Tracking PR for v0.14.0 relese

.github/actions/debian/action.yml

@@ -28,15 +28,15 @@ inputs:
     options:
       - miden-node
       - miden-remote-prover
-  service:
+  package:
     required: true
-    description: The service to build the packages for.
+    description: The Debian package name.
     type: choice
     options:
       - miden-node
       - miden-prover
       - miden-prover-proxy
-  package:
+  packaging_dir:
     required: true
     description: Name of packaging directory.
     type: choice
@@ -78,7 +78,7 @@ runs:
     - name: Create package directories
       shell: bash
       run: |
-        pkg=${{ inputs.service }}
+        pkg=${{ inputs.package }}
         mkdir -p \
           packaging/deb/$pkg/DEBIAN \
           packaging/deb/$pkg/usr/bin \
@@ -89,15 +89,18 @@ runs:
     - name: Copy package install scripts
       shell: bash
       run: |
-        svc=${{ inputs.service }}
         pkg=${{ inputs.package }}
+        pkg_dir=${{ inputs.packaging_dir }}
         crate=${{ inputs.crate_dir }}
-        git show ${{ steps.git-sha.outputs.sha }}:bin/$crate/.env             > packaging/deb/$svc/lib/systemd/system/$svc.env
-        git show ${{ steps.git-sha.outputs.sha }}:packaging/$pkg/$svc.service > packaging/deb/$svc/lib/systemd/system/$svc.service
-        git show ${{ steps.git-sha.outputs.sha }}:packaging/$pkg/postinst     > packaging/deb/$svc/DEBIAN/postinst
-        git show ${{ steps.git-sha.outputs.sha }}:packaging/$pkg/postrm       > packaging/deb/$svc/DEBIAN/postrm
-        chmod 0775 packaging/deb/$svc/DEBIAN/postinst
-        chmod 0775 packaging/deb/$svc/DEBIAN/postrm
+        git show ${{ steps.git-sha.outputs.sha }}:packaging/$pkg_dir/postinst > packaging/deb/$pkg/DEBIAN/postinst
+        git show ${{ steps.git-sha.outputs.sha }}:packaging/$pkg_dir/postrm   > packaging/deb/$pkg/DEBIAN/postrm
+        for service_file in $(ls packaging/$pkg_dir/*.service | sed "s/.*miden/miden/g"); do
+          svc=$(echo $service_file | sed "s/.service//g")
+          git show ${{ steps.git-sha.outputs.sha }}:packaging/$pkg_dir/$service_file > packaging/deb/$pkg/lib/systemd/system/$service_file
+          git show ${{ steps.git-sha.outputs.sha }}:bin/$crate/.env                  > packaging/deb/$pkg/lib/systemd/system/$svc.env
+        done
+        chmod 0775 packaging/deb/$pkg/DEBIAN/postinst
+        chmod 0775 packaging/deb/$pkg/DEBIAN/postrm
 
     - name: Create control files
       shell: bash
@@ -108,7 +111,7 @@ runs:
         # Control file's version field must be x.y.z format so strip the rest.
         version=$(git describe --tags --abbrev=0 | sed 's/[^0-9.]//g' )
 
-        pkg=${{ inputs.service }}
+        pkg=${{ inputs.package }}
         cat > packaging/deb/$pkg/DEBIAN/control << EOF
         Package: $pkg
         Version: $version
@@ -132,14 +135,14 @@ runs:
     - name: Copy binary files
       shell: bash
       run: |
-        pkg=${{ inputs.service }}
+        pkg=${{ inputs.package }}
         bin=${{ inputs.crate }}
         cp -p ./bin/$bin   packaging/deb/$pkg/usr/bin/
 
     - name: Build packages
       shell: bash
       run: |
-        dpkg-deb --build --root-owner-group packaging/deb/${{ inputs.service }}
+        dpkg-deb --build --root-owner-group packaging/deb/${{ inputs.package }}
 
         # Save the .deb files, delete the rest.
         mv packaging/deb/*.deb .
@@ -148,12 +151,12 @@ runs:
     - name: Package names
       shell: bash
       run: |
-        echo "package=${{ inputs.service }}-${{ inputs.gitref }}-${{ inputs.arch }}.deb" >> $GITHUB_ENV
+        echo "package=${{ inputs.package }}-${{ inputs.gitref }}-${{ inputs.arch }}.deb" >> $GITHUB_ENV
 
     - name: Rename package files
       shell: bash
       run: |
-        mv ${{ inputs.service }}.deb ${{ env.package }}
+        mv ${{ inputs.package}}.deb ${{ env.package }}
 
     - name: shasum packages
       shell: bash

.github/workflows/build-docker.yml

@@ -12,38 +12,16 @@ permissions:
 
 jobs:
   docker-build:
-    strategy:
-      matrix:
-        component: [node]
     runs-on: Linux-ARM64-Runner
-    name: Build ${{ matrix.component }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Configure AWS credentials
-        if: github.event.pull_request.head.repo.fork == false
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          aws-region: ${{ secrets.AWS_REGION }}
-          role-to-assume: ${{ secrets.AWS_ROLE }}
-          role-session-name: GithubActionsSession
-
-      - name: Set cache parameters
-        if: github.event.pull_request.head.repo.fork == false
-        run: |
-          echo "CACHE_FROM=type=s3,region=${{ secrets.AWS_REGION }},bucket=${{ secrets.AWS_CACHE_BUCKET }},name=miden-${{ matrix.component }}" >> $GITHUB_ENV
-          echo "CACHE_TO=type=s3,region=${{ secrets.AWS_REGION }},bucket=${{ secrets.AWS_CACHE_BUCKET }},name=miden-${{ matrix.component }}" >> $GITHUB_ENV
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-        with:
-          cache-binary: true
 
-      - name: Build Docker image
-        uses: docker/build-push-action@v5
+      - name: Build and push
+        uses: docker/build-push-action@v6
         with:
           push: false
-          file: ./bin/${{ matrix.component }}/Dockerfile
-          cache-from: ${{ env.CACHE_FROM || '' }}
-          cache-to: ${{ env.CACHE_TO || '' }}
+          file: ./bin/node/Dockerfile
+          cache-from: type=gha
+          # Only save cache on push into next
+          cache-to: ${{ github.event_name == 'push' && github.ref == 'refs/heads/next' && 'type=gha,mode=max' || '' }}

.github/workflows/ci.yml

@@ -58,6 +58,43 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/next' }}
       - name: cargo build
         run: cargo build --workspace --all-targets --locked
+      - name: Check static linkage
+        run: |
+          # Ensure database libraries are statically linked to avoid system library dependencies
+          #
+          # It explodes our possible dependency matrix when debugging, particularly
+          # in the case of sqlite and rocksdb as embedded databases, we want them
+          # shipped in identical versions we test with. Those are notoriously difficult
+          # to compile time configure and OSes make very opinionated choices.
+          metadata=$(cargo metadata --no-deps --format-version 1)
+          mapfile -t bin_targets < <(
+            echo "${metadata}" | jq -r '.packages[].targets[] | select(.kind[] == "bin") | .name' | sort -u
+          )
+          if [[ ${#bin_targets[@]} -eq 0 ]]; then
+            echo "error: No binary targets found in cargo manifest."
+            exit 1
+          fi
+          for bin_target in "${bin_targets[@]}"; do
+            # Ensure the binary was built by the previous step.
+            binary_path="target/debug/${bin_target}"
+            if ! [[ -x "${binary_path}" ]]; then
+              echo "error: Missing binary or missing executable bit: ${binary_path}";
+              exit 2;
+            fi
+            # ldd exits non-zero for static binaries, so we inspect its output instead.
+            # if ldd fails we use an empty string instead
+            ldd_output="$(ldd "${binary_path}" 2>&1 || true)"
+            if echo "${ldd_output}" | grep -E -q 'not a dynamic executable'; then
+              continue
+            fi
+            # librocksdb/libsqlite entries indicate dynamic linkage (bad).
+            if echo "${ldd_output}" | grep -E -q 'librocksdb|libsqlite'; then
+              echo "error: Dynamic linkage detected for ${bin_target}."
+              echo "${ldd_output}"
+              exit 3
+            fi
+          done
+          echo "Static linkage check passed for all of ${bin_targets[@]}"
 
   clippy:
     name: lint - clippy
@@ -167,11 +204,12 @@ jobs:
           cargo run --bin miden-node-stress-test seed-store \
             --data-directory ${{ env.DATA_DIR }} \
             --num-accounts 500 --public-accounts-percentage 50
-      - name: Benchmark state sync
-        run: |
-          cargo run --bin miden-node-stress-test benchmark-store \
-            --data-directory ${{ env.DATA_DIR }} \
-            --iterations 10 --concurrency 1 sync-state
+  # TODO re-introduce 
+      # - name: Benchmark state sync
+        # run: |
+          # cargo run --bin miden-node-stress-test benchmark-store \
+            # --data-directory ${{ env.DATA_DIR }} \
+            # --iterations 10 --concurrency 1 sync-state
       - name: Benchmark notes sync
         run: |
           cargo run --bin miden-node-stress-test benchmark-store \