ci: patch Hive Lean build and run devnet5

Author: dicethedev

.github/scripts/patch-hive-lean-dockerfile.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+"""Patch Hive's Lean simulator Dockerfile for CI.
+
+The pinned Hive Dockerfile uses unauthenticated GitHub API `ADD` instructions
+as cache-busters for commit/release metadata. GitHub-hosted runners can hit the
+anonymous API rate limit there before Hive starts. Replace those remote fetches
+with local metadata stubs; the build still downloads the actual pinned assets
+through the later `git clone`/`curl` steps.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import sys
+
+
+REPLACEMENTS = {
+    "ADD ${LEAN_SPEC_DEVNET4_COMMIT_METADATA_URL} /tmp/devnet4-commit.json":
+        'RUN printf \'{"sha":"%s"}\\n\' "$devnet4_tag" > /tmp/devnet4-commit.json',
+    "ADD ${LEAN_SPEC_DEVNET5_COMMIT_METADATA_URL} /tmp/devnet5-commit.json":
+        'RUN printf \'{"sha":"%s"}\\n\' "$devnet5_tag" > /tmp/devnet5-commit.json',
+    "ADD ${LEAN_SPEC_TESTS_METADATA_URL} /tmp/lean-spec-tests-commit.json":
+        'RUN printf \'{"sha":"%s"}\\n\' "$lean_spec_tests_ref" > /tmp/lean-spec-tests-commit.json',
+    "ADD ${LEAN_SPEC_FIXTURES_METADATA_URL} /tmp/devnet5-lean-spec-fixtures-release.json":
+        'RUN printf \'{"tag_name":"%s"}\\n\' "$lean_spec_fixtures_tag" > /tmp/devnet5-lean-spec-fixtures-release.json',
+    "ADD ${LEAN_SPEC_DEVNET5_KEYS_METADATA_URL} /tmp/devnet5-keys-release.json":
+        'RUN printf \'{"tag_name":"%s"}\\n\' "$devnet5_keys_tag" > /tmp/devnet5-keys-release.json',
+}
+
+
+def main() -> int:
+    dockerfile = pathlib.Path(sys.argv[1] if len(sys.argv) > 1 else "src/simulators/lean/Dockerfile")
+    content = dockerfile.read_text()
+
+    missing = [needle for needle in REPLACEMENTS if needle not in content]
+    if missing:
+        print("Hive Lean Dockerfile did not contain expected metadata ADD line(s):", file=sys.stderr)
+        for needle in missing:
+            print(f"- {needle}", file=sys.stderr)
+        return 1
+
+    for needle, replacement in REPLACEMENTS.items():
+        content = content.replace(needle, replacement)
+
+    if "ADD ${LEAN_SPEC_" in content:
+        print("Hive Lean Dockerfile still contains a remote Lean metadata ADD", file=sys.stderr)
+        return 1
+
+    dockerfile.write_text(content)
+    print(f"Patched {dockerfile} to avoid unauthenticated GitHub API metadata fetches")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/workflows/ci.yml

@@ -248,15 +248,54 @@ jobs:
           fi
           echo "flags=$FLAGS" >> "$GITHUB_OUTPUT"
 
-      - name: Run Hive Simulation
-        uses: ethpandaops/hive-github-action@09050fc75bae8a10b1876a0826ca4114ea9ed6e8 # v0.6.3
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.24"
+          cache: false
+
+      - name: Checkout hive
+        uses: actions/checkout@v6
         with:
-          hive_repository: ethereum/hive
-          hive_version: dde4f59d04ff0ff8b6585670b08cea1b6c8ab65c
-          simulator: lean
-          client: ethlambda_devnet4
-          client_config: ${{ steps.client-config.outputs.config }}
-          extra_flags: ${{ steps.hive-flags.outputs.flags }}
+          repository: ethereum/hive
+          ref: dde4f59d04ff0ff8b6585670b08cea1b6c8ab65c
+          path: src
+
+      - name: Patch Hive Lean Dockerfile
+        run: python3 .github/scripts/patch-hive-lean-dockerfile.py src/simulators/lean/Dockerfile
+
+      - name: Build Hive
+        working-directory: src
+        run: go build -o hive .
+
+      - name: Create Hive results directory
+        working-directory: src
+        run: mkdir -p results
+
+      - name: Write Hive client config
+        working-directory: src
+        run: |
+          cat > client-config.yaml <<'EOF'
+          ${{ steps.client-config.outputs.config }}
+          EOF
+
+      - name: Run Hive Simulation
+        working-directory: src
+        run: |
+          set -x
+          (./hive \
+            --sim lean \
+            --client ethlambda_devnet5 \
+            --results-root results \
+            --client-file=client-config.yaml \
+            ${{ steps.hive-flags.outputs.flags }} \
+            2>&1 || true) | tee hive.log
+
+          if tail -n 10 hive.log | grep -q "simulation .* finished"; then
+            exit 0
+          fi
+
+          exit 1
 
       - name: Check Hive Results For Failures
         id: verify-hive-results