Tracking PR for v0.14.0 release

.github/actions/workspace-release/action.yml

@@ -0,0 +1,111 @@
+name: workspace-release
+description: "Dry-run or publish Rust workspace crates using cargo"
+
+inputs:
+  mode:
+    description: "Release mode: dry-run or publish"
+    required: true
+    default: "dry-run"
+  verify-branch-head:
+    description: "If true, ensure the triggering SHA matches the release branch HEAD"
+    required: false
+    default: "false"
+  release-branch:
+    description: "Branch to verify HEAD against (used when verify-branch-head is true)"
+    required: false
+    default: "main"
+
+runs:
+  using: "composite"
+  steps:
+    # Optional: guard that release happens from latest release branch
+    - name: Verify tag matches release branch HEAD
+      if: ${{ inputs.verify-branch-head == 'true' }}
+      shell: bash
+      run: |
+        git fetch origin ${{ inputs.release-branch }} --depth=1
+        branch_sha="$(git rev-parse origin/${{ inputs.release-branch }})"
+        tag_sha="$(git rev-parse HEAD)"
+
+        echo "branch_sha=$branch_sha"
+        echo "tag_sha=$tag_sha"
+
+        if [ "$branch_sha" != "$tag_sha" ]; then
+          echo "::error::The release/tag commit does not match origin/${{ inputs.release-branch }} HEAD. Aborting."
+          exit 1
+        fi
+
+    - name: Install Rust toolchain
+      uses: dtolnay/rust-toolchain@stable
+
+    - name: Cache cargo registry and git index
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-cargo-
+
+    - name: Cleanup large tools for build space
+      uses: ./.github/actions/cleanup-runner
+
+    # Install cargo-msrv for MSRV checks
+    # Using binstall with --force to avoid stale cached binaries (see PR #2234)
+    - name: Install cargo-binstall
+      uses: taiki-e/install-action@v2
+      with:
+        tool: cargo-binstall
+
+    - name: Install cargo-msrv
+      shell: bash
+      run: cargo binstall --no-confirm --force cargo-msrv
+
+    # Keep your existing MSRV check
+    # PATH export required for check-msrv.sh subprocess (see PR #2234)
+    - name: Check MSRV
+      shell: bash
+      run: |
+        export PATH="$HOME/.cargo/bin:$PATH"
+        chmod +x scripts/check-msrv.sh
+        ./scripts/check-msrv.sh
+
+    # Clean packaging directory to avoid stale/corrupted tmp-registry state
+    - name: Clean packaging directory
+      shell: bash
+      run: |
+        echo "Cleaning target/package directory to ensure fresh state"
+        rm -rf target/package
+
+    # Clear cargo registry to ensure fresh resolution during verification.
+    # This prevents issues where cached metadata from previous runs
+    # might interfere with workspace dependency feature resolution
+    # during the verification step (related to cargo#14283, cargo#14789).
+    # Specifically, this ensures the temp registry used during workspace
+    # publish verification doesn't conflict with cached crates.io data.
+    - name: Clear cargo registry for fresh resolution
+      if: ${{ inputs.mode == 'dry-run' }}
+      shell: bash
+      run: |
+        echo "Clearing cargo registry for fresh resolution"
+        rm -rf ~/.cargo/registry/cache
+        rm -rf ~/.cargo/registry/index
+        rm -rf ~/.cargo/registry/src
+
+    # Dry-run vs real publish
+    - name: Dry-run workspace publish
+      if: ${{ inputs.mode == 'dry-run' }}
+      shell: bash
+      run: |
+        echo "Running cargo publish --workspace --dry-run"
+        cargo publish --workspace --dry-run
+
+    - name: Publish workspace crates
+      if: ${{ inputs.mode == 'publish' }}
+      shell: bash
+      env:
+        CARGO_REGISTRY_TOKEN: ${{ env.CARGO_REGISTRY_TOKEN }}
+      run: |
+        echo "Publishing workspace crates to crates.io"
+        cargo publish --workspace

.github/workflows/build.yml

@@ -12,6 +12,7 @@ on:
         branches: [main, next]
     pull_request:
         types: [opened, reopened, synchronize]
+    merge_group:
 
 permissions:
     contents: read
@@ -66,4 +67,4 @@ jobs:
             # cache hits and cache evictions (github has a 10GB cache limit).
             save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/next' }}
         - name: build benches
-          run: cargo bench --no-run
+          run: cargo build --benches

.github/workflows/lint.yml

@@ -12,6 +12,7 @@ on:
     branches: [main, next]
   pull_request:
     types: [opened, reopened, synchronize]
+  merge_group:
 
 permissions:
   contents: read

.github/workflows/test.yml

@@ -11,7 +11,8 @@ on:
   push:
     branches: [main, next]
   pull_request:
-    types: [opened, reopened, synchronize] 
+    types: [opened, reopened, synchronize]
+  merge_group:
 
 permissions:
   contents: read
@@ -31,9 +32,9 @@ jobs:
       - name: Install rust
         run: rustup update --no-self-update 
       - name: Build tests
-        run: make test-build
+        run: make test-release-build
       - name: test
-        run: make test
+        run: make test-release # runs without debug mode
 
   doc-tests:
     name: doc-tests

.github/workflows/workspace-dry-run.yml

@@ -0,0 +1,34 @@
+name: Workspace release dry-run
+
+on:
+  push:
+    branches:
+      - main
+      - next
+      - 'release/**'
+
+permissions:
+  contents: read
+  id-token: write  # Required for OIDC token exchange
+
+concurrency:
+  group: "${{ github.workflow }} @ ${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  release-dry-run:
+    if: ${{ github.repository_owner == '0xMiden' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Dry-run workspace release
+        uses: ./.github/actions/workspace-release
+        with:
+          mode: "dry-run"
+          verify-branch-head: "false"
+          # ref left blank: uses the pushed ref

.github/workflows/workspace-publish.yml

@@ -0,0 +1,35 @@
+name: Publish workspace to crates.io
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  id-token: write  # Required for OIDC token exchange
+
+jobs:
+  publish:
+    if: ${{ github.repository_owner == '0xMiden' }}
+    runs-on: ubuntu-latest
+    environment: release  # Optional: for enhanced security
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.release.target_commitish }}
+
+      - name: Authenticate with crates.io
+        uses: rust-lang/crates-io-auth-action@v1
+        id: auth
+
+      - name: Publish workspace crates
+        uses: ./.github/actions/workspace-release
+        with:
+          mode: "publish"
+          verify-branch-head: "true"
+          release-branch: ${{ github.event.release.target_commitish }}
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

.gitmodules

@@ -0,0 +1,10 @@
+[submodule "crates/miden-agglayer/solidity-compat/lib/forge-std"]
+	path = crates/miden-agglayer/solidity-compat/lib/forge-std
+	url = https://github.com/foundry-rs/forge-std
+[submodule "crates/miden-agglayer/solidity-compat/lib/agglayer-contracts"]
+	path = crates/miden-agglayer/solidity-compat/lib/agglayer-contracts
+	url = https://github.com/agglayer/agglayer-contracts
+[submodule "crates/miden-agglayer/solidity-compat/lib/openzeppelin-contracts-upgradeable"]
+	path = crates/miden-agglayer/solidity-compat/lib/openzeppelin-contracts-upgradeable
+	url = https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable.git
+	branch = release-v4.9

.taplo.toml

@@ -1,3 +1,5 @@
+exclude = ["crates/miden-agglayer/solidity-compat/lib/*"]
+
 [formatting]
 align_entries         = true
 column_width          = 120