dependabot(gomod): bump golang.org/x/term from 0.28.0 to 0.31.0

.circleci/config.yml

@@ -1219,7 +1219,12 @@ jobs:
     steps:
       - utils/checkout-with-mise
       - setup_remote_docker
-      - run: make -C op-program verify-reproducibility
+      - run:
+          name: Verify reproducibility
+          command: make -C op-program verify-reproducibility
+      - store_artifacts:
+          path: ./op-program/temp/logs
+          when: always
       - notify-failures-on-develop:
           mentions: "@proofs-team"
 
@@ -1289,20 +1294,6 @@ jobs:
     steps:
       - run: echo Done
 
-  fpp-verify:
-    circleci_ip_ranges: true
-    docker:
-      - image: cimg/go:1.21
-    steps:
-      - utils/checkout-with-mise
-      - run:
-          name: verify-sepolia
-          command: |
-            make verify-sepolia
-          working_directory: op-program
-      - notify-failures-on-develop:
-          mentions: "@proofs-team"
-
   op-program-compat:
     machine: true
     resource_class: ethereum-optimism/latitude-1
@@ -1454,23 +1445,28 @@ workflows:
           name: contracts-bedrock-build
           # Build with just core + script contracts.
           build_args: --deny-warnings --skip test
+          context: circleci-repo-readonly-authenticated-github-token
       - check-kontrol-build:
           requires:
             - contracts-bedrock-build
+          context: circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-tests:
           # Test everything except PreimageOracle.t.sol since it's slow.
           name: contracts-bedrock-tests
           test_list: find test -name "*.t.sol" -not -name "PreimageOracle.t.sol"
+          context: circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-tests:
           # PreimageOracle test is slow, run it separately to unblock CI.
           name: contracts-bedrock-tests-preimage-oracle
           test_list: find test -name "PreimageOracle.t.sol"
+          context: circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-tests:
           # Heavily fuzz any fuzz tests within added or modified test files.
           name: contracts-bedrock-tests-heavy-fuzz-modified
           test_list: git diff origin/develop...HEAD --name-only --diff-filter=AM -- './test/**/*.t.sol' | sed 's|packages/contracts-bedrock/||'
           test_timeout: 1h
           test_profile: ciheavy
+          context: circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-coverage:
           # Generate coverage reports.
           name: contracts-bedrock-coverage
@@ -1479,25 +1475,49 @@ workflows:
           # need this requires to ensure that all FFI JSONs exist
           requires:
             - contracts-bedrock-build
+          context: circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-tests-upgrade:
           name: contracts-bedrock-tests-upgrade
           fork_op_chain: op
           fork_base_chain: mainnet
           fork_base_rpc: https://ci-mainnet-l1-archive.optimism.io
+          context: circleci-repo-readonly-authenticated-github-token
+      - contracts-bedrock-tests-upgrade:
+          name: contracts-bedrock-tests-upgrade base-mainnet
+          fork_op_chain: base
+          fork_base_chain: mainnet
+          fork_base_rpc: https://ci-mainnet-l1-archive.optimism.io
+          context: circleci-repo-readonly-authenticated-github-token
+      - contracts-bedrock-tests-upgrade:
+          name: contracts-bedrock-tests-upgrade ink-mainnet
+          fork_op_chain: ink
+          fork_base_chain: mainnet
+          fork_base_rpc: https://ci-mainnet-l1-archive.optimism.io
+          context: circleci-repo-readonly-authenticated-github-token
+      - contracts-bedrock-tests-upgrade:
+          name: contracts-bedrock-tests-upgrade unichain-mainnet
+          fork_op_chain: unichain
+          fork_base_chain: mainnet
+          fork_base_rpc: https://ci-mainnet-l1-archive.optimism.io
+          context: circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-checks:
           requires:
             - contracts-bedrock-build
+          context: circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-frozen-code:
           requires:
             - contracts-bedrock-build
-      - diff-asterisc-bytecode
+          context: circleci-repo-readonly-authenticated-github-token
+      - diff-asterisc-bytecode:
+          context: circleci-repo-readonly-authenticated-github-token
       - semgrep-scan:
           name: semgrep-scan-local
           scan_command: semgrep scan --timeout=100 --config .semgrep/rules/ --error .
       - semgrep-scan:
           name: semgrep-test
           scan_command: semgrep scan --test --config .semgrep/rules/ .semgrep/tests/
-      - go-lint
+      - go-lint:
+          context: circleci-repo-readonly-authenticated-github-token
       - fuzz-golang:
           name: fuzz-golang-<<matrix.package_name>>
           on_changes: <<matrix.package_name>>
@@ -1508,18 +1528,21 @@ workflows:
                 - op-node
                 - op-service
                 - op-chain-ops
+          context: circleci-repo-readonly-authenticated-github-token
       - fuzz-golang:
           name: cannon-fuzz
           package_name: cannon
           on_changes: cannon,packages/contracts-bedrock/src/cannon
           uses_artifacts: true
           requires: ["contracts-bedrock-build"]
+          context: circleci-repo-readonly-authenticated-github-token
       - fuzz-golang:
           name: op-e2e-fuzz
           package_name: op-e2e
           on_changes: op-e2e,packages/contracts-bedrock/src
           uses_artifacts: true
           requires: ["contracts-bedrock-build"]
+          context: circleci-repo-readonly-authenticated-github-token
       - go-tests:
           environment_overrides: |
             export PARALLEL=24
@@ -1546,10 +1569,15 @@ workflows:
             packages/contracts-bedrock/scripts/checks
             packages/contracts-bedrock/scripts/verify
             op-dripper
+            devnet-sdk
+            kurtosis-devnet
+            op-acceptance-tests
           requires:
             - contracts-bedrock-build
             - cannon-prestate-quick
-      - op-program-compat
+          context: circleci-repo-readonly-authenticated-github-token
+      - op-program-compat:
+          context: circleci-repo-readonly-authenticated-github-token
       - bedrock-go-tests:
           requires:
             - go-lint
@@ -1567,6 +1595,7 @@ workflows:
             - proofs-tools-docker-build
             - go-tests
             - sanitize-op-program
+          context: circleci-repo-readonly-authenticated-github-tokens
       - docker-build:
           name: <<matrix.docker_name>>-docker-build
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
@@ -1586,12 +1615,17 @@ workflows:
                 - op-supervisor
                 - cannon
                 - op-dripper
-      - cannon-prestate-quick
+          context: circleci-repo-readonly-authenticated-github-token
+      - cannon-prestate-quick:
+          context: circleci-repo-readonly-authenticated-github-token
       - sanitize-op-program:
           requires:
             - cannon-prestate-quick
-      - check-generated-mocks-op-node
-      - check-generated-mocks-op-service
+          context: circleci-repo-readonly-authenticated-github-token
+      - check-generated-mocks-op-node:
+          context: circleci-repo-readonly-authenticated-github-token
+      - check-generated-mocks-op-service:
+          context: circleci-repo-readonly-authenticated-github-token
       - cannon-go-lint-and-test:
           name: cannon-go-lint-and-test-<<matrix.mips_word_size>>-bit
           requires:
@@ -1601,10 +1635,13 @@ workflows:
           matrix:
             parameters:
               mips_word_size: [32, 64]
-      - cannon-build-test-vectors
+          context: circleci-repo-readonly-authenticated-github-token
+      - cannon-build-test-vectors:
+          context: circleci-repo-readonly-authenticated-github-token
       - todo-issues:
           name: todo-issues-check
           check_closed: false
+          context: circleci-repo-readonly-authenticated-github-token
       - shellcheck/check:
           name: shell-check
           # We don't need the `exclude` key as the orb detects the `.shellcheckrc`
@@ -1744,15 +1781,7 @@ workflows:
           name: todo-issue-checks
           context:
             - slack
-
-  scheduled-fpp:
-    when:
-      equal: [build_hourly, <<pipeline.schedule.name>>]
-    jobs:
-      - fpp-verify:
-          context:
-            - slack
-            - oplabs-fpp-nodes
+            - circleci-repo-readonly-authenticated-github-token
 
   develop-publish-contract-artifacts:
     when:
@@ -1761,7 +1790,9 @@ workflows:
         - equal:
             [true, <<pipeline.parameters.publish_contract_artifacts_dispatch>>]
     jobs:
-      - publish-contract-artifacts
+      - publish-contract-artifacts:
+          context:
+            - circleci-repo-readonly-authenticated-github-token
 
   develop-fault-proofs:
     when:
@@ -1772,14 +1803,18 @@ workflows:
         - not:
             equal: [scheduled_pipeline, << pipeline.trigger_source >>]
     jobs:
-      - cannon-prestate
+      - cannon-prestate:
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - cannon-stf-verify:
           context:
             - slack
+            - circleci-repo-readonly-authenticated-github-token
       - contracts-bedrock-build:
           build_args: --deny-warnings --skip test
           context:
             - slack
+            - circleci-repo-readonly-authenticated-github-token
       - go-tests:
           name: op-e2e-cannon-tests
           notify: true
@@ -1794,6 +1829,7 @@ workflows:
             op-e2e/faultproofs
           context:
             - slack
+            - circleci-repo-readonly-authenticated-github-token
           requires:
             - contracts-bedrock-build
             - cannon-prestate
@@ -1822,6 +1858,7 @@ workflows:
           context:
             - slack
             - runtimeverification
+            - circleci-repo-readonly-authenticated-github-token
 
   scheduled-cannon-full-tests:
     when:
@@ -1839,6 +1876,7 @@ workflows:
           notify: true
           context:
             - slack
+            - circleci-repo-readonly-authenticated-github-token
           matrix:
             parameters:
               mips_word_size: [32, 64]
@@ -1897,7 +1935,9 @@ workflows:
         - equal: [true, << pipeline.parameters.reproducibility_dispatch >>]
     jobs:
       - preimage-reproducibility:
-          context: slack
+          context:
+            - slack
+            - circleci-repo-readonly-authenticated-github-token
 
   scheduled-stale-check:
     when:

.semgrep/rules/sol-rules.yaml

@@ -200,7 +200,6 @@ rules:
     paths:
       exclude:
         - packages/contracts-bedrock/src/L1/OPContractsManager.sol
-        - packages/contracts-bedrock/src/L1/OPContractsManagerInterop.sol
         - packages/contracts-bedrock/src/legacy/L1ChugSplashProxy.sol
 
   - id: sol-style-enforce-require-msg
@@ -241,10 +240,6 @@ rules:
             _disableInitializers();
             ...
           }
-    paths:
-      exclude:
-        - packages/contracts-bedrock/src/L1/SystemConfigInterop.sol
-        - packages/contracts-bedrock/src/L1/OptimismPortalInterop.sol
 
   - id: sol-safety-proper-initializer
     languages: [solidity]
@@ -273,9 +268,6 @@ rules:
           function initialize(...) public reinitializer(...) {
             ...
           }
-    paths:
-      exclude:
-        - packages/contracts-bedrock/src/L1/SystemConfigInterop.sol
 
   - id: sol-safety-proper-upgrade-function
     languages: [solidity]