initial commit and unit and integration tests in one place

Signed-off-by: Joshua Fernandes <joshua.fernandes@consensys.net>

Author: joshuafernandes

.github/workflows/splitList.sh .github/scripts/splitList.sh.github/workflows/splitList.sh renamed to .github/scripts/splitList.sh

@@ -1,4 +1,11 @@
-name: update-test-reports
+name: acceptance-tests-timing-reports-update
+
+# Runs on every merge to main. Grabs the per-runner acceptance test XML results from the just-merged
+# PR's latest successful CI run and consolidates them into a single 'acceptance-tests-timing-reports'
+# artifact on main. 
+# That artifact is the timing baseline that acceptance-tests.yml downloads on every PR to split 
+# tests across parallel runners by historical duration. The data is always one merge behind — a PR's
+# own results only feed the *next* PR's split.
 
 on:
   push:
@@ -18,17 +25,17 @@ jobs:
       - name: Get acceptance test reports from latest merged PR
         uses: dawidd6/action-download-artifact@e7466d1a7587ed14867642c2ca74b5bcc1e19a2d
         with:
-          workflow: acceptance-tests.yml
+          workflow: ci.yml
           workflow_conclusion: success
           pr: ${{ env.LATEST_MERGED_PR_NUMBER }}
           name_is_regexp: true
           name: 'acceptance-node-\d+-test-results'
-          path: acceptance-test-results
+          path: acceptance-tests-timing-reports
           if_no_artifact_found: fail
         env:
           LATEST_MERGED_PR_NUMBER: ${{ steps.latest_merged_pr_number.outputs.PULL_REQUEST_NUMBER }}
       - name: Upload acceptance test results
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
-          name: acceptance-test-results
-          path: 'acceptance-test-results/**/TEST-*.xml'
+          name: acceptance-tests-timing-reports
+          path: 'acceptance-tests-timing-reports/**/TEST-*.xml'

.github/workflows/splitTestsByTime.sh .github/scripts/splitTestsByTime.sh.github/workflows/splitTestsByTime.sh renamed to .github/scripts/splitTestsByTime.sh

@@ -1,24 +1,17 @@
 name: acceptance-tests
 on:
-  workflow_dispatch:
-  merge_group:
-  pull_request:
-    branches:
-      - main
-      - release-*
-      - verkle
-      - performance
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  workflow_call:
+    inputs:
+      assemble_output_run_id:
+        type: string
+        required: true
 
 env:
   GRADLE_OPTS: "-Xmx1g"
   total-runners: 14
 
 jobs:
-  acceptanceTestEthereum:
+  acceptanceTests:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     name: "Acceptance Runner"
@@ -34,6 +27,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.sha || github.ref }}
+      - name: Download assemble-output
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: assemble-output
+          run-id: ${{ inputs.assemble_output_run_id }}
+          github-token: ${{ github.token }}
+          path: ${{ github.workspace }}
       - name: Set up Java
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
@@ -49,17 +49,20 @@ jobs:
         run: ./gradlew acceptanceTest --test-dry-run -Dorg.gradle.parallel=true -Dorg.gradle.caching=true
       - name: Extract current test list
         run: mkdir tmp; find . -type f -name TEST-*.xml | xargs -I{} bash -c "xmlstarlet sel -t -v '/testsuite/testcase[1]/@classname' '{}'; echo ' acceptanceTest'" | tee tmp/currentTests.list
+      # Downloads the timing baseline produced by update-acceptance-tests-timing-reports.yml on the last merge to main.
+      # `splitTestsByTime.sh` uses the per-test durations in  these XMLs to distribute tests across parallel runners by historical wall-clock time rather than a naive split.
+      # If the artifact is missing # (e.g. first run), splitting falls back to round-robin for all tests.
       - name: Get acceptance test reports
         uses: dawidd6/action-download-artifact@e7466d1a7587ed14867642c2ca74b5bcc1e19a2d
         continue-on-error: true
         with:
           branch: main
-          workflow: update-test-reports.yml
-          name: acceptance-test-results
+          workflow: acceptance-tests-timing-reports-update.yml
+          name: acceptance-tests-timing-reports
           path: tmp/junit-xml-reports-downloaded
           if_no_artifact_found: ignore
       - name: Split tests
-        run: .github/workflows/splitTestsByTime.sh tmp/junit-xml-reports-downloaded "tmp/junit-xml-reports-downloaded/acceptance-node-.*-test-results" "TEST-" ${{env.total-runners}} ${{ matrix.runner_index }} > testList.txt
+        run: .github/scripts/splitTestsByTime.sh tmp/junit-xml-reports-downloaded "tmp/junit-xml-reports-downloaded/acceptance-node-.*-test-results" "TEST-" ${{env.total-runners}} ${{ matrix.runner_index }} > testList.txt
       - name: format gradle args
         # we do not need the module task here
         run:  cat testList.txt | cut -f 2- -d ' ' | tee gradleArgs.txt
@@ -95,10 +98,11 @@ jobs:
         with:
           name: acceptance-node-${{matrix.runner_index}}-test-html-reports
           path: 'acceptance-tests/tests/build/reports/tests/**'
-  accepttests-passed:
-    name: "accepttests-passed"
+
+  acceptanceTestsPassed:
+    name: acceptanceTestsPassed
     runs-on: ubuntu-latest
-    needs: [ acceptanceTestEthereum ]
+    needs: [ acceptanceTests ]
     permissions:
       checks: write
       statuses: write

.github/workflows/verify_artifacts.py .github/scripts/verify_artifacts.py.github/workflows/verify_artifacts.py renamed to .github/scripts/verify_artifacts.py

@@ -1,7 +1,6 @@
-name: pre-review
+name: CI
 
 on:
-  merge_group:
   pull_request:
     branches:
       - main
@@ -17,6 +16,7 @@ env:
   GRADLE_OPTS: "-Xmx6g -Dorg.gradle.parallel=true"
 
 jobs:
+
   repolint:
     name: "Repository Linting"
     runs-on: ubuntu-latest
@@ -28,6 +28,7 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.ref }}
       - name: Lint Repo
         run: bundle exec /app/bin/repolinter.js --rulesetUrl https://raw.githubusercontent.com/hyperledger-labs/hyperledger-community-management-tools/main/repo_structure/repolint.json --format markdown
+
   gradle-wrapper:
     name: "Gradle Wrapper Validation"
     runs-on: ubuntu-latest
@@ -36,6 +37,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.ref }}
       - uses: gradle/actions/wrapper-validation@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
+
   spotless-checkLicense:
     name: "Spotless & Check License"
     runs-on: ubuntu-latest
@@ -62,6 +64,7 @@ jobs:
         with:
           name: checkLicense
           path: build/reports/dependency-license
+
   compile:
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -82,6 +85,31 @@ jobs:
           cache-disabled: true
       - name: Gradle Compile
         run: ./gradlew build -x test -x spotlessCheck
+      - name: Upload tar.gz
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: besu-tar
+          path: build/distributions/besu-*.tar.gz
+          retention-days: 10
+      - name: Upload zip
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: besu-zip
+          path: build/distributions/besu-*.zip
+          retention-days: 10
+      - name: Upload workspace build
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: assemble-output
+          path: |
+            ./
+            !./.git/**
+          retention-days: 1
+          include-hidden-files: 'true'
+
+  # Supply chain security: verifies that source JARs for all dependencies are recorded
+  # in verification-metadata.xml. Prevents tampered or undeclared source artifacts
+  # from being introduced without explicit sign-off.
   verify-source-metadata:
     name: "Verify Dependency Source Metadata"
     runs-on: ubuntu-latest
@@ -102,78 +130,57 @@ jobs:
           cache-disabled: true
       - name: Verify source artifacts recorded in verification-metadata.xml
         run: ./gradlew verifySourceArtifacts
+
+  # Tests
+  # Each suite has its suite-tests-passed job in the file directly
   unitTests:
-    runs-on: besu-research-ubuntu-16 # more cores
-    timeout-minutes: 30
-    needs: [spotless-checkLicense, gradle-wrapper, repolint]
+    needs: compile
     permissions:
+      actions: read
+      contents: read
       checks: write
       statuses: write
-    strategy:
-      fail-fast: true
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.ref }}
-      - name: Set up Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          distribution: temurin
-          java-version: 25
-      - name: Install required packages
-        run:  sudo apt-get install -y xmlstarlet
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@39e147cb9de83bb9910b8ef8bd7fff0ee20fcd6f # v6.0.1
-        with:
-          cache-disabled: true
-          add-job-summary: on-failure
-      - name: run unit tests
-        env:
-          # reducing JVM forks to increase reuse of setup code such as SignatureAlgorithm
-          GRADLE_MAX_TEST_FORKS: 2 # besu-research-ubuntu-16 will use 8 by default
-        run: ./gradlew -Dorg.gradle.parallel=true -Dorg.gradle.caching=true test
-      - name: Upload Unit Test Results
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: unit-test-results
-          path: '**/test-results/**/TEST-*.xml'
-      - name: Upload Unit Test HTML Reports
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        if: success() || failure()
-        with:
-          name: unit-test-html-reports
-          path: '**/build/reports/tests/test/**'
-  unittests-passed:
-    name: "unittests-passed"
-    runs-on: ubuntu-latest
-    needs: [compile, unitTests, verify-source-metadata]
+    uses: ./.github/workflows/unit-tests.yml
+    with:
+      assemble_output_run_id: ${{ github.run_id }}
+
+  integrationTests:
+    needs: compile
     permissions:
+      actions: read
+      contents: read
       checks: write
-      statuses: write
-    if: always()
-    steps:
-      # Fail if any `needs` job was not a success.
-      # Along with `if: always()`, this allows this job to act as a single required status check for the entire workflow.
-      - name: Fail on workflow error
-        run: exit 1
-        if: >-
-          ${{
-            contains(needs.*.result, 'failure')
-            || contains(needs.*.result, 'cancelled')
-            || contains(needs.*.result, 'skipped')
-          }}
-      - name: Checkout Repo
-        if: always()
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.ref }}
-      - name: Download all unit test results
-        if: always()
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: unit-test-results
-          merge-multiple: true
-      - name: Report 10 slowest tests
-        if: always()
-        run: python3 .github/workflows/reportSlowestTests.sh 10
+      statuses: write      
+    uses: ./.github/workflows/integration-tests.yml
+    with:
+      assemble_output_run_id: ${{ github.run_id }}
+
+  referenceTests:
+    needs: compile
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      checks: write
+      statuses: write      
+    uses: ./.github/workflows/reference-tests.yml
+    with:
+      assemble_output_run_id: ${{ github.run_id }}
+    secrets: inherit
+
+  acceptanceTests:
+    needs: compile
+    permissions:
+      actions: read
+      contents: read
+      checks: write
+      statuses: write      
+    uses: ./.github/workflows/acceptance-tests.yml
+    with:
+      assemble_output_run_id: ${{ github.run_id }}
+    secrets: inherit
+
+
+# verify-source-metadata dropped from the merge gate
+# The old unittests-passed gate required [compile, unitTests, verify-source-metadata]. The new one only requires [unitTests]. Supply-chain security checks (verifySourceArtifacts) no longer block PR merge. This feels like an unintentional regression — verify-source-metadata should remain in the required set.
+# gate the merge all tests thing heresN