🤖 [claude] Firehose series on upstream develop 049d306 (fork-recovery memory fix)

.github/workflows/ci.yml

@@ -1,6 +1,10 @@
 name: Continuous Integration
 
+env:
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+
 on:
+  workflow_dispatch:
   push:
     branches:
       - "**"
@@ -14,6 +18,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      # Git dependencies pinned to the private pinax-network org (if any) need a
+      # read token; the rewrite is scoped to that prefix so public fetches stay
+      # anonymous. Unused when nothing is pinned there.
+      - name: Configure git credentials for private crates
+        run: git config --global url."https://x-access-token:${{ secrets.PAT_INTERNAL_REPOSITORIES }}@github.com/pinax-network/".insteadOf "https://github.com/pinax-network/"
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y liburing-dev pkg-config libclang-dev
       - uses: actions-rs/toolchain@v1
@@ -29,6 +38,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      # Git dependencies pinned to the private pinax-network org (if any) need a
+      # read token; the rewrite is scoped to that prefix so public fetches stay
+      # anonymous. Unused when nothing is pinned there.
+      - name: Configure git credentials for private crates
+        run: git config --global url."https://x-access-token:${{ secrets.PAT_INTERNAL_REPOSITORIES }}@github.com/pinax-network/".insteadOf "https://github.com/pinax-network/"
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y liburing-dev pkg-config libclang-dev
       - uses: actions-rs/toolchain@v1
@@ -45,6 +59,11 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
+      # Git dependencies pinned to the private pinax-network org (if any) need a
+      # read token; the rewrite is scoped to that prefix so public fetches stay
+      # anonymous. Unused when nothing is pinned there.
+      - name: Configure git credentials for private crates
+        run: git config --global url."https://x-access-token:${{ secrets.PAT_INTERNAL_REPOSITORIES }}@github.com/pinax-network/".insteadOf "https://github.com/pinax-network/"
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y liburing-dev pkg-config libclang-dev
       - uses: actions-rs/toolchain@v1
@@ -62,6 +81,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      # Git dependencies pinned to the private pinax-network org (if any) need a
+      # read token; the rewrite is scoped to that prefix so public fetches stay
+      # anonymous. Unused when nothing is pinned there.
+      - name: Configure git credentials for private crates
+        run: git config --global url."https://x-access-token:${{ secrets.PAT_INTERNAL_REPOSITORIES }}@github.com/pinax-network/".insteadOf "https://github.com/pinax-network/"
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y liburing-dev pkg-config libclang-dev
       - uses: actions-rs/toolchain@v1

.github/workflows/lockfile.yml

@@ -0,0 +1,55 @@
+# Keeps Cargo.lock consistent on the Firehose branches without a local Rust
+# toolchain: after a rebase of the Firehose series onto a new upstream commit the
+# lockfile is taken from upstream and lacks the Firehose crates' entries. This
+# job runs `cargo fetch`, which adds/updates only what the manifests require
+# (unlike `cargo generate-lockfile`, it does not re-resolve unrelated deps), and
+# commits the result back to the branch. The commit is made with the default
+# GITHUB_TOKEN, which does not trigger push workflows, so this cannot loop; the
+# job therefore dispatches ci.yml and the Docker build explicitly so the repaired
+# lockfile is the commit that gets verified, not the stale one before it.
+#
+# Reth crates are pinned by tag, so `cargo fetch` can only add entries for new
+# dependencies; it cannot move the reth layer to a different commit.
+name: Update Cargo.lock
+
+on:
+  push:
+    branches:
+      - "release/**"
+    paths:
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - "**/Cargo.toml"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  actions: write
+
+jobs:
+  lockfile:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref_name }}
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Resolve lockfile
+        run: cargo fetch --locked || cargo fetch
+      - name: Commit if changed
+        run: |
+          if git diff --quiet -- Cargo.lock; then echo "Cargo.lock already consistent"; exit 0; fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add Cargo.lock
+          git commit -m "Update Cargo.lock for the Firehose crates" -m "Generated by .github/workflows/lockfile.yml (cargo fetch) after the Firehose series was rebased."
+          git push origin HEAD:${{ github.ref_name }}
+          echo "pushed=true" >> "$GITHUB_OUTPUT"
+        id: commit
+      - name: Verify the repaired lockfile
+        if: steps.commit.outputs.pushed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh workflow run ci.yml --ref "${{ github.ref_name }}"
+          gh workflow run sf-release.yml --ref "${{ github.ref_name }}"