Overhaul workflows: dedup, supply-chain hardening, bug fixes, e2e tests

.github/actionlint.yaml

@@ -0,0 +1,10 @@
+# actionlint's context schema lags behind GitHub: job.workflow_sha /
+# job.workflow_ref (the SHA/ref of the reusable workflow file that defines the
+# current job) are documented at
+# https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
+# but not yet in actionlint's `job` context type.
+paths:
+  .github/workflows/**/*.yml:
+    ignore:
+      - 'property "workflow_sha" is not defined in object type'
+      - 'property "workflow_ref" is not defined in object type'

.github/actions/setup/action.yml

@@ -0,0 +1,76 @@
+name: Setup Foundry toolchain
+description: >-
+  Shared setup for etherform jobs: installs Foundry, optionally sets up Node.js
+  and installs package-manager dependencies, and restores the Foundry compile cache.
+  The consumer repository must already be checked out.
+
+inputs:
+  foundry-version:
+    description: Foundry version to install (stable, nightly, or a specific version)
+    required: false
+    default: stable
+  package-manager:
+    description: Package manager for Node.js dependencies (none, npm, yarn, pnpm)
+    required: false
+    default: none
+  node-version:
+    description: Node.js version for package installation
+    required: false
+    default: '22'
+  working-directory:
+    description: Directory containing the Foundry project
+    required: false
+    default: '.'
+  cache:
+    description: Restore/save the Foundry compile cache between runs
+    required: false
+    default: 'true'
+
+runs:
+  using: composite
+  steps:
+    - name: Install Foundry
+      uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d # v1.8.0
+      with:
+        version: ${{ inputs.foundry-version }}
+
+    - name: Setup Node.js
+      if: inputs.package-manager != 'none'
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: ${{ inputs.package-manager }}
+        cache-dependency-path: |
+          ${{ inputs.working-directory }}/package-lock.json
+          ${{ inputs.working-directory }}/yarn.lock
+          ${{ inputs.working-directory }}/pnpm-lock.yaml
+
+    - name: Install dependencies
+      if: inputs.package-manager != 'none'
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        PACKAGE_MANAGER: ${{ inputs.package-manager }}
+      run: |
+        case "$PACKAGE_MANAGER" in
+          npm)  npm ci ;;
+          yarn) yarn --frozen-lockfile ;;
+          pnpm) corepack enable && pnpm install --frozen-lockfile ;;
+          *)
+            echo "::error::Unsupported package-manager '$PACKAGE_MANAGER' (expected none, npm, yarn, pnpm)"
+            exit 1
+            ;;
+        esac
+
+    - name: Restore Foundry compile cache
+      if: inputs.cache == 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ inputs.working-directory }}/cache
+        key: foundry-compile-${{ runner.os }}-${{ hashFiles(format('{0}/foundry.toml', inputs.working-directory), format('{0}/src/**/*.sol', inputs.working-directory)) }}
+        restore-keys: |
+          foundry-compile-${{ runner.os }}-
+
+    - name: Show Forge version
+      shell: bash
+      run: forge --version

.github/dependabot.yml

@@ -0,0 +1,13 @@
+# Keeps the SHA-pinned actions in workflows and the composite setup action
+# fresh; Dependabot updates the pin and the trailing version comment together.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directories:
+      - "/"
+      - "/.github/actions/setup"
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]