build(solidity): remove external sortition dependencies - #4330
Merged
Merged
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…shes artifactSha256 in VENDOR.json records the pristine pre-stripping upstream hash by design, so it can't detect tampering with the 11 committed deployment artifact JSONs. Add committedSha256 alongside it and a new CI job that checks the committed files against those hashes. Also inline the LC_ALL=C sort step in the export-byte-identity regenerate message, which previously omitted it and would reproduce the exact ordering bug this PR fixed elsewhere.
The three vendored Thesis interfaces (IApproveAndCall, IERC20WithPermit, IReceiveApproval) only had a bare interfaces.revision, unlike the nine sortition sources which get a per-file sourceSha256 entry. Add the matching interfaceSha256 map to both packages' VENDOR.json copies.
tasks/initialize.ts now imports the vendored .js task files by relative path, which base tsconfig.json (unlike tsconfig.export.json) can't resolve without allowJs, so tsc --noEmit / IDE tooling using the base config reports TS2307.
…on-export README The Source section claimed all bundled deploy scripts are TypeScript- compiled output, while Format and Regeneration policy correctly carve out the hand-written 05_approve_random_beacon_in_token_staking.js.
…-dependency Resolve conflicts from the ethers v6 migration, ESLint 10 flat configs, Prettier 3, Solhint 6, and TypeScript 6 changes on dev: - .prettierignore: keep PR's legacy/ ignores + dev's .hardhat/ and export/ - .eslintignore: deleted (dev moved to ESLint 10 flat config); add tasks/legacy-random-beacon/ to eslint.config.mjs ignores instead - package.json: keep PR's removal of @keep-network/random-beacon and @keep-network/sortition-pools from dependencies; add dev's types/ and utils/ to files array - hardhat.config.ts: use dev's resolveRandomBeaconExport module import and setupTenderly call; keep PR's spread (no npm fallback) for development deployments; keep dev's typechain ethers-v6 target - utils/random-beacon-export.ts: remove npm package fallback for artifacts (PR removed the package; bundled copy is the only fallback) - tasks/index.ts: remove legacy-random-beacon/unlock-eth-accounts import (dev's random-beacon.ts module already loads it via the resolver) - tasks/initialize.ts: use dev's import from ./random-beacon module instead of direct legacy JS imports - tsconfig.json: take dev's strict config (allowJs no longer needed) - export-baseline.sha256: keep PR's structure; regenerate after merge - yarn.lock: regenerated for both packages (removes sortition-pools) - npm-random-beacon.yml: take dev's yarn install --immutable (PR's solidity-contracts pin no longer needed; ethers v6 precheck is in TS) - README.md: merge PR's frozen snapshot description with dev's ethers v6/ES2020 regeneration instructions
- Update resolveRandomBeaconExport tests: artifacts now resolve from the bundled copy (npm package was removed by the PR); the real-checkout test accepts either sibling or bundled path, just not node_modules - Regenerate solidity/ecdsa/external/random-beacon-export/ deploy scripts and tasks from random-beacon prepack output (ES2020/ethers v6 from dev migration, replacing the PR's frozen ES5 scripts) - Regenerate export-baseline.sha256 for both packages after the dev merge (Prettier 3, ESLint 10, Solhint 6, ethers v6, TypeScript 6 changes altered artifact hashes) - Update bundled-beacon-export-freshness CI check to exclude LICENSE, VENDOR.json, and artifacts/ from the diff (PR added these frozen provenance files to the bundle alongside the deploy scripts)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remove
@keep-network/sortition-poolsfrom both Solidity packages and lockfiles while preserving the legacy implementations still needed by the source tree, fixtures, and deployment replay.Freeze the nine runtime sortition sources plus their three Thesis interfaces under
contracts/legacy/, with licenses, original package metadata, source revisions, and hashes. The runtime sources in the previously resolved 2.0.0 and 2.0.0-pre.16 packages are identical; only local import paths change.ECDSA's published Random Beacon dependency also reintroduced sortition transitively. Replace it with the seven required support sources, initialization tasks, and eleven frozen deployment artifacts from its existing 2.1.0-dev.18 dependency. Preserve the already-corrected deployment scripts. Package the compatibility files explicitly and remove CI steps that could reinstall sortition, including the old test-fork override. Keep the existing dependency exclusions in lint/Slither for the relocated frozen files.
Testnet SortitionPool deploys now run unmodified production 2.0.0 logic instead of the removed
test-forkoverride, which had been tweaked to bypass the chaosnet beta-operator gate (Chaosnet.sol'sisChaosnetActive/isBetaOperatorcheck, enforced inSortitionPool.sol's operator-insertion path) for easier operator onboarding. TheaddBetaOperatortask is the existing onboarding path for that gate on both testnet and mainnet: it already calledsortitionPool.chaosnetOwner()+addBetaOperators([operator])before this PR and is already wired into the standard initialize task flow, just imported from the vendored copy instead of the npm package now. It is not new to this PR, but testnets that previously bypassed the gate via the fork must now go through it like mainnet does.Validation:
LC_ALL=C sort); all artifact hashes already match between local and CI output. The tracked ECDSA mainnetexport.jsonand historical deployment records are unchanged.This removes external legacy dependencies, not historical ABI/deployment compatibility. The frozen code is not a statement about the live protocol's operator-selection mechanism. Downstream packages still pinned to older npm releases need producer releases and consumer lockfile updates to remove their remaining transitive copies.
Supersedes #4328, including its unused direct Thesis dependency removal.