Merge remote-tracking branch 'origin/master' into HEAD

# Conflicts:
#	crates/lint/README.md
#	crates/lint/src/sol/info/mod.rs

Author: mablr

.github/actionlint.yaml

@@ -0,0 +1,12 @@
+self-hosted-runner:
+  labels:
+    - depot-ubuntu-22.04-16
+    - depot-ubuntu-22.04-arm-16
+    - depot-ubuntu-24.04-32
+    - depot-ubuntu-latest-arm-16
+    - depot-ubuntu-latest
+    - depot-ubuntu-latest-16
+    - depot-macos-latest
+    - depot-windows-latest-16
+
+config-variables: null

.github/scripts/bump-tempo.sh

@@ -14,6 +14,7 @@ set -euo pipefail
 #   Sets outputs in $GITHUB_OUTPUT if it exists:
 #     - current_rev: The current tempo revision
 #     - latest_rev: The latest tempo revision on main
+#     - latest_rev_short: The short latest tempo revision
 #     - updated: "true" if dependencies were updated, "false" otherwise
 #     - changelog: Path to changelog file (if updated)
 
@@ -107,6 +108,7 @@ main() {
   LATEST_REV=$(get_latest_rev)
   echo "Latest revision:  $LATEST_REV"
   set_output "latest_rev" "$LATEST_REV"
+  set_output "latest_rev_short" "${LATEST_REV:0:7}"
 
   if [[ "$CURRENT_REV" == "$LATEST_REV" ]]; then
     echo ""

.github/scripts/compare-nightly.sh

@@ -23,6 +23,11 @@ prev = json.load(open(prev_path)) if prev_path and os.path.isfile(prev_path) els
 with open(os.environ["TODAY_JSON"]) as f:
     today = json.load(f)
 
+# Each value is either the current summary object ({"mean": ..., ...}) or, for
+# historical files, a bare mean-seconds float. Normalize to the mean.
+def mean_of(v):
+    return v["mean"] if isinstance(v, dict) else v
+
 print("## Nightly Benchmark Regression Report\n")
 print("| Benchmark | Stable | Nightly | Δ | Status |")
 print("|-----------|--------|---------|---|--------|")
@@ -33,12 +38,14 @@ for key in all_keys:
     t = today.get(key)
     p = prev.get(key)
     if t is None:
-        print(f"| `{key}` | {p:.5f}s | N/A | — | ⚠️ Missing |")
+        print(f"| `{key}` | {mean_of(p):.5f}s | N/A | — | ⚠️ Missing |")
         has_regression = True
         continue
     if p is None:
-        print(f"| `{key}` | N/A | {t:.5f}s | — | 🆕 New |")
+        print(f"| `{key}` | N/A | {mean_of(t):.5f}s | — | 🆕 New |")
         continue
+    t = mean_of(t)
+    p = mean_of(p)
     delta = (t - p) / p * 100
     if delta >= fail:
         status = "🔴 Regression"

.github/scripts/matrices.py

@@ -45,7 +45,8 @@ class Expanded:
     runner_label: str
     target: str
     svm_target_platform: str
-    flags: str
+    filter: str
+    partition_arg: str
     partition: int
 
     def __init__(
@@ -54,14 +55,16 @@ def __init__(
         runner_label: str,
         target: str,
         svm_target_platform: str,
-        flags: str,
+        filter: str,
+        partition_arg: str,
         partition: int,
     ):
         self.name = name
         self.runner_label = runner_label
         self.target = target
         self.svm_target_platform = svm_target_platform
-        self.flags = flags
+        self.filter = filter
+        self.partition_arg = partition_arg
         self.partition = partition
 
 
@@ -108,22 +111,21 @@ def main():
                     os_str = f" ({target.target})"
 
                 name = case.name
-                flags = f"-E '{case.filter}'"
+                partition_arg = ""
                 if case.n_partitions > 1:
                     s = f"{partition}/{case.n_partitions}"
                     name += f" ({s})"
-                    flags += f" --partition count:{s}"
+                    partition_arg = f"count:{s}"
 
                 name += os_str
 
-                flags += " --no-fail-fast"
-
                 obj = Expanded(
                     name=name,
                     runner_label=target.runner_label,
                     target=target.target,
                     svm_target_platform=target.svm_target_platform,
-                    flags=flags,
+                    filter=case.filter,
+                    partition_arg=partition_arg,
                     partition=partition,
                 )
                 expanded.append(vars(obj))

.github/scripts/tempo-check.sh

@@ -6,8 +6,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Non-verification tempo checks: local tests, fork tests, cast commands, DEX operations
 
-# Hardfork version, defaults to T5.
-HARDFORK="${TEMPO_HARDFORK:-T5}"
+# Hardfork version, defaults to T7.
+HARDFORK="${TEMPO_HARDFORK:-T7}"
 HARDFORK_UPPER=$(echo "$HARDFORK" | tr '[:lower:]' '[:upper:]')
 
 # Fee token address, defaults to native fee token

.github/workflows/benchmarks-dispatch.yml

@@ -40,6 +40,7 @@ jobs:
             const usage = [
               '**Usage:** `derek bench <subcommand> [args]` (also `decofe bench ...`).\n',
               '- `bench invariant [compare-ref=REF] [timeout=N] [workers=N] [benchmark-type=property|optimization]`',
+              '- `bench symex [compare-ref=REF] [timeout=N]`',
             ].join('');
             const actor = context.payload.comment.user.login;
             const trustedAssociations = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
@@ -81,8 +82,8 @@ jobs:
             const subcommand = subMatch ? subMatch[1].toLowerCase() : '';
             const rawArgs = (subMatch ? afterBench.slice(subMatch[0].length) : afterBench).trim();
 
-            // Only `invariant` is live; build/all are reserved.
-            const supported = new Set(['invariant']);
+            // Only `invariant` and `symex` are live; build/all are reserved.
+            const supported = new Set(['invariant', 'symex']);
             const planned = new Set(['build', 'all']);
             if (!subcommand) {
               await failWithComment('Missing bench subcommand.');
@@ -207,6 +208,59 @@ jobs:
               ].join(', ');
             }
 
+            if (subcommand === 'symex') {
+              const opts = {
+                'compare-ref': 'master',
+                timeout: '600',
+              };
+              const { unknown, invalid } = parseArgs(
+                opts,
+                new Set(['compare-ref']),
+                new Set(['timeout']),
+                {},
+              );
+
+              const safeRef = /^[A-Za-z0-9._/-]{1,128}$/;
+              if (!safeRef.test(opts['compare-ref'])) {
+                invalid.push("`compare-ref` may only contain letters, numbers, '.', '_', '-', and '/'");
+              }
+              const timeout = Number(opts.timeout);
+              if (!Number.isInteger(timeout) || timeout < 60 || timeout > 1800) {
+                invalid.push('`timeout` must be between 60 and 1800 seconds');
+              }
+
+              const errors = [];
+              if (unknown.length) errors.push(`Unknown argument(s): \`${unknown.join('`, `')}\``);
+              if (invalid.length) errors.push(`Invalid value(s): ${invalid.join(', ')}`);
+              if (errors.length) {
+                await failWithComment(`Invalid \`bench symex\` command\n\n${errors.join('\n')}`);
+                return;
+              }
+
+              // PR identity + safe knobs only; benchmark targets and pod sizing
+              // are owned by the server-side foundry-bench workflow.
+              payload = {
+                repository: repoFullName,
+                event: 'foundry-bench',
+                data: {
+                  subcommand: 'symex',
+                  pr_number: String(context.issue.number),
+                  head_repo: pr.head.repo.full_name,
+                  actor,
+                  foundry_git_ref: pr.head.sha,
+                  compare_foundry_git_ref: opts['compare-ref'],
+                  timeout_seconds: opts.timeout,
+                },
+              };
+
+              summary = [
+                `subcommand: \`symex\``,
+                `PR SHA: \`${pr.head.sha.slice(0, 12)}\``,
+                `compare-ref: \`${opts['compare-ref']}\``,
+                `timeout: \`${opts.timeout}s\``,
+              ].join(', ');
+            }
+
             core.setOutput('actor', actor);
             core.setOutput('subcommand', subcommand);
             core.setOutput('summary', summary);

.github/workflows/benchmarks-nightly.yml

@@ -35,7 +35,7 @@ jobs:
           sudo apt-get install -y build-essential pkg-config z3
 
       - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
           toolchain: stable
 
@@ -204,8 +204,8 @@ jobs:
           DATE=$(date -u +%Y-%m-%d)
           shopt -s nullglob
 
-          stable_parts=( benches/stable-${DATE}-*.json )
-          nightly_parts=( benches/nightly-${DATE}-*.json )
+          stable_parts=( "benches/stable-${DATE}-"*.json )
+          nightly_parts=( "benches/nightly-${DATE}-"*.json )
 
           if [[ ${#stable_parts[@]} -eq 0 && ${#nightly_parts[@]} -eq 0 ]]; then
             echo "No benchmark results produced — all steps failed."

.github/workflows/benchmarks.yml

@@ -70,7 +70,7 @@ jobs:
           sudo apt-get install -y build-essential pkg-config z3
 
       - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
           toolchain: stable
 
@@ -191,9 +191,10 @@ jobs:
       pull-requests: write
 
     steps:
-      - name: Checkout repository
+      - name: Checkout repository # zizmor: ignore[artipacked] persists credentials to push benchmark data
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        # persist-credentials defaults to true so we can push.
+        with:
+          persist-credentials: true
 
       - name: Download benchmark results
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/workflows/bump-tempo.yml

@@ -18,42 +18,22 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Bump tempo dependencies
         id: bump
         env:
           GH_TOKEN: ${{ github.token }}
         run: ./.github/scripts/bump-tempo.sh
 
-      - name: Create Pull Request
+      - name: Create or update Pull Request
         if: steps.bump.outputs.updated == 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          LATEST_REV: ${{ steps.bump.outputs.latest_rev }}
-          CHANGELOG_FILE: ${{ steps.bump.outputs.changelog }}
-        run: |
-          BRANCH_NAME="deps/bump-tempo-${LATEST_REV:0:7}"
-
-          # Skip if a PR already exists for this branch
-          EXISTING_PR=$(gh pr list --head "$BRANCH_NAME" --state open --json number --jq '.[0].number')
-          if [[ -n "$EXISTING_PR" ]]; then
-            echo "PR #${EXISTING_PR} already exists for ${BRANCH_NAME}, skipping."
-            exit 0
-          fi
-
-          # Configure git
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          # Create and push branch (force-push in case a stale branch exists from a prior failed run)
-          git checkout -b "$BRANCH_NAME"
-          git add Cargo.toml Cargo.lock
-          git commit -m "chore(deps): bump tempo dependencies to ${LATEST_REV:0:7}"
-          git push --force-with-lease origin "$BRANCH_NAME"
-
-          # Create PR
-          gh pr create \
-            --title "chore(deps): bump tempo dependencies to ${LATEST_REV:0:7}" \
-            --body-file "$CHANGELOG_FILE" \
-            --base master \
-            --head "$BRANCH_NAME"
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          add-paths: |
+            Cargo.toml
+            Cargo.lock
+          commit-message: "chore(deps): bump tempo dependencies to ${{ steps.bump.outputs.latest_rev_short }}"
+          title: "chore(deps): bump tempo dependencies to ${{ steps.bump.outputs.latest_rev_short }}"
+          body-path: ${{ steps.bump.outputs.changelog }}
+          branch: deps/bump-tempo

.github/workflows/ci-mpp.yml

@@ -28,10 +28,10 @@ jobs:
       contents: read
     steps:
       # Checkout the repository
-      - uses: actions/checkout@v7.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
+      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
         with:
           toolchain: stable