v0.8.0 — inline script evaluation, derived memory budget, full mining candidates

.github/workflows/fmt.yml

@@ -0,0 +1,50 @@
+name: fmt
+
+# Gate formatting on every push and PR.
+#
+# Added 2026-08-13 with the first workspace-wide `cargo fmt` pass. Before that
+# nothing enforced formatting and 831 diffs had accumulated across every crate —
+# drift that is invisible until someone runs the command, and then arrives as a
+# 90-file diff on top of whatever they were actually doing.
+#
+# Formatting only. Tests and clippy are deliberately NOT gated here: the
+# workspace carries a pre-existing enr-p2p doc-lint that would fail a strict
+# clippy gate on day one, and a test job needs submodules plus the sigma-rust
+# git dependencies, which is a slower and separate decision. A gate that fails
+# for reasons unrelated to the change gets ignored, and an ignored gate is worse
+# than none.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  rustfmt:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        # No `submodules:` — chain/, p2p/, state/ and store/ were absorbed into
+        # this repo in 35802a8 and are ordinary directories now. release.yml
+        # still passes submodules: true, which is a harmless no-op there.
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+
+      - name: Check workspace formatting
+        run: cargo fmt --all --check
+
+      # The addons are `exclude`d from the workspace with their own lockfiles,
+      # so `--all` above does not reach them. They were formatted in the same
+      # pass and are checked explicitly here — otherwise they are exactly the
+      # code that drifts again, being the part no workspace command touches.
+      - name: Check addon formatting
+        run: |
+          cargo fmt --manifest-path addons/fastsync/Cargo.toml --all --check
+          cargo fmt --manifest-path addons/indexer/Cargo.toml --all --check

.github/workflows/release.yml

@@ -5,21 +5,37 @@ name: release
 # and attaches both to a GitHub Release for the tag.
 
 on:
+  # Two ways in, and they must stay equivalent.
   push:
     tags:
       - 'v*'
+  # Merging a release/* PR into main releases what was merged. The tag is
+  # created by this workflow rather than by hand, so the tag and the merge
+  # cannot disagree about what shipped.
+  pull_request:
+    types: [closed]
 
 permissions:
-  contents: write   # required for creating the release + uploading assets
+  contents: write   # release + asset upload, and the tag push on the merge path
 
 jobs:
   build-and-release:
     runs-on: ubuntu-24.04
+    # A closed PR is not a merged one, and only release/* branches release.
+    # Without this the job would run on every closed PR, including abandoned
+    # ones.
+    if: >-
+      github.event_name == 'push' ||
+      (github.event.pull_request.merged == true &&
+       startsWith(github.event.pull_request.head.ref, 'release/'))
 
     steps:
       - name: Checkout (with submodules)
         uses: actions/checkout@v5
         with:
+          # On the merge path the PR ref is gone; take main, which now
+          # contains the merge commit.
+          ref: ${{ github.event_name == 'pull_request' && 'main' || github.ref }}
           # Top-level submodules only — fetches chain, p2p, state, store,
           # facts but NOT their nested facts/ pointers. The nested
           # facts/ submodules are docs read by per-submodule Claude
@@ -29,6 +45,65 @@ jobs:
           submodules: true
           fetch-depth: 0
 
+      # Resolves to the pushed tag on the tag path, or creates one from
+      # Cargo.toml on the merge path. Everything downstream reads
+      # steps.tag.outputs.name and does not care which path it came from.
+      - name: Resolve release tag
+        id: tag
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "push" ]; then
+            echo "name=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # Read the literal out of [workspace.package] — the one place it
+          # exists, since every member inherits it via version.workspace.
+          # Scoped to the section rather than "first ^version line": that was
+          # correct only by accident of section ordering, and this is the step
+          # that decides what gets tagged.
+          version=$(awk '
+              /^\[workspace\.package\]/ { in_section = 1; next }
+              /^\[/                     { in_section = 0 }
+              in_section && /^version[[:space:]]*=/ {
+                  match($0, /"[^"]*"/)
+                  print substr($0, RSTART + 1, RLENGTH - 2)
+                  exit
+              }
+          ' Cargo.toml)
+          if ! printf '%s' "$version" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
+            echo "::error::could not read a version from [workspace.package] in Cargo.toml (got '${version}')"
+            exit 1
+          fi
+          tag="v${version}"
+          if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
+            echo "::error::tag ${tag} already exists — bump the workspace version before merging a release branch"
+            exit 1
+          fi
+          # Annotated, with the CHANGELOG section as the message: the release
+          # body is sourced from the annotation further down, and a lightweight
+          # tag would leave it empty.
+          #
+          # Prefer the release's "### Release summary" subsection: one line per
+          # change, no reasoning, which is what belongs on a release page. The
+          # rest of the CHANGELOG entry is the durable record and reads as a
+          # wall of text there.
+          #
+          # Falls back to the whole section when that subsection is absent, so
+          # re-tagging any older release still produces the body it always did.
+          section=$(awk -v v="## ${tag}" '$0 ~ "^" v {f=1; next} /^## v/ {f=0} f' CHANGELOG.md)
+          notes=$(printf '%s\n' "$section" | awk '
+              /^### Release summary/ { f=1; next }
+              /^### / { f=0 }
+              f
+          ' | sed '/^$/d')
+          [ -z "$notes" ] && notes="$section"
+          [ -z "$notes" ] && notes="Release ${tag}"
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "${tag}" -m "${notes}"
+          git push origin "${tag}"
+          echo "name=${tag}" >> "$GITHUB_OUTPUT"
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
@@ -81,7 +156,7 @@ jobs:
           git fetch --tags --force
           {
             echo 'body<<EOF_TAG_BODY'
-            git tag -l --format='%(contents)' "${GITHUB_REF_NAME}"
+            git tag -l --format='%(contents)' "${{ steps.tag.outputs.name }}"
             echo 'EOF_TAG_BODY'
           } >> "$GITHUB_OUTPUT"