Implement verification of reproducible builds and run differential E2E tests

.github/actions/get-llvm/action.yml

@@ -114,7 +114,9 @@ runs:
               core.setFailed(`Artifact for '${target}' not found in release ${llvmRelease.tag_name} (${llvmRelease.html_url})`);
               process.exit();
             }
-            return asset.browser_download_url;
+            // Use the API URL (rather than `browser_download_url`) so that
+            // the authorization header is respected for draft releases.
+            return asset.url;
           }
 
           if (versionPrefix) {
@@ -127,7 +129,8 @@ runs:
     - name: download
       shell: bash
       run: |
-        curl -sSLo llvm.tar.gz ${{ steps.find.outputs.result }}
+        # Pass the authorization token to allow downloading draft release assets.
+        curl -sSLo llvm.tar.gz -H "Authorization: Bearer ${{ github.token }}" -H "Accept: application/octet-stream" ${{ steps.find.outputs.result }}
 
     - name: unpack
       shell: bash

.github/assets/revive-dev-node-polkavm-resolc.json

@@ -0,0 +1,3 @@
+{
+  "fixtures/solidity/simple/algorithm/cryptography/caesar_cypher.sol::2::Y M0 S-": "Failed"
+}

.github/workflows/reusable-build.yml

@@ -37,6 +37,10 @@ on:
 env:
   CARGO_TERM_COLOR: always
   RUST_MUSL_CROSS_IMAGE: messense/rust-musl-cross@sha256:2a8837c43bf12e246f1ebd05191de9ee27fcd22f9ca81511ccd4cf75dc16d71c
+  # Empty string is interpreted as the latest published release.
+  # To test a specific draft release, use the full name (e.g. "llvm-21.1.8-revive.5789e11").
+  # TODO: Update to `""` after publishing the draft LLVM release.
+  LLVM_VERSION: "llvm-21.1.8-revive.5789e11"
 
 jobs:
   build:
@@ -51,6 +55,23 @@ jobs:
       resolc-x86_64-apple-darwin_sha: ${{ steps.set-output.outputs.resolc-x86_64-apple-darwin_sha }}
       resolc-x86_64-pc-windows-msvc_url: ${{ steps.set-output.outputs.resolc-x86_64-pc-windows-msvc_url }}
       resolc-x86_64-pc-windows-msvc_sha: ${{ steps.set-output.outputs.resolc-x86_64-pc-windows-msvc_sha }}
+    # Queue jobs for the same target and commit instead of running in parallel or cancelling
+    # the first job. This allows the second workflow to use cached builds from the first if
+    # it is triggered by the same commit.
+    #
+    # Example: Workflow A and Workflow B both call this workflow for the same commit:
+    #
+    #   Time | Workflow A                | Workflow B
+    #   -----|---------------------------|---------------------------
+    #   T1   | Job starts, cache miss    |
+    #   T2   | Building...               | Job queued (same group)
+    #   T3   | Build done, cache saved   | Job queued
+    #   T4   | Job finishes              | Job starts, cache hit
+    #   T5   |                           | Skips build, job finishes
+    concurrency:
+      # Use `reusable-build` and not `${{ github.workflow }}` here so that callers share the same concurrency group.
+      group: reusable-build-${{ matrix.target }}-${{ github.sha }}
+      cancel-in-progress: false
     strategy:
       matrix:
         target:
@@ -81,26 +102,39 @@ jobs:
         if: runner.os == 'Windows'
         run: git config --system core.longpaths true
       - uses: actions/checkout@v4
+
+      # Cache build artifacts by target and commit (restores if available, saves on cache miss).
+      - name: Check Build Cache
+        id: cache
+        uses: actions/cache@v5
+        with:
+          # Use glob to match binaries with and without extensions.
+          path: resolc-${{ matrix.target }}*
+          key: build-${{ matrix.target }}-${{ github.sha }}
+
       - uses: actions-rust-lang/setup-rust-toolchain@v1
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
         with:
           rustflags: ""
           cache-key: ${{ matrix.target }}
 
       - name: Download LLVM
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
         uses: ./.github/actions/get-llvm
         with:
           target: ${{ matrix.target }}
+          version: ${{ env.LLVM_VERSION }}
 
       - name: Build (Native)
-        if: ${{ matrix.type == 'native' }}
+        if: ${{ steps.cache.outputs.cache-hit != 'true' && matrix.type == 'native' }}
         shell: bash
         run: |
           export LLVM_SYS_211_PREFIX=$PWD/llvm-${{ matrix.target }}
           make install-bin
           mv target/release/resolc resolc-${{ matrix.target }} || mv target/release/resolc.exe resolc-${{ matrix.target }}.exe
 
       - name: Build (MUSL)
-        if: ${{ matrix.type == 'musl' }}
+        if: ${{ steps.cache.outputs.cache-hit != 'true' && matrix.type == 'musl' }}
         run: |
           docker run -v $PWD:/opt/revive $RUST_MUSL_CROSS_IMAGE /bin/bash -c "
            cd /opt/revive
@@ -142,39 +176,70 @@ jobs:
     outputs:
       resolc_web_js_url: ${{ steps.set-output.outputs.resolc_web_js_url }}
       resolc_web_js_sha: ${{ steps.set-output.outputs.resolc_web_js_sha }}
+    # Queue jobs for the same target and commit instead of running in parallel or cancelling
+    # the first job. This allows the second workflow to use cached builds from the first if
+    # it is triggered by the same commit.
+    concurrency:
+      # Use `reusable-build` and not `${{ github.workflow }}` here so that callers share the same concurrency group.
+      group: reusable-build-wasm32-unknown-emscripten-${{ github.sha }}
+      cancel-in-progress: false
     env:
       RELEASE_RESOLC_WASM_URI: https://github.com/paritytech/revive/releases/download/${{ github.ref_name }}/resolc.wasm
     steps:
       - uses: actions/checkout@v4
+
+      # Cache build artifacts by commit (restores if available, saves on cache miss).
+      - name: Check Build Cache
+        id: cache
+        uses: actions/cache@v5
+        with:
+          path: resolc-wasm32-unknown-emscripten
+          key: build-wasm32-unknown-emscripten-${{ github.sha }}
+
       # Pin to 1.92.0 until LLVM WASM libraries are rebuilt with -fwasm-exceptions
       # See: https://github.com/paritytech/revive/issues/XXX
       - uses: actions-rust-lang/setup-rust-toolchain@v1
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
         with:
           toolchain: "1.92.0"
           target: wasm32-unknown-emscripten
           rustflags: ""
 
       - name: Download Host LLVM
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
         uses: ./.github/actions/get-llvm
         with:
           target: x86_64-unknown-linux-gnu
+          version: ${{ env.LLVM_VERSION }}
 
       - name: Download Wasm LLVM
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
         uses: ./.github/actions/get-llvm
         with:
           target: wasm32-unknown-emscripten
+          version: ${{ env.LLVM_VERSION }}
 
       - name: Download EMSDK
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
         uses: ./.github/actions/get-emsdk
 
       - name: Build
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
         run: |
           export LLVM_SYS_211_PREFIX=$PWD/llvm-x86_64-unknown-linux-gnu
           export REVIVE_LLVM_TARGET_PREFIX=$PWD/llvm-wasm32-unknown-emscripten
           source emsdk/emsdk_env.sh
           make install-wasm
           chmod -x ./target/wasm32-unknown-emscripten/release/resolc.wasm
 
+      - name: Compress Artifact
+        if: ${{ steps.cache.outputs.cache-hit != 'true' }}
+        run: |
+          mkdir -p resolc-wasm32-unknown-emscripten
+          mv ./target/wasm32-unknown-emscripten/release/resolc.js ./resolc-wasm32-unknown-emscripten/
+          mv ./target/wasm32-unknown-emscripten/release/resolc.wasm ./resolc-wasm32-unknown-emscripten/
+          mv ./target/wasm32-unknown-emscripten/release/resolc_web.js ./resolc-wasm32-unknown-emscripten/
+
       - name: Set Up Node.js
         uses: actions/setup-node@v3
         with:
@@ -185,8 +250,11 @@ jobs:
           mkdir -p solc
           curl -sSLo solc/soljson.js https://github.com/argotorg/solidity/releases/download/v0.8.34/soljson.js
           node -e "
-          const soljson = require('solc/soljson');
-          const createRevive = require('./target/wasm32-unknown-emscripten/release/resolc.js');
+          // Make sure to require './solc/soljson' and not 'solc/soljson' in order to use
+          // the explicitly downloaded solc, rather than resolving an npm package potentially
+          // installed in prior workflow jobs.
+          const soljson = require('./solc/soljson');
+          const createRevive = require('./resolc-wasm32-unknown-emscripten/resolc.js');
 
           const compiler = createRevive();
           compiler.soljson = soljson;
@@ -224,13 +292,6 @@ jobs:
           if(!bytecode.startsWith('50564d')) { process.exit(1); }
           "
 
-      - name: Compress Artifact
-        run: |
-          mkdir -p resolc-wasm32-unknown-emscripten
-          mv ./target/wasm32-unknown-emscripten/release/resolc.js ./resolc-wasm32-unknown-emscripten/
-          mv ./target/wasm32-unknown-emscripten/release/resolc.wasm ./resolc-wasm32-unknown-emscripten/
-          mv ./target/wasm32-unknown-emscripten/release/resolc_web.js ./resolc-wasm32-unknown-emscripten/
-
       - name: Upload artifacts (Release)
         if: ${{ inputs.is_release }}
         uses: actions/upload-artifact@v4