Merge branch 'main' into main

Author: Ayushjhax

.github/workflows/backtest.yml

@@ -1,21 +1,33 @@
-name: Replay Ledgers
+name: Backtest
 on:
   workflow_call:
     inputs:
-      coverage:
-        type: boolean
-        default: false
       machine:
         type: string
         default: linux_gcc_zen2
       extras:
         type: string
         default: "handholding"
+      script:
+        type: string
+        default: src/flamenco/runtime/tests/run_backtest_ci.sh
   workflow_dispatch:
+    inputs:
+      machine:
+        type: string
+        default: linux_gcc_zen2
+      extras:
+        type: string
+        default: "handholding"
+      script:
+        type: string
+        default: src/flamenco/runtime/tests/run_backtest_ci.sh
 jobs:
   backtest-ledger-replay:
     timeout-minutes: 15
-    runs-on: [self-hosted, 512G]
+    runs-on:
+      labels: [self-hosted, 512G]
+      group: fd-public-repo
     env:
       CC: gcc
       MACHINE: ${{ inputs.machine }}
@@ -33,11 +45,13 @@ jobs:
       - uses: ./.github/actions/deps
         with:
           extras: +dev
+
       - uses: ./.github/actions/hugepages
         with:
           # DO NOT CHANGE THESE VALUES - increasing the hugetlbfs reservations on the CI runners too high causes other jobs to be OOM-killed
           count_gigantic: 398
           count_huge: 535
+
       - uses: ./.github/actions/cpusonline
 
       - name: build
@@ -48,12 +62,12 @@ jobs:
         run: |
           echo OBJDIR=$(make help | grep OBJDIR | awk '{print $4}') >> $GITHUB_ENV
 
-      - name: test replay ledgers
+      - name: run backtest
         run: |
           sudo $OBJDIR/bin/firedancer-dev configure init keys
           sudo prlimit --pid=$$ --nofile=1048576
           sudo prlimit --pid=$$ --memlock=unlimited
-          DUMP_DIR=../dump HUGE_TLBFS_ALLOW_HUGEPAGE_INCREASE=false make run-runtime-backtest
+          DUMP_DIR=../dump HUGE_TLBFS_ALLOW_HUGEPAGE_INCREASE=false ${{ inputs.script }}
 
       - name: fini
         if: always()

.github/workflows/benchmark.yml

@@ -21,7 +21,9 @@ permissions:
 
 jobs:
   benchmark:
-    runs-on: [self-hosted, 512G]
+    runs-on:
+      labels: [self-hosted, 512G]
+      group: fd-public-repo
     timeout-minutes: 15
     env:
       CC: gcc
@@ -59,8 +61,7 @@ jobs:
         sudo $OBJDIR/bin/firedancer-dev configure init keys
         rm -rf baseline.log
         DUMP_DIR=../dump ./src/flamenco/runtime/tests/run_ledger_backtest.sh \
-          -l mainnet-368528500-perf \
-          -y 5 -m 2000000 -e 368529500 -c 3.0.0 \
+          -l mainnet-368528500-perf -y 5 -m 2000000 -e 368529500 \
           --log baseline.log --skip-checksum
         SPS_BASELINE=$(grep "Backtest playback done." baseline.log | awk -F 'sec/slot: ' '{print $2}')
         TOTAL_ELAPSED_BASELINE=$(grep "Backtest playback done." baseline.log | awk -F 'elapsed: ' '{print $2}' | awk '{print $1}')
@@ -88,8 +89,7 @@ jobs:
         rm -rf new.log
         sudo $OBJDIR/bin/firedancer-dev configure init keys
         DUMP_DIR=../dump ./src/flamenco/runtime/tests/run_ledger_backtest.sh \
-          -l mainnet-368528500-perf \
-          -y 5 -m 2000000 -e 368529500 -c 3.0.0 \
+          -l mainnet-368528500-perf -y 5 -m 2000000 -e 368529500 \
           --log new.log --skip-checksum
         SPS_NEWVAL=$(grep "Backtest playback done." new.log | awk -F 'sec/slot: ' '{print $2}')
         TOTAL_ELAPSED_NEWVAL=$(grep "Backtest playback done." new.log | awk -F 'elapsed: ' '{print $2}' | awk '{print $1}')

.github/workflows/builds.yml

@@ -91,7 +91,9 @@ concurrency:
   cancel-in-progress: true
 jobs:
   build_gcc:
-    runs-on: rocky8
+    runs-on:
+      labels: rocky8
+      group: fd-public-repo
     if: ${{ inputs.gcc != 'none' }}
     steps:
       - uses: actions/checkout@v5
@@ -144,7 +146,9 @@ jobs:
           contrib/build.sh --no-rust --no-clang ${{ env.BUILD_ARGS }}
 
   build_clang:
-    runs-on: rocky9
+    runs-on:
+      labels: rocky9
+      group: fd-public-repo
     if: ${{ inputs.clang != 'none' }}
     steps:
       - uses: actions/checkout@v5
@@ -197,7 +201,9 @@ jobs:
           contrib/build.sh --no-rust --no-gcc ${{ env.BUILD_ARGS }}
 
   build_arm:
-    runs-on: ARM64
+    runs-on:
+      labels: ARM64
+      group: fd-public-repo
     if: ${{ inputs.build_arm }}
     strategy:
       matrix:
@@ -214,5 +220,6 @@ jobs:
           if [ "${{ matrix.gcc_version }}" != "8" ]; then
             source /opt/rh/gcc-toolset-${{ matrix.gcc_version }}/enable
           fi
+          ./deps.sh +dev fetch install
           make -j clean
           make -j all

.github/workflows/check_seccomp.yml

@@ -0,0 +1,33 @@
+name: Check Generated Seccomp Files
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  check-seccomp:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+
+    steps:
+      - name: Checkout current commit
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Setup Python environment
+        run: |
+          python -m venv venv && venv/bin/pip install edn_format
+
+      - name: Check generated seccomp files
+        run: |
+          set -e
+          source venv/bin/activate
+          make seccomp-policies
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "Generated seccomp files are out of date. Please run 'make seccomp-policies' and commit the changes."
+            git --no-pager diff
+            exit 1
+          else
+            echo "All generated seccomp files are up to date."
+          fi

.github/workflows/clusterfuzz.yml

@@ -5,11 +5,10 @@ on:
 jobs:
   solfuzz-build-and-publish:
     timeout-minutes: 30
-    runs-on:
-      group: github-v1
+    runs-on: ubuntu-latest
     env:
-      MACHINE: linux_clang_haswell
-      OBJ_DIR: build/linux/clang/haswell
+      MACHINE: linux_clang_icelake
+      OBJ_DIR: build/linux/clang/icelake
       COV_BUILD_DIR: cov
       COV_OBJ_DIR: build/cov
       EXTRAS: fuzz # asan
@@ -35,7 +34,7 @@ jobs:
         env:
           BUILDDIR: ${{ env.COV_BUILD_DIR }}
           EXTRAS: fuzz llvm-cov
-          MACHINE: linux_clang_haswell
+          MACHINE: linux_clang_icelake
         with:
           command: cd src && pwd > buildpwd && cd - && make -j -Otarget lib && llvm-config --version | cut -d '.' -f 1 > llvm_version
 
@@ -56,14 +55,14 @@ jobs:
 
 
       - name: upload so artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           path: ${{ env.OBJ_DIR }}/lib/libfd_exec_sol_compat*.so
           name: libfd_exec_sol_compat
           retention-days: 14
 
       - name: upload .so with cov
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           path: ${{ env.COV_OBJ_DIR }}/lib/libfd_exec_sol_compat* # includes ${{ env.COV_OBJ_DIR}}/lib/libfd_exec_sol_compat_src/
           name: libfd_exec_sol_compat_cov
@@ -84,8 +83,7 @@ jobs:
           # - machine: linux_clang_icelake
           #   artifact_dir: build/linux/clang/icelake
           #   qualifier: highend
-    runs-on:
-      group: github-v1
+    runs-on: ubuntu-latest
     env:
       MACHINE: ${{ matrix.machine }}
       EXTRAS: fuzz asan ubsan
@@ -110,7 +108,7 @@ jobs:
           ls ${{ matrix.artifact_dir }}/fuzz-test
           ls ${{ matrix.artifact_dir }}/lib
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         name: Zip and upload to GitHub Artifacts
         id: artifact-zip-m1
         with:

.github/workflows/codeql.yml

@@ -10,8 +10,8 @@ permissions:
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
-    runs-on: 1T
-
+    runs-on:
+      group: fd-public-repo-codeql
     strategy:
       fail-fast: false
       matrix:

.github/workflows/coverage_report.yml

@@ -10,7 +10,9 @@ jobs:
   coverage-report:
     timeout-minutes: 60
     name: Coverage Report
-    runs-on: icelake
+    runs-on:
+      labels: icelake
+      group: fd-public-repo
     environment:
       name: coverage-report
       url: ${{ vars.COVERAGE_URL }}

.github/workflows/doxygen.yml

@@ -7,7 +7,9 @@ jobs:
   doxygen:
     timeout-minutes: 20
     name: Doxygen
-    runs-on: rocky810
+    runs-on:
+      labels: rocky810
+      group: fd-public-repo
     environment:
       name: doxygen
       url: ${{ vars.DOXYGEN_URL }}

.github/workflows/on_nightly.yml

@@ -64,3 +64,8 @@ jobs:
       build_arm: false
       clang: none
       cid: 6
+  backtest:
+    uses: ./.github/workflows/backtest.yml
+    with:
+      script: src/flamenco/runtime/tests/run_backtest_all.sh
+    secrets: inherit

.github/workflows/test_firedancer_localnet.yml

@@ -9,7 +9,9 @@ on:
 jobs:
   firedancer-localnet:
     timeout-minutes: 30
-    runs-on: [self-hosted, 512G]
+    runs-on:
+      labels: [self-hosted, 512G]
+      group: fd-public-repo
     env:
       CC: gcc
       MACHINE: ${{ inputs.machine }}