feat(evm): Besu test network and the fungible suite running on it

.github/workflows/nightly-fuzz.yml

@@ -96,6 +96,52 @@ jobs:
           - name: fabricx-endorser-for-threshold-rule
             pkg: ./token/services/network/fabricx/endorsement
             func: FuzzEndorserForThresholdRuleNoPanic
+          # The evm driver is its own Go module, so its targets run from that module's root rather
+          # than the repository root. `dir` defaults to "." for every entry above.
+          - name: evm-recover-endorsement-signature
+            dir: ./x/token/services/network/evm
+            pkg: ./eip712
+            func: FuzzRecoverAddress
+          - name: evm-signer-from-bytes
+            dir: ./x/token/services/network/evm
+            pkg: ./eip712
+            func: FuzzNewSignerFromBytes
+          - name: evm-envelope-from-bytes
+            dir: ./x/token/services/network/evm
+            pkg: .
+            func: FuzzEnvelopeFromBytes
+          - name: evm-compute-anchor
+            dir: ./x/token/services/network/evm
+            pkg: .
+            func: FuzzComputeAnchor
+          - name: evm-abi-decode-bytes
+            dir: ./x/token/services/network/evm
+            pkg: ./abi
+            func: FuzzDecodeBytes
+          - name: evm-abi-decode-bool-array
+            dir: ./x/token/services/network/evm
+            pkg: ./abi
+            func: FuzzDecodeBoolArray
+          - name: evm-abi-decode-uint64
+            dir: ./x/token/services/network/evm
+            pkg: ./abi
+            func: FuzzDecodeUint64
+          - name: evm-abi-decode-bytes32
+            dir: ./x/token/services/network/evm
+            pkg: ./abi
+            func: FuzzDecodeBytes32
+          - name: evm-hex-to-address
+            dir: ./x/token/services/network/evm
+            pkg: ./client
+            func: FuzzHexToAddress
+          - name: evm-hex-to-hash
+            dir: ./x/token/services/network/evm
+            pkg: ./client
+            func: FuzzHexToHash
+          - name: evm-bytes-to-address
+            dir: ./x/token/services/network/evm
+            pkg: ./client
+            func: FuzzBytesToAddress
 
     steps:
       - name: Checkout code
@@ -116,6 +162,7 @@ jobs:
             fuzz-${{ matrix.name }}-
 
       - name: Run fuzz campaign
+        working-directory: ${{ matrix.dir || '.' }}
         run: |
           set -o pipefail
           go test ${{ matrix.pkg }} \
@@ -126,6 +173,9 @@ jobs:
 
       - name: Collect crash artifacts
         if: failure()
+        # Same directory the campaign ran in: both the log and the corpus that reproduces the crash are
+        # written relative to it, and losing them would leave only the fact that something failed.
+        working-directory: ${{ matrix.dir || '.' }}
         run: |
           mkdir -p fuzz-failure
           cp fuzz-output.log fuzz-failure/ || true
@@ -137,7 +187,7 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: fuzz-failure-${{ matrix.name }}
-          path: fuzz-failure/
+          path: ${{ matrix.dir || '.' }}/fuzz-failure/
           retention-days: 30
 
       - name: File or update GitHub issue

.github/workflows/tests.yml

@@ -220,6 +220,47 @@ jobs:
           parallel: true
           fail-on-error: false
 
+  # The evm suites run on the feature branch rather than on main, because that is where the driver
+  # lives until it graduates. They are their own job for two reasons: they need foundry, which nothing
+  # else in this workflow does, and they need no fabric binaries at all.
+  #
+  # No coverage upload here on purpose. The other jobs upload with parallel: true and publish-coverage
+  # closes the set; adding this one would either make that job wait on a run that is skipped on main,
+  # or leave a parallel report that never finishes.
+  itest-evm:
+    needs: checks
+    if: github.ref == 'refs/heads/feature/evm-network-driver' || github.base_ref == 'feature/evm-network-driver'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        tests: [ evm, evm-fabtoken ]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          # forge-std is a submodule of the contracts project, and the deploy script imports it.
+          # Without this the checkout is missing lib/forge-std and forge fails to compile.
+          submodules: recursive
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+          cache-dependency-path: "**/*.sum"
+
+      - name: Set up tools
+        run: make install-tools
+
+      - name: Set up foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: stable
+
+      - name: Run ${{ matrix.tests }}
+        run: make integration-tests-${{ matrix.tests }}
+
   publish-coverage:
     needs: [ utest, itest ]
     runs-on: ubuntu-latest

.gitignore

@@ -14,3 +14,15 @@ cmd/token_validation_service/out/
 /site/
 coverage.out
 /.codex/
+
+# The EVM integration suites generate a node binary tree and a network under out/ and testdata/.
+# Both hold real Go files, so a stray "git add -A" commits them and a linter then reports on them.
+integration/token/fungible/evm/out/
+integration/token/fungible/evm/testdata/
+integration/token/fungible/evmfabtoken/out/
+integration/token/fungible/evmfabtoken/testdata/
+# ginkgo leaves its compiled suite binary behind when a run fails.
+integration/token/fungible/evm/evm.test
+integration/token/fungible/evmfabtoken/evmfabtoken.test
+# ginkgo -cover writes this next to the suite it ran.
+integration/token/fungible/*/coverprofile.out

Makefile

@@ -83,9 +83,12 @@ unit-tests-regression:
 install-softhsm:
 	./ci/scripts/install_softhsm.sh
 
+# The EVM integration suites run against this Besu image.
+BESU_IMAGE ?= hyperledger/besu:24.3.0
+
 .PHONY: docker-images
 # build/pull docker images needed for testing
-docker-images: fabric-docker-images monitoring-docker-images testing-docker-images
+docker-images: fabric-docker-images monitoring-docker-images testing-docker-images besu-docker-images
 
 .PHONY: testing-docker-images
 # pull docker images for testing (postgres, vault)
@@ -102,6 +105,11 @@ fabric-docker-images:
 	docker pull hyperledger/fabric-ccenv:$(FABRIC_TWO_DIGIT_VERSION)
 	docker image tag hyperledger/fabric-ccenv:$(FABRIC_TWO_DIGIT_VERSION) hyperledger/fabric-ccenv:latest
 
+.PHONY: besu-docker-images
+# pull the besu docker image the EVM integration suites run against
+besu-docker-images:
+	docker pull $(BESU_IMAGE)
+
 .PHONY: monitoring-docker-images
 # pull monitoring docker images (explorer, prometheus, grafana, jaeger)
 monitoring-docker-images:
@@ -111,6 +119,17 @@ monitoring-docker-images:
 	docker pull grafana/grafana:latest
 	docker pull cr.jaegertracing.io/jaegertracing/jaeger:2.12.0
 
+.PHONY: integration-tests-evm
+# run the fungible integration tests against an EVM backend (Besu).
+# Unlike the fabric suites this needs no FAB_BINS, but it does need docker and forge.
+integration-tests-evm: besu-docker-images
+	cd ./integration/token/fungible/evm; ginkgo $(GINKGO_TEST_OPTS) .
+
+.PHONY: integration-tests-evm-fabtoken
+# run the fungible integration tests against an EVM backend with the fabtoken driver.
+integration-tests-evm-fabtoken: besu-docker-images
+	cd ./integration/token/fungible/evmfabtoken; ginkgo $(GINKGO_TEST_OPTS) .
+
 .PHONY: integration-tests-nft-dlog
 # run nft integration tests with idemix
 integration-tests-nft-dlog:
@@ -150,6 +169,10 @@ clean:
 	rm -rf ./integration/token/fungible/dlog/out/
 	rm -rf ./integration/token/fungible/dlog/testdata/
 	rm -rf ./integration/token/fungible/dlogx/out/
+	rm -rf ./integration/token/fungible/evm/out/
+	rm -rf ./integration/token/fungible/evm/testdata/
+	rm -rf ./integration/token/fungible/evmfabtoken/out/
+	rm -rf ./integration/token/fungible/evmfabtoken/testdata/
 	rm -rf ./integration/token/fungible/dloghsm/out/
 	rm -rf ./integration/token/fungible/dloghsm/testdata/
 	rm -rf ./integration/token/fungible/dlogstress/out/

cmd/artifactgen/go.mod

@@ -24,6 +24,7 @@ require (
 	github.com/DATA-DOG/go-sqlmock v1.5.2 // indirect
 	github.com/IBM/idemix v0.2.0 // indirect
 	github.com/IBM/mathlib v0.3.0 // indirect
+	github.com/LFDT-Panurus/panurus/x/token/services/network/evm v0.0.0 // indirect
 	github.com/Masterminds/semver/v3 v3.5.0 // indirect
 	github.com/Masterminds/squirrel v1.5.4 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
@@ -233,3 +234,5 @@ require (
 	modernc.org/memory v1.11.0 // indirect
 	modernc.org/sqlite v1.53.0 // indirect
 )
+
+replace github.com/LFDT-Panurus/panurus/x/token/services/network/evm => ../../x/token/services/network/evm