leanSpec/.github/workflows/prod-vectors.yml at 75dfe923d341bf24ca46a8832daff85a016b23bc · tcoratger/leanSpec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: Production Test Vectors

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: prod-vectors-latest
  cancel-in-progress: true

jobs:
  check:
    name: Check key availability
    runs-on: ubuntu-latest
    outputs:
      scheme-changed: ${{ steps.scheme-diff.outputs.changed }}
      cache-hit: ${{ steps.key-cache.outputs.cache-hit }}
    steps:
      - name: Checkout leanSpec
        uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Check if scheme changed
        id: scheme-diff
        run: |
          if git diff HEAD~1 --name-only | grep -qE '^src/lean_spec/subspecs/(xmss|poseidon1)/'; then
            echo "changed=true" >> $GITHUB_OUTPUT
          fi

      - name: Check prod key cache
        id: key-cache
        uses: actions/cache/restore@v4
        with:
          path: /tmp/prod-keys-probe
          key: prod-keys-${{ hashFiles('src/lean_spec/subspecs/xmss/**', 'src/lean_spec/subspecs/poseidon1/**') }}
          lookup-only: true

  keygen:
    name: Generate keys
    needs: check
    if: needs.check.outputs.cache-hit != 'true' && needs.check.outputs.scheme-changed == 'true'
    uses: ./.github/workflows/generate-keys.yml
    secrets: inherit

  fill:
    name: Fill production test fixtures
    needs: [check, keygen]
    # Trick to run even when keygen was skipped, but not on failure or cancel.
    if: always() && !failure() && !cancelled()
    runs-on: ubuntu-latest

    steps:
      - name: Checkout leanSpec
        uses: actions/checkout@v4

      - name: Set up Python 3.14
        uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true
          cache-dependency-glob: "pyproject.toml"

      - name: Install just
        uses: taiki-e/install-action@v2
        with:
          tool: just

      - name: Restore prod key cache
        id: key-cache
        uses: actions/cache/restore@v4
        with:
          path: packages/testing/src/consensus_testing/test_keys/prod_scheme
          key: prod-keys-${{ hashFiles('src/lean_spec/subspecs/xmss/**', 'src/lean_spec/subspecs/poseidon1/**') }}

      - name: Download keys
        if: steps.key-cache.outputs.cache-hit != 'true'
        run: uv run python -m consensus_testing.keys --download --scheme prod

      - name: Save key cache
        if: steps.key-cache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: packages/testing/src/consensus_testing/test_keys/prod_scheme
          key: prod-keys-${{ hashFiles('src/lean_spec/subspecs/xmss/**', 'src/lean_spec/subspecs/poseidon1/**') }}

      - name: Fill production test fixtures
        run: just fill-ci --scheme=prod

      - name: Bundle keys with fixtures
        run: |
          mkdir -p fixtures/keys
          cp -r packages/testing/src/consensus_testing/test_keys/prod_scheme fixtures/keys/

      - name: Create reproducible fixture archive
        run: |
          tar \
            --sort=name \
            --owner=0 \
            --group=0 \
            --numeric-owner \
            --mtime='UTC 2020-01-01' \
            -cf - fixtures | gzip --no-name > fixtures-prod-scheme.tar.gz
          sha256sum fixtures-prod-scheme.tar.gz > fixtures-prod-scheme.tar.gz.sha256

      - name: Upload fixture archive
        uses: actions/upload-artifact@v4
        with:
          name: fixtures-prod-scheme
          path: |
            fixtures-prod-scheme.tar.gz
            fixtures-prod-scheme.tar.gz.sha256
          if-no-files-found: error

      - name: Publish latest release
        run: |
          gh release delete latest --cleanup-tag --yes || true
          gh release create latest \
            fixtures-prod-scheme.tar.gz \
            fixtures-prod-scheme.tar.gz.sha256 \
            --target "${{ github.sha }}" \
            --title "Latest production fixtures" \
            --notes "Auto-generated from leanSpec@${{ github.sha }}"
        env:
          GH_TOKEN: ${{ github.token }}