Merge branch 'next' into fix-2813-dyncall-stack-depth-at-min

Author: huitseeker

.github/workflows/signed-commits.yml

@@ -0,0 +1,79 @@
+# Verifies that all commits in a PR are signed (GPG or SSH).
+# Posts a comment with remediation steps if unsigned commits are found.
+
+name: signed commits
+
+permissions:
+  contents: read
+  pull-requests: write
+
+on:
+  pull_request_target:
+    branches:
+      - main
+      - next
+    types: [opened, reopened, synchronize]
+
+jobs:
+  check-signed-commits:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for unsigned commits
+        id: check
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber = context.payload.pull_request.number;
+            const commits = await github.rest.pulls.listCommits({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+              per_page: 250
+            });
+
+            const unsigned = commits.data.filter(c => !c.commit.verification.verified);
+
+            if (unsigned.length === 0) {
+              core.setOutput('unsigned', '');
+              core.info('All commits are signed.');
+              return;
+            }
+
+            const lines = unsigned.map(c =>
+              `- \`${c.sha.slice(0, 8)}\` ${c.commit.message.split('\n')[0]}`
+            );
+
+            core.setOutput('unsigned', lines.join('\n'));
+            core.setOutput('pr_number', String(prNumber));
+            core.setFailed(
+              `Found ${unsigned.length} unsigned commit(s) in this PR. ` +
+              'All commits must be signed (GPG or SSH).'
+            );
+
+      - name: Comment with remediation steps
+        if: failure() && steps.check.outputs.unsigned != ''
+        uses: actions/github-script@v7
+        env:
+          UNSIGNED: ${{ steps.check.outputs.unsigned }}
+          PRNUM: ${{ steps.check.outputs.pr_number }}
+        with:
+          script: |
+            const issue_number = parseInt(process.env.PRNUM, 10);
+            const unsignedList = process.env.UNSIGNED;
+
+            const body = [
+              'This PR contains unsigned commits. All commits must be cryptographically signed (GPG or SSH).',
+              '',
+              'Unsigned commits:',
+              unsignedList,
+              '',
+              'For instructions on setting up commit signing and re-signing existing commits, see:',
+              'https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits'
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number,
+              body
+            });

CHANGELOG.md

@@ -49,6 +49,8 @@
 - [BREAKING] `Variant::new` now expects an optional payload type to be specified ([#2848](https://github.com/0xMiden/miden-vm/pull/2848))
 - [BREAKING] Enum types are now exported from libraries as a `midenc_hir_type::EnumType`, rather than the type of the discriminant. ([#2848](https://github.com/0xMiden/miden-vm/pull/2848))
 - In `ExecutionTracer`, we no longer record node flags in `CoreTraceFragmentContext` when entering a node (they are redundant) ([#2866](https://github.com/0xMiden/miden-vm/pull/2866))
+- Updated the recursive STARK verifier to work with the lifted-STARK / `p3-miden` backend ([#2869](https://github.com/0xMiden/miden-vm/pull/2869)).
+- Switched Keccak STARK config to use stateful binary sponge with `[Felt; VECTOR_LEN]` packing, and reorganized `config.rs` into per-hash-family sections ([#2874](https://github.com/0xMiden/miden-vm/pull/2874)).
 
 #### Fixes
 - Fixed C-like enum validation and constant materialization in `define_enum` ([#2887](https://github.com/0xMiden/miden-vm/pull/2887)).

Cargo.lock

@@ -47,6 +47,7 @@ overflow-checks = true
 
 [workspace.dependencies]
 # Workspace crates
+miden-ace-codegen       = { path = "./crates/ace-codegen", version = "0.23.0", default-features = false }
 miden-air               = { path = "./air", version = "0.23.0", default-features = false }
 miden-assembly          = { path = "./crates/assembly", version = "0.23.0", default-features = false }
 miden-assembly-syntax   = { path = "./crates/assembly-syntax", version = "0.23.0", default-features = false }

Cargo.toml

@@ -25,6 +25,7 @@ testing = []
 
 [dependencies]
 # Miden dependencies
+miden-ace-codegen.workspace = true
 miden-core.workspace = true
 miden-crypto.workspace = true
 miden-utils-indexing.workspace = true