Sync PIR integration

.github/actions/prepare/action.yml

@@ -28,7 +28,7 @@ inputs:
 outputs:
   feature-flags:
     description: 'Feature flags'
-    value: ${{ steps.prepare.outputs.flags }}
+    value: ${{ steps.prepare.outputs.flags || steps.prepare-all.outputs.flags }}
 runs:
   using: 'composite'
   steps:

.github/helpers/check-dep-graph.py

@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+import sys
+
+CRATES_IN_GRAPH = set([
+    # ./components
+    'eip681',
+    'equihash',
+    'f4jumble',
+    'zcash_address',
+    'zcash_encoding',
+    'zcash_protocol',
+    'zip321',
+    # ./
+    'pczt',
+    'zcash_client_backend',
+    'zcash_client_memory',
+    'zcash_client_sqlite',
+    'zcash_extensions',
+    'zcash_history',
+    'zcash_keys',
+    'zcash_primitives',
+    'zcash_proofs',
+    'zcash_transparent',
+    # Other repos
+    'orchard',
+    'sapling-crypto',
+    'zcash_note_encryption',
+    'zcash_spec',
+    'zip32',
+])
+
+def main():
+    script_dir = os.path.dirname(os.path.realpath(__file__))
+    base_dir = os.path.dirname(os.path.dirname(script_dir))
+    readme = os.path.join(base_dir, 'README.md')
+
+    # Extract the dependency graph edges from the readme.
+    readme_edges = []
+    with open(readme, 'r', encoding='utf8') as f:
+        line = ''
+        while not 'START mermaid-dependency-graph' in line:
+            line = f.readline()
+        line = f.readline()
+        while not 'END mermaid-dependency-graph' in line:
+            if '-->' in line:
+                # Include commented-out edges for linting purposes.
+                line = line.strip()
+                if line.startswith('%% '):
+                    line = line[3:]
+                (crate, dependency) = line.strip().split(' --> ', 1)
+                if crate in CRATES_IN_GRAPH and dependency in CRATES_IN_GRAPH:
+                    readme_edges.append((crate, dependency))
+            line = f.readline()
+
+    # Check for duplicate edges.
+    readme_edges_set = set(readme_edges)
+    has_duplicate_edges = len(readme_edges) != len(readme_edges_set)
+    if has_duplicate_edges:
+        duplicate_edges = readme_edges
+        for edge in readme_edges_set:
+            duplicate_edges.remove(edge)
+        duplicate_edges = ['%s --> %s' % edge for edge in duplicate_edges]
+        print('WARNING: Duplicate edges in README.md dependency graph:')
+        for edge in sorted(duplicate_edges):
+            print('    %s --> %s' % edge)
+
+    # Extract the dependency graph edges from the Rust workspace.
+    cargo_graph = subprocess.run(
+        ['cargo', 'tree', '--all-features', '-e', 'normal', '--prefix', 'depth', '-f', ' {p}'],
+        stdout=subprocess.PIPE,
+        universal_newlines=True)
+    cargo_edges = set()
+    crate_stack = []
+    for line in cargo_graph.stdout.splitlines():
+        if len(line.strip()) == 0:
+            continue
+        (depth, crate, _) = line.strip().split(' ', 2)
+        depth = int(depth)
+
+        if depth == 0:
+            crate_stack = [crate]
+            continue
+
+        while len(crate_stack) > depth:
+            crate_stack.pop()
+        if crate_stack[-1] in CRATES_IN_GRAPH and crate in CRATES_IN_GRAPH:
+            cargo_edges.add((crate_stack[-1], crate))
+        crate_stack.append(crate)
+
+    # Check for missing edges.
+    missing_edges = cargo_edges.difference(readme_edges_set)
+    has_missing_edges = len(missing_edges) > 0
+    if has_missing_edges:
+        print('ERROR: Missing edges from README.md dependency graph:')
+        for edge in sorted(missing_edges):
+            print('    %s --> %s' % edge)
+
+    # Check for stale edges.
+    stale_edges = readme_edges_set.difference(cargo_edges)
+    has_stale_edges = len(stale_edges) > 0
+    if has_stale_edges:
+        print('ERROR: Stale edges in README.md dependency graph:')
+        for edge in sorted(stale_edges):
+            print('    %s --> %s' % edge)
+
+    if has_duplicate_edges or has_missing_edges or has_stale_edges:
+        sys.exit(1)
+
+if __name__ == '__main__':
+    main()

.github/workflows/audits.yml

@@ -13,7 +13,7 @@ jobs:
     name: Vet Rust dependencies
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
@@ -28,10 +28,10 @@ jobs:
     name: Check licenses
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: EmbarkStudios/cargo-deny-action@f2ba7abc2abebaf185c833c3961145a3c275caad # v2.0.13
+      - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2.0.15
         with:
           command: check licenses
 

.github/workflows/book.yml

@@ -5,15 +5,24 @@ on:
     branches:
       - main
 
+permissions:
+  pages: write
+  id-token: write
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - id: prepare
         uses: ./.github/actions/prepare
+        with:
+          all-features: true
       - uses: dtolnay/rust-toolchain@nightly
         id: toolchain
       - run: rustup override set "${TOOLCHAIN}"
@@ -34,8 +43,11 @@ jobs:
           mkdir -p ./book/book/rustdoc
           mv ./target/doc ./book/book/rustdoc/latest
 
-      - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./book/book
+          path: ./book/book
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0