From 29b8b171134e960533fd230cbfe94417b587d6e7 Mon Sep 17 00:00:00 2001
From: Maurelian <maurelian@protonmail.ch>
Date: Wed, 14 Jan 2026 14:30:09 -0500
Subject: [PATCH 1/5] fix: do not use fallback artifacts on PRs branches other
 than develop

---
 .circleci/config.yml                                         | 3 +++
 .../contracts-bedrock/scripts/ops/use-latest-fallback.sh     | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 25f4dc03cf97b..aef040930c03e 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1343,6 +1343,7 @@ jobs:
           name: Print forge version
           command: forge --version
           working_directory: packages/contracts-bedrock
+      - get-target-branch
       - pull-artifacts-conditional
       - go-restore-cache:
           namespace: packages/contracts-bedrock/scripts/go-ffi
@@ -1511,6 +1512,7 @@ jobs:
           name: Print forge version
           command: forge --version
           working_directory: packages/contracts-bedrock
+      - get-target-branch
       - pull-artifacts-conditional
       - run:
           name: Install lcov
@@ -1608,6 +1610,7 @@ jobs:
           name: Print forge version
           command: forge --version
           working_directory: packages/contracts-bedrock
+      - get-target-branch
       - pull-artifacts-conditional
       - run:
           name: Write pinned block number for cache key
diff --git a/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh b/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh
index 45d1b9a105b5a..2ae55980ac89a 100755
--- a/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh
+++ b/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh
@@ -43,6 +43,11 @@ if [ "${CIRCLE_BRANCH:-}" != "develop" ]; then
   fi
 fi
 
+# Ensure that PRs targetting anything other than develop do not use the fallback
+if [ "$TARGET_BRANCH" != "develop" ]; then
+  USE_FALLBACK=false
+fi
+
 # Pull artifacts with or without fallback
 if [ "$USE_FALLBACK" = "true" ]; then
   bash scripts/ops/pull-artifacts.sh --fallback-to-latest

From fd356e6eed7901a7e8ad8ca816d43eed30b98a08 Mon Sep 17 00:00:00 2001
From: Maurelian <maurelian@protonmail.ch>
Date: Wed, 14 Jan 2026 15:04:51 -0500
Subject: [PATCH 2/5] Refactor get-target-branch into script

---
 .circleci/config.yml                          | 14 +++-----
 .../scripts/checks/check-semver-diff.sh       |  5 ++-
 .../scripts/ops/get-target-branch.sh          | 34 +++++++++++++++++++
 .../scripts/ops/use-latest-fallback.sh        |  5 +++
 4 files changed, 47 insertions(+), 11 deletions(-)
 create mode 100644 packages/contracts-bedrock/scripts/ops/get-target-branch.sh

diff --git a/.circleci/config.yml b/.circleci/config.yml
index aef040930c03e..0378a34f6e9fe 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -258,18 +258,12 @@ commands:
       - run:
           name: Determine target branch for this pipeline
           command: |
-            TARGET_BRANCH=""
-            if [ -n "${CIRCLE_PULL_REQUEST:-}" ]; then
-              TARGET_BRANCH=$(curl -s "https://api.github.com/repos/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}/pulls/${CIRCLE_PULL_REQUEST##*/}" | jq -r .base.ref)
-            fi
-
-            # Fallbacks when not a PR or API did not return a branch
-            if [ -z "$TARGET_BRANCH" ] || [ "$TARGET_BRANCH" = "null" ]; then
-              TARGET_BRANCH="<< pipeline.git.branch >>"
-            fi
+            # Use the get-target-branch.sh script
+            source scripts/ops/get-target-branch.sh
 
-            echo "Resolved TARGET_BRANCH=$TARGET_BRANCH"
+            # Make TARGET_BRANCH available to subsequent steps
             echo "export TARGET_BRANCH=$TARGET_BRANCH" >> "$BASH_ENV"
+          working_directory: packages/contracts-bedrock
 
   setup-features:
     description: "Set up dev and system feature environment variables. Features are auto-classified based on system_features registry."
diff --git a/packages/contracts-bedrock/scripts/checks/check-semver-diff.sh b/packages/contracts-bedrock/scripts/checks/check-semver-diff.sh
index 8eb448cbc85e7..078fcaca3601c 100755
--- a/packages/contracts-bedrock/scripts/checks/check-semver-diff.sh
+++ b/packages/contracts-bedrock/scripts/checks/check-semver-diff.sh
@@ -8,6 +8,10 @@ SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &> /dev/null && pwd)
 # shellcheck source=/dev/null
 source "$SCRIPT_DIR/utils/semver-utils.sh"
 
+# Determine the target branch.
+# shellcheck source=/dev/null
+source "$SCRIPT_DIR/../ops/get-target-branch.sh"
+
 # Path to semver-lock.json.
 SEMVER_LOCK="snapshots/semver-lock.json"
 
@@ -31,7 +35,6 @@ temp_dir=$(mktemp -d)
 trap 'rm -rf "$temp_dir"' EXIT
 
 # Exit early if semver-lock.json has not changed.
-TARGET_BRANCH="${TARGET_BRANCH:-develop}"
 UPSTREAM_REF="origin/${TARGET_BRANCH}"
 if ! {
   git diff "$UPSTREAM_REF"...HEAD --name-only
diff --git a/packages/contracts-bedrock/scripts/ops/get-target-branch.sh b/packages/contracts-bedrock/scripts/ops/get-target-branch.sh
new file mode 100644
index 0000000000000..dfe3d5f708c83
--- /dev/null
+++ b/packages/contracts-bedrock/scripts/ops/get-target-branch.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Determines the PR target branch and exports TARGET_BRANCH
+# Can be sourced by other scripts: source scripts/ops/get-target-branch.sh
+# Or called with bash: TARGET_BRANCH=$(bash scripts/ops/get-target-branch.sh)
+
+set -euo pipefail
+
+TARGET_BRANCH=""
+
+# If this is a PR, get the target branch from GitHub API
+if [ -n "${CIRCLE_PULL_REQUEST:-}" ]; then
+  PR_NUMBER="${CIRCLE_PULL_REQUEST##*/}"
+  TARGET_BRANCH=$(curl -sS --fail --connect-timeout 10 --max-time 30 \
+    "https://api.github.com/repos/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}/pulls/${PR_NUMBER}" \
+    2>/dev/null | jq -r .base.ref || echo "")
+fi
+
+# Fallbacks when not a PR or API did not return a branch
+if [ -z "$TARGET_BRANCH" ] || [ "$TARGET_BRANCH" = "null" ]; then
+  # In CircleCI, use the current branch
+  # Locally or when CIRCLE_BRANCH isn't set, default to develop
+  TARGET_BRANCH="${CIRCLE_BRANCH:-develop}"
+fi
+
+echo "Resolved TARGET_BRANCH=$TARGET_BRANCH" >&2
+
+# When sourced, export the variable. When called, output to stdout.
+if [[ "${BASH_SOURCE[0]}" != "${0}" ]]; then
+  # Script is being sourced
+  export TARGET_BRANCH
+else
+  # Script is being executed
+  echo "$TARGET_BRANCH"
+fi
diff --git a/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh b/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh
index 2ae55980ac89a..bf2100c3df48b 100755
--- a/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh
+++ b/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh
@@ -6,6 +6,10 @@ set -euo pipefail
 # - develop branch: Always build fresh (accuracy)
 # - force-use-fresh-artifacts label: Override fallback (emergency escape hatch)
 
+# Determine the target branch for this PR
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/get-target-branch.sh"
+
 USE_FALLBACK=false
 
 # Check if we're on a PR (not develop branch)
@@ -43,6 +47,7 @@ if [ "${CIRCLE_BRANCH:-}" != "develop" ]; then
   fi
 fi
 
+echo "TARGET_BRANCH=$TARGET_BRANCH"
 # Ensure that PRs targetting anything other than develop do not use the fallback
 if [ "$TARGET_BRANCH" != "develop" ]; then
   USE_FALLBACK=false

From 1e8ab14b34ff235c8ecaf1f7efda32b96d38f2f3 Mon Sep 17 00:00:00 2001
From: Maurelian <maurelian@protonmail.ch>
Date: Wed, 14 Jan 2026 15:13:31 -0500
Subject: [PATCH 3/5] fix: shellcheck error

---
 packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh b/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh
index bf2100c3df48b..5c11846e55158 100755
--- a/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh
+++ b/packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh
@@ -8,6 +8,7 @@ set -euo pipefail
 
 # Determine the target branch for this PR
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
 source "$SCRIPT_DIR/get-target-branch.sh"
 
 USE_FALLBACK=false

From 9112964c508fe293126544cfb86e5fc133b13575 Mon Sep 17 00:00:00 2001
From: Maurelian <maurelian@protonmail.ch>
Date: Wed, 14 Jan 2026 15:55:12 -0500
Subject: [PATCH 4/5] fix: simplify get-target-branch.sh to match original
 logic

Removed unnecessary error handling and conditional logic to keep the
script closer to the original CircleCI implementation for easier review.
---
 .../scripts/ops/get-target-branch.sh          | 23 ++-----------------
 1 file changed, 2 insertions(+), 21 deletions(-)

diff --git a/packages/contracts-bedrock/scripts/ops/get-target-branch.sh b/packages/contracts-bedrock/scripts/ops/get-target-branch.sh
index dfe3d5f708c83..a60d244bc9c29 100644
--- a/packages/contracts-bedrock/scripts/ops/get-target-branch.sh
+++ b/packages/contracts-bedrock/scripts/ops/get-target-branch.sh
@@ -1,34 +1,15 @@
 #!/usr/bin/env bash
 # Determines the PR target branch and exports TARGET_BRANCH
-# Can be sourced by other scripts: source scripts/ops/get-target-branch.sh
-# Or called with bash: TARGET_BRANCH=$(bash scripts/ops/get-target-branch.sh)
-
-set -euo pipefail
 
 TARGET_BRANCH=""
-
-# If this is a PR, get the target branch from GitHub API
 if [ -n "${CIRCLE_PULL_REQUEST:-}" ]; then
-  PR_NUMBER="${CIRCLE_PULL_REQUEST##*/}"
-  TARGET_BRANCH=$(curl -sS --fail --connect-timeout 10 --max-time 30 \
-    "https://api.github.com/repos/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}/pulls/${PR_NUMBER}" \
-    2>/dev/null | jq -r .base.ref || echo "")
+  TARGET_BRANCH=$(curl -s "https://api.github.com/repos/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}/pulls/${CIRCLE_PULL_REQUEST##*/}" | jq -r .base.ref)
 fi
 
 # Fallbacks when not a PR or API did not return a branch
 if [ -z "$TARGET_BRANCH" ] || [ "$TARGET_BRANCH" = "null" ]; then
-  # In CircleCI, use the current branch
-  # Locally or when CIRCLE_BRANCH isn't set, default to develop
   TARGET_BRANCH="${CIRCLE_BRANCH:-develop}"
 fi
 
 echo "Resolved TARGET_BRANCH=$TARGET_BRANCH" >&2
-
-# When sourced, export the variable. When called, output to stdout.
-if [[ "${BASH_SOURCE[0]}" != "${0}" ]]; then
-  # Script is being sourced
-  export TARGET_BRANCH
-else
-  # Script is being executed
-  echo "$TARGET_BRANCH"
-fi
+export TARGET_BRANCH

From 46de590d633485925e9c6cad0005c6f795b827e7 Mon Sep 17 00:00:00 2001
From: Maurelian <maurelian@protonmail.ch>
Date: Wed, 14 Jan 2026 16:30:46 -0500
Subject: [PATCH 5/5] remove extra ci job calls

---
 .circleci/config.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 0378a34f6e9fe..bf8b6e45d3e3b 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1337,7 +1337,6 @@ jobs:
           name: Print forge version
           command: forge --version
           working_directory: packages/contracts-bedrock
-      - get-target-branch
       - pull-artifacts-conditional
       - go-restore-cache:
           namespace: packages/contracts-bedrock/scripts/go-ffi
@@ -1506,7 +1505,6 @@ jobs:
           name: Print forge version
           command: forge --version
           working_directory: packages/contracts-bedrock
-      - get-target-branch
       - pull-artifacts-conditional
       - run:
           name: Install lcov
@@ -1604,7 +1602,6 @@ jobs:
           name: Print forge version
           command: forge --version
           working_directory: packages/contracts-bedrock
-      - get-target-branch
       - pull-artifacts-conditional
       - run:
           name: Write pinned block number for cache key