matter-labs
diff --git a/‎.cargo/config.toml‎
Lines changed: 1 addition & 0 deletions b/‎.cargo/config.toml‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎.config/nextest.toml‎
Lines changed: 1 addition & 1 deletion b/‎.config/nextest.toml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.gitattributes‎
Lines changed: 2 additions & 0 deletions b/‎.gitattributes‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎.github/dependabot.yml‎
Lines changed: 6 additions & 0 deletions b/‎.github/dependabot.yml‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎.github/scripts/matrices.py‎
Lines changed: 4 additions & 16 deletions b/‎.github/scripts/matrices.py‎
Lines changed: 4 additions & 16 deletions
diff --git a/‎.github/workflows/benchmarks.yml‎
Lines changed: 26 additions & 16 deletions b/‎.github/workflows/benchmarks.yml‎
Lines changed: 26 additions & 16 deletions
diff --git a/‎.github/workflows/codeql.yml‎
Lines changed: 5 additions & 2 deletions b/‎.github/workflows/codeql.yml‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎.github/workflows/dependencies.yml‎
Lines changed: 4 additions & 8 deletions b/‎.github/workflows/dependencies.yml‎
Lines changed: 4 additions & 8 deletions
diff --git a/‎.github/workflows/nix.yml‎
Lines changed: 16 additions & 7 deletions b/‎.github/workflows/nix.yml‎
Lines changed: 16 additions & 7 deletions
@@ -1,6 +1,7 @@
 [alias]
 cheats = "test -p foundry-cheatcodes-spec --features schema tests::"
 test-debugger = "test -p forge --test cli manual_debug_setup -- --include-ignored --nocapture"
+bless-lints = "test -p forge --test ui -- --bless"
 
 # Increase the stack size to 10MB for Windows targets, which is in line with Linux
 # (whereas default for Windows is 1MB).
 
@@ -1,5 +1,4 @@
 [test-groups]
-chisel-serial = { max-threads = 1 }
 
 [profile.default]
 retries = { backoff = "exponential", count = 2, delay = "5s", jitter = true }
@@ -9,6 +8,7 @@ slow-timeout = { period = "1m", terminate-after = 3 }
 filter = "test(/ext_integration|can_test_forge_std/)"
 slow-timeout = { period = "5m", terminate-after = 4 }
 
+# Do not re-run so that `cargo cheats` is ran locally.
 [[profile.default.overrides]]
 filter = "package(foundry-cheatcodes-spec)"
 retries = 0
@@ -8,3 +8,5 @@ testdata/fixtures/**/* eol=lf
 
 dprint.json linguist-language=JSON-with-Comments
 .devcontainer/devcontainer.json linguist-language=JSON-with-Comments
+
+.env.example linguist-language=Dotenv
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
@@ -76,27 +76,15 @@ def __init__(
 
 config = [
     Case(
-        name="unit",
-        filter="!kind(test)",
+        name="all",
+        filter="!test(/\\bext_integration/)",
         n_partitions=1,
         pr_cross_platform=True,
     ),
     Case(
-        name="integration",
-        filter="kind(test) & !test(/\\b(issue|ext_integration)/)",
-        n_partitions=3,
-        pr_cross_platform=True,
-    ),
-    Case(
-        name="integration / issue-repros",
-        filter="package(=forge) & test(/\\bissue/)",
-        n_partitions=2,
-        pr_cross_platform=False,
-    ),
-    Case(
-        name="integration / external",
+        name="external",
         filter="package(=forge) & test(/\\bext_integration/)",
-        n_partitions=2,
+        n_partitions=1,
         pr_cross_platform=False,
     ),
 ]
 
@@ -1,5 +1,7 @@
 name: Foundry Benchmarks
 
+permissions: {}
+
 on:
   workflow_dispatch:
     inputs:
@@ -18,49 +20,52 @@ on:
         type: string
         default: "ithacaxyz/account:v0.3.2,Vectorized/solady:v0.1.22"
 
-permissions:
-  contents: write
-  pull-requests: write
-
 env:
   ITHACAXYZ_ACCOUNT: "ithacaxyz/account:v0.3.2"
   VECTORIZED_SOLADY: "Vectorized/solady:v0.1.22"
   DEFAULT_REPOS: "ithacaxyz/account:v0.3.2,Vectorized/solady:v0.1.22"
+  RUSTC_WRAPPER: "sccache"
 
 jobs:
   run-benchmarks:
     name: Run All Benchmarks
     runs-on: foundry-runner
+    permissions:
+      contents: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Install build dependencies
         run: |
           sudo apt-get update
           sudo apt-get install -y build-essential pkg-config
 
       - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache Rust dependencies
-        uses: Swatinem/rust-cache@v2
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # master
         with:
-          workspaces: |
-            ./
+          toolchain: stable
+
+      - uses: rui314/setup-mold@725a8794d15fc7563f59595bd9556495c0564878 # v1
+
+      - name: Run sccache-cache
+        uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
 
       - name: Setup Foundry
         env:
           FOUNDRY_DIR: ${{ github.workspace }}/.foundry
+          GITHUB_WORKSPACE: ${{ github.workspace }}
         run: |
           ./.github/scripts/setup-foundryup.sh
-          echo "${{ github.workspace }}/.foundry/bin" >> $GITHUB_PATH
+          printf '%s\n' "$GITHUB_WORKSPACE/.foundry/bin" >> "$GITHUB_PATH"
 
       - name: Build benchmark binary
         run: cargo build --release --bin foundry-bench
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: "24"
 
@@ -150,13 +155,18 @@ jobs:
   publish-results:
     name: Publish Results
     needs: run-benchmarks
-    runs-on: foundry-runner
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Download benchmark results
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           name: benchmark-results
           path: benches/
@@ -169,7 +179,7 @@ jobs:
 
       - name: Create PR for manual runs
         if: github.event_name == 'workflow_dispatch'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const branchName = '${{ needs.run-benchmarks.outputs.branch_name }}';
@@ -197,7 +207,7 @@ jobs:
 
       - name: Comment on PR
         if: github.event.inputs.pr_number != '' || github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const prNumber = ${{ github.event.inputs.pr_number || github.event.pull_request.number }};
 
@@ -1,5 +1,7 @@
 name: CodeQL
 
+permissions: {}
+
 on:
   push:
     branches: ["master"]
@@ -18,10 +20,9 @@ jobs:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       security-events: write
-      packages: read
       actions: read
-      contents: read
 
     strategy:
       fail-fast: false
@@ -33,6 +34,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
 
@@ -2,16 +2,12 @@
 
 name: dependencies
 
+permissions: {}
+
 on:
   schedule:
-    # Run weekly
-    - cron: "0 0 * * SUN"
-  workflow_dispatch:
-# Needed so we can run it manually
-
-permissions:
-  contents: write
-  pull-requests: write
+    - cron: "0 0 * * SUN" # Run weekly on Sundays at midnight UTC
+  workflow_dispatch: # Needed so we can run it manually
 
 jobs:
     update:
 
@@ -1,11 +1,11 @@
 name: nix
 
+permissions: {}
+
 on:
   schedule:
-    # Run weekly
-    - cron: "0 0 * * SUN"
-  workflow_dispatch:
-# Needed so we can run it manually
+    - cron: "0 0 * * SUN" # Run weekly on Sundays at midnight UTC
+  workflow_dispatch: # Needed so we can run it manually
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -15,10 +15,15 @@ jobs:
   # Opens a PR with an updated flake.lock file
   update:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
-      - uses: DeterminateSystems/determinate-nix-action@v3
+      - uses: DeterminateSystems/determinate-nix-action@dbda91f6efef3ee627f56175120aa9543687d830 # v3
       - uses: actions/checkout@v5
-      - uses: DeterminateSystems/update-flake-lock@main
+        with:
+          persist-credentials: false
+      - uses: DeterminateSystems/update-flake-lock@4d443398067153ddd6191a9d9c89533f9a100c26 # main
         with:
           pr-title: "Update flake.lock"
           pr-labels: |
@@ -30,9 +35,13 @@ jobs:
       matrix:
         runs-on: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
     steps:
-      - uses: DeterminateSystems/determinate-nix-action@v3
+      - uses: DeterminateSystems/determinate-nix-action@dbda91f6efef3ee627f56175120aa9543687d830 # v3
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Update flake.lock
         run: nix flake update