Fix/forking merge main

.github/Dockerfile

@@ -25,7 +25,7 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive && \
 	libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 \
 	libxss1 libxtst6 lsb-release wget xdg-utils \
 	# Additional tools
-	gh libgmp3-dev software-properties-common curl git unzip bc \
+	gh libgmp3-dev curl git unzip bc \
 	debian-keyring debian-archive-keyring apt-transport-https \
 	# LLVM dependencies
 	llvm-19 llvm-19-dev llvm-19-runtime clang-19 clang-tools-19 \
@@ -117,9 +117,18 @@ ENV PATH="$ASDF_DATA_DIR/shims:$PATH"
 RUN asdf plugin add scarb && asdf install scarb 2.8.2 && asdf set scarb 2.8.2
 
 # Install caddy
-RUN curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg && \
-	curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-stable.list && \
-	apt update && apt install caddy && rm -rf /var/lib/apt/lists/*
+ARG TARGETPLATFORM
+RUN if [ "$TARGETPLATFORM" = "linux/arm64" ] ; then \
+	curl -L https://github.com/caddyserver/caddy/releases/download/v2.10.0/caddy_2.10.0_linux_arm64.tar.gz -o caddy.tar.gz && \
+	tar -xzf caddy.tar.gz caddy && \
+	mv caddy /usr/local/bin/ && \
+	rm caddy.tar.gz; \
+	elif [ "$TARGETPLATFORM" = "linux/amd64" ] ; then \
+	curl -L https://github.com/caddyserver/caddy/releases/download/v2.10.0/caddy_2.10.0_linux_amd64.tar.gz -o caddy.tar.gz && \
+	tar -xzf caddy.tar.gz caddy && \
+	mv caddy /usr/local/bin/ && \
+	rm caddy.tar.gz; \
+	fi
 
 # Set permissions
 RUN chown -R root:root /usr/local/cargo && chmod -R 700 /usr/local/cargo

.github/workflows/build-and-push-docker.yml

@@ -14,8 +14,8 @@ on:
       - ".github/Dockerfile"
 
 env:
-  RUST_VERSION: 1.86.0
-  CLIPPY_VERSION: nightly-2025-02-20
+  RUST_VERSION: 1.89.0
+  CLIPPY_VERSION: nightly-2025-06-20
 
 jobs:
   # Docker tag determination based on workflow trigger:

.github/workflows/dockerfile-build-test.yml

@@ -6,8 +6,8 @@ on:
       - ".github/Dockerfile"
 
 env:
-  RUST_VERSION: 1.86.0
-  CLIPPY_VERSION: nightly-2025-02-20
+  RUST_VERSION: 1.89.0
+  CLIPPY_VERSION: nightly-2025-06-20
 
 jobs:
   build-dev-image:

.github/workflows/release-dispatch.yml

@@ -71,5 +71,5 @@ jobs:
           title: "release(prepare): v${{ steps.version_info.outputs.version }}"
           commit-message: "release(prepare): v${{ steps.version_info.outputs.version }}"
           branch: prepare-release
-          base: main
+          base: ${{ github.ref_name }}
           delete-branch: true

.github/workflows/release-tee.yml

@@ -0,0 +1,125 @@
+name: release-tee
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g., v1.7.0). If empty, uses version from Cargo.toml"
+        type: string
+        required: false
+
+env:
+  CARGO_TERM_COLOR: always
+
+permissions:
+  id-token: write      # OIDC token for Sigstore signing
+  attestations: write  # Persist attestations
+  contents: write      # Release artifact upload
+
+jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      tag_name: ${{ steps.release_info.outputs.tag_name }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get version
+        id: release_info
+        run: |
+          if [[ -n "${{ github.event.inputs.tag }}" ]]; then
+            echo "tag_name=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
+          else
+            cargo install cargo-get
+            echo "tag_name=v$(cargo get workspace.package.version)" >> $GITHUB_OUTPUT
+          fi
+
+  build-contracts:
+    runs-on: ubuntu-latest
+    needs: prepare
+    container:
+      image: ghcr.io/dojoengine/katana-dev:latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build contracts
+        run: make contracts
+      - name: Upload contract artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: contract-artifacts
+          path: ./crates/contracts/build
+          retention-days: 1
+
+  reproducible-build:
+    name: Reproducible TEE Build
+    needs: [prepare, build-contracts]
+    runs-on: ubuntu-latest-8-cores
+    outputs:
+      binary-hash: ${{ steps.hash.outputs.sha384 }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download contract artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: contract-artifacts
+          path: ./crates/contracts/build
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build reproducible binary
+        run: |
+          docker build \
+            -f reproducible.Dockerfile \
+            -t katana-reproducible:${{ needs.prepare.outputs.tag_name }} \
+            --build-arg SOURCE_DATE_EPOCH=$(git log -1 --format=%ct) \
+            --no-cache \
+            .
+
+      - name: Extract binary from container
+        run: |
+          docker create --name katana-extract katana-reproducible:${{ needs.prepare.outputs.tag_name }}
+          docker cp katana-extract:/katana ./katana-reproducible
+          docker rm katana-extract
+
+      - name: Calculate binary hash
+        id: hash
+        run: |
+          SHA384=$(sha384sum ./katana-reproducible | cut -d ' ' -f 1)
+          echo "sha384=${SHA384}" >> $GITHUB_OUTPUT
+          echo "Binary SHA-384: ${SHA384}"
+
+      - name: Archive reproducible binary
+        env:
+          VERSION_NAME: ${{ needs.prepare.outputs.tag_name }}
+        run: |
+          tar -czvf "katana_${VERSION_NAME}_linux_amd64_tee.tar.gz" katana-reproducible
+          sha384sum katana-reproducible > "katana_${VERSION_NAME}_linux_amd64_tee.sha384"
+
+      - name: Generate build provenance attestation
+        id: attest
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: ./katana-reproducible
+
+      - name: Upload release artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: tee-release-artifacts
+          path: |
+            katana_${{ needs.prepare.outputs.tag_name }}_linux_amd64_tee.tar.gz
+            katana_${{ needs.prepare.outputs.tag_name }}_linux_amd64_tee.sha384
+
+      - name: Summary
+        run: |
+          echo "## TEE Reproducible Build Complete" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Version:** ${{ needs.prepare.outputs.tag_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "**SHA-384:** \`${{ steps.hash.outputs.sha384 }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Verify Attestation" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
+          echo "gh attestation verify ./katana-reproducible --repo ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

.github/workflows/release.yml

@@ -10,6 +10,7 @@ on:
     types: [closed]
     branches:
       - main
+      - "release/**"
 
 env:
   RUST_VERSION: 1.86.0
@@ -98,16 +99,6 @@ jobs:
             arch: arm64
             svm_target_platform: linux-aarch64
             native_build: false
-          - os: macos-13
-            platform: darwin
-            target: x86_64-apple-darwin
-            arch: amd64
-            native_build: true
-          - os: macos-13
-            platform: darwin
-            target: x86_64-apple-darwin
-            arch: amd64
-            native_build: false
           - os: macos-latest-xlarge
             platform: darwin
             target: aarch64-apple-darwin

.github/workflows/test.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - "release/**"
     paths:
       - "Cargo.toml"
       - "bin/**/*.rs"
@@ -214,42 +215,43 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: lcov.info
 
-  snos-integration-test:
-    needs: [fmt, clippy]
-    runs-on: ubuntu-latest-32-cores
-    timeout-minutes: 30
-    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false)
-    container:
-      image: ghcr.io/dojoengine/katana-dev:latest
-    env:
-      MLIR_SYS_190_PREFIX: /usr/lib/llvm-19/
-      LLVM_SYS_191_PREFIX: /usr/lib/llvm-19/
-      TABLEGEN_190_PREFIX: /usr/lib/llvm-19/
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          submodules: recursive
-      # Workaround for https://github.com/actions/runner-images/issues/6775
-      - run: git config --global --add safe.directory "*"
-
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: ci-${{ github.job }}
-          shared-key: katana-ci-cache
-
-      - name: Download test artifacts
-        uses: actions/download-artifact@v5
-        with:
-          name: test-artifacts
-
-      - name: Prepare SNOS test environment
-        run: |
-          if [ ! -d "./tests/snos/snos/build" ]; then
-            make snos-artifacts
-          fi
-
-      - run: |
-          cargo run -p snos-integration-test
+  # TODO: re-enable once the snos crate is added back to the workspace
+  # snos-integration-test:
+  #   needs: [fmt, clippy]
+  #   runs-on: ubuntu-latest-32-cores
+  #   timeout-minutes: 30
+  #   if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.draft == false)
+  #   container:
+  #     image: ghcr.io/dojoengine/katana-dev:latest
+  #   env:
+  #     MLIR_SYS_190_PREFIX: /usr/lib/llvm-19/
+  #     LLVM_SYS_191_PREFIX: /usr/lib/llvm-19/
+  #     TABLEGEN_190_PREFIX: /usr/lib/llvm-19/
+  #   steps:
+  #     - uses: actions/checkout@v3
+  #       with:
+  #         submodules: recursive
+  #     # Workaround for https://github.com/actions/runner-images/issues/6775
+  #     - run: git config --global --add safe.directory "*"
+
+  #     - uses: Swatinem/rust-cache@v2
+  #       with:
+  #         key: ci-${{ github.job }}
+  #         shared-key: katana-ci-cache
+
+  #     - name: Download test artifacts
+  #       uses: actions/download-artifact@v5
+  #       with:
+  #         name: test-artifacts
+
+  #     - name: Prepare SNOS test environment
+  #       run: |
+  #         if [ ! -d "./tests/snos/snos/build" ]; then
+  #           make snos-artifacts
+  #         fi
+
+  #     - run: |
+  #         cargo run -p snos-integration-test
 
   explorer-reverse-proxy:
     needs: [fmt, clippy, build-katana-binary]
@@ -344,7 +346,7 @@ jobs:
 
   db-compatibility-check:
     needs: [fmt, clippy, build-katana-binary]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-4-cores
     container:
       image: ghcr.io/dojoengine/katana-dev:latest
     steps:

.gitignore

@@ -37,7 +37,6 @@ tests/fixtures/db/*
 
 crates/contracts/build/
 !crates/contracts/build/legacy/
-CONTEXT.md
 
 **/.claude/settings.local.json
 .cargo/