Prover v5/bubble up the base fee and coin base

.gitattributes

@@ -23,6 +23,7 @@ prover/symbolic/testdata/**/*.cbor binary
 prover/prover-assets/**/**/**/*.bin binary
 prover/prover-assets/**/**/**/**/*.bin binary
 prover/prover-assets/kzgsrs/* binary
+prover/zkevm/arithmetization/*.bin binary
 
 *.woff2 binary
 

.github/ISSUE_TEMPLATE/bug-report.md

@@ -6,6 +6,8 @@ labels: Bug
 assignees: ''
 ---
 
+🔐 🔐 `Should this be a security advisory instead?` 🔐 🔐
+
 _Remenber not to put too much unhelpful information or too little important information, be specific._
 
 ## Impact

.github/ISSUE_TEMPLATE/feature_request.md

@@ -6,6 +6,8 @@ assignees: ''
 
 ---
 
+🔐 🔐 `Should this be a security advisory instead?` 🔐 🔐
+
 ## Description
 Write a clear and concise description of what you want to happen. Add any considered drawbacks.
 

.github/ISSUE_TEMPLATE/operational_task_template.md

@@ -7,6 +7,8 @@ assignees: ''
 
 ---
 
+🔐 🔐 `Should this be a security advisory instead?` 🔐 🔐
+
 ## Problem Statement
 - Contains some manner of action item. 
 - Contains the service the action pertains to

.github/actions/image-tag-and-push/action.yml

@@ -34,7 +34,7 @@ runs:
   steps:
     - name: Login to Docker Hub
       if: ${{ github.ref == 'refs/heads/main' && inputs.last_commit_tag_exists == '0' }}
-      uses: docker/login-action@v3
+      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
       with:
         username: ${{ inputs.docker_username }}
         password: ${{ inputs.docker_password }}

.github/actions/linea-besu-package/assemble/action.yml

@@ -6,10 +6,16 @@ inputs:
   release_tag_prefix:
     description: 'Custom release tag prefix'
     required: true
-  compile_release_notes:
-    description: 'Compile release notes or not'
+  fetch_besu_fleet_plugin:
+    description: 'Fetch Besu Fleet plugin or not'
     required: false
     default: 'false'
+  fleet_github_app_id:
+    description: 'GitHub App ID to authenticate to besu-fleet-plugin repo'
+    required: false
+  fleet_github_app_private_key:
+    description: 'GitHub App private key to authenticate to besu-fleet-plugin repo'
+    required: false
 
 outputs:
   workflow_id:
@@ -54,7 +60,7 @@ runs:
 
     - name: get versions via dotenv
       id: dotenv
-      uses: falti/dotenv-action@v1
+      uses: falti/dotenv-action@a33be0b8cf6a6e6f1b82cc9f3782061ab1022be5 #v1.1.4
       with:
         path: linea-besu-package/versions.env
         mode: development
@@ -100,73 +106,36 @@ runs:
       shell: bash
       run: |
         echo "dockerimage=consensys/linea-besu-package:${{ steps.dockertag.outputs.dockertag }}" >> "$GITHUB_OUTPUT"
-
-    - name: download and untar the linea-besu archive
-      shell: bash
-      run: |
-        cd /tmp/
-        echo "downloading besu from linea-besu-upstream: ${{ steps.dotenv.outputs.LINEA_BESU_TAR_GZ }}"
-        wget -nv "${{ steps.dotenv.outputs.LINEA_BESU_BASE_URL }}${{ steps.dotenv.outputs.LINEA_BESU_TAR_GZ }}/${{ steps.dotenv.outputs.LINEA_BESU_FILENAME_PREFIX }}-${{ steps.dotenv.outputs.LINEA_BESU_TAR_GZ }}.tar.gz"
-        tar -xvf ${{ steps.dotenv.outputs.LINEA_BESU_FILENAME_PREFIX }}-${{ steps.dotenv.outputs.LINEA_BESU_TAR_GZ }}.tar.gz
-        mv /tmp/${{ steps.dotenv.outputs.LINEA_BESU_FILENAME_PREFIX }}-${{ steps.dotenv.outputs.LINEA_BESU_TAR_GZ }} /tmp/besu
-
-    - name: copy the list of versions to the container
-      shell: bash      
-      run: |
-        cp ./linea-besu-package/versions.env /tmp/besu/versions.txt
-        mkdir -p /tmp/besu/plugins
 
-    - name: get the plugins
-      shell: bash      
+    - name: assemble the packages to linea-besu
+      shell: bash
       run: |
-        cd /tmp/besu/plugins
-
-        echo "getting linea_sequencer_plugin_version: ${{ steps.dotenv.outputs.LINEA_SEQUENCER_PLUGIN_VERSION }}" 
-        wget -nv "https://github.com/Consensys/linea-sequencer/releases/download/v${{ steps.dotenv.outputs.LINEA_SEQUENCER_PLUGIN_VERSION }}/linea-sequencer-v${{ steps.dotenv.outputs.LINEA_SEQUENCER_PLUGIN_VERSION }}.jar" -P /tmp/besu/plugins
-
-        echo "getting linea_finalized_tag_updater_plugin_version: ${{ steps.dotenv.outputs.LINEA_FINALIZED_TAG_UPDATER_PLUGIN_VERSION }}" 
-        wget -nv "https://github.com/Consensys/linea-monorepo/releases/download/linea-finalized-tag-updater-v${{ steps.dotenv.outputs.LINEA_FINALIZED_TAG_UPDATER_PLUGIN_VERSION }}/linea-finalized-tag-updater-v${{ steps.dotenv.outputs.LINEA_FINALIZED_TAG_UPDATER_PLUGIN_VERSION }}.jar" -P /tmp/besu/plugins
-
-        echo "getting linea_staterecovery_plugin_version: ${{ steps.dotenv.outputs.LINEA_STATERECOVERY_PLUGIN_VERSION }}"
-        wget -nv "https://github.com/Consensys/linea-monorepo/releases/download/linea-staterecovery-v${{ steps.dotenv.outputs.LINEA_STATERECOVERY_PLUGIN_VERSION }}/linea-staterecovery-besu-plugin-v${{ steps.dotenv.outputs.LINEA_STATERECOVERY_PLUGIN_VERSION }}.jar" -P /tmp/besu/plugins
-
-        echo "getting linea_tracer_plugin_version: ${{ steps.dotenv.outputs.LINEA_TRACER_PLUGIN_VERSION }}" 
-        wget -nv "https://github.com/Consensys/linea-tracer/releases/download/${{ steps.dotenv.outputs.LINEA_TRACER_PLUGIN_VERSION }}/linea-tracer-${{ steps.dotenv.outputs.LINEA_TRACER_PLUGIN_VERSION }}.jar" -P /tmp/besu/plugins
-
-        echo "getting shomei_plugin_version: ${{ steps.dotenv.outputs.SHOMEI_PLUGIN_VERSION }}" 
-        wget -nv "https://github.com/Consensys/besu-shomei-plugin/releases/download/v${{ steps.dotenv.outputs.SHOMEI_PLUGIN_VERSION }}/besu-shomei-plugin-v${{ steps.dotenv.outputs.SHOMEI_PLUGIN_VERSION }}.jar" -P /tmp/besu/plugins
+        cd linea-besu-package
+        make assemble
+        mv ./tmp/besu ./linea-besu
+
+    - name: generate token to fetch artifacts from private besu-fleet-plugin
+      id: generate_token
+      if: ${{ inputs.fetch_besu_fleet_plugin == 'true' }}
+      uses: getsentry/action-github-app-token@v3
+      with:
+        private_key: ${{ inputs.fleet_github_app_private_key }}
+        app_id: ${{ inputs.fleet_github_app_id }}
 
-    - name: place the packages together for preparing docker image build
+    - name: get plugins from private besu-fleet-plugin
+      if: ${{ inputs.fetch_besu_fleet_plugin == 'true' }}
+      uses: dsaltares/fetch-gh-release-asset@master
+      with:
+        repo: 'Consensys/besu-fleet-plugin'
+        version: 'tags/${{ steps.dotenv.outputs.BESU_FLEET_PLUGIN_VERSION }}'
+        target: './linea-besu-package/linea-besu/besu/plugins/besu-fleet-plugin-${{ steps.dotenv.outputs.BESU_FLEET_PLUGIN_VERSION }}.jar'
+        file: 'besu-fleet-plugin-${{ steps.dotenv.outputs.BESU_FLEET_PLUGIN_VERSION }}.jar'
+        token: ${{ steps.generate_token.outputs.token }}
+
+    - name: show folder structure
       shell: bash    
       run: |
-        cd linea-besu-package/linea-besu
-        mv /tmp/besu ./
-        mv config/ genesis/ profiles/ besu/
+        cd linea-besu-package
         sudo apt update
         sudo apt-get install --no-install-recommends --assume-yes tree
         tree .
-
-    - name: compile release notes
-      id: release_create_artifacts
-      if: ${{ inputs.compile_release_notes == 'true' }}
-      shell: bash
-      run: |
-        mkdir release && cd release
-        tar -czvf linea-besu-package-${{ steps.dockertag.outputs.dockertag }}.tar.gz ../linea-besu-package/linea-besu/
-
-        echo "# Release Artifact: Linea Besu Package" > output.md
-        echo "**Name:** linea-besu-package-${{ steps.dockertag.outputs.dockertag }}.tar.gz" >> output.md
-        echo "**SHA256:** $(sha256sum linea-besu-package-${{ steps.dockertag.outputs.dockertag }}.tar.gz | awk '{ print $1 }' )" >> output.md
-        echo "**From:** [${{ github.ref_name }} (${{ github.event_name }})](https://github.com/Consensys/linea-monorepo/actions/runs/${{ github.run_id }})" >> output.md
-        echo "" >> output.md
-
-        echo "### Besu and Plugin Details" >> output.md
-        echo "| Module | Version | SHA-256 |" >> output.md
-        echo "|--------|---------|--------------|" >> output.md
-        echo "| linea-besu | ${{ steps.dotenv.outputs.LINEA_BESU_TAR_GZ }} | $(sha256sum /tmp/${{ steps.dotenv.outputs.LINEA_BESU_FILENAME_PREFIX }}-${{ steps.dotenv.outputs.LINEA_BESU_TAR_GZ }}.tar.gz | awk '{ print $1 }' ) |" >> output.md
-        echo "| linea-sequencer-plugin | ${{ steps.dotenv.outputs.LINEA_SEQUENCER_PLUGIN_VERSION }} | $(sha256sum ../linea-besu-package/linea-besu/besu/plugins/linea-sequencer-v${{ steps.dotenv.outputs.LINEA_SEQUENCER_PLUGIN_VERSION }}.jar | awk '{ print $1 }' ) |" >> output.md    
-        echo "| linea-tracer-plugin | ${{ steps.dotenv.outputs.LINEA_TRACER_PLUGIN_VERSION }} | $(sha256sum ../linea-besu-package/linea-besu/besu/plugins/linea-tracer-${{ steps.dotenv.outputs.LINEA_TRACER_PLUGIN_VERSION }}.jar | awk '{ print $1 }' ) |" >> output.md    
-        echo "| linea-finalized-tag-updater-plugin | ${{ steps.dotenv.outputs.LINEA_FINALIZED_TAG_UPDATER_PLUGIN_VERSION }} | $(sha256sum ../linea-besu-package/linea-besu/besu/plugins/linea-finalized-tag-updater-v${{ steps.dotenv.outputs.LINEA_FINALIZED_TAG_UPDATER_PLUGIN_VERSION }}.jar | awk '{ print $1 }' ) |" >> output.md    
-        echo "| linea-staterecovery-plugin | ${{ steps.dotenv.outputs.LINEA_STATERECOVERY_PLUGIN_VERSION }} | $(sha256sum ../linea-besu-package/linea-besu/besu/plugins/linea-staterecovery-besu-plugin-v${{ steps.dotenv.outputs.LINEA_STATERECOVERY_PLUGIN_VERSION }}.jar | awk '{ print $1 }' ) |" >> output.md    
-        echo "| shomei-plugin | ${{ steps.dotenv.outputs.SHOMEI_PLUGIN_VERSION }} | $(sha256sum ../linea-besu-package/linea-besu/besu/plugins/besu-shomei-plugin-v${{ steps.dotenv.outputs.SHOMEI_PLUGIN_VERSION }}.jar | awk '{ print $1 }' ) |" >> output.md    
-        echo "" >> output.md

.github/actions/setup-nodejs/action.yml

@@ -9,7 +9,7 @@ inputs:
   pnpm-version:
     description: 'The version of pnpm to use'
     required: true
-    default: '9.14.4'
+    default: '10.18.3'
   pnpm-install-options:
     description: 'The options to pass to pnpm install'
     required: true

.github/workflows/all-tools.yml

@@ -1,17 +1,22 @@
 name: All tools CI
 
+permissions:
+  contents: read
+  actions: read
+  packages: write
+
 on:
   push:
     branches:
       - main
     paths:
-      - 'operations/'
+      - 'operations/**'
       - '.github/workflows/all-tools.yml'
   pull_request:
     branches:
       - main
     paths:
-      - 'operations/'
+      - 'operations/**'
       - '.github/workflows/all-tools.yml'
 
 jobs:
@@ -24,7 +29,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Filter commit changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 #v3.0.2
         id: filter
         with:
           base: ${{ github.ref }}
@@ -93,7 +98,7 @@ jobs:
           submodules: true
       - name: Login to Docker Hub
         if: ${{ env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != '' }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -103,17 +108,17 @@ jobs:
       # cases. We can later set up self-hosted arm64 github runners if we
       # want arm* based images back.
       # - name: Set up QEMU
-      #   uses: docker/setup-qemu-action@v3
+      #   uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 #v3.6.0
       #   with:
       #     platforms: 'arm64,arm'
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 #v3.11.1
       - name: Show the "version" build argument
         run: |
           echo "We inject the commit tag in the docker image ${{ env.COMMIT_TAG }}"
           echo COMMIT_TAG=${{ env.COMMIT_TAG }} >> GITHUB_ENV
       - name: Build and push all tools image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
         with:
           context: .
           file: ./operations/Dockerfile

.github/workflows/bridge-ui-e2e-tests.yml

@@ -1,4 +1,8 @@
-name: Run Bridge UI E2E Tests
+name: Bridge UI E2E Tests
+
+permissions:
+  contents: read
+  actions: read
 
 on:
   pull_request:
@@ -19,7 +23,7 @@ on:
 jobs:
   run-e2e-tests:
     if: github.event.pull_request.head.repo.fork == false
-    runs-on: gha-runner-scale-set-ubuntu-22.04-amd64-med
+    runs-on: gha-runner-scale-set-ubuntu-22.04-amd64-large
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -48,54 +52,101 @@ jobs:
           pnpm-install-options: '--frozen-lockfile --prefer-offline'
 
       - name: Install Playwright
-        run: pnpm dlx playwright@1.51.1 install --with-deps chromium
+        run: pnpm dlx playwright@1.53.2 install --with-deps chromium
 
       - name: Build Bridge UI
-        run: pnpm run -F bridge-ui build
+        run: |
+          pnpm run -F @consensys/linea-sdk-core build;
+          pnpm run -F @consensys/linea-sdk-viem build;
+          pnpm run -F bridge-ui build;
         env:
           NEXT_PUBLIC_WALLET_CONNECT_ID: ${{ secrets.PUBLIC_WALLET_CONNECT_ID }}
           NEXT_PUBLIC_INFURA_ID: ${{ secrets.PUBLIC_BRIDGE_UI_INFURA_ID }}
+          NEXT_PUBLIC_ALCHEMY_API_KEY: ${{ secrets.NEXT_PUBLIC_ALCHEMY_API_KEY }}
           NEXT_PUBLIC_QUICKNODE_ID: ${{ secrets.PUBLIC_BRIDGE_UI_QUICKNODE_ID }}
-          NEXT_PUBLIC_DYNAMIC_ENVIRONMENT_ID: ${{ secrets.PUBLIC_DYNAMIC_SANDBOX_ENVIRONMENT_ID }}
+          NEXT_PUBLIC_WEB3_AUTH_CLIENT_ID: ${{ secrets.NEXT_PUBLIC_WEB3_AUTH_TESTNET_CLIENT_ID }}
           NEXT_PUBLIC_LIFI_API_KEY: ${{ secrets.PUBLIC_LIFI_API_KEY }}
           NEXT_PUBLIC_LIFI_INTEGRATOR_NAME: ${{ secrets.PUBLIC_LIFI_INTEGRATOR_NAME }}
           NEXT_PUBLIC_ONRAMPER_API_KEY: ${{ secrets.PUBLIC_ONRAMPER_API_KEY }}
           NEXT_PUBLIC_LAYERSWAP_API_KEY: ${{ secrets.PUBLIC_LAYERSWAP_API_KEY }}
+          NEXT_PUBLIC_ENVIRONMENT: local
+          REVALIDATE_SECRET: ${{ secrets.BRIDGE_UI_REVALIDATE_SECRET }}
+          CONTENTFUL_SPACE_ID: ${{ secrets.CONTENTFUL_SPACE_ID }}
+          NEXT_PUBLIC_E2E_TEST_MODE: true
+          NEXT_PUBLIC_IS_CCTP_ENABLED: false
 
       - name: Install linux dependencies
         run: |
           sudo apt-get install --no-install-recommends -y xvfb
 
-      - name: Initialize Metamask testing fixture
-        run: xvfb-run pnpm run -F bridge-ui build:cache
-        env:
-          E2E_TEST_PRIVATE_KEY: ${{ secrets.BRIDGE_UI_E2E_TESTS_PRIVATE_KEY }}
-          E2E_TEST_SEED_PHRASE: "test test test test test test test test test test test junk"
-          E2E_TEST_WALLET_PASSWORD: "TestPassword!"
-          NEXT_PUBLIC_INFURA_ID: ${{ secrets.PUBLIC_BRIDGE_UI_INFURA_ID }}
-
       - name: Run unit tests
-        run: DOTENV_CONFIG_PATH=.env.production pnpm run -F bridge-ui test:unit
+        run: pnpm run -F bridge-ui test:unit
         env:
           # Can run unit tests in parallel
           CI: "false"
+          DOTENV_CONFIG_PATH: ".env.production"
           NEXT_PUBLIC_INFURA_ID: ${{ secrets.PUBLIC_BRIDGE_UI_INFURA_ID }}
+          NEXT_PUBLIC_ALCHEMY_API_KEY: ${{ secrets.NEXT_PUBLIC_ALCHEMY_API_KEY }}
           NEXT_PUBLIC_LIFI_API_KEY: "placeholder"
           NEXT_PUBLIC_LIFI_INTEGRATOR_NAME: "placeholder"
           NEXT_PUBLIC_WALLET_CONNECT_ID: "placeholder"
-          NEXT_PUBLIC_DYNAMIC_ENVIRONMENT_ID: "placeholder"
+          NEXT_PUBLIC_WEB3_AUTH_CLIENT_ID: "placeholder"
           NEXT_PUBLIC_QUICKNODE_ID: "placeholder"
+          NEXT_PUBLIC_E2E_TEST_MODE: false
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 #v3.4.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Pull all images with retry
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
+        with:
+          max_attempts: 10
+          retry_on: error
+          retry_wait_seconds: 30
+          timeout_minutes: 10
+          command: |
+            make docker-pull-images-external-to-monorepo
+
+      - name: Create directory for conflated traces
+        run: |
+          mkdir -p tmp/local/traces/v2/conflated
+          chmod -R a+rw tmp/local/
+
+      - name: Spin up fresh environment with besu tracing with retry
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 #v3.0.2
+        with:
+          max_attempts: 10
+          retry_on: error
+          retry_wait_seconds: 30
+          timeout_minutes: 10
+          command: |
+            make start-env-with-tracing-v2-ci CLEAN_PREVIOUS_ENV=false
+          on_retry_command: |
+            make clean-environment
+
+      - name: List docker containers/images
+        continue-on-error: true
+        run: |
+          docker ps -la && docker images
+          docker container ls -a
+
+      - name: Initialize Metamask testing fixture
+        run: xvfb-run -a pnpm run -F bridge-ui build:cache
+        env:
+          E2E_TEST_SEED_PHRASE: "test test test test test test test test test test test junk"
+          E2E_TEST_WALLET_PASSWORD: "TestPassword!"
 
       # Prerequisite - Testing wallet must have >0 ETH and USDC on Sepolia
       - name: Run E2E tests
-        run: xvfb-run pnpm run -F bridge-ui test:e2e:headful
+        run: xvfb-run -a pnpm run -F bridge-ui test:e2e:headful
         env:
           # Do not run E2E tests in parallel. Especially blockchain tx where nonces can collide.
           CI: "true"
-          E2E_TEST_PRIVATE_KEY: ${{ secrets.BRIDGE_UI_E2E_TESTS_PRIVATE_KEY }}
-          E2E_TEST_SEED_PHRASE: "test test test test test test test test test test test junk"
-          E2E_TEST_WALLET_PASSWORD: "TestPassword!"
-          NEXT_PUBLIC_INFURA_ID: ${{ secrets.PUBLIC_BRIDGE_UI_INFURA_ID }}
+          DOTENV_CONFIG_PATH: ".env.test"
+          NEXT_PUBLIC_WEB3_AUTH_CLIENT_ID: ${{ secrets.NEXT_PUBLIC_WEB3_AUTH_TESTNET_CLIENT_ID }}
 
       - name: Archive Playwright report
         uses: actions/upload-artifact@v4