perf(l1): parallelize header download with state download during snap sync

.dockerignore

@@ -21,5 +21,6 @@ hive/
 ethereum-package/
 tooling/ef_tests/blockchain/vectors
 tooling/ef_tests/state/vectors
+tooling/sync/multisync_logs/
 dev_ethrex_l1/
 dev_ethrex_l2/

.github/CODEOWNERS

@@ -2,19 +2,18 @@
 * @lambdaclass/lambda-execution-reviewers
 
 ## ethrex L2 code owners
-crates/l2 @ilitteri @manuelbilbao @avilagaston9
+crates/l2 @lambdaclass/ethrex-l2-reviewers
 crates/l2/contracts/src @jrchatruc @manuelbilbao
-cmd/ethrex/l2 @ilitteri @manuelbilbao @avilagaston9
-cmd/ethrex/build* @ilitteri @manuelbilbao @avilagaston9
-crates/blockchain/dev @ilitteri @manuelbilbao @avilagaston9
-crates/common/crypto @ilitteri @manuelbilbao @avilagaston9
-crates/common/types/blobs_bundle.rs @ilitteri @manuelbilbao @avilagaston9
-crates/common/types/l2 @ilitteri @manuelbilbao @avilagaston9
-crates/common/types/l2.rs @ilitteri @manuelbilbao @avilagaston9
-crates/common/types/transaction.rs @ilitteri @manuelbilbao @avilagaston9
-crates/common/rkyv_utils.rs @ilitteri @manuelbilbao @avilagaston9
-crates/networking/p2p/rlpx/l2 @ilitteri @manuelbilbao @avilagaston9
-crates/networking/rpc/types/transaction.rs @ilitteri @manuelbilbao @avilagaston9
-crates/networking/rpc/clients @ilitteri @manuelbilbao @avilagaston9
-crates/vm/levm/src/hooks/l2_hook.rs @ilitteri @manuelbilbao @avilagaston9
-crates/blockchain/dev @ilitteri @manuelbilbao @avilagaston9
+cmd/ethrex/l2 @lambdaclass/ethrex-l2-reviewers
+cmd/ethrex/build* @lambdaclass/ethrex-l2-reviewers
+crates/blockchain/dev @lambdaclass/ethrex-l2-reviewers
+crates/common/crypto @lambdaclass/ethrex-l2-reviewers
+crates/common/types/blobs_bundle.rs @lambdaclass/ethrex-l2-reviewers
+crates/common/types/l2 @lambdaclass/ethrex-l2-reviewers
+crates/common/types/l2.rs @lambdaclass/ethrex-l2-reviewers
+crates/common/types/transaction.rs @lambdaclass/ethrex-l2-reviewers
+crates/common/rkyv_utils.rs @lambdaclass/ethrex-l2-reviewers
+crates/networking/p2p/rlpx/l2 @lambdaclass/ethrex-l2-reviewers
+crates/networking/rpc/types/transaction.rs @lambdaclass/ethrex-l2-reviewers
+crates/networking/rpc/clients @lambdaclass/ethrex-l2-reviewers
+crates/vm/levm/src/hooks/l2_hook.rs @lambdaclass/ethrex-l2-reviewers

.github/actions/snapsync-run/action.yml

@@ -72,6 +72,7 @@ runs:
             el_extra_params:
               - "--syncmode=snap"
               - "--log.level=info"
+              - "--http.api=eth,net,web3,debug,admin,txpool"
             cl_type: ${CL_TYPE}
             cl_image: ${CL_IMAGE}
             count: 1

.github/config/assertoor/network_params_blob.yaml

@@ -10,6 +10,12 @@ participants:
     cl_type: lighthouse
     cl_image: sigp/lighthouse:v8.0.0-rc.1
     validator_count: 32
+    # ethereum-package's el_admin_node_info.star bootstrap calls admin_nodeInfo
+    # to discover the enode; the new ethrex defaults only serve eth/net/web3,
+    # so opt admin/debug/txpool back in for this devnet. --http.addr is
+    # already set by ethereum-package's ethrex launcher.
+    el_extra_params:
+      - "--http.api=eth,net,web3,debug,admin,txpool"
 
 additional_services:
   - assertoor

.github/config/assertoor/network_params_ethrex_multiple_cl.yaml

@@ -1,22 +1,32 @@
+# ethereum-package's el_admin_node_info.star bootstrap calls admin_nodeInfo
+# to discover the enode; the new ethrex defaults only serve eth/net/web3, so
+# every ethrex participant opts admin/debug/txpool back in for this devnet.
+# --http.addr is already set by ethereum-package's ethrex launcher.
 participants:
   - el_type: ethrex
     el_image: ethrex:ci
     cl_type: lighthouse
     cl_image: sigp/lighthouse:v8.0.0-rc.1
     validator_count: 32
     ethereum_metrics_exporter_enabled: true
+    el_extra_params:
+      - "--http.api=eth,net,web3,debug,admin,txpool"
   - el_type: ethrex
     el_image: ethrex:ci
     cl_type: teku
     cl_image: consensys/teku:25.6.0
     validator_count: 32
     ethereum_metrics_exporter_enabled: true
+    el_extra_params:
+      - "--http.api=eth,net,web3,debug,admin,txpool"
   - el_type: ethrex
     el_image: ethrex:ci
     cl_type: prysm
     cl_image: gcr.io/offchainlabs/prysm/beacon-chain:v6.0.4
     validator_count: 32
     ethereum_metrics_exporter_enabled: true
+    el_extra_params:
+      - "--http.api=eth,net,web3,debug,admin,txpool"
 
 network_params:
   # The address of the staking contract address on the Eth1 chain

.github/config/assertoor/network_params_tx.yaml

@@ -9,6 +9,12 @@ participants:
     cl_type: lighthouse
     cl_image: sigp/lighthouse:v8.0.0-rc.1
     validator_count: 32
+    # ethereum-package's el_admin_node_info.star bootstrap calls admin_nodeInfo
+    # to discover the enode; the new ethrex defaults only serve eth/net/web3,
+    # so opt admin/debug/txpool back in for this devnet. --http.addr is
+    # already set by ethereum-package's ethrex launcher.
+    el_extra_params:
+      - "--http.api=eth,net,web3,debug,admin,txpool"
 
 additional_services:
   - assertoor

.github/config/hive/amsterdam.yaml

@@ -1,4 +1,4 @@
 # Amsterdam (BAL) hive test configuration
-# Pinned from ethereum/execution-specs devnets/bal/3 @ 2026-04-14
-fixtures: https://github.com/ethereum/execution-spec-tests/releases/download/bal@v5.6.1/fixtures_bal.tar.gz
-eels_commit: 5c6e20abf3586f52d9e58393203ca07f2d0151fe
+# Pinned to tests-bal@v7.2.0 (execution-specs `devnets/bal/7`)
+fixtures: https://github.com/ethereum/execution-specs/releases/download/tests-bal%40v7.2.0/fixtures_bal.tar.gz
+eels_commit: a3e5201a53d8c94e2283ae170a2c71bbc233f7e7

.github/scripts/check-hive-results.sh

@@ -57,18 +57,15 @@ failed_logs_root="${results_dir}/failed_logs"
 rm -rf "${failed_logs_root}"
 mkdir -p "${failed_logs_root}"
 
-# Known-flaky tests to ignore (substring match against test case name).
-# These are hive framework issues, not ethrex bugs.
-KNOWN_FLAKY_TESTS=(
-  "Invalid Missing Ancestor Syncing ReOrg, Timestamp, EmptyTxs=False, CanonicalReOrg=False, Invalid P8"
-  "Invalid Missing Ancestor Syncing ReOrg, Timestamp, EmptyTxs=False, CanonicalReOrg=True, Invalid P8"
-  "Invalid Missing Ancestor Syncing ReOrg, Transaction Value, EmptyTxs=False, CanonicalReOrg=False, Invalid P9"
+# Tests excluded from the failure count (substring match against test case
+# name).
+KNOWN_EXCLUDED_TESTS=(
 )
 
-# Build a jq filter that excludes known-flaky tests.
-flaky_filter='true'
-for pattern in "${KNOWN_FLAKY_TESTS[@]}"; do
-  flaky_filter="${flaky_filter} and (.name | contains(\"${pattern}\") | not)"
+# Build a jq filter that excludes the known-excluded tests.
+exclude_filter='true'
+for pattern in "${KNOWN_EXCLUDED_TESTS[@]}"; do
+  exclude_filter="${exclude_filter} and (.name | contains(\"${pattern}\") | not)"
 done
 
 for json_file in "${json_files[@]}"; do
@@ -77,11 +74,11 @@ for json_file in "${json_files[@]}"; do
   fi
 
   suite_name="$(jq -r '.name // empty' "${json_file}")"
-  failed_cases="$(jq '[.testCases[]? | select(.summaryResult.pass != true) | select('"${flaky_filter}"')] | length' "${json_file}")"
+  failed_cases="$(jq '[.testCases[]? | select(.summaryResult.pass != true) | select('"${exclude_filter}"')] | length' "${json_file}")"
 
-  skipped_flaky="$(jq '[.testCases[]? | select(.summaryResult.pass != true) | select(('"${flaky_filter}"') | not)] | length' "${json_file}")"
-  if [ "${skipped_flaky}" -gt 0 ]; then
-    echo "Ignoring ${skipped_flaky} known-flaky test(s) in ${suite_name:-$(basename "${json_file}")}"
+  skipped_excluded="$(jq '[.testCases[]? | select(.summaryResult.pass != true) | select(('"${exclude_filter}"') | not)] | length' "${json_file}")"
+  if [ "${skipped_excluded}" -gt 0 ]; then
+    echo "Ignoring ${skipped_excluded} known-excluded test(s) in ${suite_name:-$(basename "${json_file}")}"
   fi
 
   if [ "${failed_cases}" -gt 0 ]; then
@@ -90,7 +87,7 @@ for json_file in "${json_files[@]}"; do
       jq -r '
         .testCases[]?
         | select(.summaryResult.pass != true)
-        | select('"${flaky_filter}"')
+        | select('"${exclude_filter}"')
         | . as $case
         | ($case.summaryResult // {}) as $summary
         | ($summary.message // $summary.reason // $summary.error // "") as $message
@@ -144,9 +141,9 @@ for json_file in "${json_files[@]}"; do
         [
           .simLog?,
           .testDetailsLog?,
-          (.testCases[]? | select(.summaryResult.pass != true) | select('"${flaky_filter}"') | .clientInfo? | to_entries? // [] | map(.value.logFile? // empty) | .[]),
-          (.testCases[]? | select(.summaryResult.pass != true) | select('"${flaky_filter}"') | .summaryResult.logFile?),
-          (.testCases[]? | select(.summaryResult.pass != true) | select('"${flaky_filter}"') | .logFile?)
+          (.testCases[]? | select(.summaryResult.pass != true) | select('"${exclude_filter}"') | .clientInfo? | to_entries? // [] | map(.value.logFile? // empty) | .[]),
+          (.testCases[]? | select(.summaryResult.pass != true) | select('"${exclude_filter}"') | .summaryResult.logFile?),
+          (.testCases[]? | select(.summaryResult.pass != true) | select('"${exclude_filter}"') | .logFile?)
         ]
         | map(select(. != null and . != ""))
         | unique
@@ -216,7 +213,7 @@ for json_file in "${json_files[@]}"; do
         .testCases
         | to_entries[]
         | select(.value.summaryResult.pass != true)
-        | select(.value | '"${flaky_filter}"')
+        | select(.value | '"${exclude_filter}"')
         | . as $case_entry
         | ($case_entry.value.clientInfo? // {}) | to_entries[]
         | [

.github/workflows/daily_snapsync.yaml

@@ -71,6 +71,11 @@ jobs:
 
   engine-restart:
     name: Restart Kurtosis Engine
+    # Self-hosted runner: only fire for non-PR events or in-org PRs.
+    # Fork PRs would otherwise execute attacker-controlled code on ethrex-sync.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ethrex-sync
     steps:
       - name: Restart engine to match CLI version
@@ -79,6 +84,9 @@ jobs:
   sync-lighthouse:
     needs: [prepare, engine-restart]
     name: Sync ${{ matrix.network }} - Lighthouse
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ethrex-sync
     strategy:
       fail-fast: false
@@ -126,6 +134,9 @@ jobs:
   sync-prysm:
     needs: [prepare, engine-restart]
     name: Sync ${{ matrix.network }} - Prysm
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ethrex-sync
     strategy:
       fail-fast: false

.github/workflows/main_prover.yaml

@@ -32,6 +32,11 @@ env:
 jobs:
   test:
     name: Integration Test Prover SP1
+    # Self-hosted GPU runner: only fire for non-PR events or in-org PRs.
+    # Fork PRs would otherwise execute attacker-controlled code on the GPU CI machine.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: gpu
     steps:
       - name: Checkout sources

.github/workflows/pr-main_l1.yaml

@@ -126,6 +126,79 @@ jobs:
         run: |
           make -C tooling/ef_tests/blockchain test
 
+      - name: Append Known Issues to job summary
+        if: ${{ always() && github.event_name != 'merge_group' && hashFiles('docs/known_issues.md') != '' }}
+        shell: bash
+        run: |
+          {
+            echo "## Known Issues (intentionally skipped)"
+            echo ""
+            echo "_Source: [\`docs/known_issues.md\`](https://github.com/${GITHUB_REPOSITORY}/blob/${GITHUB_SHA}/docs/known_issues.md)_"
+            echo ""
+            cat docs/known_issues.md
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  known-issues-comment:
+    name: Post Known Issues sticky comment
+    runs-on: ubuntu-latest
+    # Only on PRs from the same repo (forks lack write perms for comments).
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false }}
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          sparse-checkout: |
+            docs/known_issues.md
+          sparse-checkout-cone-mode: false
+
+      - name: Check if known_issues.md exists
+        id: check
+        shell: bash
+        run: |
+          if [ -s docs/known_issues.md ]; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build comment body
+        if: steps.check.outputs.exists == 'true'
+        shell: bash
+        run: |
+          {
+            echo "<!-- known-issues-comment -->"
+            echo "## :warning: Known Issues — intentionally skipped tests"
+            echo ""
+            echo "_Source: [\`docs/known_issues.md\`](https://github.com/${GITHUB_REPOSITORY}/blob/${GITHUB_SHA}/docs/known_issues.md)_"
+            echo ""
+            cat docs/known_issues.md
+          } > known_issues_comment.md
+
+      - name: Find existing comment
+        if: steps.check.outputs.exists == 'true'
+        continue-on-error: true
+        uses: peter-evans/find-comment@v4
+        id: fc
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          comment-author: "github-actions[bot]"
+          body-includes: "<!-- known-issues-comment -->"
+
+      - name: Create or update comment
+        if: steps.check.outputs.exists == 'true'
+        uses: peter-evans/create-or-update-comment@v5
+        with:
+          comment-id: ${{ steps.fc.outputs.comment-id }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          issue-number: ${{ github.event.pull_request.number }}
+          body-path: known_issues_comment.md
+          edit-mode: replace
+
   docker_build:
     name: Build Docker
     runs-on: ubuntu-latest
@@ -247,6 +320,9 @@ jobs:
       - name: Checkout sources
         uses: actions/checkout@v6
 
+      - name: Free Disk Space
+        uses: ./.github/actions/free-disk
+
       - name: Download ethrex image artifact
         uses: actions/download-artifact@v6
         with:
@@ -311,7 +387,7 @@ jobs:
         uses: ethpandaops/hive-github-action@v0.5.0
         with:
           hive_repository: ethereum/hive
-          hive_version: fbc845b230c5758382e7eb6b58e277d9afebf3e7
+          hive_version: 3b6bde032562a8733c8bfa0e928d900f91c06e82
           simulator: ${{ matrix.simulation }}
           client: ethrex
           client_config: ${{ steps.client-config.outputs.config }}

.github/workflows/pr-main_l1_l2_dev.yaml

@@ -65,6 +65,7 @@ jobs:
           --block-producer.operator-fee-vault-address 0xd5d2a85751b6F158e5b9B8cD509206A865672362 \
           --block-producer.l1-fee-vault-address 0x45681AE1768a8936FB87aB11453B4755e322ceec \
           --block-producer.operator-fee-per-gas 1000000000 \
+          --committer.commit-time 15000 \
           --no-monitor  2>&1 | tee /tmp/ethrex.log &
 
       - name: Wait for ethrex L2

.github/workflows/pr-main_l2.yaml

@@ -530,6 +530,18 @@ jobs:
 
       - name: Set up Nix
         uses: cachix/install-nix-action@v31
+        with:
+          # crates.io 403s any User-Agent containing "curl/", which is what Nix's
+          # fetchurl sends by default, breaking crate downloads during the image
+          # build. In multi-user (daemon) mode the FOD builds run under the
+          # nix-daemon and don't see the caller's environment, so override the
+          # User-Agent via impure-env (honored because the runner is a trusted
+          # user). Use curl's glued short option `-A<value>`: a single space-free
+          # token that survives impure-env's space-separated parsing and
+          # fetchurl's unquoted word-split (curl rejects the --user-agent=value form).
+          extra_nix_config: |
+            extra-experimental-features = configurable-impure-env
+            impure-env = NIX_CURL_FLAGS=-Aethrex-ci+https://github.com/lambdaclass/ethrex
 
       - name: Set up QEMU
         run: |

.github/workflows/pr-main_l2_tdx_build.yaml

@@ -49,6 +49,18 @@ jobs:
 
       - name: Set up Nix
         uses: cachix/install-nix-action@v31
+        with:
+          # crates.io 403s any User-Agent containing "curl/", which is what Nix's
+          # fetchurl sends by default, breaking crate downloads during the image
+          # build. In multi-user (daemon) mode the FOD builds run under the
+          # nix-daemon and don't see the caller's environment, so override the
+          # User-Agent via impure-env (honored because the runner is a trusted
+          # user). Use curl's glued short option `-A<value>`: a single space-free
+          # token that survives impure-env's space-separated parsing and
+          # fetchurl's unquoted word-split (curl rejects the --user-agent=value form).
+          extra_nix_config: |
+            extra-experimental-features = configurable-impure-env
+            impure-env = NIX_CURL_FLAGS=-Aethrex-ci+https://github.com/lambdaclass/ethrex
 
       - name: Build image
         run: |

.github/workflows/tag_release.yaml

@@ -442,6 +442,8 @@ jobs:
           fromTag: ${{ github.ref_name }}
           toTag: ${{ env.PREVIOUS_TAG }}
           writeToFile: false
+          restrictToTypes: feat,fix,perf,refactor,revert
+          excludeTypes: build,docs,other,style,chore
 
       - name: Finalize Release
         uses: softprops/action-gh-release@v3

.gitignore

@@ -9,6 +9,7 @@
 *.pdb
 
 tooling/ef_tests/blockchain/vectors
+tooling/ef_tests/blockchain/vectors_zkevm
 
 tooling/ef_tests/state/vectors