ci: fix TOB-SCREUC-8, do not persist git credentials

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/contracts.yml

@@ -31,14 +31,15 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@de808b1eea699e761c404bda44ba8f21aba30b2c # v1.3.1
         with:
           version: nightly
 
       - name: Setup LCOV
-        uses: hrishikesh-kadam/setup-lcov@v1
+        uses: hrishikesh-kadam/setup-lcov@6c1aa0cc9e1c02f9f58f01ac599f1064ccc83470 # v1
 
       - name: Install Node.js 18
         uses: actions/setup-node@v2
@@ -50,7 +51,7 @@ jobs:
         run: echo "::set-output name=dir::$(yarn cache dir)"
 
       - name: Cache yarn dependencies
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
@@ -60,7 +61,7 @@ jobs:
 
       - name: Cache node_modules
         id: npm_cache
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: node_modules
           key: node_modules-${{ hashFiles('yarn.lock') }}
@@ -79,10 +80,10 @@ jobs:
         run : forge coverage --evm-version cancun --report lcov
 
       - name : Prune coverage
-        run : lcov --rc branch_coverage=1 --remove ./lcov.info -o ./lcov.info.pruned 'src/mocks/*' 'src/test/*' 'scripts/*' 'node_modules/*' 'lib/*'
+        run : lcov --rc branch_coverage=1 --remove ./lcov.info -o ./lcov.info.pruned 'src/mocks/*' 'src/test/*' 'scripts/*' 'node_modules/*' 'lib/*' --ignore-errors unused,unused
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4/
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -98,6 +99,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: recursive
+          persist-credentials: false
 
       - name: Install Node.js 18
         uses: actions/setup-node@v2
@@ -109,7 +111,7 @@ jobs:
         run: echo "::set-output name=dir::$(yarn cache dir)"
 
       - name: Cache yarn dependencies
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
@@ -119,7 +121,7 @@ jobs:
 
       - name: Cache node_modules
         id: npm_cache
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: node_modules
           key: node_modules-${{ hashFiles('yarn.lock') }}

.github/workflows/docker-release.yml

@@ -14,12 +14,13 @@ jobs:
         uses: actions/checkout@v3
         with:
           submodules: true
+          persist-credentials: false
 
       - name: Update submodules recursively
         run: git submodule update --init --recursive
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
 
       - name: Setup Node.js environment
         uses: actions/setup-node@v3
@@ -30,10 +31,12 @@ jobs:
         run: npm install
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2.10.0
+        with:
+          cache-binary: false
 
       - name: Login to Dockerhub
-        uses: docker/login-action@v2
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -42,7 +45,7 @@ jobs:
         id: build_deploy_image
         env:
           REPOSITORY: scrolltech/scroll-stack-contracts
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           platforms: linux/amd64,linux/arm64
           push: true
@@ -55,7 +58,7 @@ jobs:
         id: build_gen_image
         env:
           REPOSITORY: scrolltech/scroll-stack-contracts
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           platforms: linux/amd64,linux/arm64
           push: true

scripts/foundry/DeployL1BridgeContracts.s.sol

@@ -23,7 +23,7 @@ import {L2GasPriceOracle} from "../../src/L1/rollup/L2GasPriceOracle.sol";
 import {MultipleVersionRollupVerifier} from "../../src/L1/rollup/MultipleVersionRollupVerifier.sol";
 import {ScrollChain} from "../../src/L1/rollup/ScrollChain.sol";
 import {Whitelist} from "../../src/L2/predeploys/Whitelist.sol";
-import {ZkEvmVerifierV1} from "../../src/libraries/verifier/ZkEvmVerifierV1.sol";
+import {ZkEvmVerifierPostEuclid} from "../../src/libraries/verifier/ZkEvmVerifierPostEuclid.sol";
 
 // solhint-disable max-states-count
 // solhint-disable state-visibility
@@ -38,6 +38,8 @@ contract DeployL1BridgeContracts is Script {
     address L2_WETH_ADDR = vm.envAddress("L2_WETH_ADDR");
 
     address L1_PLONK_VERIFIER_ADDR = vm.envAddress("L1_PLONK_VERIFIER_ADDR");
+    bytes32 VERIFIER_DIGEST_1 = vm.envBytes32("VERIFIER_DIGEST_1");
+    bytes32 VERIFIER_DIGEST_2 = vm.envBytes32("VERIFIER_DIGEST_2");
 
     address L1_PROXY_ADMIN_ADDR = vm.envAddress("L1_PROXY_ADMIN_ADDR");
 
@@ -55,7 +57,7 @@ contract DeployL1BridgeContracts is Script {
     address L2_SCROLL_STANDARD_ERC20_ADDR = vm.envAddress("L2_SCROLL_STANDARD_ERC20_ADDR");
     address L2_SCROLL_STANDARD_ERC20_FACTORY_ADDR = vm.envAddress("L2_SCROLL_STANDARD_ERC20_FACTORY_ADDR");
 
-    ZkEvmVerifierV1 zkEvmVerifierV1;
+    ZkEvmVerifierPostEuclid zkEvmVerifier;
     MultipleVersionRollupVerifier rollupVerifier;
     EnforcedTxGateway enforcedTxGateway;
     ProxyAdmin proxyAdmin;
@@ -66,7 +68,7 @@ contract DeployL1BridgeContracts is Script {
 
         vm.startBroadcast(L1_DEPLOYER_PRIVATE_KEY);
 
-        deployZkEvmVerifierV1();
+        deployZkEvmVerifier();
         deployMultipleVersionRollupVerifier();
         deployL1Whitelist();
         deployEnforcedTxGateway();
@@ -85,17 +87,17 @@ contract DeployL1BridgeContracts is Script {
         vm.stopBroadcast();
     }
 
-    function deployZkEvmVerifierV1() internal {
-        zkEvmVerifierV1 = new ZkEvmVerifierV1(L1_PLONK_VERIFIER_ADDR);
+    function deployZkEvmVerifier() internal {
+        zkEvmVerifier = new ZkEvmVerifierPostEuclid(L1_PLONK_VERIFIER_ADDR, VERIFIER_DIGEST_1, VERIFIER_DIGEST_2);
 
-        logAddress("L1_ZKEVM_VERIFIER_V1_ADDR", address(zkEvmVerifierV1));
+        logAddress("L1_ZKEVM_VERIFIER_V1_ADDR", address(zkEvmVerifier));
     }
 
     function deployMultipleVersionRollupVerifier() internal {
         uint256[] memory _versions = new uint256[](1);
         address[] memory _verifiers = new address[](1);
-        _versions[0] = 0;
-        _verifiers[0] = address(zkEvmVerifierV1);
+        _versions[0] = 6;
+        _verifiers[0] = address(zkEvmVerifier);
         rollupVerifier = new MultipleVersionRollupVerifier(_versions, _verifiers);
 
         logAddress("L1_MULTIPLE_VERSION_ROLLUP_VERIFIER_ADDR", address(rollupVerifier));

src/L1/rollup/IScrollChain.sol

@@ -68,19 +68,6 @@ interface IScrollChain {
      * Public Mutating Functions *
      *****************************/
 
-    /// @notice Commit a batch of transactions on layer 1.
-    ///
-    /// @param version The version of current batch.
-    /// @param parentBatchHeader The header of parent batch, see the comments of `BatchHeaderV0Codec`.
-    /// @param chunks The list of encoded chunks, see the comments of `ChunkCodec`.
-    /// @param skippedL1MessageBitmap The bitmap indicates whether each L1 message is skipped or not.
-    function commitBatch(
-        uint8 version,
-        bytes calldata parentBatchHeader,
-        bytes[] memory chunks,
-        bytes calldata skippedL1MessageBitmap
-    ) external;
-
     /// @notice Commit a batch of transactions on layer 1 with blob data proof.
     ///
     /// @dev Memory layout of `blobDataProof`:
@@ -107,28 +94,6 @@ interface IScrollChain {
     /// @param lastBatchHeader The header of last batch to revert, see the encoding in comments of `commitBatch`.
     function revertBatch(bytes calldata firstBatchHeader, bytes calldata lastBatchHeader) external;
 
-    /// @notice Finalize a committed batch (with blob) on layer 1.
-    ///
-    /// @dev Memory layout of `blobDataProof`:
-    /// |    z    |    y    | kzg_commitment | kzg_proof |
-    /// |---------|---------|----------------|-----------|
-    /// | bytes32 | bytes32 |    bytes48     |  bytes48  |
-    ///
-    /// @param batchHeader The header of current batch, see the encoding in comments of `commitBatch.
-    /// @param prevStateRoot The state root of parent batch.
-    /// @param postStateRoot The state root of current batch.
-    /// @param withdrawRoot The withdraw trie root of current batch.
-    /// @param blobDataProof The proof for blob data.
-    /// @param aggrProof The aggregation proof for current batch.
-    function finalizeBatchWithProof4844(
-        bytes calldata batchHeader,
-        bytes32 prevStateRoot,
-        bytes32 postStateRoot,
-        bytes32 withdrawRoot,
-        bytes calldata blobDataProof,
-        bytes calldata aggrProof
-    ) external;
-
     /// @notice Finalize a list of committed batches (i.e. bundle) on layer 1.
     /// @param batchHeader The header of last batch in current bundle, see the encoding in comments of `commitBatch.
     /// @param postStateRoot The state root after current bundle.
@@ -140,4 +105,8 @@ interface IScrollChain {
         bytes32 withdrawRoot,
         bytes calldata aggrProof
     ) external;
+
+    /// @notice Finalize the initial Euclid batch.
+    /// @param postStateRoot The state root after current batch.
+    function finalizeEuclidInitialBatch(bytes32 postStateRoot) external;
 }