Alert fix 3471

[Dargon789]

Summary by Sourcery

Update CI and GitHub configuration for VM workflows, container builds, issue templates, and site deployment tooling.

New Features:

• Add GitHub Pages deployment workflows for Next.js, mdBook, and Jekyll sites.
• Introduce basic CircleCI configuration with a sample hello-world job.
• Add generic GitHub issue templates for bug reports, feature requests, and custom issues.
• Add a development container configuration file.

Enhancements:

• Simplify the VM GitHub Actions workflow to run directly on pull requests with a unified concurrency group.
• Standardize Node.js setup in VM workflows on Node 18 with npm caching and explicit lint and coverage steps.
• Adjust the Docker image build workflow step naming and options.

CI:

• Refactor VM CI workflows to remove reusable workflow inputs and caching paths in favor of a simpler PR-based pipeline.
• Add multiple GitHub Pages deployment workflows to support different site generators (Next.js, mdBook, Jekyll).
• Introduce an example CircleCI pipeline alongside existing GitHub Actions workflows.

Documentation:

• Add and update GitHub issue templates, including removing automatic package labels from package-specific templates and introducing general-purpose templates.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[sourcery-ai]

Reviewer's Guide

Refactors CI/workflow configuration for the VM jobs, adjusts Docker image build config, standardizes GitHub issue templates, and introduces several new sample CI/Pages deployment workflows and devcontainer scaffolding.

Flow diagram for simplified vm-pr GitHub Actions workflow

flowchart TD
  A["pull_request opened_reopened_synchronize"] --> B["Start_VM_workflow"]

  subgraph "Job_vm-api"
    B --> C["actions_checkout_submodules_recursive"]
    C --> D["actions_setup-node_version_18_cache_npm"]
    D --> E["npm_ci_root"]
    E --> F["npm_run_lint"]
    F --> G["npm_run_coverage"]
    G --> H["codecov_action_v3_upload_lcov"]
  end

  subgraph Job_vm-state_matrix
    B --> I["checkout_with_submodules"]
    I --> J["setup-node_18_cache_npm"]
    J --> K["npm_ci_root"]
    K --> L["npm_run_test_state_with_fork_matrix"]
  end

  subgraph "Job_vm-state-extended_matrix"
    B --> M["checkout_with_submodules"]
    M --> N["setup-node_18_cache_npm"]
    N --> O["npm_ci_root"]
    O --> P["npm_run_test_state_with_extended_fork_matrix"]
  end

  subgraph "Job_vm-blockchain_matrix"
    B --> Q["checkout_with_submodules"]
    Q --> R["setup-node_18_cache_npm"]
    R --> S["npm_ci_root"]
    S --> T["npm_run_test_blockchain_with_args_matrix"]
  end

  subgraph "Job_vm-benchmarks"
    B --> U["checkout"]
    U --> V["setup-node_18_cache_npm"]
    V --> W["npm_ci_root"]
    W --> X["npm_run_build_benchmarks_in_vm_package"]
  end

  H --> Y["VM_workflow_complete"]
  L --> Y
  P --> Y
  T --> Y
  X --> Y

Loading

File-Level Changes

Change	Details	Files
Simplify and retarget the VM GitHub Actions workflow to run directly on pull requests with a simpler Node/npm setup and coverage upload.	Change workflow trigger from workflow_call/workflow_dispatch with cache-key inputs to pull_request and workflow_dispatch without custom inputs. Simplify concurrency group naming by removing the vm-pr suffix. Replace conditional checkout/cache/submodule-restore logic with unconditional checkout and npm ci in the repo root for all VM jobs. Downgrade Node version from 20 to 18 and rely on setup-node npm caching instead of custom actions/cache usage. Insert npm run lint before coverage in the vm-api job and downgrade codecov action from v4 to v3 without explicit token input.	.github/workflows/vm-pr.yml
Adjust Docker image build-and-push workflow configuration.	Tidy the docker Build & Push step into a single mapping line. Modify the tags configuration for the Docker image; verify for syntax/format correctness during review.	.github/workflows/docker-image.yml
Normalize GitHub issue templates by removing auto-applied package labels and adding spacing, and add generic bug/feature/custom templates.	Set labels: '' for all package-specific and general issue templates instead of package-specific labels. Add blank lines/spacing and trailing --- separators for consistency in each template. Add new generic bug_report, feature_request, and custom issue templates with standard GitHub forms content.	.github/ISSUE_TEMPLATE/package--ethereumjs-binarytree.md .github/ISSUE_TEMPLATE/package--ethereumjs-block.md .github/ISSUE_TEMPLATE/package--ethereumjs-blockchain.md .github/ISSUE_TEMPLATE/package--ethereumjs-client.md .github/ISSUE_TEMPLATE/package--ethereumjs-common.md .github/ISSUE_TEMPLATE/package--ethereumjs-devp2p.md .github/ISSUE_TEMPLATE/package--ethereumjs-ethash.md .github/ISSUE_TEMPLATE/package--ethereumjs-evm.md .github/ISSUE_TEMPLATE/package--ethereumjs-mpt.md .github/ISSUE_TEMPLATE/package--ethereumjs-statemanager.md .github/ISSUE_TEMPLATE/package--ethereumjs-tx.md .github/ISSUE_TEMPLATE/package--ethereumjs-util.md .github/ISSUE_TEMPLATE/package--ethereumjs-verkle.md .github/ISSUE_TEMPLATE/package--ethereumjs-vm.md .github/ISSUE_TEMPLATE/package--monorepo.md .github/ISSUE_TEMPLATE/package--rlp.md .github/ISSUE_TEMPLATE/general.md .github/ISSUE_TEMPLATE/bug_report.md .github/ISSUE_TEMPLATE/feature_request.md .github/ISSUE_TEMPLATE/custom.md
Add new sample workflows for deploying Next.js, mdBook, and Jekyll sites to GitHub Pages, and a sample CircleCI configuration.	Introduce nextjs.yml workflow that builds a Next.js site on pushes to master and deploys it to GitHub Pages via configure-pages and deploy-pages actions. Introduce mdbook.yml workflow that installs Rust/mdBook, builds documentation, and deploys it to GitHub Pages. Introduce jekyll-gh-pages.yml workflow that builds a Jekyll site using GitHub Pages-provided tooling and deploys it. Add a basic CircleCI config with a single say-hello job and workflow as a scaffold/example.	.github/workflows/nextjs.yml .github/workflows/mdbook.yml .github/workflows/jekyll-gh-pages.yml .circleci/config.yml
Introduce devcontainer configuration and update lockfile (details not visible in diff).	Add a .devcontainer/devcontainer.json file to support VS Code devcontainers or similar remote development setup. Modify package-lock.json; reviewers should inspect the lockfile change to ensure it matches intended dependency updates or format changes.	.devcontainer/devcontainer.json package-lock.json

Possibly linked issues

• EVM: Generic BLS Interface / Use JS Implementation (@noble/curves) as Default ethereumjs/ethereumjs-monorepo#3471: PR modifies GitHub Actions and Codecov configuration apparently to remediate the code scanning alert 3471 on credentials.
• EVM: Generic BLS Interface / Use JS Implementation (@noble/curves) as Default ethereumjs/ethereumjs-monorepo#3471: The PR is explicitly labeled as fixing alert 3471, which the issue tracks, so they correspond.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[gemini-code-assist]

Summary of Changes

Hello @Dargon789, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly upgrades the project's development workflow and community interaction mechanisms. It establishes a foundation for continuous integration using CircleCI and ensures a consistent development environment across contributors through a new DevContainer setup. Furthermore, the PR refines the project's issue management by introducing new, comprehensive issue templates and simplifying existing package-specific templates, thereby improving the clarity and flexibility of issue reporting. Minor dependency updates are also included to maintain toolchain currency.

Highlights

• Continuous Integration Setup: A new CircleCI configuration file (.circleci/config.yml) has been added to introduce automated checks, starting with a basic "Hello, World!" job.
• Standardized Development Environment: A DevContainer configuration (.devcontainer/devcontainer.json) is now included, providing a consistent development setup with Node.js 18, Hardhat, and essential VS Code extensions like Prettier and Hardhat Solidity.
• Enhanced Issue Reporting: New GitHub issue templates have been added for bug reports, feature requests, and general custom issues, improving the structure for community contributions.
• Streamlined Package Issue Templates: Existing package-specific issue templates have been updated to remove predefined labels, allowing for more flexible label assignment during issue creation.
• Dependency Updates: Key development dependencies, including tinyglobby, fdir, and vite, have been updated to their latest patch versions in package-lock.json.

Ignored Files

• Ignored by pattern: .github/workflows/** (5)
  • .github/workflows/docker-image.yml
  • .github/workflows/jekyll-gh-pages.yml
  • .github/workflows/mdbook.yml
  • .github/workflows/nextjs.yml
  • .github/workflows/vm-pr.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[sourcery-ai]

Hey - I've found 2 issues, and left some high level feedback:

• The docker-image.yml change to the tags field appears syntactically broken (ghcr.io/${{ github.repository_owner/ethereumjs-monorepo:latest is missing a closing }} and slash), which will likely cause the Docker build step to fail.
• The VM workflows now use Node 18 instead of 20 while the newly added Next.js workflow explicitly uses Node 20; consider aligning Node versions across workflows (or documenting the reason to diverge) to avoid subtle runtime/tooling inconsistencies.
• Several newly added CI/workflow files (Next.js, mdBook, Jekyll, CircleCI) look like generic templates and may not be wired correctly for this repo (e.g., next build writing to ./out, the curl ... -y in mdBook, multiple Pages workflows); it would be good to either remove unused templates or adapt and verify them for this project before merging.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `docker-image.yml` change to the `tags` field appears syntactically broken (`ghcr.io/${{ github.repository_owner/ethereumjs-monorepo:latest` is missing a closing `}}` and slash), which will likely cause the Docker build step to fail.
- The VM workflows now use Node 18 instead of 20 while the newly added Next.js workflow explicitly uses Node 20; consider aligning Node versions across workflows (or documenting the reason to diverge) to avoid subtle runtime/tooling inconsistencies.
- Several newly added CI/workflow files (Next.js, mdBook, Jekyll, CircleCI) look like generic templates and may not be wired correctly for this repo (e.g., `next build` writing to `./out`, the `curl ... -y` in mdBook, multiple Pages workflows); it would be good to either remove unused templates or adapt and verify them for this project before merging.

## Individual Comments

### Comment 1
<location> `.github/workflows/mdbook.yml:35-39` </location>
<code_context>
+      MDBOOK_VERSION: 0.4.36
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install mdBook
+        run: |
+          curl --proto '=https' --tlsv1.2 https://sh.rustup.rs -sSf -y | sh
+          rustup update
+          cargo install --version ${MDBOOK_VERSION} mdbook
+      - name: Setup Pages
+        id: pages
</code_context>

<issue_to_address>
**issue (bug_risk):** The mdBook install script likely fails due to incorrect rustup invocation and missing cargo PATH setup.

This sequence is likely to fail:

```sh
curl --proto '=https' --tlsv1.2 https://sh.rustup.rs -sSf -y | sh
rustup update
cargo install --version ${MDBOOK_VERSION} mdbook
```

Two issues:
- `-y` should be passed to the installer via `sh`, not to `curl` (use `| sh -s -- -y`). As written, the installer script may not run as expected.
- After installing rustup, `cargo` isn’t on `PATH` until you source `$HOME/.cargo/env`, so `cargo install` in the same step will likely fail.

You can fix this with:

```sh
curl --proto '=https' --tlsv1.2 https://sh.rustup.rs -sSf | sh -s -- -y
source "$HOME/.cargo/env"
rustup update
cargo install --version "${MDBOOK_VERSION}" mdbook
```
</issue_to_address>

### Comment 2
<location> `.github/ISSUE_TEMPLATE/bug_report.md:32` </location>
<code_context>
+ - Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
</code_context>

<issue_to_address>
**nitpick (typo):** Add a space in the device example (`iPhone6` → `iPhone 6`)

Please update the example device name to `iPhone 6` for correctness and readability.

```suggestion
 - Device: [e.g. iPhone 6]
```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request introduces a significant number of configuration updates for CI/CD, the development environment, and GitHub issue templates. The changes are well-structured and improve the project's tooling. I've provided a couple of suggestions to pin base image versions in the CircleCI and dev container configurations to ensure reproducible environments, which is a crucial best practice. The rest of the changes, including dependency updates and issue template modifications, look solid.