Merge op-reth/v2.3.3 into firehose/2.x

.circleci/config.yml

@@ -11,11 +11,11 @@ parameters:
   default_docker_image:
     type: string
     default: cimg/base:2026.03
-  # Pinned ci-base-clang image (cimg/base + clang/llvm-dev/libclang-dev) for Rust jobs.
+  # Pinned ci-base-clang image (cimg/base + clang/llvm-dev/libclang-dev + protobuf-compiler) for Rust jobs.
   # Provenance is verified by .github/workflows/security.yml.
   rust_base_image:
     type: string
-    default: us-docker.pkg.dev/oplabs-tools-artifacts/images/ci-base-clang@sha256:d79c625a042269c64b2444ef1edf9bb4a399d1c892caee57f9021be067da5617
+    default: us-docker.pkg.dev/oplabs-tools-artifacts/images/ci-base-clang@sha256:873a6709dd48d7706b0baee139300f18ab7babf4a66f982b2383fe51ce2e5489
   base_image:
     type: string
     default: default
@@ -80,7 +80,7 @@ parameters:
   # go-cache-version can be used as a cache buster when making breaking changes to caching strategy
   go-cache-version:
     type: string
-    default: "v0.0"
+    default: "v0.1"
 
 orbs:
   continuation: circleci/continuation@2.0.1

.circleci/continue/helpers.yml

@@ -101,6 +101,16 @@ commands:
             - run:
                 name: Ensure clang available
                 command: 'command -v clang >/dev/null 2>&1 || { echo "ERROR: clang is required but was not found in PATH" >&2; exit 1; }'
+      # protoc + libprotobuf-dev well-known types (sp1-sdk prost/tonic build
+      # dep) are preinstalled in ci-base-clang, so just assert their presence.
+      - run:
+          name: Ensure protobuf compiler available
+          command: |
+            if ! command -v protoc >/dev/null 2>&1 || [ ! -f /usr/include/google/protobuf/empty.proto ]; then
+              echo "ERROR: protoc and the protobuf well-known type includes are required but were not found in PATH (expected in the ci-base-clang image)" >&2
+              exit 1
+            fi
+            protoc --version
       # Shared GCS compile cache (op-rust-sccache).
       - rust-sccache-setup:
           enabled: << parameters.enable_sccache >>

.circleci/continue/main.yml

@@ -6,7 +6,7 @@ parameters:
     default: cimg/base:2026.03
   c-rust_base_image:
     type: string
-    default: us-docker.pkg.dev/oplabs-tools-artifacts/images/ci-base-clang@sha256:758f67c7212e7d05c3d02c34f26766ef86f657d3bb811da07cc01e37b736ebef
+    default: us-docker.pkg.dev/oplabs-tools-artifacts/images/ci-base-clang@sha256:873a6709dd48d7706b0baee139300f18ab7babf4a66f982b2383fe51ce2e5489
   c-base_image:
     type: string
     default: default
@@ -16,7 +16,7 @@ parameters:
   # go-cache-version can be used as a cache buster when making breaking changes to caching strategy
   c-go-cache-version:
     type: string
-    default: "v0.0"
+    default: "v0.1"
   c-publish_contract_artifacts_ref:
     type: string
     default: ""
@@ -28,7 +28,7 @@ parameters:
     default: cimg/base:2026.03
   rust_base_image:
     type: string
-    default: us-docker.pkg.dev/oplabs-tools-artifacts/images/ci-base-clang@sha256:d79c625a042269c64b2444ef1edf9bb4a399d1c892caee57f9021be067da5617
+    default: us-docker.pkg.dev/oplabs-tools-artifacts/images/ci-base-clang@sha256:873a6709dd48d7706b0baee139300f18ab7babf4a66f982b2383fe51ce2e5489
   base_image:
     type: string
     default: default
@@ -85,7 +85,7 @@ parameters:
     default: "__not_set__"
   go-cache-version:
     type: string
-    default: "v0.0"
+    default: "v0.1"
   # Workflow activation flags (set by the decision tree in config.yml)
   c-run_main:
     type: boolean
@@ -505,6 +505,13 @@ commands:
         description: "Prefix to add to the cache key"
         type: string
         default: "rust-build"
+      init_superchain_submodule:
+        # Unused by this command. Declared so a job can pass one shared YAML anchor
+        # to both rust-prepare-and-restore-cache (which acts on it) and this command
+        # without CircleCI rejecting an undeclared parameter.
+        description: "Unused; accepted for shared-anchor compatibility."
+        type: boolean
+        default: false
     steps:
       # Surface sccache hit/write stats at job end. Harmless no-op when sccache
       # is absent; confirms the GCS cache is hit rather than silently failing.
@@ -555,10 +562,23 @@ commands:
         description: "Whether to set up the sccache GCS compile cache (see rust-prepare)."
         type: boolean
         default: true
+      init_superchain_submodule:
+        # Default true: most rust jobs build op-reth's chainspec, whose build.rs
+        # regenerates the gitignored superchain archive from this submodule. Only
+        # no-build lint jobs (fmt/typos/deny/zepter/no-std) opt out with false.
+        description: "Init the superchain-registry submodule (op-reth chainspec's build.rs reads it)."
+        type: boolean
+        default: true
     steps:
       - rust-prepare:
           needs_clang: << parameters.needs_clang >>
           enable_sccache: << parameters.enable_sccache >>
+      - when:
+          condition: << parameters.init_superchain_submodule >>
+          steps:
+            - run:
+                name: Initialize superchain-registry submodule
+                command: just update-superchain-registry-submodule
       - rust-restore-build-cache:
           version: << parameters.version >>
           directory: << parameters.directory >>
@@ -755,6 +775,15 @@ jobs:
     steps:
       - utils/checkout-with-mise:
           checkout-method: blobless
+      # These vendored workspaces path-depend on op-reth, whose chainspec build.rs
+      # regenerates the gitignored superchain archive from this submodule. Unlike
+      # rust-build (which goes through rust-prepare-and-restore-cache), this command
+      # never restores it, so on a binary cache miss the build below panics with
+      # "superchain-registry submodule not found". Init it up front; idempotent and
+      # cheap on a cache hit (the build short-circuits before touching it).
+      - run:
+          name: Initialize superchain-registry submodule
+          command: just update-superchain-registry-submodule
       # Wrap the cargo build with sccache (sets RUSTC_WRAPPER). Fail-open: if the
       # cache is unavailable the build just runs uncached. Only helps on a binary
       # cache miss (a hit short-circuits the build below).
@@ -881,10 +910,6 @@ jobs:
           command: |
             mkdir -p ./tmp/test-results
             mkdir -p ./tmp/testlogs
-      - run:
-          name: build Cannon example binaries
-          command: just elf # only compile ELF binaries with Go, we do not have MIPS GCC for creating the debug-dumps.
-          working_directory: cannon/testdata
       - run:
           name: Cannon Go lint
           command: |
@@ -1666,15 +1691,17 @@ jobs:
           checkout-method: blobless
           enable-mise-cache: true
       - run:
+          # sync-superchain-go runs in refresh mode: it regenerates the bundle AND
+          # rewrites the .sha256, so the diff check below is meaningful.
           name: build superchain bundle
-          command: just sync-superchain
+          command: just sync-superchain-go
       - run:
           # Catches non-deterministic builds and stale .sha256 commits: if the
           # rebuilt zip differs from what was approved in review, the .sha256
           # file written by sync-superchain.sh will diverge from the committed
-          # one and this fails. The init.go runtime checks (SHA256 of embedded
-          # zip, COMMIT entry, op-geth cross-commit) run as part of go-tests
-          # downstream — no need to repeat them here.
+          # one and this fails. The init.go runtime check (SHA256 of the embedded
+          # zip against the committed .sha256) runs as part of go-tests
+          # downstream — no need to repeat it here.
           name: verify rebuilt bundle matches committed .sha256
           command: git diff --exit-code op-core/superchain/superchain-configs.zip.sha256
       - persist_to_workspace:
@@ -1849,6 +1876,10 @@ jobs:
           at: .
       - go-restore-cache:
           namespace: go-tests-with-fault-proof-deps
+      # Build the superchain-configs.zip op-e2e/faultproofs //go:embeds (no prep-superchain job here).
+      - run:
+          name: Build superchain bundle
+          command: just build-superchain-go
       - run:
           name: build cannon
           command: just cannon
@@ -2447,6 +2478,8 @@ workflows:
       - fuzz-golang:
           name: fuzz-golang-<<matrix.package_name>>
           on_changes: <<matrix.package_name>>
+          # attaches prep-superchain's superchain-configs.zip, which several of these packages //go:embed.
+          uses_artifacts: true
           matrix:
             parameters:
               package_name:
@@ -2456,6 +2489,7 @@ workflows:
                 - op-chain-ops
           requires:
             - prep-go-modules
+            - prep-superchain
           context:
             - circleci-repo-readonly-authenticated-github-token
       - fuzz-golang:
@@ -2479,6 +2513,8 @@ workflows:
             - contracts-bedrock-build
             - cannon-prestate
             - prep-go-modules
+            # for the gitignored superchain-configs.zip op-e2e //go:embeds
+            - prep-superchain
       - go-tests:
           name: go-tests-short
           parallelism: 12
@@ -2614,6 +2650,8 @@ workflows:
             - rust-binaries-for-sysgo
             - go-binaries-for-sysgo
             - prep-go-modules
+            # for the gitignored superchain-configs.zip op-acceptance-tests //go:embeds
+            - prep-superchain
       # IN-MEMORY - op-node/op-reth
       - op-acceptance-tests:
           name: memory-all-opn-op-reth
@@ -2631,6 +2669,8 @@ workflows:
             - rust-binaries-for-sysgo
             - go-binaries-for-sysgo
             - prep-go-modules
+            # for the gitignored superchain-configs.zip op-acceptance-tests //go:embeds
+            - prep-superchain
       # IN-MEMORY - kona/op-reth
       - op-acceptance-tests:
           name: memory-all-kona-op-reth
@@ -2649,6 +2689,8 @@ workflows:
             - rust-binaries-for-sysgo
             - go-binaries-for-sysgo
             - prep-go-modules
+            # for the gitignored superchain-configs.zip op-acceptance-tests //go:embeds
+            - prep-superchain
       # Gate job - single stable job used as GitHub required status check for develop.
       # Uses terminal requires so it always runs (even when deps fail), giving the
       # merge queue an immediate failure signal instead of a timeout.