Tracking PR fo v0.24.0 release

.cargo/config.toml

@@ -0,0 +1,163 @@
+[alias]
+# Collection of project-wide Clippy lints. This is done via aliases because
+# Clippy does not currently support project-wide lint configuration in a
+# dedicated config file.
+#
+# NOTE: Only lints that currently pass in this workspace are enabled.
+# Additional lints can be enabled incrementally as the codebase is cleaned up.
+# NOTE: for the `make lint` command to work well, this must contain the same
+# list of lints as the xclippy-fix command below.
+xclippy = [
+  "clippy",
+  "--workspace",
+  "--all-targets",
+  "--all-features",
+  "--",
+  "-Dwarnings",
+  "-Wunused-qualifications",
+  "-Wclippy::all",
+  "-Wclippy::await_holding_lock",
+  "-Wclippy::char_lit_as_u8",
+  "-Wclippy::checked_conversions",
+  "-Wclippy::dbg_macro",
+  "-Wclippy::debug_assert_with_mut_call",
+  "-Wclippy::disallowed_methods",
+  "-Wclippy::empty_enums",
+  "-Wclippy::exit",
+  "-Wclippy::expl_impl_clone_on_copy",
+  "-Wclippy::explicit_deref_methods",
+  "-Wclippy::filter_map_next",
+  "-Wclippy::float_cmp_const",
+  "-Wclippy::fn_params_excessive_bools",
+  "-Wclippy::if_let_mutex",
+  "-Wclippy::imprecise_flops",
+  "-Wclippy::inefficient_to_string",
+  "-Wclippy::invalid_upcast_comparisons",
+  "-Wclippy::large_digit_groups",
+  "-Wclippy::large_stack_arrays",
+  "-Wclippy::large_types_passed_by_value",
+  "-Wclippy::let_unit_value",
+  "-Wclippy::linkedlist",
+  "-Wclippy::lossy_float_literal",
+  "-Wclippy::macro_use_imports",
+  "-Wclippy::manual_ok_or",
+  "-Wclippy::map_flatten",
+  "-Wclippy::mem_forget",
+  "-Wclippy::missing_enforced_import_renames",
+  "-Wclippy::mut_mut",
+  "-Wclippy::mutex_integer",
+  "-Wclippy::needless_borrow",
+  "-Wclippy::needless_collect",
+  "-Wclippy::option_option",
+  "-Wclippy::path_buf_push_overwrite",
+  "-Wclippy::rc_mutex",
+  "-Wclippy::redundant_clone",
+  "-Wclippy::redundant_closure_for_method_calls",
+  "-Wclippy::trivially_copy_pass_by_ref",
+  "-Wclippy::uninlined_format_args",
+  "-Wclippy::ref_option_ref",
+  "-Wclippy::rest_pat_in_fully_bound_structs",
+  "-Wclippy::same_functions_in_if_condition",
+  "-Wclippy::string_add",
+  "-Wclippy::string_add_assign",
+  "-Wclippy::todo",
+  "-Wclippy::trait_duplication_in_bounds",
+  "-Wclippy::unimplemented",
+  "-Wclippy::unnested_or_patterns",
+  "-Wclippy::useless_transmute",
+  "-Wclippy::verbose_file_reads",
+  "-Wclippy::zero_sized_map_values",
+  # The following lints are disabled because they still trigger warnings:
+  # -Wclippy::derive_partial_eq_without_eq (4 warnings)
+  # -Wclippy::doc_markdown                 (826 warnings)
+  # -Wclippy::enum_glob_use               (5 warnings)
+  # -Wclippy::explicit_into_iter_loop     (7 warnings)
+  # -Wclippy::fallible_impl_from          (4 warnings)
+  # -Wclippy::flat_map_option             (1 warning)
+  # -Wclippy::from_iter_instead_of_collect (6 warnings)
+  # -Wclippy::implicit_clone              (2 warnings)
+  # -Wclippy::map_err_ignore              (138 warnings)
+  # -Wclippy::map_unwrap_or               (17 warnings)
+  # -Wclippy::manual_assert               (6 warnings)
+  # -Wclippy::match_same_arms             (16 warnings)
+  # -Wclippy::match_wild_err_arm          (6 warnings)
+  # -Wclippy::match_wildcard_for_single_variants (2 warnings)
+  # -Wclippy::needless_continue           (6 warnings)
+  # -Wclippy::needless_for_each           (10 warnings)
+  # -Wclippy::needless_pass_by_value      (37 warnings)
+  # -Wclippy::ptr_as_ptr                  (12 warnings)
+  # -Wclippy::semicolon_if_nothing_returned (159 warnings)
+  # -Wclippy::single_match_else           (16 warnings)
+  # -Wclippy::string_lit_as_bytes         (1 warning)
+  # -Wclippy::unnecessary_wraps           (9 warnings)
+  # -Wclippy::unused_self                 (8 warnings)
+  # -Wclippy::cast_lossless               (158 warnings)
+]
+
+# Clippy fix with the same lints as xclippy.
+# NOTE: for the `make lint` command to work well, this must contain the same
+# list of lints as the xclippy setting above.
+xclippy-fix = [
+  "clippy",
+  "--fix",
+  "--allow-staged",
+  "--allow-dirty",
+  "--workspace",
+  "--all-targets",
+  "--all-features",
+  "--",
+  "-Dwarnings",
+  "-Wunused-qualifications",
+  "-Wclippy::all",
+  "-Wclippy::await_holding_lock",
+  "-Wclippy::char_lit_as_u8",
+  "-Wclippy::checked_conversions",
+  "-Wclippy::dbg_macro",
+  "-Wclippy::debug_assert_with_mut_call",
+  "-Wclippy::disallowed_methods",
+  "-Wclippy::empty_enums",
+  "-Wclippy::exit",
+  "-Wclippy::expl_impl_clone_on_copy",
+  "-Wclippy::explicit_deref_methods",
+  "-Wclippy::filter_map_next",
+  "-Wclippy::float_cmp_const",
+  "-Wclippy::fn_params_excessive_bools",
+  "-Wclippy::if_let_mutex",
+  "-Wclippy::imprecise_flops",
+  "-Wclippy::inefficient_to_string",
+  "-Wclippy::invalid_upcast_comparisons",
+  "-Wclippy::large_digit_groups",
+  "-Wclippy::large_stack_arrays",
+  "-Wclippy::large_types_passed_by_value",
+  "-Wclippy::let_unit_value",
+  "-Wclippy::linkedlist",
+  "-Wclippy::lossy_float_literal",
+  "-Wclippy::macro_use_imports",
+  "-Wclippy::manual_ok_or",
+  "-Wclippy::map_flatten",
+  "-Wclippy::mem_forget",
+  "-Wclippy::missing_enforced_import_renames",
+  "-Wclippy::mut_mut",
+  "-Wclippy::mutex_integer",
+  "-Wclippy::needless_borrow",
+  "-Wclippy::needless_collect",
+  "-Wclippy::option_option",
+  "-Wclippy::path_buf_push_overwrite",
+  "-Wclippy::rc_mutex",
+  "-Wclippy::redundant_clone",
+  "-Wclippy::redundant_closure_for_method_calls",
+  "-Wclippy::trivially_copy_pass_by_ref",
+  "-Wclippy::uninlined_format_args",
+  "-Wclippy::ref_option_ref",
+  "-Wclippy::rest_pat_in_fully_bound_structs",
+  "-Wclippy::same_functions_in_if_condition",
+  "-Wclippy::string_add",
+  "-Wclippy::string_add_assign",
+  "-Wclippy::todo",
+  "-Wclippy::trait_duplication_in_bounds",
+  "-Wclippy::unimplemented",
+  "-Wclippy::unnested_or_patterns",
+  "-Wclippy::useless_transmute",
+  "-Wclippy::verbose_file_reads",
+  "-Wclippy::zero_sized_map_values",
+]

.config/nextest.toml

@@ -1,5 +1,6 @@
 [profile.default]
-default-filter = 'not (test(merkle::smt::full::concurrent) or test(merkle::smt::full::large) or binary(rocksdb_large_smt))'
+# The large-SMT module path is merkle::smt::large::...
+default-filter = 'not (test(merkle::smt::full::concurrent) or test(merkle::smt::large) or binary(rocksdb_large_smt))'
 fail-fast      = false
 failure-output = "immediate-final"
 
@@ -9,6 +10,6 @@ fail-fast      = false
 failure-output = "immediate-final"
 
 [profile.large-smt]
-default-filter = '(test(merkle::smt::full::large) or binary(rocksdb_large_smt))'
+default-filter = '(test(merkle::smt::large) or binary(rocksdb_large_smt))'
 fail-fast      = false
 failure-output = "immediate-final"

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - warp-ubuntu-latest-x64-4x

.github/actions/install-llvm/action.yml

@@ -9,35 +9,44 @@ runs:
   using: "composite"
   steps:
     - shell: bash
-      run: |
+      env:
+        LLVM_VERSION: ${{ inputs.version }}
+      run: | # zizmor: ignore[github-env] this composite action intentionally exports LLVM paths for later steps
         set -eux
+        case "${LLVM_VERSION}" in
+          ''|*[!0-9]*)
+            echo "::error::LLVM version must be a numeric major version"
+            exit 1
+            ;;
+        esac
+
         CODENAME="$(. /etc/os-release && echo "$UBUNTU_CODENAME")"
 
         # Add apt.llvm.org repo
         curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key | \
           sudo gpg --dearmor -o /usr/share/keyrings/llvm-archive-keyring.gpg
         echo "deb [signed-by=/usr/share/keyrings/llvm-archive-keyring.gpg] \
-          http://apt.llvm.org/${CODENAME}/ llvm-toolchain-${CODENAME}-${{ inputs.version }} main" | \
+          http://apt.llvm.org/${CODENAME}/ llvm-toolchain-${CODENAME}-${LLVM_VERSION} main" | \
           sudo tee /etc/apt/sources.list.d/llvm.list
 
         sudo apt-get update
         sudo apt-get install -y \
-          clang-17 \
-          lld-17 \
-          llvm-17-dev \
-          libclang-17-dev
+          clang-"${LLVM_VERSION}" \
+          lld-"${LLVM_VERSION}" \
+          llvm-"${LLVM_VERSION}"-dev \
+          libclang-"${LLVM_VERSION}"-dev
 
-        sudo ln -sf /usr/lib/llvm-${{ inputs.version }}/lib/libclang-${{ inputs.version }}.so \
-                    /usr/lib/llvm-${{ inputs.version }}/lib/libclang.so
+        sudo ln -sf /usr/lib/llvm-"${LLVM_VERSION}"/lib/libclang-"${LLVM_VERSION}".so \
+                    /usr/lib/llvm-"${LLVM_VERSION}"/lib/libclang.so
 
-        echo "/usr/lib/llvm-${{ inputs.version }}/lib" | \
-          sudo tee /etc/ld.so.conf.d/llvm-${{ inputs.version }}.conf
+        echo "/usr/lib/llvm-${LLVM_VERSION}/lib" | \
+          sudo tee /etc/ld.so.conf.d/llvm-"${LLVM_VERSION}".conf
         sudo ldconfig
 
         # Env for build scripts & tools
-        echo "LIBCLANG_PATH=/usr/lib/llvm-${{ inputs.version }}/lib" >> "$GITHUB_ENV"
-        echo "LIBRARY_PATH=/usr/lib/llvm-${{ inputs.version }}/lib:${LIBRARY_PATH:-}" >> "$GITHUB_ENV"
-        echo "LD_LIBRARY_PATH=/usr/lib/llvm-${{ inputs.version }}/lib:${LD_LIBRARY_PATH:-}" >> "$GITHUB_ENV"
-        echo "/usr/lib/llvm-${{ inputs.version }}/bin" >> "$GITHUB_PATH"
-        echo "CC=clang-${{ inputs.version }}"   >> "$GITHUB_ENV"
-        echo "CXX=clang++-${{ inputs.version }}" >> "$GITHUB_ENV"
+        echo "LIBCLANG_PATH=/usr/lib/llvm-${LLVM_VERSION}/lib" >> "$GITHUB_ENV"
+        echo "LIBRARY_PATH=/usr/lib/llvm-${LLVM_VERSION}/lib:${LIBRARY_PATH:-}" >> "$GITHUB_ENV"
+        echo "LD_LIBRARY_PATH=/usr/lib/llvm-${LLVM_VERSION}/lib:${LD_LIBRARY_PATH:-}" >> "$GITHUB_ENV"
+        echo "/usr/lib/llvm-${LLVM_VERSION}/bin" >> "$GITHUB_PATH"
+        echo "CC=clang-${LLVM_VERSION}" >> "$GITHUB_ENV"
+        echo "CXX=clang++-${LLVM_VERSION}" >> "$GITHUB_ENV"

.github/actions/workspace-release/action.yml

@@ -31,12 +31,12 @@ runs:
         fi
 
     - name: Install Rust toolchain
-      uses: dtolnay/rust-toolchain@stable
+      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # pin@stable
       with:
         toolchain: "1.90"
 
     - name: Cache cargo registry and git index
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # pin@v4
       with:
         path: |
           ~/.cargo/registry
@@ -49,22 +49,16 @@ runs:
       uses: ./.github/actions/cleanup-runner
 
     - name: Install cargo-binstall
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@a2352fc6ce487f030a3aa709482d57823eadfb37 # pin@v2
       with:
         tool: cargo-binstall
 
     - name: Install cargo-msrv
       shell: bash
       run: cargo binstall --no-confirm --force cargo-msrv
 
-    - name: Install Rust 1.91 for cargo-msrv
-      shell: bash
-      run: rustup toolchain install 1.91
-
     - name: Check MSRV
       shell: bash
-      env:
-        RUSTUP_TOOLCHAIN: "1.91"
       run: |
         export PATH="$HOME/.cargo/bin:$PATH"
         ./scripts/check-msrv.sh

.github/workflows/build.yml

@@ -25,7 +25,7 @@ jobs:
       matrix:
         toolchain: [stable, nightly]
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4
       - name: Cleanup large tools for build space
         uses: ./.github/actions/cleanup-runner
       - name: Build for no-std
@@ -43,7 +43,7 @@ jobs:
       matrix:
         toolchain: [stable, nightly]
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4
       - name: Cleanup large tools for build space
         uses: ./.github/actions/cleanup-runner
       - name: Build miden-field for on-chain target

.github/workflows/changelog.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@main
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4
         with:
           fetch-depth: 0
       - name: Check for changes in changelog

.github/workflows/contribution-quality.yml

@@ -0,0 +1,31 @@
+name: Contribution Quality
+
+# Uses pull_request_target only to let the pinned shared workflow comment/label via API;
+# it must not checkout or execute PR code.
+on:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] metadata-only shared workflow, no PR checkout
+    types: [opened, reopened, edited, synchronize, ready_for_review]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "PR number to evaluate (manual runs)"
+        required: true
+        type: string
+      force_all:
+        description: "Skip trusted/draft checks"
+        required: false
+        default: "false"
+        type: choice
+        options: ["false", "true"]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  contribution-quality:
+    uses: 0xMiden/.github/.github/workflows/contribution-quality.yml@385c1c10c311dc0508c71d83abb0be749a2c12ca # pin@main
+    with:
+      pr_number: ${{ github.event.inputs.pr_number || '' }}
+      force_all: ${{ github.event.inputs.force_all || 'false' }}

.github/workflows/docs.yml

@@ -28,7 +28,7 @@ jobs:
     name: Generate and deploy crate documentation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4
 
       - name: Cleanup large tools for build space
         uses: ./.github/actions/cleanup-runner

.github/workflows/fuzz.yml

@@ -28,13 +28,13 @@ jobs:
         target: [primitives, collections, string, vint64, goldilocks, budgeted]
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4
       - name: Cleanup large tools for build space
         uses: ./.github/actions/cleanup-runner
-      - uses: dtolnay/rust-toolchain@nightly
+      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # pin@nightly
         with:
           toolchain: nightly
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # pin@v2
       - name: Install cargo-fuzz
         run: cargo +nightly install cargo-fuzz --locked
       - name: Run fuzz target (smoke test)
@@ -52,13 +52,13 @@ jobs:
         target: [word, merkle, merkle_store, smt_serde, mmr, crypto, aead, signatures]
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # pin@v4
       - name: Cleanup large tools for build space
         uses: ./.github/actions/cleanup-runner
-      - uses: dtolnay/rust-toolchain@nightly
+      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # pin@nightly
         with:
           toolchain: nightly
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@42dc69e1aa15d09112580998cf2ef0119e2e91ae # pin@v2
       - name: Install cargo-fuzz
         run: cargo +nightly install cargo-fuzz --locked
       - name: Run fuzz target (smoke test)