feat: consolidate Tsuki migration onto inbound-only clean Reth (f851224e + component 18adb117)

.cargo/config.toml

@@ -1,4 +1,5 @@
 [alias]
 docs = "doc --workspace --all-features --no-deps"
-[build]
-rustflags = ["--cfg", "tokio_unstable"]
+
+[net]
+git-fetch-with-cli = true

.github/assets/verify_reth_sources.jq

@@ -0,0 +1,77 @@
+# Validates a `cargo metadata` dependency graph against the canonical DogeOS
+# component, clean DogeOS Reth, DogeOS REVM, and reviewed official Reth pins.
+#
+# Arguments (exact canonical source strings):
+#   $components  DogeOS component packages (dogeos-reth repository)
+#   $reth        clean DogeOS Reth packages (DogeOS69/reth repository)
+#   $revm        DogeOS REVM packages (dogeos-revm repository)
+#   $official    reviewed official Reth transitive source (paradigmxyz/reth)
+#
+# Emits one line per violation; empty output means the graph is verified.
+
+# Reduce a source URL to its repository identity so revision pinning cannot be
+# bypassed through case, scheme, `.git`, or trailing-slash spelling variants.
+def norm_repo:
+  ascii_downcase
+  | sub("^git\\+"; "")
+  | split("?")[0]
+  | split("#")[0]
+  | sub("^(https?|ssh|git)://"; "")
+  | sub("^git@"; "")
+  | sub("^github\\.com:"; "github.com/")
+  | sub("\\.git$"; "")
+  | sub("/+$"; "");
+
+def retired_repos:
+  ["github.com/dogeos69/dogeos-reth2",
+   "github.com/dogeos69/scroll-reth",
+   "github.com/scroll-tech/reth"];
+
+[
+  # Anchor packages must each resolve exactly once from their canonical source.
+  (if [.packages[] | select(.name == "dogeos-reth-node") | .source] == [$components] then empty
+   else "anchor dogeos-reth-node must resolve exactly once from the canonical DogeOS component source" end),
+  (if [.packages[] | select(.name == "reth-node-builder") | .source] == [$reth] then empty
+   else "anchor reth-node-builder must resolve exactly once from the clean DogeOS Reth source" end),
+  (if [.packages[] | select(.name == "revm-scroll") | .source] == [$revm] then empty
+   else "revm-scroll must resolve exactly once from the canonical DogeOS REVM source" end),
+
+  (.packages[]
+   | (if .source == null then null else (.source | norm_repo) end) as $repo
+   | (
+       # Every DogeOS component package must use the canonical component
+       # source; null/path sources fail this comparison as well.
+       (if (.name | startswith("dogeos-")) and .source != $components then
+          "DogeOS component package \(.name) must use the canonical component source, found \(.source // "null/path source")"
+        else empty end),
+
+       # Every reth-* package must be a registry compatibility crate, clean
+       # DogeOS Reth, or the exact reviewed official Reth source.
+       (if (.name | test("^reth(-|$)")) then
+          (if .source == null then
+             "Reth package \(.name) must not use a null/path source"
+           elif (.source | startswith("registry+")) or .source == $reth or .source == $official then
+             empty
+           else
+             "Reth package \(.name) has an unreviewed source \(.source)"
+           end)
+        else empty end),
+
+       # Any package drawn from a guarded repository must use the exact
+       # canonical source; retired forks are rejected outright.
+       (if $repo == null then empty
+        elif retired_repos | index($repo) then
+          "package \(.name) uses the retired fork source \(.source)"
+        elif $repo == "github.com/dogeos69/dogeos-reth" and .source != $components then
+          "package \(.name) uses a noncanonical DogeOS component source \(.source)"
+        elif $repo == "github.com/dogeos69/reth" and .source != $reth then
+          "package \(.name) uses a noncanonical clean DogeOS Reth source \(.source)"
+        elif $repo == "github.com/dogeos69/dogeos-revm" and .source != $revm then
+          "package \(.name) uses a noncanonical DogeOS REVM source \(.source)"
+        elif $repo == "github.com/paradigmxyz/reth" and .source != $official then
+          "package \(.name) uses an unreviewed official Reth source \(.source)"
+        else empty end)
+     )
+  )
+]
+| .[]

.github/assets/verify_reth_sources.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env sh
+set -eu
+
+script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+
+# Canonical reviewed sources; every guarded package family must resolve to
+# these exact strings (see verify_reth_sources.jq for the enforced rules).
+components_source="git+https://github.com/DogeOS69/dogeos-reth.git?rev=18adb1176636b4f3bdc828a15c4622f60d2e5ec7#18adb1176636b4f3bdc828a15c4622f60d2e5ec7"
+reth_source="git+https://github.com/DogeOS69/reth.git?rev=f851224ee9aaf21c76a14e844cbd12d9756f5f3b#f851224ee9aaf21c76a14e844cbd12d9756f5f3b"
+revm_source="git+https://github.com/DogeOS69/dogeos-revm.git?branch=dogeos#dcf087684f255131c96c0d20f3291eef9198e990"
+official_reth_source="git+https://github.com/paradigmxyz/reth?rev=b25f32a977b489f9b84254c7811a2a5a25a81369#b25f32a977b489f9b84254c7811a2a5a25a81369"
+
+# The predicate runs against a metadata file when one is provided (used by the
+# fixtures in verify_reth_sources_test.sh); CI and local runs generate the
+# metadata from the locked workspace.
+if [ "$#" -gt 0 ]; then
+    metadata_file="$1"
+else
+    metadata_file=$(mktemp)
+    trap 'rm -f "$metadata_file"' EXIT
+    cargo metadata --locked --offline --format-version 1 > "$metadata_file"
+fi
+
+violations=$(jq -r \
+    --arg components "$components_source" \
+    --arg reth "$reth_source" \
+    --arg revm "$revm_source" \
+    --arg official "$official_reth_source" \
+    -f "$script_dir/verify_reth_sources.jq" \
+    "$metadata_file")
+
+if [ -n "$violations" ]; then
+    printf '%s\n' "dependency source verification failed:" "$violations" >&2
+    exit 1
+fi
+
+echo "dependency graph verified: qualified DogeOS component, Reth, and REVM revisions"

.github/assets/verify_reth_sources_test.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env sh
+# Fixtures for verify_reth_sources.sh: the unmodified dependency graph must
+# pass, and every mutated copy of it must be rejected. Requires a fetched
+# workspace (cargo metadata --locked --offline must succeed).
+set -eu
+
+script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+verify="$script_dir/verify_reth_sources.sh"
+
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+
+metadata_file="$workdir/metadata.json"
+cargo metadata --locked --offline --format-version 1 > "$metadata_file"
+
+# Positive control: the checked-in graph must pass through the file entry point.
+"$verify" "$metadata_file" > /dev/null
+echo "ok: guard accepts the checked-in dependency graph"
+
+fixture="$workdir/fixture.json"
+canonical_metadata="$workdir/metadata.canonical.json"
+jq -S . "$metadata_file" > "$canonical_metadata"
+
+expect_reject() {
+    description="$1"
+    mutation="$2"
+    jq "$mutation" "$metadata_file" > "$fixture"
+    # A fixture that does not change the metadata would trivially pass the
+    # guard; treat it as a broken fixture rather than a rejection.
+    if jq -S . "$fixture" | cmp -s - "$canonical_metadata"; then
+        echo "FAIL: fixture mutation for $description left the metadata unchanged" >&2
+        exit 1
+    fi
+    if "$verify" "$fixture" > /dev/null 2>&1; then
+        echo "FAIL: guard accepted $description" >&2
+        exit 1
+    fi
+    echo "ok: guard rejects $description"
+}
+
+expect_reject "a null-source DogeOS component" \
+    '.packages |= map(if .name == "dogeos-reth-evm" then .source = null else . end)'
+
+expect_reject "a path-source DogeOS component" \
+    '.packages |= map(if .name == "dogeos-chainspec" then .source = "path+file:///tmp/dogeos-chainspec" else . end)'
+
+expect_reject "the obsolete c5198f7 DogeOS component source alongside the good anchors" \
+    '.packages += [first(.packages[] | select(.name == "dogeos-chainspec")) | .source = "git+https://github.com/DogeOS69/dogeos-reth.git?rev=c5198f722a4fcbd47e8c0a10fe8f9835a801c2d2#c5198f722a4fcbd47e8c0a10fe8f9835a801c2d2"]'
+
+expect_reject "the obsolete PR #3 ae160090 clean-Reth source alongside the good anchors" \
+    '.packages += [first(.packages[] | select(.name == "reth-node-builder")) | .source = "git+https://github.com/DogeOS69/reth.git?rev=ae160090003d9b04be0521e9e4760558798cdf40#ae160090003d9b04be0521e9e4760558798cdf40"]'
+
+expect_reject "a retired dogeos-reth2 source without the .git suffix" \
+    '.packages += [first(.packages[] | select(.name == "reth-node-builder")) | .source = "git+https://github.com/DogeOS69/dogeos-reth2?rev=0000000000000000000000000000000000000000#0000000000000000000000000000000000000000"]'
+
+expect_reject "a retired scroll-reth source with alternate casing" \
+    '.packages += [first(.packages[] | select(.name == "reth-node-builder")) | .source = "git+https://github.com/DogeOS69/Scroll-Reth.git?branch=dev#0000000000000000000000000000000000000000"]'
+
+expect_reject "a retired scroll-tech/reth source without the .git suffix" \
+    '.packages += [first(.packages[] | select(.name == "reth-node-builder")) | .source = "git+https://github.com/scroll-tech/reth?branch=scroll#0000000000000000000000000000000000000000"]'
+
+expect_reject "a duplicate lowercase-organization DogeOS REVM source" \
+    '.packages += [first(.packages[] | select(.name == "revm-scroll")) | .source = "git+https://github.com/dogeos69/dogeos-revm?branch=dogeos#dcf087684f255131c96c0d20f3291eef9198e990"]'
+
+expect_reject "a wrong DogeOS REVM revision" \
+    '.packages |= map(if .name == "revm-scroll" then .source = "git+https://github.com/DogeOS69/dogeos-revm.git?branch=dogeos#1111111111111111111111111111111111111111" else . end)'
+
+expect_reject "a wrong official Reth revision" \
+    '.packages |= map(if .source != null and (.source | contains("paradigmxyz/reth")) then .source = "git+https://github.com/paradigmxyz/reth?rev=2222222222222222222222222222222222222222#2222222222222222222222222222222222222222" else . end)'
+
+echo "source guard fixtures passed"

.github/workflows/lint.yaml

@@ -13,6 +13,24 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  dependency-sources:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: dcarbone/install-jq-action@v3
+      - name: Configure dependency access
+        env:
+          GITHUB_TOKEN: ${{ secrets.DOGEOS_RETH_TOKEN || secrets.DOGEOS_RETH2_TOKEN || github.token }}
+        run: git config --global url."https://x-access-token:${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
+      - name: Fetch locked dependencies
+        run: cargo fetch --locked
+      - name: Verify Reth dependency sources
+        run: .github/assets/verify_reth_sources.sh
+      - name: Check source guard rejects noncanonical fixtures
+        run: .github/assets/verify_reth_sources_test.sh
+
   clippy:
     runs-on: ubuntu-latest
     timeout-minutes: 30

.github/workflows/release.yml

@@ -140,6 +140,8 @@ jobs:
           push: false
           platforms: ${{ env.PLATFORM }}
           tags: ${{ env.DOCKER_TAGS }}
+          secrets: |
+            github_token=${{ secrets.DOGEOS_RETH_TOKEN || secrets.DOGEOS_RETH2_TOKEN || github.token }}
           labels: |
             org.opencontainers.image.title=rollup-node
             org.opencontainers.image.description=DogeOS rollup-node service
@@ -163,6 +165,8 @@ jobs:
           push: true
           platforms: ${{ env.PLATFORM }}
           tags: ${{ env.DOCKER_TAGS }}
+          secrets: |
+            github_token=${{ secrets.DOGEOS_RETH_TOKEN || secrets.DOGEOS_RETH2_TOKEN || github.token }}
           cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
           cache-to: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache,mode=max
           labels: |