383fe51ce2e5489
+    default: us-docker.pkg.dev/oplabs-tools-artifacts/images/nexus/circleci-runner-wolfi@sha256:f79d7c422cf320f67bbd9dbe3f36ed2755bf800d7065e4fbb63a034c3ff56914
   base_image:
     type: string
     default: default
@@ -65,6 +65,9 @@ parameters:
   rust_e2e_dispatch:
     type: boolean
     default: false
+  rust_nightly_bump_dispatch:
+    type: boolean
+    default: false
   l2_fork_test_dispatch:
     type: boolean
     default: false
@@ -84,20 +87,24 @@ parameters:
 
 orbs:
   continuation: circleci/continuation@2.0.1
+  utils: ethereum-optimism/circleci-utils@1.0.31
 
 jobs:
   # --------------------------------------------------------------------------
-  # This job prepares the dynamic continuation pipeline in 6 steps:
+  # This job prepares the dynamic continuation pipeline in 7 steps:
   #
-  #   1. Install yq (YAML processor for merging configs)
+  #   1. Install the mise toolset (front-loads the shared mise cache; provides
+  #      yq for merging configs)
   #   2. Store string pipeline params  → /tmp/pipeline-parameters.json
   #   3. Store boolean pipeline params → /tmp/pipeline-parameters.json
   #   4. Detect file-tree changes     → /tmp/pipeline-parameters.json
-  #   5. Decision tree: read the JSON, enable c-run_* workflow flags, strip
-  #      intermediate params, write final JSON
+  #   5. Routing policy (compute-workflow-conditions.sh): read the JSON, enable
+  #      c-run_* workflow flags, strip intermediate params, write final JSON
   #   6. Merge continuation YAML configs → /tmp/merged-config.yml
   #   7. Call CircleCI continuation API with merged config + JSON params
   #
+  # The routing data (schedules, dispatch flags, change patterns, passthrough
+  # params) is declarative in routing.yml; the scripts only hold the logic.
   # The result: only workflows whose c-run_* flag is true will execute.
   # --------------------------------------------------------------------------
   prepare-continuation-config:
@@ -107,16 +114,28 @@ jobs:
       BASE_REVISION: develop
     steps:
       - checkout
-      # yq is used by the "Merge continuation configs" step to deep-merge YAML files.
-      # Keep version in sync with mise.toml.
+      # Front-loads the mise toolset for the whole pipeline: this job always
+      # completes before the continuation pipeline exists, so on a cold cache
+      # (mise.toml change or eviction) it is the only job that cold-installs —
+      # every continuation job restores the cache saved here. During an
+      # upstream outage (GitHub rate limits, missing release attestations) the
+      # blast radius is this one job instead of every job on every PR.
+      # Also provides yq (pinned in mise.toml) for the merge/routing scripts.
+      #
+      # This must remain a full, unfiltered `mise install`: the orb saves
+      # /data/mise-data under a write-once key, so narrowing the install here
+      # (e.g. to just yq) would freeze an incomplete toolset for every
+      # continuation job and silently force them all to cold-install forever.
+      - utils/install-mise:
+          enable_mise_cache: true
+      # mise shims re-resolve the tool on every invocation, which the yq/jq
+      # loops in the routing scripts below pay hundreds of times (~9s of
+      # overhead measured). Putting the resolved tool bin directories ahead
+      # of the shims makes those calls direct.
       - run:
-          name: Install yq
+          name: Put mise tool bin paths on PATH
           command: |
-            YQ_VERSION="4.44.5"
-            wget -qO /usr/local/bin/yq \
-              "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64"
-            chmod +x /usr/local/bin/yq
-            echo "yq version: $(yq --version)"
+            echo "export PATH=\"$(mise bin-paths | paste -sd: -):\$PATH\"" >> "$BASH_ENV"
       # Validates the decision tree logic against known scenarios.
       # Fails fast if a refactor breaks expected workflow activation.
       - run:
@@ -141,8 +160,8 @@ jobs:
       # Same as above but for booleans. Separate step because CircleCI renders
       # boolean pipeline params as 0/1 in environment blocks — the "bool" mode
       # normalizes them to JSON true/false.
-      # These dispatch flags are consumed only by the decision tree below;
-      # they do NOT reach continuation configs.
+      # These dispatch flags are consumed only by the routing policy
+      # (compute-workflow-conditions.sh); they do NOT reach continuation configs.
       - run:
           name: Store boolean pipeline parameters in JSON file
           command: .circleci/scripts/collect-params.sh bool
@@ -159,167 +178,34 @@ jobs:
             c-heavy_fuzz_dispatch: << pipeline.parameters.heavy_fuzz_dispatch >>
             c-rust_ci_dispatch: << pipeline.parameters.rust_ci_dispatch >>
             c-rust_e2e_dispatch: << pipeline.parameters.rust_e2e_dispatch >>
+            c-rust_nightly_bump_dispatch: << pipeline.parameters.rust_nightly_bump_dispatch >>
             c-l2_fork_test_dispatch: << pipeline.parameters.l2_fork_test_dispatch >>
-      # Each env var value is a POSIX Extended Regular Expression (ERE, like grep -E).
-      # Matched line-by-line against `git diff --name-only origin/develop...HEAD`.
-      # Result: the c-* key is set to true/false in the JSON.
+      # Change-detection patterns live in routing.yml (change_patterns.any and
+      # change_patterns.all). Each is a POSIX ERE matched line-by-line against
+      # `git diff --name-only origin/develop...HEAD`; collect-params.sh writes
+      # the resulting c-<name> boolean into the JSON.
       #
       # Test a pattern locally:
       #   git diff --name-only origin/develop...HEAD | grep -E "^your/pattern/"
-      #
-      # When to add: you need path-based workflow gating. Also add a corresponding
-      # is_true/run call in the decision tree below.
       - run:
           name: Detect file tree changes and store in JSON file
           command: .circleci/scripts/collect-params.sh detect
-          environment:
-            c-contracts_changed: "^(packages/contracts-bedrock|op-core/forks|op-core/nuts|\\.circleci|\\.github|ops/check-changed)/|^(package\\.json|mise\\.toml)$"
-            c-docs_changes_detected: "^docs/public-docs/"
-            c-rust_changes_detected: "^(rust|op-e2e|\\.circleci)/"
-      # Safer "docs-only" detection: true iff EVERY changed file is under docs/public-docs/.
-      # Using an inclusion (all-match) check instead of an exclusion of known code categories
-      # makes the fast path safe-by-default — any path not enumerated by the patterns above
-      # still falls through to the full main workflow.
       - run:
           name: Detect docs-only changes (all-match)
           command: .circleci/scripts/collect-params.sh detect_all
-          environment:
-            c-only_docs_changes: "^docs/public-docs/"
-      # Decision tree: determines which workflows to enable based on trigger, branch, and params.
-      #
-      # Helpers (defined in workflow-helpers.sh):
-      #   run foo      → sets c-run_foo: true in JSON (maps 1:1 to
-      #                   "when: << pipeline.parameters.c-run_foo >>" in a continuation config)
-      #   is_true x   → checks if c-x is true in JSON (set by earlier steps)
-      #   param x     → reads raw value of c-x from JSON
-      #   finalize    → strips intermediate params, keeps only the listed whitelist + all c-run_* flags
-      #
-      # How to add a new workflow:
-      #   1. Add "c-run_your_workflow: {type: boolean, default: false}" in the relevant continuation config
-      #   2. Add "run your_workflow" in the appropriate branch below
+      # Routing policy: enables the c-run_* workflow flags based on trigger,
+      # branch, schedule, and the detected params. The workflow lists are data
+      # in routing.yml; the conditions live in compute-workflow-conditions.sh.
+      # Each c-run_<name> maps 1:1 to "when: << pipeline.parameters.c-run_<name> >>"
+      # in a continuation config under .circleci/continue/.
       - run:
           name: Compute workflow conditions from pipeline parameters and store in JSON file
           environment:
             BRANCH: << pipeline.git.branch >>
             TRIGGER_SOURCE: << pipeline.trigger_source >>
             TAG: << pipeline.git.tag >>
             SCHEDULE_NAME: << pipeline.schedule.name >>
-          command: |
-            set -euo pipefail
-            source .circleci/scripts/workflow-helpers.sh
-            init_json
-
-            case "${TRIGGER_SOURCE}" in
-
-              # Scheduled pipelines: map schedule name → workflows
-              scheduled_pipeline)
-                case "${SCHEDULE_NAME}" in
-                  build_four_hours) run scheduled_todo_issues scheduled_cannon_full_tests ;;
-                  build_daily)      run scheduled_preimage_reproducibility scheduled_stale_check scheduled_heavy_fuzz_tests ;;
-                  build_weekly)     run scheduled_weekly_tests scheduled_kona_link_checker ;;
-                esac
-                ;;
-
-              # Webhook (push events)
-              webhook)
-                # --- Tag push ---
-                if [[ -n "${TAG}" ]]; then
-                  run release
-
-                # =========================================================
-                #  Three mutually exclusive lifecycle stages:
-                # =========================================================
-
-                # 1. PR (feature branch push)
-                #    Runs on every push to a feature branch.
-                #    Path-based gating: only changed areas are tested.
-                #    Docs-only changes skip main/release entirely.
-                # ---------------------------------------------------------
-                elif [[ "${BRANCH}" != "develop" && ! "${BRANCH}" =~ ^gh-readonly-queue/ ]]; then
-                  if is_true only_docs_changes; then
-                    run ci_gate_skip
-                    run contracts_feature_tests_short
-                    run rust_ci_gate_short
-                    run rust_e2e_gate_skip
-                  else
-                    run main
-                    run release
-                    if is_true contracts_changed; then
-                      run contracts_feature_tests
-                    else
-                      run contracts_feature_tests_short
-                    fi
-                    if is_true rust_changes_detected; then
-                      run rust_ci
-                      run rust_e2e_ci
-                    else
-                      run rust_ci_gate_short
-                      run rust_e2e_gate_skip
-                    fi
-                  fi
-
-                # 2. Merge queue (pre-merge validation)
-                #    Runs when GitHub merge queue picks up the PR.
-                #    Full contract tests, path-gated rust/docs.
-                # ---------------------------------------------------------
-                elif [[ "${BRANCH}" =~ ^gh-readonly-queue/ ]]; then
-                  run main
-                  run release
-                  run contracts_feature_tests
-                  if is_true rust_changes_detected; then
-                    run rust_ci
-                    run rust_e2e_ci
-                  else
-                    run rust_ci_gate_short
-                    run rust_e2e_gate_skip
-                  fi
-
-                # 3. After merge (develop push)
-                #    Runs after the merge queue completes and pushes to develop.
-                #    Adds expensive post-merge jobs: fault proofs, kontrol, prestate publishing.
-                # ---------------------------------------------------------
-                elif [[ "${BRANCH}" == "develop" ]]; then
-                  run main
-                  run release
-                  run publish_contract_artifacts
-                  run develop_fault_proofs
-                  run develop_kontrol_tests
-                  run contracts_feature_tests
-                  if is_true rust_changes_detected; then
-                    run rust_ci
-                    run rust_e2e_ci
-                    run kona_publish_prestates
-                  else
-                    run rust_ci_gate_short
-                    run rust_e2e_gate_skip
-                  fi
-                fi
-                ;;
-
-              # API triggers: dispatch flags select workflows
-              api)
-                run release
-                if is_true main_dispatch && [[ "$(param github-event-type)" == "__not_set__" ]]; then
-                  run main contracts_feature_tests
-                fi
-                if is_true fault_proofs_dispatch;     then run develop_fault_proofs; fi
-                if is_true kontrol_dispatch;          then run develop_kontrol_tests; fi
-                if is_true cannon_full_test_dispatch; then run scheduled_cannon_full_tests; fi
-                if is_true reproducibility_dispatch;  then run scheduled_preimage_reproducibility; fi
-                if is_true stale_check_dispatch;      then run scheduled_stale_check; fi
-                if is_true heavy_fuzz_dispatch;       then run scheduled_heavy_fuzz_tests; fi
-                if is_true publish_contract_artifacts_dispatch; then run publish_contract_artifacts; fi
-                if is_true l2_fork_test_dispatch;     then run l2_fork_test; fi
-                if is_true rust_ci_dispatch;          then run rust_ci; fi
-                if is_true rust_e2e_dispatch;         then run rust_e2e_ci; fi
-                if [[ "$(param github-event-type)" == "pull_request" && "$(param github-event-action)" == "labeled" ]]; then
-                  run close_issue
-                fi
-                ;;
-            esac
-
-            # Params to forward to continuation configs (everything else is stripped)
-            finalize "c-default_docker_image,c-rust_base_image,c-base_image,c-github-event-base64,c-go-cache-version,c-publish_contract_artifacts_ref"
+          command: .circleci/scripts/compute-workflow-conditions.sh
       # Deep-merges the 3 continuation YAML configs (main, rust-ci, rust-e2e)
       # into /tmp/merged-config.yml using yq. Later files win on key conflicts.
       # explode(.) resolves YAML anchors/aliases so the output is self-contained.
@@ -341,14 +227,21 @@ workflows:
     when:
       equal: ["", << pipeline.git.tag >>]
     jobs:
-      - prepare-continuation-config
+      - prepare-continuation-config:
+          # MISE_GITHUB_TOKEN: authenticated GitHub API quota for mise's tool
+          # downloads (5,000 req/h per token vs 60/h/IP anonymous).
+          context:
+            - circleci-repo-readonly-authenticated-github-token
 
   setup-tag:
     when:
       not:
         equal: ["", << pipeline.git.tag >>]
     jobs:
       - prepare-continuation-config:
+          # MISE_GITHUB_TOKEN, as in the setup workflow above.
+          context:
+            - circleci-repo-readonly-authenticated-github-token
           filters:
             tags:
               only: /.*/

.circleci/continue/helpers.yml

@@ -74,10 +74,7 @@ commands:
           name: Configure Rust binary paths (sysgo)
           command: |
             ROOT_DIR="$(pwd)"
-            BIN_DIR="$ROOT_DIR/.circleci-cache/rust-binaries"
             echo "export RUST_BINARY_PATH_KONA_NODE=$ROOT_DIR/rust/target/release/kona-node" >> "$BASH_ENV"
-            echo "export RUST_BINARY_PATH_OP_RBUILDER=$BIN_DIR/op-rbuilder" >> "$BASH_ENV"
-            echo "export RUST_BINARY_PATH_ROLLUP_BOOST=$BIN_DIR/rollup-boost" >> "$BASH_ENV"
 
   rust-prepare:
     parameters:
@@ -101,13 +98,13 @@ commands:
             - run:
                 name: Ensure clang available
                 command: 'command -v clang >/dev/null 2>&1 || { echo "ERROR: clang is required but was not found in PATH" >&2; exit 1; }'
-      # protoc + libprotobuf-dev well-known types (sp1-sdk prost/tonic build
-      # dep) are preinstalled in ci-base-clang, so just assert their presence.
+      # protoc (sp1-sdk prost/tonic build dep) bundles the well-known type
+      # includes it resolves, so its presence on PATH is enough to assert.
       - run:
           name: Ensure protobuf compiler available
           command: |
-            if ! command -v protoc >/dev/null 2>&1 || [ ! -f /usr/include/google/protobuf/empty.proto ]; then
-              echo "ERROR: protoc and the protobuf well-known type includes are required but were not found in PATH (expected in the ci-base-clang image)" >&2
+            if ! command -v protoc >/dev/null 2>&1; then
+              echo "ERROR: protoc is required but was not found in PATH" >&2
               exit 1
             fi
             protoc --version