Bump fast-uri from 3.1.3 to 3.1.8 in /nitro-reth/docs

.github/actions/nitro-reth-setup/action.yml

@@ -0,0 +1,51 @@
+name: nitro-reth setup
+description: >
+  Common setup for nitro-reth CI jobs: submodules, C build deps, prebuilt brotli
+  static libs, the Rust toolchain, and the shared cargo cache. Run after checkout.
+
+inputs:
+  client-id:
+    description: GitHub App client id for submodule access
+    required: true
+  app-private-key:
+    description: GitHub App private key for submodule access
+    required: true
+  toolchain:
+    description: Rust toolchain to install
+    default: "1.93"
+  components:
+    description: Extra toolchain components (comma-separated)
+    default: ""
+  targets:
+    description: Extra compilation targets (comma-separated)
+    default: ""
+  brotli:
+    description: Build the prebuilt brotli static libs (needed by jobs that link)
+    default: "false"
+  cache-shared-key:
+    description: rust-cache shared-key (empty means per-job default keys)
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/init-submodules
+      with:
+        client-id: ${{ inputs.client-id }}
+        app-private-key: ${{ inputs.app-private-key }}
+    - name: Install build deps
+      shell: bash
+      run: sudo apt-get update && sudo apt-get install -y build-essential clang libclang-dev cmake
+    - name: Build brotli static libs
+      if: inputs.brotli == 'true'
+      shell: bash
+      run: ./scripts/build-brotli.sh -l
+    - uses: dtolnay/rust-toolchain@master
+      with:
+        toolchain: ${{ inputs.toolchain }}
+        components: ${{ inputs.components }}
+        targets: ${{ inputs.targets }}
+    - uses: Swatinem/rust-cache@v2
+      with:
+        workspaces: nitro-reth
+        shared-key: ${{ inputs.cache-shared-key }}

.github/buildspec.yml

@@ -9,6 +9,18 @@ env:
 phases:
   pre_build:
     commands:
+      # CODEBUILD_CLONE_REF checks out the source action's BranchName, not the
+      # revision the execution resolved, so pin the tree before anything reads git.
+      - |
+        set -euo pipefail
+        REF=${SOURCE_REF:-auto}
+        if [ "$REF" = auto ]; then REF=$CODEBUILD_RESOLVED_SOURCE_VERSION; fi
+        if ! git rev-parse --verify --quiet "${REF}^{commit}" >/dev/null; then
+          echo "ERROR: $REF is not in the clone. CodeBuild does not leave usable credentials on origin, so it cannot be fetched." >&2
+          echo "local refs:" >&2; git for-each-ref --format='  %(refname)' >&2
+          exit 1
+        fi
+        git checkout --force --detach "$REF"
       - |
         set -euo pipefail
         if [ -n "${GITHUB_APP_KEY:-}" ]; then
@@ -47,7 +59,7 @@ phases:
       - NITRO_MODIFIED="false"
       - echo ${IMAGE_TAG} > ./.nitro-tag.txt
       - >-
-        BUILD_ARGS="--build-arg tag=$NITRO_TAG
+        export BUILD_ARGS="--build-arg tag=$NITRO_TAG
         --build-arg branch=$NITRO_BRANCH
         --build-arg commit=$NITRO_COMMIT
         --build-arg datetime=$NITRO_DATETIME
@@ -58,10 +70,6 @@ phases:
       - echo Building the Docker image ${IMAGE_TAG}...
       - |
         set -euo pipefail
-        # CodeBuild does not propagate env between phases (only IMAGE_TAG is
-        # in exported-variables), and installation tokens expire in ~10 min.
-        # Re-mint here so the docker builds can forward a fresh token to
-        # BuildKit as the gh_token secret consumed by scripts/download-machine.sh.
         build_secret_arg=""
         if [ -n "${GITHUB_APP_KEY:-}" ]; then
           trap 'rm -f /tmp/github-app-key.pem; unset GITHUB_TOKEN' EXIT
@@ -85,13 +93,26 @@ phases:
           rm -f /tmp/github-app-key.pem
           build_secret_arg="--secret id=gh_token,env=GITHUB_TOKEN"
         fi
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-slim --target nitro-node-slim ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node --target nitro-node ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-dev --target nitro-node-dev ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-validator --target nitro-node-validator ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-rust-validator --target nitro-node-rust-validator ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-slim-stripped --target nitro-node-slim-stripped ${BUILD_ARGS:-} $build_secret_arg
-        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-stripped --target nitro-node-stripped ${BUILD_ARGS:-} $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-slim --target nitro-node-slim $BUILD_ARGS $build_secret_arg
+
+        # Docker only warns when a build arg is not declared, so a rename
+        # silently ships an unstamped binary. An empty value would match
+        # anything, so reject it rather than pass vacuously.
+        stamped=$(docker run --rm --entrypoint /usr/local/bin/nitro nitro-node-slim --version)
+        for want in "${NITRO_TAG:-$NITRO_BRANCH}" "$NITRO_COMMIT"; do
+          [ -n "$want" ] || { echo "ERROR: provenance value is empty" >&2; exit 1; }
+          case $stamped in
+            *"$want"*) ;;
+            *) echo "ERROR: nitro-node-slim stamped '$stamped', expected '$want'" >&2; exit 1 ;;
+          esac
+        done
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node --target nitro-node $BUILD_ARGS $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-dev --target nitro-node-dev $BUILD_ARGS $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-validator --target nitro-node-validator $BUILD_ARGS $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-rust-validator --target nitro-node-rust-validator $BUILD_ARGS $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-slim-stripped --target nitro-node-slim-stripped $BUILD_ARGS $build_secret_arg
+        DOCKER_BUILDKIT=1 docker build . --tag nitro-node-stripped --target nitro-node-stripped $BUILD_ARGS $build_secret_arg
+
       - docker tag nitro-node:latest $REPOSITORY_URI:$IMAGE_TAG-$ARCH_TAG
       - docker tag nitro-node-slim:latest $REPOSITORY_URI:$IMAGE_TAG-slim-$ARCH_TAG
       - docker tag nitro-node-dev:latest $REPOSITORY_URI:$IMAGE_TAG-dev-$ARCH_TAG

.github/manifest-buildspec.yml

@@ -7,6 +7,18 @@ env:
 phases:
   pre_build:
     commands:
+      # CODEBUILD_CLONE_REF checks out the source action's BranchName, not the
+      # revision the execution resolved, so pin the tree before anything reads git.
+      - |
+        set -euo pipefail
+        REF=${SOURCE_REF:-auto}
+        if [ "$REF" = auto ]; then REF=$CODEBUILD_RESOLVED_SOURCE_VERSION; fi
+        if ! git rev-parse --verify --quiet "${REF}^{commit}" >/dev/null; then
+          echo "ERROR: $REF is not in the clone. CodeBuild does not leave usable credentials on origin, so it cannot be fetched." >&2
+          echo "local refs:" >&2; git for-each-ref --format='  %(refname)' >&2
+          exit 1
+        fi
+        git checkout --force --detach "$REF"
       # Sets NITRO_TAG, NITRO_BRANCH, NITRO_COMMIT, and the Docker-safe
       # IMAGE_TAG; must select the same image tag as buildspec.yml.
       - . scripts/ci-version-select.sh
@@ -71,5 +83,6 @@ phases:
         push_variant "-slim"
         push_variant "-dev"
         push_variant "-validator"
+        push_variant "-rust-validator"
         push_variant "-stripped"
         push_variant "-slim-stripped"

.github/workflows/_nitro-reth-build-release.yml

@@ -39,17 +39,12 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: ${{ inputs.ref }}
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - name: Install build deps
-        run: sudo apt-get update && sudo apt-get install -y build-essential clang libclang-dev cmake
-      - uses: dtolnay/rust-toolchain@1.93
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: nitro-reth
-          shared-key: arbreth-release-build
+          brotli: "true"
+          cache-shared-key: arbreth-release-build
       - name: Cargo build
         run: |
           set -euo pipefail

.github/workflows/_nitro-reth-coverage.yml

@@ -20,18 +20,12 @@ jobs:
         working-directory: nitro-reth
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - name: Install build deps
-        run: sudo apt-get update && sudo apt-get install -y build-essential clang libclang-dev cmake
-      - uses: dtolnay/rust-toolchain@1.93
-        with:
           components: llvm-tools-preview
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: nitro-reth
+          brotli: "true"
       - uses: taiki-e/install-action@0abfcd587b70a713fdaa7fb502c885e2112acb15  # v2
         with:
           tool: cargo-llvm-cov,cargo-nextest

.github/workflows/_nitro-reth-dependencies.yml

@@ -20,11 +20,10 @@ jobs:
         working-directory: nitro-reth
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - uses: dtolnay/rust-toolchain@1.93
       - uses: taiki-e/install-action@0abfcd587b70a713fdaa7fb502c885e2112acb15  # v2.75.7
         with:
           tool: cargo-deny,cargo-audit

.github/workflows/_nitro-reth-lint.yml

@@ -22,12 +22,11 @@ jobs:
       - uses: actions/checkout@v6
       # Any cargo invocation (fmt included) loads the manifests of the whole
       # local path-dep closure, which includes the wasmer submodule.
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - uses: dtolnay/rust-toolchain@nightly
-        with:
+          toolchain: nightly
           components: rustfmt
       # Plain fmt (not --all): --all would also format the path-based deps,
       # i.e. crates/{prover,arbutil,brotli} and the vendored wasmer.
@@ -42,18 +41,11 @@ jobs:
         working-directory: nitro-reth
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - name: Install build deps
-        run: sudo apt-get update && sudo apt-get install -y build-essential clang libclang-dev cmake
-      - uses: dtolnay/rust-toolchain@1.93
-        with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: nitro-reth
       - run: cargo clippy --workspace --all-targets -- -D warnings
 
   wasm-check:
@@ -65,17 +57,26 @@ jobs:
         working-directory: nitro-reth
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - uses: dtolnay/rust-toolchain@1.93
-        with:
           targets: wasm32-wasip1
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: nitro-reth
       - run: cargo wasm-check
+      # The macOS-lies guard: a local `cargo check` can pass a wasm tree that still
+      # contains C (clang headers mask the missing WASI sysroot), so require the
+      # dependency tree of every listed crate to be free of -sys crates.
+      - name: No C dependencies in the wasm trees
+        run: |
+          set -euo pipefail
+          bad=0
+          for c in $(grep -oE '"-p", "[a-z0-9-]+"' .cargo/config.toml | cut -d'"' -f4); do
+            if cargo tree -p "$c" -e normal --target wasm32-wasip1 | grep -E -- '-sys v'; then
+              echo "::error::$c pulls a -sys crate into its wasm dependency tree"
+              bad=1
+            fi
+          done
+          exit $bad
 
   docs:
     name: docs
@@ -88,16 +89,10 @@ jobs:
         working-directory: nitro-reth
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - name: Install build deps
-        run: sudo apt-get update && sudo apt-get install -y build-essential clang libclang-dev cmake
-      - uses: dtolnay/rust-toolchain@1.93
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: nitro-reth
       - run: cargo doc --workspace --no-deps
 
   guardrails:

.github/workflows/_nitro-reth-miri.yml

@@ -22,16 +22,13 @@ jobs:
         working-directory: nitro-reth
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - uses: dtolnay/rust-toolchain@nightly
-        with:
+          toolchain: nightly
           components: miri
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: nitro-reth
+          brotli: "true"
       # The lifetime-bound Storage<'a, D> foundation and the per-block
       # ArbPrecompileCtx are the two types whose aliasing invariants are
       # load-bearing for the rest of the workspace.

.github/workflows/_nitro-reth-spec-tests.yml

@@ -27,16 +27,11 @@ jobs:
         working-directory: nitro-reth
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - name: Install build deps
-        run: sudo apt-get update && sudo apt-get install -y build-essential clang libclang-dev cmake
-      - uses: dtolnay/rust-toolchain@1.93
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: nitro-reth
+          brotli: "true"
       - uses: taiki-e/install-action@0abfcd587b70a713fdaa7fb502c885e2112acb15  # v2
         with:
           tool: cargo-nextest

.github/workflows/_nitro-reth-test.yml

@@ -20,16 +20,11 @@ jobs:
         working-directory: nitro-reth
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - name: Install build deps
-        run: sudo apt-get update && sudo apt-get install -y build-essential clang libclang-dev cmake
-      - uses: dtolnay/rust-toolchain@1.93
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: nitro-reth
+          brotli: "true"
       - uses: taiki-e/install-action@0abfcd587b70a713fdaa7fb502c885e2112acb15  # v2
         with:
           tool: cargo-nextest
@@ -45,18 +40,12 @@ jobs:
         working-directory: nitro-reth
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - name: Install build deps
-        run: sudo apt-get update && sudo apt-get install -y build-essential clang libclang-dev cmake
-      - uses: dtolnay/rust-toolchain@1.93
-        with:
           targets: wasm32-wasip1
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: nitro-reth
+          brotli: "true"
       - run: cargo test -p arb-replay --release --test wasm_runner -- --ignored
 
   doctests:
@@ -68,14 +57,9 @@ jobs:
         working-directory: nitro-reth
     steps:
       - uses: actions/checkout@v6
-      - uses: ./.github/actions/init-submodules
+      - uses: ./.github/actions/nitro-reth-setup
         with:
           client-id: ${{ vars.NITRO_CI_APP_CLIENT_ID }}
           app-private-key: ${{ secrets.NITRO_CI_APP_PRIVATE_KEY }}
-      - name: Install build deps
-        run: sudo apt-get update && sudo apt-get install -y build-essential clang libclang-dev cmake
-      - uses: dtolnay/rust-toolchain@1.93
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: nitro-reth
+          brotli: "true"
       - run: cargo test --doc --workspace