[ZIP-233] Network Sustainability Mechanism: Burning

.cargo/config.toml

@@ -0,0 +1,2 @@
+[env]
+RUST_BACKTRACE = "1"

.editorconfig

@@ -0,0 +1,7 @@
+# EditorConfig is awesome:http://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*.md]
+indent_style = space

.gitattributes

@@ -1,2 +1,3 @@
 zcash_client_backend/src/proto/compact_formats.rs linguist-generated=true
 zcash_client_backend/src/proto/service.rs linguist-generated=true
+zcash_client_backend/src/proto/proposal.rs linguist-generated=true

.github/actions/prepare/action.yml

@@ -0,0 +1,54 @@
+name: 'Prepare CI'
+description: 'Prepares feature flags'
+inputs:
+  extra-features:
+    description: 'Extra feature flags to enable'
+    required: false
+    default: ''
+  all-pools:
+    description: 'Enable all pool-specific feature flags'
+    required: false
+    default: true
+  test-dependencies:
+    description: 'Include test dependencies'
+    required: false
+    default: true
+outputs:
+  feature-flags:
+    description: 'Feature flags'
+    value: ${{ steps.prepare.outputs.flags }}
+runs:
+  using: 'composite'
+  steps:
+    - id: pools
+      shell: bash
+      run: echo "features=orchard transparent-inputs" >> $GITHUB_OUTPUT
+      if: inputs.all-pools == 'true'
+
+    - id: test
+      shell: bash
+      run: echo "feature=test-dependencies" >> $GITHUB_OUTPUT
+      if: inputs.test-dependencies == 'true'
+
+    # `steps.pools.outputs.features` and `steps.test.outputs.feature` cannot
+    # expand into attacker-controllable code because the previous steps only
+    # enable them to have one of two fixed values.
+    - name: Prepare feature flags # zizmor: ignore[template-injection]
+      id: prepare
+      shell: bash
+      run: >
+        echo "flags=--features '
+        bundled-prover
+        download-params
+        lightwalletd-tonic
+        sync
+        temporary-zcashd
+        unstable
+        unstable-serialization
+        unstable-spanning-tree
+        ${EXTRA_FEATURES}
+        ${{ steps.pools.outputs.features }}
+        ${{ steps.test.outputs.feature }}
+        '" >> $GITHUB_OUTPUT
+      env:
+        EXTRA_FEATURES: ${{ inputs.extra-features }}

.github/workflows/aggregate-audits.yml

@@ -0,0 +1,24 @@
+name: Aggregate audits
+
+on:
+  push:
+    branches: main
+    paths:
+      - '.github/workflows/aggregate-audits.yml'
+      - 'supply-chain/audits.toml'
+
+permissions:
+  contents: read
+
+jobs:
+  trigger:
+    name: Trigger
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger aggregation in zcash/rust-ecosystem
+        run: >
+          gh api repos/zcash/rust-ecosystem/dispatches
+            --field event_type="aggregate-audits"
+            --field client_payload[sha]="$GITHUB_SHA"
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/audits.yml

@@ -0,0 +1,50 @@
+name: Audits
+
+on:
+  pull_request:
+  push:
+    branches: main
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-vet:
+    name: Vet Rust dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@stable
+        id: toolchain
+      - run: rustup override set "${TOOLCHAIN}"
+        env:
+          TOOLCHAIN: ${{steps.toolchain.outputs.name}}
+      - run: cargo install cargo-vet --version ~0.10
+      - run: cargo vet --locked
+
+  cargo-deny:
+    name: Check licenses
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check licenses
+
+  required-audits:
+    name: Required audits have passed
+    needs:
+      - cargo-vet
+      - cargo-deny
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine whether all required-pass steps succeeded
+        run: |
+          echo "${NEEDS}" | jq -e '[ .[] | .result == "success" ] | all'
+        env:
+          NEEDS: ${{ toJSON(needs) }}

.github/workflows/book.yml

@@ -3,19 +3,29 @@ name: librustzcash documentation
 on:
   push:
     branches:
-      - master
+      - main
 
 jobs:
   deploy:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - id: prepare
+        uses: ./.github/actions/prepare
       - uses: dtolnay/rust-toolchain@nightly
         id: toolchain
-      - run: rustup override set ${{steps.toolchain.outputs.name}}
+      - run: rustup override set "${TOOLCHAIN}"
+        env:
+          TOOLCHAIN: ${{steps.toolchain.outputs.name}}
 
       - name: Build latest rustdocs
-        run: cargo doc --no-deps --workspace --all-features
+        run: >
+          cargo doc
+          --no-deps
+          --workspace
+          ${{ steps.prepare.outputs.feature-flags }}
         env:
           RUSTDOCFLAGS: -Z unstable-options --enable-index-page --cfg docsrs
 
@@ -25,7 +35,7 @@ jobs:
           mv ./target/doc ./book/book/rustdoc/latest
 
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./book/book