ci: make Forge the single EVM release path

Co-authored-by: Hanzo Dev <[email protected]>

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+self-hosted-runner:
+  labels:
+    - amd64
+    - lux-build-amd64
+    - lux-build-linux-amd64

.github/workflows/publish_docker.yml

@@ -1,65 +0,0 @@
-name: Docker Release
-
-on:
-  push:
-    branches: [main]
-    tags: ["v*"]
-  workflow_dispatch:
-
-concurrency:
-  group: docker-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  packages: write
-  id-token: write
-
-jobs:
-  build-amd64:
-    runs-on: [self-hosted, linux, amd64]
-    outputs:
-      digest: ${{ steps.build.outputs.digest }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver: docker-container
-          driver-opts: |
-            network=host
-
-      - name: Login to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Image metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/luxfi/evm
-          tags: |
-            type=ref,event=tag
-            type=ref,event=branch
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=sha,format=short,prefix=sha-
-
-      - name: Build & push (amd64)
-        id: build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile
-          platforms: linux/amd64
-          push: true
-          build-args: |
-            LUXD_NODE_IMAGE=ghcr.io/luxfi/node:latest
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          provenance: false
-          cache-from: type=registry,ref=ghcr.io/luxfi/evm:buildcache-amd64
-          cache-to: type=registry,ref=ghcr.io/luxfi/evm:buildcache-amd64,mode=max

.github/workflows/release-binaries.yml

@@ -1,8 +1,7 @@
 name: Release Binaries
 
 on:
-  push:
-    tags: ['v*']
+  workflow_call:
 
 permissions:
   contents: write

.github/workflows/tests.yml

@@ -1,15 +1,6 @@
 name: Tests
 
 on:
-  push:
-    branches:
-      - main
-      - master
-    tags:
-      - "*"
-  pull_request:
-  merge_group:
-    types: [checks_requested]
   workflow_call:
 
 env:

.hanzo/workflows/ci.yml

@@ -0,0 +1,57 @@
+name: Tests
+
+# Forge is the authoritative CI for Lux. Keep one native-runner workflow here;
+# the GitHub workflows remain for the GitHub mirror and are not duplicated by
+# Forge when this directory exists.
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  GOWORK: off
+  CGO_ENABLED: '0'
+
+jobs:
+  test:
+    runs-on: [lux-build-linux-amd64]
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - run: go test ./... -count=1
+
+  generated:
+    runs-on: [lux-build-linux-amd64]
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - run: go mod tidy
+      - run: git diff --exit-code
+
+  static:
+    runs-on: [lux-build-linux-amd64]
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Formatting
+        run: |
+          unformatted=$(gofmt -l .)
+          test -z "$unformatted"
+      - run: go vet ./...

.hanzo/workflows/release.yml

@@ -0,0 +1,28 @@
+name: Release
+
+# The EVM tag is the plugin source consumed by node's single image build. It
+# does not publish a second Docker image: node clones this exact tag, builds the
+# plugin, checks node/plugin API agreement, and publishes the deployable image.
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: [lux-build-linux-amd64]
+    timeout-minutes: 60
+    env:
+      GOWORK: off
+      CGO_ENABLED: '0'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - run: go test ./... -count=1
+      - run: ./scripts/build.sh
+      - run: test -x build/evm