contracts-bedrock: migrate to just

.circleci/config.yml

@@ -528,7 +528,7 @@ jobs:
       # We do not use the pre-built contracts becuase forge coverage uses different optimizer settings
       - run:
           name: test and generate coverage
-          command: pnpm coverage:lcov
+          command: just coverage-lcov
           no_output_timeout: 18m
           environment:
             FOUNDRY_PROFILE: ci
@@ -556,7 +556,7 @@ jobs:
           working_directory: packages/contracts-bedrock
       - run:
           name: run tests
-          command: pnpm test
+          command: just test
           environment:
             FOUNDRY_PROFILE: ci
           working_directory: packages/contracts-bedrock
@@ -602,36 +602,36 @@ jobs:
         # Semver lock must come second because one of the later steps may modify the cache & force a contracts rebuild.
           name: semver lock
           command: |
-            pnpm semver-lock
+            just semver-lock
             git diff --exit-code semver-lock.json || echo "export SEMVER_LOCK_STATUS=1" >> "$BASH_ENV"
           working_directory: packages/contracts-bedrock
       - run:
           name: check deploy configs
-          command: pnpm validate-deploy-configs || echo "export DEPLOY_CONFIGS_STATUS=1" >> "$BASH_ENV"
+          command: just validate-deploy-configs || echo "export DEPLOY_CONFIGS_STATUS=1" >> "$BASH_ENV"
           working_directory: packages/contracts-bedrock
       - run:
           name: lint
           command: |
-            pnpm lint:check || echo "export LINT_STATUS=1" >> "$BASH_ENV"
+            just lint-check || echo "export LINT_STATUS=1" >> "$BASH_ENV"
           working_directory: packages/contracts-bedrock
       - run:
           name: gas snapshot
           command: |
-            pnpm gas-snapshot --check || echo "export GAS_SNAPSHOT_STATUS=1" >> "$BASH_ENV"
+            just gas-snapshot-check || echo "export GAS_SNAPSHOT_STATUS=1" >> "$BASH_ENV"
           environment:
             FOUNDRY_PROFILE: ci
           working_directory: packages/contracts-bedrock
           no_output_timeout: 15m
       - run:
           name: invariant docs
           command: |
-            pnpm autogen:invariant-docs
+            just autogen-invariant-docs
             git diff --exit-code ./invariant-docs/*.md || echo "export INVARIANT_DOCS_STATUS=1" >> "$BASH_ENV"
           working_directory: packages/contracts-bedrock
       - run:
           name: snapshots
           command: |
-            pnpm snapshots:check || echo "export SNAPSHOTS_STATUS=1" >> "$BASH_ENV"
+            just snapshots-check || echo "export SNAPSHOTS_STATUS=1" >> "$BASH_ENV"
           working_directory: packages/contracts-bedrock
       - run:
           name: size check
@@ -697,7 +697,7 @@ jobs:
           patterns: contracts-bedrock
       - run:
           name: validate spacers
-          command: pnpm validate-spacers
+          command: just validate-spacers
           working_directory: packages/contracts-bedrock
 
   todo-issues:
@@ -1162,6 +1162,11 @@ jobs:
           command: |
             nvm install
             nvm use && node --version && npm --version
+      - run:
+          name: Install Just
+          command: |
+            curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to $HOME/bin
+            echo 'export PATH="${PATH}:$HOME/bin"' >> $BASH_ENV
       - run:
           name: Install pnpm
           command: |
@@ -1491,7 +1496,7 @@ jobs:
           docker_layer_caching: true
       - run:
           name: Run Kontrol Tests
-          command: pnpm test:kontrol
+          command: just test-kontrol
           working_directory: ./packages/contracts-bedrock
       - store_artifacts:
           path: ./packages/contracts-bedrock/test/kontrol/logs/kontrol-results_latest.tar.gz

.github/workflows/slither.yml

@@ -15,13 +15,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Workaround to prevent slither-action from trying to install JS deps.
-      # Without this step, it detects the `package.json`, and since there is no
-      # lockfile it defaults `npm install` which fails due to the preinstall
-      # script to enforce pnpm. https://github.com/crytic/slither-action/issues/44#issuecomment-1338183656
-      - name: Remove package.json
-        run: rm packages/contracts-bedrock/package.json
-
       - name: Run Slither
         uses: crytic/slither-action@v0.4.0
         id: slither

ops/docker/Dockerfile.packages

@@ -1,92 +1,52 @@
-# This Dockerfile builds all the dependencies needed by the monorepo, and should
-# be used to build any of the follow-on services
-#
-
-# Stage 0 (named `manifests`) collects
-# dependency manifest files (`package.json` and `pnpm-lock.yaml`) which are then
-# used by stage 1 to install these dependencies
-# development. The only reason we need a separate stage just for collecting the
-# dependency manifests is that Docker's `COPY` command still does not allow
-# copying based on a glob pattern (see this GitHub issue for more details
-# https://github.com/moby/moby/issues/15858). Being able to copy only manifests
-# into stage 1 (the `COPY --from=manifests` statement) is important to maximize
-# Docker build cache hit rate. `alpine` is chosen as the base image for the
-# first stage because it's the smallest image that have access to the `cp
-# --parents -t` command (by installing the `coreutils` package).
-FROM alpine:3.16 as manifests
-RUN apk add coreutils
-
-WORKDIR /tmp
-COPY pnpm-lock.yaml pnpm-workspace.yaml .nvmrc package.json ./src/
-COPY packages src/packages/
-RUN mkdir manifests && \
-  cd src && \
-  # copy package.json recursively
-  find . -name 'package.json' | xargs cp --parents -t ../manifests/ && \
-  # pnpm-lock.yaml
-  cp pnpm-lock.yaml ../manifests/ && \
-  # pnpm-workspace.yaml
-  cp pnpm-workspace.yaml ../manifests/ && \
-  # .nvmrc
-  cp .nvmrc ../manifests/
+# This Dockerfile builds all the dependencies needed by the smart-contracts, excluding Go and Python.
 
 FROM us-docker.pkg.dev/oplabs-tools-artifacts/images/ci-builder:latest as foundry
-# bullseye-slim is debian based
-# we use it rather than alpine because it's not much
-# bigger and alpine is often missing packages for node applications
-# alpine is not officially supported by node.js
-FROM node:20.8.1-bullseye-slim as base
+
+# Historically the contracts-bedrock was on the node image based on Debian 11 (bullseye),
+# for Node / PNPM compatibility reasons.
+# We no longer use Node JS, but continue to use the same Debian version for compatibility.
+FROM debian:bullseye-slim as base
 
 # Base: install deps
 RUN apt-get update && apt-get install -y \
   curl \
   jq \
-  python3 \
   ca-certificates \
   git \
-  g++ \
   make \
-  gcc \
-  musl-dev \
   bash \
-  # the following 4 deps are needed for node-hid
-  # which is a deep sub dependency of ethers to install
-  # correctly
-  pkg-config \
-  libusb-1.0-0-dev \
-  libudev-dev \
   --no-install-recommends
 
 COPY /ops/docker/oplabs.crt /usr/local/share/ca-certificates/oplabs.crt
 RUN chmod 644 /usr/local/share/ca-certificates/oplabs.crt \
   && update-ca-certificates
 
-RUN npm install pnpm --global
+# Note: "just" is only available on Debian 13. Instead, pull it from the foundry image.
+COPY --from=foundry /usr/local/bin/just /usr/local/bin/just
 
 COPY --from=foundry /usr/local/bin/forge /usr/local/bin/forge
 COPY --from=foundry /usr/local/bin/cast /usr/local/bin/cast
 
 WORKDIR /opt/optimism
 
-# Copy manifest files into the image in
-# preparation for `pnpm install`.
-COPY --from=manifests /tmp/manifests  ./
-COPY *.json ./
-
-RUN pnpm install --frozen-lockfile
-
+COPY ./versions.json ./versions.json
 COPY ./packages ./packages
 
 COPY .git/ ./.git
 COPY .gitmodules ./.gitmodules
 RUN git submodule update --init --recursive
 
+# Not to be confused with OP, this is a OnePassword CLI tool.
 COPY --from=1password/op:2 /usr/local/bin/op /usr/local/bin/op
 
-RUN pnpm build
-
-ENTRYPOINT ["pnpm", "run"]
+# prebuild the smart-contracts for the convenience of the user
+RUN cd packages/contracts-bedrock && just build
 
 FROM base as contracts-bedrock
 WORKDIR /opt/optimism/packages/contracts-bedrock
+
+# Set "just" as entrypoint, so the default args (the Dockerfile CMD)
+# are passed in to it. This was previously "pnpm run" + "deploy".
+ENTRYPOINT ["just"]
+
 CMD ["deploy"]

package.json

@@ -5,8 +5,8 @@
   "license": "MIT",
   "scripts": {
     "clean": "rm -rf node_modules packages/**/node_modules",
-    "build": "cd packages/contracts-bedrock && pnpm build",
-    "test": "cd packages/contracts-bedrock && pnpm test",
+    "build": "cd packages/contracts-bedrock && just build",
+    "test": "cd packages/contracts-bedrock && just test",
     "issues": "./ops/scripts/todo-checker.sh",
     "lint:shellcheck": "find . -type f -name '*.sh' -not -path '*/node_modules/*' -not -path './packages/contracts-bedrock/lib/*' -not -path './packages/contracts-bedrock/kout*/*' -exec sh -c 'echo \"Checking $1\"; shellcheck \"$1\"' _ {} \\;",
     "install:foundry": "curl -L https://foundry.paradigm.xyz | bash && pnpm update:foundry",