fix(ci): freeze orchestrated fhevm baseline

Author: Eikix

.github/workflows/test-suite-e2e-tests.yml

@@ -210,6 +210,12 @@ jobs:
           fi
           echo "LOCK_FILE=$lock_file" >> "$GITHUB_ENV"
 
+      - name: Require frozen baseline lock for orchestrated runs
+        if: ${{ inputs.orchestrated && inputs.lock-artifact-name == '' }}
+        run: |
+          echo "Orchestrated e2e requires a frozen baseline lock artifact" >&2
+          exit 1
+
       - name: Resolve latest-main lock once
         if: ${{ inputs.lock-artifact-name == '' && !inputs.orchestrated }}
         working-directory: test-suite/fhevm
@@ -227,6 +233,9 @@ jobs:
           args=(--scenario "$SCENARIO")
           if [ -n "${LOCK_FILE:-}" ]; then
             args+=(--lock-file "$LOCK_FILE")
+          elif [ "${{ inputs.orchestrated }}" = "true" ]; then
+            echo "Orchestrated e2e requires a frozen baseline lock artifact" >&2
+            exit 1
           else
             args+=(--target latest-main)
           fi
@@ -241,6 +250,9 @@ jobs:
           args=(--scenario "$SCENARIO")
           if [ -n "${LOCK_FILE:-}" ]; then
             args+=(--lock-file "$LOCK_FILE")
+          elif [ "${{ inputs.orchestrated }}" = "true" ]; then
+            echo "Orchestrated e2e requires a frozen baseline lock artifact" >&2
+            exit 1
           else
             args+=(--target latest-main)
           fi

.github/workflows/test-suite-orchestrate-e2e-tests.yml

@@ -14,9 +14,56 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
-  coprocessor-docker-build:
+  resolve-baseline:
+    name: resolve-baseline
     if: &build-trigger-condition |
       startsWith(github.head_ref, 'mergify/merge-queue/') || startsWith(github.base_ref, 'release/') || contains(github.event.pull_request.labels.*.name, 'e2e orchestrate test')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: 'read' # Required to checkout repository code
+      packages: 'read' # Required to read GitHub package metadata during base-sha resolution
+    env:
+      BASE_SHA: ${{ github.event.pull_request.base.sha }}
+      GH_TOKEN: ${{ github.token }}
+    outputs:
+      lock-artifact-name: ${{ steps.resolve-baseline.outputs.lock-artifact-name }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: 'false'
+          fetch-depth: 0
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@ecf28ddc73e819eb6fa29df6b34ef8921c743461 # v2.1.3
+
+      - name: Install GitHub CLI
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gh
+
+      - name: Install CLI deps
+        working-directory: test-suite/fhevm
+        run: bun install --frozen-lockfile
+
+      - id: resolve-baseline
+        name: Resolve base-sha baseline lock
+        working-directory: test-suite/fhevm
+        run: |
+          set -euo pipefail
+          lock_path="$(./fhevm-cli resolve --target sha --sha "$BASE_SHA" --reset | tail -n 1)"
+          artifact_name="fhevm-base-lock-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          echo "lock-path=$lock_path" >> "$GITHUB_OUTPUT"
+          echo "lock-artifact-name=$artifact_name" >> "$GITHUB_OUTPUT"
+
+      - name: Upload baseline lock
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        with:
+          name: ${{ steps.resolve-baseline.outputs.lock-artifact-name }}
+          path: ${{ steps.resolve-baseline.outputs.lock-path }}
+
+  coprocessor-docker-build:
+    if: *build-trigger-condition
     uses: ./.github/workflows/coprocessor-docker-build.yml
     permissions: &docker_permissions
       actions: 'read' # Required to read workflow run information
@@ -61,6 +108,7 @@ jobs:
   create-e2e-tests-input:
     name: create-e2e-tests-input
     needs:
+      - resolve-baseline
       - coprocessor-docker-build
       - gateway-contracts-docker-build
       - host-contracts-docker-build
@@ -91,6 +139,7 @@ jobs:
       gateway-version: ${{ steps.create-e2e-tests-input.outputs.gateway-version }}
       host-version: ${{ steps.create-e2e-tests-input.outputs.host-version }}
       kms-core-version: ${{ steps.create-e2e-tests-input.outputs.kms-core-version }}
+      lock-artifact-name: ${{ needs.resolve-baseline.outputs.lock-artifact-name }}
       relayer-migrate-version: ${{ steps.create-e2e-tests-input.outputs.relayer-migrate-version }}
       relayer-version: ${{ steps.create-e2e-tests-input.outputs.relayer-version }}
       test-suite-version: ${{ steps.create-e2e-tests-input.outputs.test-suite-version }}
@@ -215,6 +264,7 @@ jobs:
       gateway-version: ${{ needs.create-e2e-tests-input.outputs.gateway-version }}
       host-version: ${{ needs.create-e2e-tests-input.outputs.host-version }}
       kms-core-version: ${{ needs.create-e2e-tests-input.outputs.kms-core-version }}
+      lock-artifact-name: ${{ needs.create-e2e-tests-input.outputs.lock-artifact-name }}
       relayer-migrate-version: ${{ needs.create-e2e-tests-input.outputs.relayer-migrate-version }}
       relayer-version: ${{ needs.create-e2e-tests-input.outputs.relayer-version }}
       scenario: ${{ startsWith(github.base_ref, 'release/') && 'two-of-two' || 'two-of-two-multi-chain' }}