foundry-rs
diff --git a/‎.github/TEMPO_NIGHTLY_FAILURE_TEMPLATE.md‎
Lines changed: 10 additions & 0 deletions b/‎.github/TEMPO_NIGHTLY_FAILURE_TEMPLATE.md‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎.github/workflows/ci-tempo.yml‎
Lines changed: 58 additions & 33 deletions b/‎.github/workflows/ci-tempo.yml‎
Lines changed: 58 additions & 33 deletions
diff --git a/‎.github/workflows/docker-publish.yml‎
Lines changed: 30 additions & 0 deletions b/‎.github/workflows/docker-publish.yml‎
Lines changed: 30 additions & 0 deletions
diff --git a/‎.github/workflows/release.yml‎
Lines changed: 72 additions & 6 deletions b/‎.github/workflows/release.yml‎
Lines changed: 72 additions & 6 deletions
@@ -0,0 +1,10 @@
+---
+title: "bug: tempo nightly workflow failed"
+labels: P-high, T-bug
+---
+
+The nightly Tempo workflow (mainnet and testnet checks) has failed. This indicates a regression in Foundry's Tempo support or an issue with the Tempo mainnet/testnet endpoints.
+
+Check the [tempo nightly workflow page]({{ env.WORKFLOW_URL }}) for details.
+
+This issue was raised by the workflow at `.github/workflows/ci-tempo.yml`.
@@ -6,6 +6,8 @@ on:
   push:
     branches: [master]
   pull_request:
+  schedule:
+    - cron: "0 2 * * *" # Run daily at 2 AM UTC (offset from other nightlies)
   workflow_dispatch:
     inputs:
       network:
@@ -59,36 +61,28 @@ jobs:
           cargo build --profile dev --locked -p forge -p cast -p anvil -p chisel
           echo "${{ github.workspace }}/target/debug" >> "$GITHUB_PATH"
 
-      # TODO: re-enable once devnet is up and stable
-      # - name: Run Tempo check on devnet
-      #   if: |
-      #     github.event_name == 'pull_request' ||
-      #     github.event.inputs.network == 'devnet' ||
-      #     github.event.inputs.network == 'all'
-      #   env:
-      #     ETH_RPC_URL: ${{ secrets.TEMPO_DEVNET_RPC_URL }}
-      #     SCRIPTS: ${{ github.event.inputs.scripts || 'both' }}
-      #   run: |
-      #     if [ "$SCRIPTS" = "check" ] || [ "$SCRIPTS" = "both" ]; then
-      #       ./.github/scripts/tempo-check.sh
-      #     fi
-      #     if [ "$SCRIPTS" = "deploy" ] || [ "$SCRIPTS" = "both" ]; then
-      #       ./.github/scripts/tempo-deploy.sh
-      #     fi
-
-      # TODO: re-enable once devnet is up and stable
-      # - name: Run Tempo wallet tests on devnet
-      #   if: |
-      #     github.event_name == 'pull_request' ||
-      #     github.event.inputs.network == 'devnet' ||
-      #     github.event.inputs.network == 'all'
-      #   env:
-      #     ETH_RPC_URL: ${{ secrets.TEMPO_DEVNET_RPC_URL }}
-      #   run: ./.github/scripts/tempo-wallet.sh
+      - name: Run Tempo check on mainnet
+        if: |
+          github.event_name == 'schedule' ||
+          github.event.inputs.network == 'mainnet' ||
+          github.event.inputs.network == 'all'
+        env:
+          ETH_RPC_URL: ${{ secrets.TEMPO_MAINNET_RPC_URL }}
+          TEMPO_FEE_TOKEN: "0x20c0000000000000000000000000000000000000"
+          VERIFIER_URL: ${{ secrets.VERIFIER_URL }}
+          PRIVATE_KEY: ${{ secrets.THROW_AWAY_MAINNET_PKEY }}
+          SCRIPTS: ${{ github.event.inputs.scripts || 'both' }}
+        run: |
+          if [ "$SCRIPTS" = "check" ] || [ "$SCRIPTS" = "both" ]; then
+            ./.github/scripts/tempo-check.sh
+          fi
+          if [ "$SCRIPTS" = "deploy" ] || [ "$SCRIPTS" = "both" ]; then
+            ./.github/scripts/tempo-deploy.sh
+          fi
 
       - name: Run Tempo check on testnet
         if: |
-          github.event_name == 'pull_request' ||
+          github.event_name == 'schedule' ||
           github.event.inputs.network == 'testnet' ||
           github.event.inputs.network == 'all'
         env:
@@ -103,15 +97,14 @@ jobs:
             ./.github/scripts/tempo-deploy.sh
           fi
 
-      - name: Run Tempo check on mainnet
+      - name: Run Tempo check on devnet
         if: |
-          github.event.inputs.network == 'mainnet' ||
+          github.event_name == 'push' ||
+          github.event_name == 'pull_request' ||
+          github.event.inputs.network == 'devnet' ||
           github.event.inputs.network == 'all'
         env:
-          ETH_RPC_URL: ${{ secrets.TEMPO_MAINNET_RPC_URL }}
-          TEMPO_FEE_TOKEN: "0x20c0000000000000000000000000000000000000"
-          VERIFIER_URL: ${{ secrets.VERIFIER_URL }}
-          PRIVATE_KEY: ${{ secrets.THROW_AWAY_MAINNET_PKEY }}
+          ETH_RPC_URL: ${{ secrets.TEMPO_DEVNET_RPC_URL }}
           SCRIPTS: ${{ github.event.inputs.scripts || 'both' }}
         run: |
           if [ "$SCRIPTS" = "check" ] || [ "$SCRIPTS" = "both" ]; then
@@ -120,3 +113,35 @@ jobs:
           if [ "$SCRIPTS" = "deploy" ] || [ "$SCRIPTS" = "both" ]; then
             ./.github/scripts/tempo-deploy.sh
           fi
+
+      - name: Run Tempo wallet tests on devnet
+        if: |
+          github.event_name == 'push' ||
+          github.event_name == 'pull_request' ||
+          github.event.inputs.network == 'devnet' ||
+          github.event.inputs.network == 'all'
+        env:
+          ETH_RPC_URL: ${{ secrets.TEMPO_DEVNET_RPC_URL }}
+        run: ./.github/scripts/tempo-wallet.sh
+
+  # If the nightly run fails, this will create an issue to signal so.
+  issue:
+    name: Open an issue
+    runs-on: ubuntu-latest
+    needs: [tempo-check]
+    if: failure() && github.event_name == 'schedule'
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: JasonEtco/create-an-issue@1b14a70e4d8dc185e5cc76d3bec9eab20257b2c5 # v2.9.2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          WORKFLOW_URL: |
+            ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        with:
+          update_existing: true
+          filename: .github/TEMPO_NIGHTLY_FAILURE_TEMPLATE.md
@@ -32,6 +32,8 @@ jobs:
     name: build and push
     runs-on: depot-ubuntu-latest
     permissions:
+      attestations: write
+      artifact-metadata: write
       contents: read
       id-token: write
       packages: write
@@ -92,6 +94,7 @@ jobs:
         uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.7.1
 
       - name: Build and push Foundry image
+        id: build
         uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
         with:
           build-args: |
@@ -106,3 +109,30 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           no-cache: true
+          sbom: true
+          provenance: mode=max
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+
+      - name: Sign image with cosign (keyless)
+        env:
+          DOCKER_TAGS: ${{ steps.docker_tagging.outputs.docker_tags }}
+          DIGEST: ${{ steps.build.outputs.digest }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          IFS=',' read -r -a tags <<< "$DOCKER_TAGS"
+          for tag in "${tags[@]}"; do
+            # Strip any tag suffix and pin to immutable digest, then sign.
+            ref="${tag%%:*}@${DIGEST}"
+            printf 'Signing %s\n' "$ref"
+            cosign sign --yes "$ref"
+          done
+
+      - name: Image build provenance attestation
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
@@ -71,7 +71,7 @@ jobs:
 
       - name: Build changelog
         id: build_changelog
-        uses: mikepenz/release-changelog-builder-action@bcae7115752d4ed746ff92feb666574428a79415 # v6.2
+        uses: mikepenz/release-changelog-builder-action@bcae7115752d4ed746ff92feb666574428a79415 # v6.2.1
         with:
           configuration: "./.github/changelog.json"
           fromTag: ${{ steps.release_info.outputs.from_tag || '' }}
@@ -117,6 +117,8 @@ jobs:
     needs: prepare
     uses: ./.github/workflows/docker-publish.yml
     permissions:
+      attestations: write
+      artifact-metadata: write
       contents: read
       id-token: write
       packages: write
@@ -129,9 +131,10 @@ jobs:
   # way, GitHub's immutable-releases setting seals the release at publish.
   release:
     permissions:
-      id-token: write
-      contents: write
       attestations: write
+      artifact-metadata: write
+      contents: write
+      id-token: write
     name: release ${{ matrix.target }} (${{ matrix.runner }})
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 240
@@ -264,6 +267,38 @@ jobs:
             printf "file_name=%s\n" "foundry_${VERSION_NAME}_${PLATFORM_NAME}_${ARCH}.zip" >> "$GITHUB_OUTPUT"
           fi
           printf "foundry_attestation=%s\n" "foundry_${VERSION_NAME}_${PLATFORM_NAME}_${ARCH}.attestation.txt" >> "$GITHUB_OUTPUT"
+          printf "foundry_sbom=%s\n" "foundry_${VERSION_NAME}_${PLATFORM_NAME}_${ARCH}.spdx.json" >> "$GITHUB_OUTPUT"
+          printf "foundry_checksum=%s\n" "foundry_${VERSION_NAME}_${PLATFORM_NAME}_${ARCH}.sha256" >> "$GITHUB_OUTPUT"
+          printf "foundry_signature=%s\n" "foundry_${VERSION_NAME}_${PLATFORM_NAME}_${ARCH}.sigstore.json" >> "$GITHUB_OUTPUT"
+
+      - name: Generate archive checksum
+        env:
+          FILE_NAME: ${{ steps.artifacts.outputs.file_name }}
+          FOUNDRY_CHECKSUM: ${{ steps.artifacts.outputs.foundry_checksum }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if command -v sha256sum >/dev/null 2>&1; then
+            sha256sum "$FILE_NAME" > "$FOUNDRY_CHECKSUM"
+          else
+            shasum -a 256 "$FILE_NAME" > "$FOUNDRY_CHECKSUM"
+          fi
+          cat "$FOUNDRY_CHECKSUM"
+
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+
+      - name: Generate SBOM (SPDX)
+        env:
+          FOUNDRY_SBOM: ${{ steps.artifacts.outputs.foundry_sbom }}
+          VERSION_NAME: ${{ (env.IS_NIGHTLY == 'true' && 'nightly') || needs.prepare.outputs.tag_name }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          syft scan dir:. \
+            --source-name foundry \
+            --source-version "$VERSION_NAME" \
+            -o spdx-json="$FOUNDRY_SBOM"
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -292,15 +327,37 @@ jobs:
           tar -czvf "foundry_man_${VERSION_NAME}.tar.gz" forge.1.gz cast.1.gz anvil.1.gz chisel.1.gz
           printf 'foundry_man=%s\n' "foundry_man_${VERSION_NAME}.tar.gz" >> "$GITHUB_OUTPUT"
 
-      - name: Binaries attestation
+      - name: Binaries and archive provenance attestation
         id: attestation
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
         with:
           subject-path: |
             ${{ env.anvil_bin_path }}
             ${{ env.cast_bin_path }}
             ${{ env.chisel_bin_path }}
             ${{ env.forge_bin_path }}
+            ${{ steps.artifacts.outputs.file_name }}
+
+      - name: Archive SBOM attestation
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: ${{ steps.artifacts.outputs.file_name }}
+          sbom-path: ${{ steps.artifacts.outputs.foundry_sbom }}
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+
+      - name: Sign archive with cosign (keyless)
+        env:
+          FILE_NAME: ${{ steps.artifacts.outputs.file_name }}
+          FOUNDRY_SIGNATURE: ${{ steps.artifacts.outputs.foundry_signature }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          cosign sign-blob \
+            --yes \
+            --bundle "$FOUNDRY_SIGNATURE" \
+            "$FILE_NAME"
 
       - name: Record attestation URL
         env:
@@ -321,11 +378,20 @@ jobs:
           TAG_NAME: ${{ needs.prepare.outputs.tag_name }}
           FILE_NAME: ${{ steps.artifacts.outputs.file_name }}
           FOUNDRY_ATTESTATION: ${{ steps.artifacts.outputs.foundry_attestation }}
+          FOUNDRY_SBOM: ${{ steps.artifacts.outputs.foundry_sbom }}
+          FOUNDRY_CHECKSUM: ${{ steps.artifacts.outputs.foundry_checksum }}
+          FOUNDRY_SIGNATURE: ${{ steps.artifacts.outputs.foundry_signature }}
           FOUNDRY_MAN: ${{ steps.man.outputs.foundry_man }}
         shell: bash
         run: |
           set -euo pipefail
-          files=("$FILE_NAME" "$FOUNDRY_ATTESTATION")
+          files=(
+            "$FILE_NAME"
+            "$FOUNDRY_ATTESTATION"
+            "$FOUNDRY_SBOM"
+            "$FOUNDRY_CHECKSUM"
+            "$FOUNDRY_SIGNATURE"
+          )
           if [[ -n "${FOUNDRY_MAN:-}" ]]; then
             files+=("$FOUNDRY_MAN")
           fi