chore: rename vendored artifact root to vendor/cargo

Author: kariy

.github/workflows/test.yml

@@ -13,7 +13,7 @@ on:
             - "crates/**/*.rs"
             - "crates/**/Cargo.toml"
             - "scripts/release/*.sh"
-            - "third_party/cargo/**"
+            - "vendor/cargo/**"
             - ".github/workflows/test.yml"
 
     pull_request:
@@ -26,7 +26,7 @@ on:
             - "crates/**/*.rs"
             - "crates/**/Cargo.toml"
             - "scripts/release/*.sh"
-            - "third_party/cargo/**"
+            - "vendor/cargo/**"
             - ".github/workflows/test.yml"
 
 # Cancel in progress workflow when a new one is triggered by running in a concurrency group
@@ -71,7 +71,7 @@ jobs:
                   CHANGED_FILES="$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")"
 
                   if echo "$CHANGED_FILES" | grep -q "^Cargo.lock$"; then
-                      if ! echo "$CHANGED_FILES" | grep -Eq "^third_party/cargo/(vendor\.tar\.gz\.part-[0-9]+|vendor\.tar\.gz\.sha256|VENDOR_MANIFEST\.lock)$"; then
+                      if ! echo "$CHANGED_FILES" | grep -Eq "^vendor/cargo/(vendor\.tar\.gz\.part-[0-9]+|vendor\.tar\.gz\.sha256|VENDOR_MANIFEST\.lock)$"; then
                           echo "Cargo.lock changed but vendored dependency artifacts were not refreshed."
                           echo "Run: make vendor-refresh"
                           exit 1

.gitignore

@@ -41,7 +41,9 @@ crates/contracts/build/
 
 **/.claude/settings.local.json
 
-vendor
+vendor/*
+!vendor/cargo/
+!vendor/cargo/**
 katana-tee
 
 # AMDSEV build artifacts

README.md

@@ -108,9 +108,9 @@ cargo nextest run
 
 Katana release binaries are built from a vendored Cargo dependency archive committed in this repository:
 
-- `third_party/cargo/vendor.tar.gz.part-*`
-- `third_party/cargo/vendor.tar.gz.sha256`
-- `third_party/cargo/VENDOR_MANIFEST.lock`
+- `vendor/cargo/vendor.tar.gz.part-*`
+- `vendor/cargo/vendor.tar.gz.sha256`
+- `vendor/cargo/VENDOR_MANIFEST.lock`
 
 The archive is committed as split parts to stay under GitHub's per-file size limit.
 

docs/release-reproducibility.md

@@ -4,9 +4,9 @@ Katana release binaries use a vendored Cargo dependency archive to reduce non-de
 
 ## Vendored Artifacts
 
-- `third_party/cargo/vendor.tar.gz.part-*`
-- `third_party/cargo/vendor.tar.gz.sha256`
-- `third_party/cargo/VENDOR_MANIFEST.lock`
+- `vendor/cargo/vendor.tar.gz.part-*`
+- `vendor/cargo/vendor.tar.gz.sha256`
+- `vendor/cargo/VENDOR_MANIFEST.lock`
 
 The archive is stored as split parts to remain below GitHub's per-file blob limit.
 
@@ -27,9 +27,9 @@ make vendor-refresh
 Commit all of the following in the same PR:
 
 - `Cargo.lock`
-- `third_party/cargo/vendor.tar.gz.part-*`
-- `third_party/cargo/vendor.tar.gz.sha256`
-- `third_party/cargo/VENDOR_MANIFEST.lock`
+- `vendor/cargo/vendor.tar.gz.part-*`
+- `vendor/cargo/vendor.tar.gz.sha256`
+- `vendor/cargo/VENDOR_MANIFEST.lock`
 
 ## Validation
 

scripts/release/build-katana-vendored.sh

@@ -9,7 +9,7 @@ TARGET=""
 PROFILE="${PROFILE:-performance}"
 NATIVE_BUILD=0
 
-VENDOR_DIR="${VENDOR_DIR:-$PROJECT_ROOT/third_party/cargo}"
+VENDOR_DIR="${VENDOR_DIR:-$PROJECT_ROOT/vendor/cargo}"
 VENDOR_ARCHIVE_NAME="${VENDOR_ARCHIVE_NAME:-vendor.tar.gz}"
 VERIFY_SCRIPT="$SCRIPT_DIR/verify-vendor-archive.sh"
 

scripts/release/update-vendor-archive.sh

@@ -5,7 +5,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 
-VENDOR_DIR="$PROJECT_ROOT/third_party/cargo"
+VENDOR_DIR="$PROJECT_ROOT/vendor/cargo"
 VENDOR_ARCHIVE_NAME="${VENDOR_ARCHIVE_NAME:-vendor.tar.gz}"
 VENDOR_PART_PREFIX="${VENDOR_PART_PREFIX:-$VENDOR_DIR/${VENDOR_ARCHIVE_NAME}.part-}"
 VENDOR_PART_SIZE="${VENDOR_PART_SIZE:-95m}"
@@ -153,16 +153,16 @@ cat > "$VENDOR_MANIFEST_FILE" <<EOF
 manifest_version=1
 cargo_lock_path=Cargo.lock
 cargo_lock_sha256=$CARGO_LOCK_SHA256
-vendor_archive_path=third_party/cargo/$VENDOR_ARCHIVE_NAME
+vendor_archive_path=vendor/cargo/$VENDOR_ARCHIVE_NAME
 vendor_archive_sha256=$VENDOR_ARCHIVE_SHA256
-vendor_archive_sha256_file=third_party/cargo/$(basename "$VENDOR_ARCHIVE_SHA256_FILE")
-vendor_archive_part_prefix=third_party/cargo/${VENDOR_ARCHIVE_NAME}.part-
+vendor_archive_sha256_file=vendor/cargo/$(basename "$VENDOR_ARCHIVE_SHA256_FILE")
+vendor_archive_part_prefix=vendor/cargo/${VENDOR_ARCHIVE_NAME}.part-
 source_date_epoch=$SOURCE_DATE_EPOCH
 generated_by=scripts/release/update-vendor-archive.sh
 EOF
 
 echo "Vendor archive updated."
 echo "Files to commit:"
-echo "  - third_party/cargo/${VENDOR_ARCHIVE_NAME}.part-* ($PART_COUNT files)"
-echo "  - third_party/cargo/$(basename "$VENDOR_ARCHIVE_SHA256_FILE")"
-echo "  - third_party/cargo/$(basename "$VENDOR_MANIFEST_FILE")"
+echo "  - vendor/cargo/${VENDOR_ARCHIVE_NAME}.part-* ($PART_COUNT files)"
+echo "  - vendor/cargo/$(basename "$VENDOR_ARCHIVE_SHA256_FILE")"
+echo "  - vendor/cargo/$(basename "$VENDOR_MANIFEST_FILE")"

scripts/release/verify-vendor-archive.sh

@@ -5,7 +5,7 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 
-VENDOR_DIR="$PROJECT_ROOT/third_party/cargo"
+VENDOR_DIR="$PROJECT_ROOT/vendor/cargo"
 VENDOR_ARCHIVE_NAME="${VENDOR_ARCHIVE_NAME:-vendor.tar.gz}"
 VENDOR_PART_GLOB="${VENDOR_PART_GLOB:-$VENDOR_DIR/${VENDOR_ARCHIVE_NAME}.part-*}"
 VENDOR_ARCHIVE_SHA256_FILE="${VENDOR_ARCHIVE_SHA256_FILE:-$VENDOR_DIR/vendor.tar.gz.sha256}"

third_party/cargo/VENDOR_MANIFEST.lock vendor/cargo/VENDOR_MANIFEST.lockthird_party/cargo/VENDOR_MANIFEST.lock renamed to vendor/cargo/VENDOR_MANIFEST.lock

@@ -1,9 +1,9 @@
 manifest_version=1
 cargo_lock_path=Cargo.lock
 cargo_lock_sha256=d68486924d65e41aa0f4d342db8fd39ab4a5d3d519e0e79ae7939a15674b5bac
-vendor_archive_path=third_party/cargo/vendor.tar.gz
+vendor_archive_path=vendor/cargo/vendor.tar.gz
 vendor_archive_sha256=7f54d37e1cd5c1c7d0ea8f0eacd167ce36199cd2bc8def36762f6314eab86ee8
-vendor_archive_sha256_file=third_party/cargo/vendor.tar.gz.sha256
-vendor_archive_part_prefix=third_party/cargo/vendor.tar.gz.part-
+vendor_archive_sha256_file=vendor/cargo/vendor.tar.gz.sha256
+vendor_archive_part_prefix=vendor/cargo/vendor.tar.gz.part-
 source_date_epoch=0
 generated_by=scripts/release/update-vendor-archive.sh