Merge pull request #856 from Manuelshub/feat/deployment-rollback

fix(testing): stabilize test optimizer suite and fix CI clippy checks

Author: Manuelshub

.cargo/config.toml

@@ -0,0 +1,15 @@
+# MSRV-aware dependency resolution.
+#
+# The crate declares `rust-version = "1.80"` and CI enforces it via the
+# `MSRV (Rust 1.80)` job (`cargo check --locked --workspace` on 1.80.0).
+# Without this setting, `cargo update` happily resolves to dependency
+# versions that require a newer compiler (e.g. crates that switched to
+# edition 2024, which needs Rust 1.85), which breaks that job even though
+# nothing in our own source changed.
+#
+# `fallback` tells the resolver to prefer the newest dependency version
+# whose own `rust-version` is compatible with ours, and only consider
+# incompatible ones when there is no other choice.
+# Stabilized in Cargo 1.84.
+[resolver]
+incompatible-rust-versions = "fallback"

.github/workflows/benchmark-latency.yml

@@ -29,6 +29,10 @@ on:
   # Allow manual trigger for ad-hoc budget checks.
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   latency-budget:
     name: Latency Budget Check
@@ -51,10 +55,14 @@ jobs:
       # while still exercising cold-start and command-dispatch paths.
       - name: Run latency benchmarks
         run: |
+          mkdir -p target/criterion
+          # Criterion's harness takes a SINGLE positional filter, which it
+          # treats as a regex. Passing the three group names as separate
+          # arguments made it exit 2 with
+          # "unexpected argument 'cli_command_latency' found", so this step
+          # failed before any budget was ever measured. Use one alternation.
           cargo bench --locked -- \
-            cli_cold_start \
-            cli_command_latency \
-            latency_budget \
+            'cli_cold_start|cli_command_latency|latency_budget' \
             2>&1 | tee target/criterion/latency-bench-output.txt
 
       # Parse Criterion output and check against latency budgets.
@@ -65,17 +73,24 @@ jobs:
         id: budget-check
         run: |
           chmod +x scripts/check-latency-budgets.sh
+          # Capture stdout only. The script writes its JSON report to stdout and
+          # progress notes to stderr; folding stderr in with 2>&1 made `jq` fail
+          # with "Invalid numeric literal". Because the result was then compared
+          # only against the literal "false", an unparseable report silently
+          # counted as a pass -- this gate could not fail. Let stderr flow to the
+          # job log instead.
           REPORT=$(bash scripts/check-latency-budgets.sh \
             --input target/criterion/latency-bench-output.txt \
-            --report-path target/criterion/latency-budget-report.json \
-            2>&1) || EXIT_CODE=$?
+            --report-path target/criterion/latency-budget-report.json) || EXIT_CODE=$?
           echo "::group::Latency Budget Report"
           echo "$REPORT"
           echo "::endgroup::"
-          ALL_PASS=$(echo "$REPORT" | jq -r '.all_pass')
+          ALL_PASS=$(printf '%s' "$REPORT" | jq -r '.all_pass' 2>/dev/null || echo "unparseable")
           echo "all_pass=$ALL_PASS" >> "$GITHUB_OUTPUT"
-          if [ "$ALL_PASS" = "false" ]; then
-            echo "❌ Latency budget violations detected!"
+          # Fail closed: only an explicit `true` is a pass. A missing or
+          # unparseable report is a failure, not a free pass.
+          if [ "$ALL_PASS" != "true" ]; then
+            echo "❌ Latency budget check did not pass (all_pass=$ALL_PASS)"
             echo "failures=true" >> "$GITHUB_OUTPUT"
             exit 1
           fi
@@ -94,8 +109,14 @@ jobs:
             target/criterion/latency-budget-report.json
 
       # Post a PR comment with the budget check summary when run on a PR.
+      # Posting the summary is a courtesy, not the gate: the budget check step
+      # above is what fails the job. A `pull_request` from a fork gets a
+      # read-only GITHUB_TOKEN, so createComment returns 403
+      # ("Resource not accessible by integration"). That used to fail this job
+      # even when every budget passed.
       - name: Comment PR with budget summary
         if: github.event_name == 'pull_request' && always()
+        continue-on-error: true
         uses: actions/github-script@v7
         with:
           script: |
@@ -117,9 +138,18 @@ jobs:
             } else {
               summary += '_No latency budget report was generated._';
             }
-            github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: summary
-            });
+            try {
+              await github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: summary
+              });
+            } catch (error) {
+              core.warning(
+                `Could not post the latency budget comment (this is expected ` +
+                `for pull requests from forks, which get a read-only token): ` +
+                `${error.message}`
+              );
+              core.summary.addRaw(summary).write();
+            }

.github/workflows/fuzzing.yml

@@ -18,6 +18,11 @@ on:
       - 'tests/contract_property_tests.rs'
       - '.github/workflows/fuzzing.yml'
       - 'Cargo.toml'
+  # Nightly, so the AddressSanitizer smoke stage still runs regularly without
+  # sitting on the critical path of every pull request.
+  schedule:
+    - cron: '0 3 * * *'
+
   # Allow manual dispatch with configurable fuzz duration.
   workflow_dispatch:
     inputs:
@@ -110,28 +115,33 @@ jobs:
         run: cargo build --locked
 
   # ── 3. Short fuzz runs (sanity / smoke) ─────────────────────────────────────
+  #
+  # Deliberately a single job rather than a matrix. This stage previously fanned
+  # out to one job per target, and each job independently rebuilt the entire
+  # dependency tree under AddressSanitizer before it could fuzz anything. Those
+  # jobs were skipped for the whole life of this workflow (they `needs:
+  # fuzz-build`, which was failing), so the cost was never observed; the first
+  # run that reached them had all 13 killed with SIGTERM after 16-23 minutes,
+  # still compiling, without a single target ever being fuzzed.
+  #
+  # `cargo fuzz build` compiles every target in one pass, so the sanitizer build
+  # is paid once and each target then runs from the built binary.
   fuzz-smoke:
-    name: Fuzz Smoke Run (${{ matrix.target }})
+    name: Fuzz Smoke Run
     runs-on: ubuntu-latest
     needs: fuzz-build
-    strategy:
-      fail-fast: false
-      matrix:
-        target:
-          - fuzz_validate_public_key
-          - fuzz_validate_secret_key
-          - fuzz_validate_contract_id
-          - fuzz_validate_wallet_name
-          - fuzz_validate_amount
-          - fuzz_passphrase_strength
-          - fuzz_wasm_hash
-          - fuzz_encrypted_bundle_parse
-          - fuzz_template_operations
-          # Contract fuzzing harnesses
-          - fuzz_wasm_validation
-          - fuzz_contract_invocation
-          - fuzz_contract_spec_parse
-          - fuzz_test_generator
+    # Not on pull requests. Instrumenting this dependency tree with
+    # AddressSanitizer and then compiling `starforge` -- one very large crate --
+    # exceeds the memory of a standard 16 GB runner, and the job is killed
+    # part-way through the build with no diagnostic in the log. Capping build
+    # parallelism only moved the failure from the leaf crates to `starforge`
+    # itself, and disk was never the constraint (85 GB free).
+    #
+    # `Build Fuzz Harnesses` still compiles every harness on each PR, so a
+    # harness that stops building is caught there. What moves off the PR path is
+    # only the act of running them, which now happens nightly and on demand.
+    if: github.event_name != 'pull_request'
+    timeout-minutes: 90
     steps:
       - uses: actions/checkout@v4
 
@@ -155,23 +165,59 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             fuzz/target
-          key: ${{ runner.os }}-fuzz-smoke-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-fuzz-smoke-${{ hashFiles('fuzz/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-fuzz-smoke-${{ matrix.target }}-
+            ${{ runner.os }}-fuzz-smoke-
+
+      - name: Build all fuzz targets
+        env:
+          # Fewer parallel rustc processes, each holding less peak memory.
+          CARGO_BUILD_JOBS: '2'
+        run: cargo fuzz build --fuzz-dir fuzz
 
-      - name: Run fuzz target (${{ matrix.target }})
+      - name: Run each fuzz target
         run: |
           DURATION=${{ github.event.inputs.fuzz_duration || '30' }}
-          cargo fuzz run ${{ matrix.target }} \
-            --fuzz-dir fuzz \
-            -- -max_total_time=${DURATION} -max_len=4096
+          TARGETS="
+            fuzz_validate_public_key
+            fuzz_validate_secret_key
+            fuzz_validate_contract_id
+            fuzz_validate_wallet_name
+            fuzz_validate_amount
+            fuzz_passphrase_strength
+            fuzz_wasm_hash
+            fuzz_encrypted_bundle_parse
+            fuzz_template_operations
+            fuzz_wasm_validation
+            fuzz_contract_invocation
+            fuzz_contract_spec_parse
+            fuzz_test_generator
+          "
+          failed=""
+          for target in $TARGETS; do
+            echo "::group::$target"
+            # The build above is already done, so this only fuzzes.
+            if cargo fuzz run "$target" --fuzz-dir fuzz \
+                 -- -max_total_time="$DURATION" -max_len=4096; then
+              echo "  PASS $target"
+            else
+              echo "  FAIL $target"
+              failed="$failed $target"
+            fi
+            echo "::endgroup::"
+          done
+          if [ -n "$failed" ]; then
+            echo "Fuzz targets reported findings:$failed"
+            exit 1
+          fi
+          echo "All fuzz targets completed without findings."
 
       - name: Upload corpus artifacts on failure
         if: failure()
         uses: actions/upload-artifact@v4
         with:
-          name: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
-          path: fuzz/corpus/${{ matrix.target }}/
+          name: fuzz-corpus-${{ github.run_id }}
+          path: fuzz/corpus/
 
   # ── 4. Coverage reporting ─────────────────────────────────────────────────────
   coverage:

.gitignore

@@ -146,7 +146,13 @@ target/debug/incremental/
 .rustfmt.toml.local
 
 # Cargo
-.cargo/
+# Ignore local cargo state, but keep the committed resolver config:
+# .cargo/config.toml pins MSRV-aware dependency resolution so that a
+# future `cargo update` cannot silently break the Rust 1.80 CI job.
+# (Uses `.cargo/*` rather than `.cargo/`: git cannot re-include a file
+# whose parent directory is itself excluded.)
+.cargo/*
+!.cargo/config.toml
 Cargo.toml.local
 
 # GitHub Actions