Bump to nitro v3.12.1

.dockerignore

@@ -27,6 +27,7 @@ crates/tools/module_roots
 crates/tools/pricer
 
 # Rust outputs
+crates/sp1/target/
 crates/stylus/tests/target/
 crates/wasm-testsuite/target/
 crates/wasm-libraries/target/

.github/actions/ci-setup/action.yml

@@ -7,10 +7,19 @@ runs:
 
   steps:
     - name: Install dependencies
-      run: sudo apt update && sudo apt install -y wabt gotestsum
+      run: sudo apt update && sudo apt install -y build-essential cmake clang wabt gotestsum protobuf-compiler python3 jq curl wget uuid-runtime lld-14
       shell: bash
 
     - name: Setup Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: "24"
+
+    - name: Enable corepack (provides yarn)
+      run: corepack enable
+      shell: bash
+
+    - name: Setup Node.js with yarn cache
       uses: actions/setup-node@v6
       with:
         node-version: "24"
@@ -24,10 +33,14 @@ runs:
         # The Go caches are managed by the explicit cache steps below.
         cache: false
 
+    # "|" falls back to direct fetching on any proxy error; the default ","
+    # only falls back on 404/410, so a transient proxy error fails the build.
+    - name: Fall back to direct module fetching on Go proxy errors
+      run: echo "GOPROXY=https://proxy.golang.org|direct" >> "$GITHUB_ENV"
+      shell: bash
+
     - name: Install wasm-ld
-      run: |
-        sudo apt-get update && sudo apt-get install -y lld-14
-        sudo ln -s /usr/bin/wasm-ld-14 /usr/local/bin/wasm-ld
+      run: sudo ln -s /usr/bin/wasm-ld-14 /usr/local/bin/wasm-ld
       shell: bash
 
     - name: Install rust

.github/actions/lint-go/action.yml

@@ -1,16 +1,23 @@
 ---
 name: 'Lint Go Code'
-description: 'Runs both golangci-lint and custom linters on the Go codebase.'
+description: 'Runs golangci-lint, the custom linters, and solhint via `make lint` so the tool versions pinned in the Makefile are the single source of truth.'
 
 runs:
   using: composite
 
   steps:
-    - name: GolangCI Lint
-      uses: golangci/golangci-lint-action@v9
+    - name: Cache golangci-lint analysis
+      uses: actions/cache@v5
       with:
-        version: v2.5
+        path: ~/.cache/golangci-lint
+        # github.sha prevents exact-key hits, which would skip the save and
+        # let the cache go stale.
+        key: ${{ runner.os }}-golangci-${{ hashFiles('**/go.sum') }}-${{ github.sha }}
+        # Stale restores are safe: golangci-lint invalidates per file/config.
+        restore-keys: |
+          ${{ runner.os }}-golangci-${{ hashFiles('**/go.sum') }}-
+          ${{ runner.os }}-golangci-
 
-    - name: Custom Lint
+    - name: Lint
       shell: bash
-      run: go run ./linters ./...
+      run: make lint

.github/actions/nitro-reth-setup/action.yml

@@ -0,0 +1,51 @@
+name: nitro-reth setup
+description: >
+  Common setup for nitro-reth CI jobs: submodules, C build deps, prebuilt brotli
+  static libs, the Rust toolchain, and the shared cargo cache. Run after checkout.
+
+inputs:
+  client-id:
+    description: GitHub App client id for submodule access
+    required: true
+  app-private-key:
+    description: GitHub App private key for submodule access
+    required: true
+  toolchain:
+    description: Rust toolchain to install
+    default: "1.93"
+  components:
+    description: Extra toolchain components (comma-separated)
+    default: ""
+  targets:
+    description: Extra compilation targets (comma-separated)
+    default: ""
+  brotli:
+    description: Build the prebuilt brotli static libs (needed by jobs that link)
+    default: "false"
+  cache-shared-key:
+    description: rust-cache shared-key (empty means per-job default keys)
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/init-submodules
+      with:
+        client-id: ${{ inputs.client-id }}
+        app-private-key: ${{ inputs.app-private-key }}
+    - name: Install build deps
+      shell: bash
+      run: sudo apt-get update && sudo apt-get install -y build-essential clang libclang-dev cmake
+    - name: Build brotli static libs
+      if: inputs.brotli == 'true'
+      shell: bash
+      run: ./scripts/build-brotli.sh -l
+    - uses: dtolnay/rust-toolchain@master
+      with:
+        toolchain: ${{ inputs.toolchain }}
+        components: ${{ inputs.components }}
+        targets: ${{ inputs.targets }}
+    - uses: Swatinem/rust-cache@v2
+      with:
+        workspaces: nitro-reth
+        shared-key: ${{ inputs.cache-shared-key }}

.github/buildspec.yml

@@ -9,6 +9,18 @@ env:
 phases:
   pre_build:
     commands:
+      # CODEBUILD_CLONE_REF checks out the source action's BranchName, not the
+      # revision the execution resolved, so pin the tree before anything reads git.
+      - |
+        set -euo pipefail
+        REF=${SOURCE_REF:-auto}
+        if [ "$REF" = auto ]; then REF=$CODEBUILD_RESOLVED_SOURCE_VERSION; fi
+        if ! git rev-parse --verify --quiet "${REF}^{commit}" >/dev/null; then
+          echo "ERROR: $REF is not in the clone. CodeBuild does not leave usable credentials on origin, so it cannot be fetched." >&2
+          echo "local refs:" >&2; git for-each-ref --format='  %(refname)' >&2
+          exit 1
+        fi
+        git checkout --force --detach "$REF"
       - |
         set -euo pipefail
         if [ -n "${GITHUB_APP_KEY:-}" ]; then
@@ -28,7 +40,7 @@ phases:
           export GITHUB_TOKEN
           GITHUB_TOKEN=$(printf '%s' "$TOKEN_RESPONSE" | jq -r '.token // empty')
           if [ -z "$GITHUB_TOKEN" ]; then
-            redacted=$(printf '%s' "$TOKEN_RESPONSE" | sed -E 's/(ghs_|ghu_)[A-Za-z0-9]+/\1REDACTED/g')
+            redacted=$(printf '%s' "$TOKEN_RESPONSE" | sed -E 's/(ghs_|ghu_)[A-Za-z0-9._-]+/\1REDACTED/g')
             echo "ERROR: installation token missing from response: ${redacted}" >&2
             exit 1
           fi
@@ -40,30 +52,24 @@ phases:
       - echo Logging in to Dockerhub....
       - printf '%s' "$DOCKERHUB_PASSWORD" | docker login --username "$DOCKERHUB_USERNAME" --password-stdin
       - aws ecr get-login-password --region us-west-2 | docker login --username AWS --password-stdin "$REPOSITORY_URI"
-      - COMMIT_HASH=$(git rev-parse --short=7 HEAD)
-      - >-
-        VERSION_TAG=$(git tag --points-at HEAD | sed '/-/!s/$/_/' | sort -rV |
-        sed 's/_$//' | head -n 1 | grep ^ || git show -s --pretty=%D | sed 's/, /\n/g' |
-        grep -v '^origin/' |grep -v '^grafted\|HEAD\|master\|main$' || echo "dev")
-      - NITRO_VERSION=${VERSION_TAG}-${COMMIT_HASH}
-      - IMAGE_TAG=${NITRO_VERSION}
+      # Sets NITRO_TAG, NITRO_BRANCH, NITRO_COMMIT, and the Docker-safe
+      # IMAGE_TAG.
+      - . scripts/ci-version-select.sh
       - NITRO_DATETIME=$(git show -s --date=iso-strict --format=%cd)
       - NITRO_MODIFIED="false"
-      - echo ${NITRO_VERSION} > ./.nitro-tag.txt
+      - echo ${IMAGE_TAG} > ./.nitro-tag.txt
       - >-
-        BUILD_ARGS="--build-arg version=$NITRO_VERSION
+        export BUILD_ARGS="--build-arg tag=$NITRO_TAG
+        --build-arg branch=$NITRO_BRANCH
+        --build-arg commit=$NITRO_COMMIT
         --build-arg datetime=$NITRO_DATETIME
         --build-arg modified=$NITRO_MODIFIED"
   build:
     commands:
       - echo Build started on `date`
-      - echo Building the Docker image ${NITRO_VERSION}...
+      - echo Building the Docker image ${IMAGE_TAG}...
       - |
         set -euo pipefail
-        # CodeBuild does not propagate env between phases (only IMAGE_TAG is
-        # in exported-variables), and installation tokens expire in ~10 min.
-        # Re-mint here so the docker builds can forward a fresh token to
-        # BuildKit as the gh_token secret consumed by scripts/download-machine.sh.
         build_secret_arg=""
         if [ -n "${GITHUB_APP_KEY:-}" ]; then
           trap 'rm -f /tmp/github-app-key.pem; unset GITHUB_TOKEN' EXIT
@@ -80,20 +86,33 @@ phases:
           export GITHUB_TOKEN
           GITHUB_TOKEN=$(printf '%s' "$TOKEN_RESPONSE" | jq -r '.token // empty')
           if [ -z "$GITHUB_TOKEN" ]; then
-            redacted=$(printf '%s' "$TOKEN_RESPONSE" | sed -E 's/(ghs_|ghu_)[A-Za-z0-9]+/\1REDACTED/g')
+            redacted=$(printf '%s' "$TOKEN_RESPONSE" | sed -E 's/(ghs_|ghu_)[A-Za-z0-9._-]+/\1REDACTED/g')
             echo "ERROR: installation token missing from response: ${redacted}" >&2
             exit 1
           fi
           rm -f /tmp/github-app-key.pem
           build_secret_arg="--secret id=gh_token,env=GITHUB_TOKEN"
         fi
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-slim --target nitro-node-slim ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node --target nitro-node ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-dev --target nitro-node-dev ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-validator --target nitro-node-validator ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-rust-validator --target nitro-node-rust-validator ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-slim-stripped --target nitro-node-slim-stripped ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-stripped --target nitro-node-stripped ${BUILD_ARGS:-} $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-slim --target nitro-node-slim $BUILD_ARGS $build_secret_arg
+
+        # Docker only warns when a build arg is not declared, so a rename
+        # silently ships an unstamped binary. An empty value would match
+        # anything, so reject it rather than pass vacuously.
+        stamped=$(docker run --rm --entrypoint /usr/local/bin/nitro nitro-node-slim --version)
+        for want in "${NITRO_TAG:-$NITRO_BRANCH}" "$NITRO_COMMIT"; do
+          [ -n "$want" ] || { echo "ERROR: provenance value is empty" >&2; exit 1; }
+          case $stamped in
+            *"$want"*) ;;
+            *) echo "ERROR: nitro-node-slim stamped '$stamped', expected '$want'" >&2; exit 1 ;;
+          esac
+        done
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node --target nitro-node $BUILD_ARGS $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-dev --target nitro-node-dev $BUILD_ARGS $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-validator --target nitro-node-validator $BUILD_ARGS $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-rust-validator --target nitro-node-rust-validator $BUILD_ARGS $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-slim-stripped --target nitro-node-slim-stripped $BUILD_ARGS $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-stripped --target nitro-node-stripped $BUILD_ARGS $build_secret_arg
+
       - docker tag nitro-node:latest $REPOSITORY_URI:$IMAGE_TAG-$ARCH_TAG
       - docker tag nitro-node-slim:latest $REPOSITORY_URI:$IMAGE_TAG-slim-$ARCH_TAG
       - docker tag nitro-node-dev:latest $REPOSITORY_URI:$IMAGE_TAG-dev-$ARCH_TAG

.github/manifest-buildspec.yml

@@ -7,13 +7,21 @@ env:
 phases:
   pre_build:
     commands:
-      - COMMIT_HASH=$(git rev-parse --short=7 HEAD || echo "latest")
-      - >-
-        VERSION_TAG=$(git tag --points-at HEAD | sed '/-/!s/$/_/' | sort -rV |
-        sed 's/_$//' | head -n 1 | grep ^ || git show -s --pretty=%D | sed 's/, /\n/g' |
-        grep -v '^origin/' |grep -v '^grafted\|HEAD\|master\|main$' || echo "dev")
-      - NITRO_VERSION=${VERSION_TAG}-${COMMIT_HASH}
-      - IMAGE_TAG=${NITRO_VERSION}
+      # CODEBUILD_CLONE_REF checks out the source action's BranchName, not the
+      # revision the execution resolved, so pin the tree before anything reads git.
+      - |
+        set -euo pipefail
+        REF=${SOURCE_REF:-auto}
+        if [ "$REF" = auto ]; then REF=$CODEBUILD_RESOLVED_SOURCE_VERSION; fi
+        if ! git rev-parse --verify --quiet "${REF}^{commit}" >/dev/null; then
+          echo "ERROR: $REF is not in the clone. CodeBuild does not leave usable credentials on origin, so it cannot be fetched." >&2
+          echo "local refs:" >&2; git for-each-ref --format='  %(refname)' >&2
+          exit 1
+        fi
+        git checkout --force --detach "$REF"
+      # Sets NITRO_TAG, NITRO_BRANCH, NITRO_COMMIT, and the Docker-safe
+      # IMAGE_TAG; must select the same image tag as buildspec.yml.
+      - . scripts/ci-version-select.sh
 
       # Log IMAGE_TAG environment variable
       - echo "Using IMAGE_TAG environment variable $IMAGE_TAG"
@@ -75,5 +83,6 @@ phases:
         push_variant "-slim"
         push_variant "-dev"
         push_variant "-validator"
+        push_variant "-rust-validator"
         push_variant "-stripped"
         push_variant "-slim-stripped"

.github/workflows/_bold-legacy.yml

@@ -12,38 +12,8 @@ permissions:
 jobs:
   bold-legacy:
     if: false
-    name: Run Bold Legacy challenge tests
-    runs-on: arbitrator-ci
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - uses: ./.github/actions/init-submodules
-        with:
-          client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
-          app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-
-      - name: Setup CI
-        uses: ./.github/actions/ci-setup
-
-      - name: Build
-        run: make -j8 build test-go-deps
-
-      - name: run challenge tests
-        run: >-
-          ${{ github.workspace }}/.github/workflows/gotestsum.sh --tags legacychallengetest
-          --run TestChallenge --timeout 60m --cover
-
-      - name: Archive detailed run log
-        uses: actions/upload-artifact@v6
-        with:
-          name: full.log
-          path: full.log
-
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
-        with:
-          fail_ci_if_error: false
-          files: ./coverage.txt,./coverage-redis.txt
-          verbose: false
-          token: ${{ secrets.CODECOV_TOKEN }}
+    uses: ./.github/workflows/_go-tests.yml
+    secrets: inherit
+    with:
+      run-name: bold-legacy
+      run-legacy-challenge: true

.github/workflows/_cargo-lock-check.yml

@@ -0,0 +1,32 @@
+---
+name: cargo-lock-check
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  cargo-lock:
+    name: Check Cargo.lock files are up to date
+    runs-on: ubuntu-4
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - uses: ./.github/actions/init-submodules
+        with:
+          client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
+          app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
+
+      - name: Install rust
+        uses: ./.github/actions/install-rust
+
+      - name: Check Cargo.lock files
+        run: ./scripts/check-cargo-locks.sh

.github/workflows/_changelog.yml

@@ -13,17 +13,16 @@ jobs:
     if: false
     name: Check if changelog is updated
     runs-on: ubuntu-4
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
       - name: Download unclog binary
-        uses: dsaltares/fetch-gh-release-asset@1.1.2
-        with:
-          repo: OffchainLabs/unclog
-          version: "tags/v0.1.8"
-          file: "unclog"
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release download v0.1.8 --repo OffchainLabs/unclog --pattern unclog --clobber
 
       - name: Check changelog fragments
         env: