Merge upstream 20260430

.github/actions/prepare/action.yml

@@ -1,10 +1,6 @@
 name: 'Prepare Halo 2'
-description: 'Sets up the Rust toolchain and prepares feature flags'
+description: 'Prepares feature flags'
 inputs:
-  toolchain:
-    description: 'Rust toolchain to use (defaults to MSRV)'
-    required: false
-    default: 1.60.0
   beta-features:
     description: 'Include beta features'
     required: false
@@ -24,10 +20,6 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    - uses: actions-rs/toolchain@v1
-      with:
-        toolchain: ${{ inputs.toolchain }}
-        override: true
     - id: beta
       shell: bash
       run: echo "feature=beta" >> $GITHUB_OUTPUT

.github/workflows/bench.yml

@@ -13,7 +13,9 @@
     name: Performance regression check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare
       - name: Run benchmark
         run: cargo bench -- --output-format bencher | tee output.txt

.github/workflows/book.yml

@@ -1,71 +1,61 @@
-#name: halo2 book
-#
-#on:
-#  push:
-#    branches:
-#      - main
-#
-#jobs:
-#  deploy:
-#    runs-on: ubuntu-latest
-#    steps:
-#      - uses: actions/checkout@v3
-#      - uses: actions-rs/toolchain@v1
-#        with:
-#          toolchain: '1.76.0'
-#          override: true
-#
-#      # - name: Setup mdBook
-#      #   uses: peaceiris/actions-mdbook@v1
-#      #   with:
-#      #     mdbook-version: 'latest'
-#
-#      # mdBook for mdbook-pdf compatibility by fixing broken links in print.html
-#      # Waiting for https://github.com/rust-lang/mdBook/pull/1738 to get merged
-#      - name: Install patched mdbook
-#        uses: actions-rs/cargo@v1
-#        with:
-#          command: install
-#          args: mdbook --git https://github.com/HollowMan6/mdBook.git --rev 5830c9555a4dc051675d17f1fcb04dd0920543e8
-#
-#      - name: Install mdbook-katex and mdbook-pdf
-#        uses: actions-rs/cargo@v1
-#        with:
-#          command: install
-#          args: mdbook-katex mdbook-pdf
-#
-#      - name: Install mdbook-pdf-outline
-#        run: pip3 install mdbook-pdf-outline
-#
-#      - name: Build halo2 book
-#        run: mdbook build book/
-#
-#      - uses: actions-rs/toolchain@v1
-#        with:
-#          toolchain: nightly-2023-10-05 
-#          override: true
-#
-#      - name: Build latest rustdocs
-#        uses: actions-rs/cargo@v1
-#        with:
-#          command: doc
-#          args: --no-deps --workspace --all-features
-#        env:
-#          RUSTDOCFLAGS: -Z unstable-options --enable-index-page --cfg docsrs --html-in-header ${{ github.workspace }}/halo2_proofs/katex-header.html
-#
-#      - name: Move latest rustdocs into book
-#        run: |
-#          mkdir -p ./book/book/html/rustdoc
-#          mv ./target/doc ./book/book/html/rustdoc/latest
-#
-#      - name: Deploy to GitHub Pages
-#        uses: peaceiris/actions-gh-pages@v3
-#        with:
-#          github_token: ${{ secrets.GITHUB_TOKEN }}
-#          publish_dir: ./book/book/html
-#
-#      - name: Upload PDF File to Artifact
-#        uses: actions/upload-artifact@v3
-#        with:
-#          name: The_halo2_Book
-#          path: book/book/pdf-outline/*.pdf
+name: halo2 book
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@nightly
+        id: toolchain
+      - run: rustup override set "${TOOLCHAIN}"
+        shell: sh
+        env:
+          TOOLCHAIN: ${{steps.toolchain.outputs.name}}
+
+      - name: Setup mdBook
+        uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
+        with:
+          mdbook-version: '0.5.1'
+
+      - name: Install mdbook-katex and mdbook-pdf
+        run: cargo install mdbook-katex@0.10.0-alpha mdbook-pdf
+
+      - name: Install mdbook-pdf-outline
+        run: pip3 install mdbook-pdf-outline
+
+      - name: Build halo2 book
+        run: mdbook build book/
+
+      - run: sudo apt-get -y install libfontconfig1-dev
+      - name: Build latest rustdocs
+        run: >
+          cargo doc
+          --no-deps
+          --workspace
+          --all-features
+        env:
+          RUSTDOCFLAGS: -Z unstable-options --enable-index-page --cfg docsrs --html-in-header ${{ github.workspace }}/halo2_proofs/katex-header.html
+
+      - name: Move latest rustdocs into book
+        run: |
+          mkdir -p ./book/book/html/rustdoc
+          mv ./target/doc ./book/book/html/rustdoc/latest
+
+      - name: Deploy to GitHub Pages
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./book/book/html
+
+      - name: Upload PDF File to Artifact
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: The_halo2_Book
+          path: book/book/pdf-outline/*.pdf

.github/workflows/ci.yml

@@ -1,6 +1,11 @@
 name: CI checks
 
-on: [push, pull_request]
+on:
+  pull_request:
+  push:
+    branches: main
+
+permissions: {}
 
 jobs:
   test:
@@ -20,19 +25,21 @@
             extra_flags: --features nightly
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - id: prepare
         uses: ./.github/actions/prepare
       - name: Run tests
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: >
-            --verbose
-            --release
-            --workspace
-            ${{ steps.prepare.outputs.feature-flags }}
-            ${{ matrix.extra_flags }}
+        run: >
+          cargo test
+          --verbose
+          --release
+          --workspace
+          ${{ steps.prepare.outputs.feature-flags }}
+          ${{ matrix.extra_flags }}
+      - name: Verify working directory is clean
+        run: git diff --exit-code
 
   test-32-bit:
     name: Test on i686-unknown-linux-gnu${{ matrix.name_suffix }}
@@ -47,7 +54,9 @@
             name_suffix: " with nightly features"
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - id: prepare
         uses: ./.github/actions/prepare
         with:
@@ -75,7 +84,9 @@
           - wasm32-wasi
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - id: prepare
         uses: ./.github/actions/prepare
         with:
@@ -84,108 +95,103 @@
       - name: Add target
         run: rustup target add ${{ matrix.target }}
       - name: cargo build
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: >
-            ${{ steps.prepare.outputs.feature-flags }}
-            --target ${{ matrix.target }}
+        run: >
+          cargo build
+          ${{ steps.prepare.outputs.feature-flags }}
+          --target ${{ matrix.target }}
 
   bitrot:
     name: Bitrot check
     runs-on: ubuntu-latest
-
     steps:
-      - uses: actions/checkout@v3
-      - run: sudo apt-get -y install libfontconfig1-dev
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/prepare
       # Check bitrot with stable (as we don't need benchmarks or the test-dev-graph
       # feature flag to work with MSRV).
-      - uses: ./.github/actions/prepare
-        with:
-          toolchain: stable
+      - uses: dtolnay/rust-toolchain@stable
+        id: toolchain
+      - run: rustup override set "${TOOLCHAIN}"
+        shell: sh
+        env:
+          TOOLCHAIN: ${{steps.toolchain.outputs.name}}
       - run: sudo apt-get -y install libfontconfig1-dev
       # Build benchmarks and all-features to prevent bitrot
       - name: Build benchmarks
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --benches --examples --all-features
+        run: cargo build --benches --examples --all-features
 
   book:
     name: Book tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare
+      # Build with stable so the .rmeta files match what mdBook expects.
+      - uses: dtolnay/rust-toolchain@stable
+        id: toolchain
+      - run: rustup override set "${TOOLCHAIN}"
+        shell: sh
+        env:
+          TOOLCHAIN: ${{steps.toolchain.outputs.name}}
       - name: cargo build
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
+        run: cargo build
       - name: Setup mdBook
-        uses: peaceiris/actions-mdbook@v1
+        uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
         with:
-          mdbook-version: '0.4.5'
+          mdbook-version: '0.5.1'
       - name: Test halo2 book
         run: mdbook test -L target/debug/deps book/
 
   codecov:
     name: Code coverage
     runs-on: ubuntu-latest
-
+    container:
+      image: xd009642/tarpaulin:develop-nightly
+      options: --security-opt seccomp=unconfined
     steps:
-      - uses: actions/checkout@v3
-      # Use stable for this to ensure that cargo-tarpaulin can be built.
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - id: prepare
         uses: ./.github/actions/prepare
         with:
-          toolchain: stable
           nightly-features: true
-      - name: Install cargo-tarpaulin
-        uses: actions-rs/cargo@v1
-        with:
-          command: install
-          args: cargo-tarpaulin
+      # Extend the timeout to 3600 to ensure the code coverage test pass
       - name: Generate coverage report
-        uses: actions-rs/cargo@v1
-        with:
-          command: tarpaulin
-          # Extend the timeout to 3600 to ensure the code coverage test pass
-          args: >
-            ${{ steps.prepare.outputs.feature-flags }}
-            --timeout 3600
-            --out Xml
+        run: >
+          cargo tarpaulin
+          --engine llvm
+          ${{ steps.prepare.outputs.feature-flags }}
+          --timeout 3600
+          --out xml
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v3.1.4
 
   doc-links:
     name: Intra-doc links
     runs-on: ubuntu-latest
-
     steps:
-      - uses: actions/checkout@v3
-      - uses: ./.github/actions/prepare
-      - name: cargo fetch
-        uses: actions-rs/cargo@v1
+      - uses: actions/checkout@v5
         with:
-          command: fetch
-
+          persist-credentials: false
+      - uses: ./.github/actions/prepare
+      - run: sudo apt-get -y install libfontconfig1-dev
+      - run: cargo fetch
       # Ensure intra-documentation links all resolve correctly
       # Requires #![deny(intra_doc_link_resolution_failure)] in crates.
       - name: Check intra-doc links
-        uses: actions-rs/cargo@v1
-        with:
-          command: doc
-          args: --all --document-private-items
+        run: cargo doc --all --all-features --document-private-items
 
   fmt:
     name: Rustfmt
     timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: ./.github/actions/prepare
-      - run: rustup component add rustfmt
-      - uses: actions-rs/cargo@v1
+      - uses: actions/checkout@v5
         with:
-          command: fmt
-          args: --all -- --check
+          persist-credentials: false
+      - uses: ./.github/actions/prepare
+      - run: cargo fmt --all -- --check