chore: migrate root Makefile to justfile

[ajsutton]

Summary

• Migrates all root Makefile targets to the root justfile, including build targets, Docker targets, test runners, and CI-specific test infrastructure
• Replaces the root Makefile with the standard deprecated shim (justfiles/deprecated.mk) that forwards make invocations to just with a deprecation warning
• Converts all make -C ./subdir target calls to cd subdir && just target — all subdirectories already have justfiles with deprecated Make shims
• Adds semgrep-ci target (uses semgrep ci with develop baseline) alongside the existing semgrep target (uses semgrep scan)
• Updates op-e2e/justfile to use cd .. && just cannon-prestates instead of make -C ..
• Restores explanatory GOPRIVATE comment on mod-tidy
• Updates CONTRIBUTING.md to reference just instead of make

Stack

1. optimism#19473 — linter migration + shared infrastructure (merged)
2. optimism#19474 — cannon migration (merged)
3. optimism#19475 — op-e2e migration (merged)
4. optimism#19476 — op-program migration
5. This PR — root Makefile migration
6. optimism#19482 — CI config update
7. optimism#19483 — cannon testdata migration

Test plan

• just --list at repo root shows all migrated targets
• make build triggers the deprecation shim and delegates to just build
• CI targets (go-tests-ci, go-tests-short-ci, go-tests-fraud-proofs-ci) work correctly in CircleCI
• CI passes

🤖 Generated with Claude Code

[wiz-inc-a178a98b5d]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	-

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.8%. Comparing base (9a50c60) to head (8ce1363).
⚠️ Report is 1 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #19477      +/-   ##
===========================================
+ Coverage     75.3%    75.8%    +0.5%     
===========================================
  Files          194      477     +283     
  Lines        11285    59985   +48700     
===========================================
+ Hits          8502    45506   +37004     
- Misses        2639    14479   +11840     
+ Partials       144        0     -144     

Flag	Coverage Δ
cannon-go-tests-64	?
contracts-bedrock-tests	?
unit	75.8% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 671 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sebastianst]

Review: root Makefile → justfile migration

This is a large but straightforward migration. All original Make targets are replicated in the justfile, and the pre-existing justfile targets (release-notes, shellcheck, etc.) are preserved. A few items:

1. PR description says op-e2e/justfile was updated — it wasn't

The description says "Updates op-e2e/justfile to use cd .. && just cannon-prestates instead of make -C .." but the op-e2e/justfile has no changes in this PR's commits (945b5e3b6e..f42c9d3f71). The op-e2e justfile still has make -C .. cannon-prestates.

2. Several targets still round-trip through Make shims

Targets like cannon, op-program, op-challenger, op-dispute-mon still call make -C ./subdir target. Since cannon and op-program already have deprecated Make shims (from earlier PRs in the stack), the flow is just cannon → make -C ./cannon cannon → deprecated shim → just cannon. Not a bug, but an unnecessary indirection that could be cleaned up (e.g. cd cannon && just cannon). Same for reproducible-prestate-op-program, op-program-client, op-program-host, make-pre-test, generate-mocks-op-node, generate-mocks-op-service, and test-unit.

3. mod-tidy dropped the explanatory comment

The original had a useful comment explaining why GOPRIVATE is set (bypasses the Go module proxy for freshly released versions). Minor, but the comment was helpful context.

Things that look good

• update-op-geth renamed correctly: Pre-existing update-op-geth ref (bash script) renamed to update-op-geth-ref to avoid conflict with the Make target's update-op-geth (Python script). Both preserved.
• cross-op-node GIT_VERSION computation: Faithfully reproduced in bash. Actually cleaner — the Make version used $(GITCOMMIT) which wasn't defined in the root Makefile scope; the just version computes it fresh with git rev-parse HEAD.
• _go-tests-ci-internal flags as positional param: Works fine since bash word-splits the string. No current flags contain spaces.
• go-tests-fraud-proofs-ci: Correctly sets OP_E2E_CANNON_ENABLED="true" (vs "false" in the regular test targets) and includes all CI env vars.
• ALL_TEST_PACKAGES construction: String concatenation produces identical result.
• help target: just --list is a clean replacement for the grep-based Make help.
• CI test infrastructure (go-tests-ci, go-tests-short-ci, go-tests-ci-kona-action, go-tests-fraud-proofs-ci): All faithfully replicated including CircleCI node sharding logic.
• CONTRIBUTING.md: Clean update.

---

Review generated by Claude Code

[ajsutton]

Restored the parallel build of prestates. It just uses basic bash wait rather than parallel to avoid an extra dependency.

[wwared]

🚢