ci: automated snarkvm upgrades (skill + daily workflow) - #64
Closed
iamalwaysuncomfortable wants to merge 7 commits into
Closed
ci: automated snarkvm upgrades (skill + daily workflow)#64iamalwaysuncomfortable wants to merge 7 commits into
iamalwaysuncomfortable wants to merge 7 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds automation to detect new upstream snarkVM releases and, when needed, run a codified /upgrade-snarkvm procedure in CI to open an upgrade PR.
Changes:
- Adds a daily + manual GitHub Actions workflow that gates an automated upgrade run behind a lightweight “check” job.
- Introduces a deterministic
snarkvm_check.shscript to compute current vs latest snarkVM tags, crates.io availability, and open-PR de-dup. - Adds an
upgrade-snarkvmskill document describing the end-to-end upgrade/adaptation/validation/release-bump process.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
.github/workflows/snarkvm-upgrade.yml |
New scheduled/dispatch workflow to run the upgrade automation via claude-code-action. |
.github/scripts/snarkvm_check.sh |
New shell script to detect whether an upgrade is needed and avoid duplicate upgrade PRs. |
.agents/skills/upgrade-snarkvm/SKILL.md |
New skill procedure document for performing and validating snarkVM upgrades (interactive or CI-driven). |
Comments suppressed due to low confidence (1)
.github/scripts/snarkvm_check.sh:40
- With
set -euo pipefail, thelatest=$(...)command substitution can exit the script early if the pipeline returns non-zero (e.g., ifgrep -Efinds no matching tags). That prevents the explicitif [[ -z "$latest" ]]error message from running. Appending|| trueto the pipeline keeps the friendly error path intact.
latest=$(git ls-remote --tags "$REPO_URL" \
| awk '{print $2}' \
| sed 's|^refs/tags/||; s|\^{}$||' \
| grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \
| sort -uV | tail -1)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+25
to
+33
| dep_line=$(grep -m1 '^snarkvm = {' "$CARGO_TOML") | ||
| if [[ $dep_line =~ tag\ =\ \"(v[0-9]+\.[0-9]+\.[0-9]+)\" ]]; then | ||
| current="${BASH_REMATCH[1]}" | ||
| elif [[ $dep_line =~ version\ =\ \"([0-9]+\.[0-9]+\.[0-9]+)\" ]]; then | ||
| current="v${BASH_REMATCH[1]}" | ||
| else | ||
| echo "error: could not parse snarkvm pin from $CARGO_TOML" >&2 | ||
| exit 1 | ||
| fi |
Comment on lines
+16
to
+19
| - `sdk-abi`'s snarkvm dep is type-coupled to leo: it stays in git-tag form | ||
| with the exact tag and feature set leo's pinned rev uses, or | ||
| `Process<N>`/`Program<N>` in leo-disassembler's signatures become distinct | ||
| types. Never give sdk-abi a crates.io-form snarkvm dep. |
Comment on lines
+22
to
+25
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
|
|
Comment on lines
+26
to
+30
| jobs: | ||
| check: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| current: ${{ steps.check.outputs.current }} |
- SKILL.md hard rules contradicted step 4 on sdk-abi's dep form; replace with the actual policy (prefer crates.io when it matches the latest tag, else git tag) plus sdk-abi's source-identity constraint and a lockfile canary - fail-soft the two greps whose failure exits under set -e, making the friendly parse/no-tags errors reachable - add a concurrency group so a dispatch can't race the cron on one branch - keep testnet-/canary- prefixes when reporting the devnode's snarkvm tag
sdk-abi pins leo by rev, and leo moves on its own cadence, so a snarkvm-only trigger left it to drift. The pre-check now resolves leo's latest release (max version across leo-*-vX.Y.Z tags, since a release tags several crates at one rev but not every crate every time) and compares it against the version leo's manifest declares at sdk-abi's pinned rev — no new bookkeeping to drift. Either pin being behind triggers a run; the script composes the branch name so one source of truth encodes what moved. Dispatch inputs now arrive via env with format validation instead of being interpolated into the script body.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automates the recurring snarkVM upgrade. Three pieces:
.agents/skills/upgrade-snarkvm/SKILL.md— the/upgrade-snarkvmprocedure: detect latest non-testnet tag → study the changeset → bump pins (crates.io form when published; sdk-abi mirrors leo's pin exactly for type-coupling, held back if leo hasn't adopted the release) → adapt code → full native validation loop → PyPI patch bumps (one above live) → PR (ready if green, draft with findings if stuck)..github/scripts/snarkvm_check.sh— deterministic pre-check: current pin vs latestv*tag, crates.io publication, open-PR dedup. Shared by the skill and the workflow's early-exit job..github/workflows/snarkvm-upgrade.yml— daily cron (15:00 UTC ≈ 08:00 PDT) +workflow_dispatch(withforce_from_taginput for testing). The token-freecheckjob gates a claude-code-action job that runs the skill.One-time setup required before the workflow can run
ANTHROPIC_API_KEYrepo secret (claude-code-action)SNARKVM_UPGRADE_PATrepo secret — PAT/App token with repo scope, so upgrade PRs triggeron: pull_requestCI (defaultGITHUB_TOKENPRs don't)Rehearsal
Dry-run performed by staging the pin back to v4.8.0 and executing the skill end-to-end: #63 is the resulting upgrade PR (review the shape, then close). Full validation loop was green (874 fast + 4 proving + 6 testnet + 8 abi + 3 hook tests), version bumps landed at 0.3.1. Two skill fixes came out of it (leo's crates.io pin form, local-clone preference) — included here.