Merge pull request matter-labs#1419 from matter-labs/draft-v29

feat: v29

Author: StanislavBreadless

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-## What ❔
+# What ❔
 
 <!-- What are the changes this PR brings about? -->
 <!-- Example: This PR adds a PR template to the repo. -->

.github/workflows/build-release.yaml

@@ -12,9 +12,6 @@ on:
       - "v*" # for main releases
       - "zkos*" # for zk releases
 
-permissions:
-  contents: write
-
 jobs:
   build-contracts:
     runs-on: ubuntu-latest

.github/workflows/codespell.yaml

@@ -11,9 +11,6 @@ name: Codespell
 
 on: pull_request
 
-permissions:
-  contents: read
-
 jobs:
   # TODO: fix codespell CI
   # codespell:

.github/workflows/dead-links.yaml

@@ -19,4 +19,4 @@ jobs:
       - name: Find and check markdown files
         run: |
           GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
-          find . -type f -name "*.md" ! -path "*/node_modules/*" ! -path "*/openzeppelin*" ! -path "*/murky/*" -exec lychee --max-concurrency 1 --cache --retry-wait-time 10 --exclude-path .lycheeignore --github-token $GITHUB_TOKEN {} +
+          find . -type f -name "*.md" ! -path "*/node_modules/*" ! -path "*/openzeppelin*" ! -path "*/murky/*" -exec lychee --accept 200,201,301,302,403,429 --max-retries 5 --max-concurrency 1 --cache --retry-wait-time 30 --exclude-path .lycheeignore --github-token "$GITHUB_TOKEN" {} +

.github/workflows/invariant-tests.yaml

@@ -5,8 +5,7 @@ on:
     - cron: "00 01 * * *"
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: read-all
 
 jobs:
   define-matrix:

.github/workflows/l1-contracts-ci.yaml

@@ -3,8 +3,10 @@ name: L1 contracts CI
 on:
   pull_request:
 
+# We need this permissions for this CI to work with external contributions
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   build:
@@ -19,7 +21,7 @@ jobs:
       - name: Install foundry-zksync
         run: |
           mkdir ./foundry-zksync
-          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-27360d4c8d12beddbb730dae07ad33a206b38f4b/foundry_nightly_linux_amd64.tar.gz
+          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-ae913af65381734ad46c044a9495b67310bc77c4/foundry_nightly_linux_amd64.tar.gz
           tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
           chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
           echo "$PWD/foundry-zksync" >> $GITHUB_PATH
@@ -55,7 +57,7 @@ jobs:
           yarn build:foundry
 
       - name: Create cache
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@v4
         with:
           key: artifacts-l1-${{ github.sha }}
           path: |
@@ -147,7 +149,7 @@ jobs:
       - name: Install foundry-zksync
         run: |
           mkdir ./foundry-zksync
-          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-27360d4c8d12beddbb730dae07ad33a206b38f4b/foundry_nightly_linux_amd64.tar.gz
+          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-ae913af65381734ad46c044a9495b67310bc77c4/foundry_nightly_linux_amd64.tar.gz
           tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
           chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
           echo "$PWD/foundry-zksync" >> $GITHUB_PATH
@@ -171,7 +173,12 @@ jobs:
 
       - name: Run tests
         working-directory: ./l1-contracts
-        run: FOUNDRY_PROFILE=default yarn test:foundry
+        run: yarn test:foundry
+
+      # TODO: restore once we can get back to latest foundry
+      # - name: Check gas snapshots
+      #   working-directory: ./l1-contracts
+      #   run: forge test --match-test MeasureGas --gas-snapshot-check=true
 
   test-foundry-zksync:
     needs: [build, lint]
@@ -192,7 +199,7 @@ jobs:
       - name: Install foundry-zksync
         run: |
           mkdir ./foundry-zksync
-          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-27360d4c8d12beddbb730dae07ad33a206b38f4b/foundry_nightly_linux_amd64.tar.gz
+          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-ae913af65381734ad46c044a9495b67310bc77c4/foundry_nightly_linux_amd64.tar.gz
           tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
           chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
           echo "$PWD/foundry-zksync" >> $GITHUB_PATH
@@ -219,7 +226,7 @@ jobs:
 
       - name: Run tests
         working-directory: ./l1-contracts
-        run: FOUNDRY_PROFILE=default yarn test:zkfoundry
+        run: yarn test:zkfoundry
 
   check-verifier-generator-l1:
     runs-on: ubuntu-latest
@@ -278,15 +285,11 @@ jobs:
         run: diff tools/data/VerifierFflonk.sol l1-contracts/contracts/state-transition/verifiers/L2VerifierFflonk.sol
 
   coverage:
-    if: false # FIXME: coverage disabled due to stack-too-deep in VerifierFflonk.sol
     defaults:
       run:
         working-directory: l1-contracts
     needs: [build, lint]
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
 
     steps:
       - name: Checkout the repository
@@ -303,7 +306,7 @@ jobs:
       - name: Install foundry-zksync
         run: |
           mkdir ./foundry-zksync
-          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-27360d4c8d12beddbb730dae07ad33a206b38f4b/foundry_nightly_linux_amd64.tar.gz
+          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-ae913af65381734ad46c044a9495b67310bc77c4/foundry_nightly_linux_amd64.tar.gz
           tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
           chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
           echo "$PWD/foundry-zksync" >> $GITHUB_PATH
@@ -326,7 +329,7 @@ jobs:
             system-contracts/zkout
 
       - name: Run coverage
-        run: FOUNDRY_PROFILE=default yarn test:foundry && FOUNDRY_PROFILE=default yarn coverage:foundry --report summary --report lcov
+        run: yarn test:foundry && yarn coverage:foundry --report summary --report lcov
 
       # Installing the specific version of `lcov` because of
       # the `genhtml: ERROR: line ... of ... has branchcov but no linecov data` error.
@@ -337,15 +340,15 @@ jobs:
           ref: v1.16
 
       # To ignore coverage for certain directories modify the paths in this step as needed. The
-      # below default ignores coverage results for the test and script directories. Alternatively,
-      # to include coverage in all directories, comment out this step. Note that because this
-      # filtering applies to the lcov file, the summary table generated in the previous step will
-      # still include all files and directories.
-      # The `--rc branch_coverage=1` part keeps branch info in the filtered report, since lcov
-      # defaults to removing branch info.
+      # below default ignores coverage results for the test and script directories. It also ignores
+      # the ChainRegistrar contract since it is unused. Alternatively, to include coverage in all
+      # directories, comment out this step. Note that because this filtering applies to the lcov
+      # file, the summary table generated in the previous step will still include all files and
+      # directories. The `--rc branch_coverage=1` part keeps branch info in the filtered report,
+      # since lcov defaults to removing branch info.
       - name: Filter directories
         run: |
-          lcov --ignore-errors unused --remove lcov.info 'test/*' 'contracts/dev-contracts/*' 'lib/*' '../lib/*' 'lib/' 'deploy-scripts/*' --output-file lcov.info --rc branch_coverage=1
+          lcov --ignore-errors unused --remove lcov.info 'test/*' 'contracts/dev-contracts/*' 'lib/*' '../lib/*' 'lib/' 'deploy-scripts/*' 'contracts/chain-registrar/ChainRegistrar.sol' --output-file lcov.info --rc branch_coverage=1
 
       # This step posts a detailed coverage report as a comment and deletes previous comments on
       # each push. The below step is used to fail coverage if the specified coverage threshold is

.github/workflows/l1-contracts-foundry-ci.yaml

@@ -19,7 +19,7 @@ jobs:
       - name: Install foundry-zksync
         run: |
           mkdir ./foundry-zksync
-          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-27360d4c8d12beddbb730dae07ad33a206b38f4b/foundry_nightly_linux_amd64.tar.gz
+          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-ae913af65381734ad46c044a9495b67310bc77c4/foundry_nightly_linux_amd64.tar.gz
           tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
           chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
           echo "$PWD/foundry-zksync" >> $GITHUB_PATH
@@ -46,7 +46,7 @@ jobs:
         run: yarn da build:foundry
 
       - name: Create cache
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@v4
         with:
           key: artifacts-l1-contracts-foudry-${{ github.sha }}
           path: |
@@ -109,11 +109,40 @@ jobs:
             exit 1
           fi
 
-      - name: Run DeployL1 script
+      - name: Run DeployL1CoreContracts script
         working-directory: ./l1-contracts
-        # l1-contracts are skipped because we don't want to recompile Bridgehub with a high optimizer-runs value.
-        # Otherwise, the Bridgehub contract size would be too large.
-        run: forge script ./deploy-scripts/DeployL1.s.sol --ffi --rpc-url $ANVIL_RPC_URL --broadcast --private-key $ANVIL_PRIVATE_KEY --skip '*/l1-contracts/contracts/*'
+        # First we need to deploy the ecosystem contracts
+        run: forge script ./deploy-scripts/DeployL1CoreContracts.s.sol --ffi --rpc-url $ANVIL_RPC_URL --broadcast --private-key $ANVIL_PRIVATE_KEY --skip '*/l1-contracts/contracts/*'
+
+      - name: Read bridgehub proxy address
+        id: read-bridgehub
+        working-directory: ./l1-contracts
+        run: |
+          # Extract bridgehub_proxy_addr allowing leading whitespace
+          BRIDGEHUB=$(
+            sed -nE 's/^[[:space:]]*bridgehub_proxy_addr[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' \
+              ./script-out/output-deploy-l1.toml | head -n1
+          )
+
+          echo "Parsed bridgehub_proxy_addr: $BRIDGEHUB"
+
+          if [[ -z "$BRIDGEHUB" || ! "$BRIDGEHUB" =~ ^0x[0-9a-fA-F]{40}$ ]]; then
+            echo "❌ Failed to parse a valid bridgehub address"
+            exit 1
+          fi
+
+          echo "BRIDGEHUB=$BRIDGEHUB" >> $GITHUB_ENV
+
+      - name: Run DeployCTM script with bridgehub
+        working-directory: ./l1-contracts
+        run: |
+          forge script ./deploy-scripts/DeployCTM.s.sol \
+            --ffi \
+            --rpc-url $ANVIL_RPC_URL \
+            --broadcast \
+            --private-key $ANVIL_PRIVATE_KEY \
+            --sig "runWithBridgehub(address,bool)" $BRIDGEHUB "false" \
+            --skip '*/l1-contracts/contracts/*'
 
       - name: Run DeployErc20 script
         working-directory: ./l1-contracts

.github/workflows/l2-contracts-ci.yaml

@@ -3,9 +3,6 @@ name: L2 contracts CI
 on:
   pull_request:
 
-permissions:
-  contents: read
-
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -19,7 +16,7 @@ jobs:
       - name: Install foundry-zksync
         run: |
           mkdir ./foundry-zksync
-          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-27360d4c8d12beddbb730dae07ad33a206b38f4b/foundry_nightly_linux_amd64.tar.gz
+          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-ae913af65381734ad46c044a9495b67310bc77c4/foundry_nightly_linux_amd64.tar.gz
           tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
           chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
           echo "$PWD/foundry-zksync" >> $GITHUB_PATH
@@ -48,7 +45,7 @@ jobs:
         run: yarn sc build:foundry
 
       - name: Create cache
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@v4
         with:
           key: artifacts-l2-${{ github.sha }}
           path: |
@@ -113,7 +110,7 @@ jobs:
       - name: Install foundry-zksync
         run: |
           mkdir ./foundry-zksync
-          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-27360d4c8d12beddbb730dae07ad33a206b38f4b/foundry_nightly_linux_amd64.tar.gz
+          curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly-ae913af65381734ad46c044a9495b67310bc77c4/foundry_nightly_linux_amd64.tar.gz
           tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
           chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
           echo "$PWD/foundry-zksync" >> $GITHUB_PATH

.github/workflows/nodejs-license.yaml

@@ -23,9 +23,6 @@ env:
   # It has to be one line, there must be no space between packages.
   EXCLUDE_PACKAGES: [email protected];[email protected];[email protected];
 
-permissions:
-  contents: read
-
 jobs:
   generate-matrix:
     name: Lists modules

.github/workflows/secrets_scanner.yaml

@@ -1,9 +1,5 @@
 name: Leaked Secrets Scan
 on: [pull_request]
-
-permissions:
-  contents: read
-
 jobs:
   TruffleHog:
     runs-on: ubuntu-latest