[DO NOT MERGE]: Release v25 protocol defense

.eslintrc

@@ -11,6 +11,7 @@
  "no-console": "off"
  },
  "ignorePatterns": [
- "**/lib/*"
+ "**/lib/*",
+ "lib/*"
  ]
 }

.github/workflows/build-release.yaml

@@ -22,6 +22,15 @@ jobs:
  uses: actions/checkout@v4
  with:
  ref: ${{ inputs.commit }}
+ submodules: recursive
+
+ - name: Install foundry-zksync
+ run: |
+ mkdir ./foundry-zksync
+ curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly/foundry_nightly_linux_amd64.tar.gz
+ tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
+ chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
+ echo "$PWD/foundry-zksync" >> $GITHUB_PATH
 
  - name: Use Node.js
  uses: actions/setup-node@v3
@@ -35,11 +44,24 @@ jobs:
  yarn
  echo "release_tag=${{ inputs.prefix }}-${{ inputs.commit }}" >> $GITHUB_OUTPUT
 
- - name: Build contracts
+ - name: Build l1 contracts
+ working-directory: l1-contracts
+ run: |
+ forge build
+
+ - name: Build l2 contracts
+ working-directory: l2-contracts
+ run: |
+ forge build --zksync --zk-enable-eravm-extensions
+
+ - name: Build system-contracts
+ working-directory: system-contracts
  run: |
- yarn l1 build
- yarn l2 build
- yarn sc build
+ yarn install
+ yarn preprocess:system-contracts
+ forge build --zksync --zk-enable-eravm-extensions
+ yarn preprocess:bootloader
+ forge build --zksync --zk-enable-eravm-extensions
 
  - name: Prepare artifacts
  run: |

.github/workflows/l1-contracts-ci.yaml

@@ -3,40 +3,54 @@ name: L1 contracts CI
 on:
  pull_request:
 
+# We need this permissions for this CI to work with external contributions
+permissions:
+ contents: read
+ pull-requests: write
+
 jobs:
  build:
  runs-on: ubuntu-latest
 
  steps:
  - name: Checkout the repository
  uses: actions/checkout@v4
+ with:
+ submodules: recursive
+
+ - name: Install foundry-zksync
+ run: |
+ mkdir ./foundry-zksync
+ curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly/foundry_nightly_linux_amd64.tar.gz
+ tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
+ chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
+ echo "$PWD/foundry-zksync" >> $GITHUB_PATH
 
  - name: Use Node.js
  uses: actions/setup-node@v3
  with:
  node-version: 18.18.0
  cache: yarn
 
- - name: Install dependencies
- run: yarn
-
- - name: Build artifacts
- run: yarn l1 build
+ - name: Build l1 contracts
+ working-directory: l1-contracts
+ run: |
+ forge build
 
- - name: Build L2 artifacts
- run: yarn l2 build
+ - name: Build l2 contracts
+ working-directory: l2-contracts
+ run: |
+ forge build --zksync --zk-enable-eravm-extensions
 
  - name: Create cache
  uses: actions/cache/save@v3
  with:
  key: artifacts-l1-${{ github.sha }}
  path: |
- l1-contracts/artifacts
- l1-contracts/cache
- l1-contracts/typechain
- l2-contracts/artifacts-zk
- l2-contracts/cache-zk
- l2-contracts/typechain
+ l1-contracts/cache-forge
+ l1-contracts/out
+ l2-contracts/cache-forge
+ l2-contracts/zkout
 
  lint:
  runs-on: ubuntu-latest
@@ -67,15 +81,19 @@ jobs:
  with:
  submodules: recursive
 
- - name: Use Foundry
- uses: foundry-rs/foundry-toolchain@v1
-
  - name: Use Node.js
  uses: actions/setup-node@v3
  with:
  node-version: 18.18.0
  cache: yarn
 
+ - name: Install foundry-zksync
+ run: |
+ mkdir ./foundry-zksync
+ curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly/foundry_nightly_linux_amd64.tar.gz
+ tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
+ chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
+ echo "$PWD/foundry-zksync" >> $GITHUB_PATH
  - name: Install dependencies
  run: yarn
 
@@ -123,7 +141,7 @@ jobs:
  l2-contracts/typechain
 
  - name: Run tests
- run: yarn l1 test --no-compile
+ run: yarn l1 test
 
  check-verifier-generator:
  runs-on: ubuntu-latest
@@ -145,3 +163,78 @@ jobs:
 
  - name: Compare
  run: diff tools/data/Verifier.sol l1-contracts/contracts/state-transition/Verifier.sol
+
+ coverage:
+ defaults:
+ run:
+ working-directory: l1-contracts
+ needs: [build, lint]
+ runs-on: ubuntu-latest
+
+ steps:
+ - name: Checkout the repository
+ uses: actions/checkout@v4
+ with:
+ submodules: recursive
+
+ - name: Use Node.js
+ uses: actions/setup-node@v3
+ with:
+ node-version: 18.18.0
+ cache: yarn
+
+ - name: Install foundry-zksync
+ run: |
+ mkdir ./foundry-zksync
+ curl -LO https://github.com/matter-labs/foundry-zksync/releases/download/nightly/foundry_nightly_linux_amd64.tar.gz
+ tar zxf foundry_nightly_linux_amd64.tar.gz -C ./foundry-zksync
+ chmod +x ./foundry-zksync/forge ./foundry-zksync/cast
+ echo "$PWD/foundry-zksync" >> $GITHUB_PATH
+
+ - name: Install dependencies
+ run: yarn
+
+ - name: Restore artifacts cache
+ uses: actions/cache/restore@v3
+ with:
+ fail-on-cache-miss: true
+ key: artifacts-l1-${{ github.sha }}
+ path: |
+ l1-contracts/artifacts
+ l1-contracts/cache
+ l1-contracts/typechain
+
+ - name: Run coverage
+ run: FOUNDRY_PROFILE=default yarn test:foundry && FOUNDRY_PROFILE=default yarn coverage:foundry --report summary --report lcov
+
+ # To ignore coverage for certain directories modify the paths in this step as needed. The
+ # below default ignores coverage results for the test and script directories. Alternatively,
+ # to include coverage in all directories, comment out this step. Note that because this
+ # filtering applies to the lcov file, the summary table generated in the previous step will
+ # still include all files and directories.
+ # The `--rc lcov_branch_coverage=1` part keeps branch info in the filtered report, since lcov
+ # defaults to removing branch info.
+ - name: Filter directories
+ run: |
+ sudo apt update && sudo apt install -y lcov
+ lcov --remove lcov.info 'test/*' 'contracts/dev-contracts/*' '../lib/forge-std/*' '../lib/murky/*' 'lib/*' '../lib/*' 'lib/' --output-file lcov.info --rc lcov_branch_coverage=1
+
+ # This step posts a detailed coverage report as a comment and deletes previous comments on
+ # each push. The below step is used to fail coverage if the specified coverage threshold is
+ # not met. The below step can post a comment (when it's `github-token` is specified) but it's
+ # not as useful, and this action cannot fail CI based on a minimum coverage threshold, which
+ # is why we use both in this way.
+ - name: Post coverage report
+ if: github.event_name == 'pull_request' # This action fails when ran outside of a pull request.
+ uses: romeovs/[email protected]
+ with:
+ delete-old-comments: true
+ lcov-file: ./l1-contracts/lcov.info
+ github-token: ${{ secrets.GITHUB_TOKEN }} # Adds a coverage summary comment to the PR.
+
+ - name: Verify minimum coverage
+ uses: zgosalvez/github-actions-report-lcov@v2
+ with:
+ coverage-files: ./l1-contracts/lcov.info
+ working-directory: l1-contracts
+ minimum-coverage: 85 # Set coverage threshold.