fix: sync

.circleci/config.yml

@@ -1269,6 +1269,21 @@ jobs:
           when: on_fail
       - notify-failures-on-develop
 
+  contracts-bedrock-upload:
+    machine: true
+    resource_class: ethereum-optimism/latitude-1
+    steps:
+      - utils/checkout-with-mise:
+          checkout-method: blobless
+      - install-contracts-dependencies
+      - check-changed:
+          patterns: contracts-bedrock
+      - get-target-branch
+      - run:
+          name: upload selectors
+          command: just update-selectors
+          working_directory: packages/contracts-bedrock
+
   contracts-bedrock-checks:
     docker:
       - image: <<pipeline.parameters.default_docker_image>>
@@ -1308,6 +1323,8 @@ jobs:
           command: size-check
       - run-contracts-check:
           command: unused-imports-check-no-build
+      - run-contracts-check:
+          command: strict-pragma-check-no-build
       - run-contracts-check:
           command: validate-spacers-no-build
       - run-contracts-check:
@@ -2609,6 +2626,11 @@ workflows:
             - contracts-bedrock-build
           context:
             - circleci-repo-readonly-authenticated-github-token
+      - contracts-bedrock-upload:
+          requires:
+            - contracts-bedrock-build
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - diff-fetcher-forge-artifacts:
           context:
             - circleci-repo-readonly-authenticated-github-token
@@ -3255,7 +3277,7 @@ workflows:
       - op-acceptance-tests:
           name: memory-all
           gate: "" # Empty gate = gateless mode
-          no_output_timeout: 80m # Keep this less than 90m to avoid CircleCI timeout
+          no_output_timeout: 120m # Allow longer runs for memory-all gate
           context:
             - circleci-repo-readonly-authenticated-github-token
             - slack

.github/workflows/bake.yaml → .github/workflows/protected.yaml

@@ -1,20 +1,15 @@
 name: bake
 
 on:
-  pull_request:
-    paths:
-      - 'ops/docker/**'
-      - 'packages/contracts-bedrock/**'
-      - 'docker-bake.hcl'
-      - '.github/workflows/bake.yaml'
-      - 'ops/scripts/compute-git-versions.sh'
   push:
     tags:
       - '*'
+    branches:
+      - 'develop'
 
 jobs:
   prep:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     outputs:
       sanitised_ref_name: ${{ steps.sanitize.outputs.ref_name }}
       versions: ${{ steps.compute_versions.outputs.versions }}
@@ -25,7 +20,7 @@ jobs:
         with:
           egress-policy: audit
       - name: Checkout
-        uses: actions/checkout@71cf2267d89c5cb81562390fa70a37fa40b1305e # v4
+        uses: actions/checkout@71cf2267d89c5cb81562390fa70a37fa40b1305e # v6
         with:
           fetch-depth: 0  # Need full history for git tag operations
       - name: Sanitize ref_name
@@ -66,14 +61,14 @@ jobs:
           - cannon
           - op-dripper
           - op-interop-mon
-    uses: ethereum-optimism/factory/.github/workflows/docker-bake.yaml@35765f06fe9e78ffc4b00aff0adb3fca948959f3
+    uses: ethereum-optimism/factory/.github/workflows/docker-bake.yaml@2ff3f9bba03d59a6ad10fdf660ed253f53956188
     with:
       image_name: ${{ matrix.image_name }}
       bake_file: docker-bake.hcl
       target: ${{ matrix.image_name }}
       tag: ${{ needs.prep.outputs.sanitised_ref_name }}
       gcp_project_id: ${{ vars.GCP_PROJECT_ID_OPLABS_TOOLS_ARTIFACTS }}
-      gcp_registry: us-docker.pkg.dev/oplabs-tools-artifacts/oss
+      registry: us-docker.pkg.dev/oplabs-tools-artifacts/oss
       env: |
         GIT_VERSION=${{ fromJson(needs.prep.outputs.versions)[matrix.image_name] }}
         KONA_VERSION=${{ needs.prep.outputs.kona_version }}
@@ -84,5 +79,3 @@ jobs:
       contents: read
       id-token: write
       attestations: write
-
-

.github/workflows/unprotected.yaml

@@ -0,0 +1,87 @@
+name: bake (PR)
+
+on:
+  pull_request:
+    branches:
+      - 'develop'
+    paths:
+      - 'ops/docker/**'
+      - 'packages/contracts-bedrock/**'
+      - 'docker-bake.hcl'
+      - '.github/workflows/unprotected.yaml'
+      - 'ops/scripts/compute-git-versions.sh'
+
+jobs:
+  prep:
+    runs-on: ubuntu-latest
+    outputs:
+      versions: ${{ steps.compute_versions.outputs.versions }}
+      kona_version: ${{ steps.kona.outputs.version }}
+      date: ${{ steps.date.outputs.date }}
+    steps:
+      - name: Get date
+        id: date
+        run: |
+          DATE=$(date +%Y%m%d)
+          echo "date=$DATE" >> $GITHUB_OUTPUT
+      - name: harden-runner
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2
+        with:
+          egress-policy: audit
+      - name: Checkout
+        uses: actions/checkout@71cf2267d89c5cb81562390fa70a37fa40b1305e # v6
+        with:
+          fetch-depth: 0  # Need full history for git tag operations
+      - name: Read KONA_VERSION from kona/version.json
+        id: kona
+        run: |
+          KONA_VERSION=$(jq -r .version kona/version.json)
+          echo "version=$KONA_VERSION" >> $GITHUB_OUTPUT
+          echo "KONA_VERSION: $KONA_VERSION"
+      - name: Compute GIT_VERSION for all images
+        id: compute_versions
+        run: |
+          VERSIONS=$(GIT_COMMIT="${{ github.sha }}" make compute-git-versions)
+          echo "versions=$VERSIONS" >> $GITHUB_OUTPUT
+          echo "Computed versions: $VERSIONS"
+
+  build:
+    needs: prep
+    strategy:
+      fail-fast: false
+      matrix:
+        image_name:
+          - op-node
+          - op-batcher
+          - op-deployer
+          - op-faucet
+          - op-program
+          - op-proposer
+          - op-challenger
+          - op-dispute-mon
+          - op-conductor
+          - da-server
+          - op-supervisor
+          - op-supernode
+          - op-test-sequencer
+          - cannon
+          - op-dripper
+          - op-interop-mon
+    uses: ethereum-optimism/factory/.github/workflows/docker-bake.yaml@2ff3f9bba03d59a6ad10fdf660ed253f53956188
+    with:
+      image_name: ${{ matrix.image_name }}
+      bake_file: docker-bake.hcl
+      target: ${{ matrix.image_name }}
+      tag: 24h
+      registry: ttl.sh/${{ github.sha }}
+      push_provenance: false
+      env: |
+        GIT_VERSION=${{ fromJson(needs.prep.outputs.versions)[matrix.image_name] }}
+        KONA_VERSION=${{ needs.prep.outputs.kona_version }}
+      set: |
+        *.args.GIT_COMMIT=${{ github.sha }}
+        *.args.GIT_DATE=${{ needs.prep.outputs.date }}
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write

op-acceptance-tests/justfile

@@ -101,7 +101,7 @@ acceptance-test devnet="" gate="base":
             "--validators" "./acceptance-tests.yaml"
             "--exclude-gates" "flake-shake"
             "--allow-skips"
-            "--timeout" "60m"
+            "--timeout" "120m"
             "--orchestrator" "$ORCHESTRATOR"
             "--show-progress"
         )

op-acceptance-tests/scripts/ci_flake_shake_prepare_slack.sh

@@ -81,11 +81,8 @@ if [ -f "$PROMO_JSON" ]; then
     ($meta.date // "") as $date |
     ($meta.gate // "flake-shake") as $gate |
     ($meta.pr_url // "") as $pr_url |
-    ( if (($meta.flake_gate_tests // 0) == 0) then
-        [
-          {"type":"header","text":{"type":"plain_text","text":":partywizard: Acceptance Tests: Flake-Shake — Gate Empty"}},
-          {"type":"section","text":{"type":"mrkdwn","text":"No tests in flake-shake gate; nothing to promote. Artifacts: <\($job)|CircleCI Job>"}}
-        ]
+    ( if (($meta|length) > 0 and ($meta.flake_gate_tests // 0) == 0) then
+        []
       elif ($root.candidates|length) == 0 then
         [
           {"type":"header","text":{"type":"plain_text","text":":partywizard: Acceptance Tests: No Flake-Shake Promotion Candidates — \(if $date != "" then $date else (now|strftime("%Y-%m-%d")) end)"}},

op-acceptance-tests/tests/base/conductor/leadership_transfer_test.go

@@ -1,6 +1,3 @@
-//go:build !ci
-
-// use a tag prefixed with "!". Such tag ensures that the default behaviour of this test would be to be built/run even when the go toolchain (go test) doesn't specify any tag filter.
 package conductor
 
 import (