From 2e207fc5b7ea6983dfc3dd4456aed24fdd61e590 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Gr=C3=BCner?=
 <47506558+MegaRedHand@users.noreply.github.com>
Date: Wed, 11 Feb 2026 17:23:49 -0300
Subject: [PATCH 1/3] ci: generate test fixtures from pinned leanSpec commit

---
 .github/workflows/ci.yml | 65 ++++++++++++++++++++++++++++++++++++----
 1 file changed, 59 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df940e6..e91e32a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,13 +47,66 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      # NOTE: we download the latest fixtures since generating them in CI fails
-      - name: Download test fixtures
-        env:
-          GH_TOKEN: ${{ github.token }}
+      # Read the pinned leanSpec commit from the Makefile (single source of truth)
+      - name: Get leanSpec pinned commit
+        id: lean-spec
+        run: echo "commit=$(grep 'LEAN_SPEC_COMMIT_HASH' Makefile | sed 's/.*:=//')" >> $GITHUB_OUTPUT
+
+      - name: Cache test fixtures
+        id: cache-fixtures
+        uses: actions/cache@v4
+        with:
+          path: leanSpec/fixtures
+          key: leanspec-fixtures-${{ steps.lean-spec.outputs.commit }}
+
+      # All fixture generation steps are skipped when the cache hits
+      - name: Checkout leanSpec at pinned commit
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        uses: actions/checkout@v6
+        with:
+          repository: leanEthereum/leanSpec
+          ref: ${{ steps.lean-spec.outputs.commit }}
+          path: leanSpec
+
+      - name: Install uv and Python 3.14
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+          cache-dependency-glob: "leanSpec/pyproject.toml"
+          python-version: "3.14"
+
+      - name: Sync leanSpec dependencies
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        working-directory: leanSpec
+        run: uv sync --no-progress
+
+      - name: Get production keys URL hash
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        id: prod-keys-url
+        working-directory: leanSpec
         run: |
-          mkdir -p leanSpec/fixtures
-          gh run download --repo leanEthereum/leanSpec --name fixtures-prod-scheme --dir leanSpec/fixtures
+          URL=$(uv run python -c "from consensus_testing.keys import KEY_DOWNLOAD_URLS; print(KEY_DOWNLOAD_URLS['prod'])")
+          HASH=$(echo -n "$URL" | sha256sum | awk '{print $1}')
+          echo "hash=$HASH" >> $GITHUB_OUTPUT
+
+      - name: Cache production keys
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        id: cache-prod-keys
+        uses: actions/cache@v4
+        with:
+          path: leanSpec/packages/testing/src/consensus_testing/test_keys/prod_scheme
+          key: prod-keys-${{ steps.prod-keys-url.outputs.hash }}
+
+      - name: Download production keys
+        if: steps.cache-fixtures.outputs.cache-hit != 'true' && steps.cache-prod-keys.outputs.cache-hit != 'true'
+        working-directory: leanSpec
+        run: uv run python -m consensus_testing.keys --download --scheme prod
+
+      - name: Generate test fixtures
+        if: steps.cache-fixtures.outputs.cache-hit != 'true'
+        working-directory: leanSpec
+        run: uv run fill --fork=Devnet --scheme prod -o fixtures -n 2
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master

From 17952ccea23edface15e9415d05db7e973e180fc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Gr=C3=BCner?=
 <47506558+MegaRedHand@users.noreply.github.com>
Date: Wed, 11 Feb 2026 17:27:55 -0300
Subject: [PATCH 2/3] fix(ci): use anchored sed to extract leanSpec commit hash

The previous grep matched multiple Makefile lines containing
LEAN_SPEC_COMMIT_HASH, including the recipe usage, which
produced invalid $GITHUB_OUTPUT entries.
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e91e32a..8a7c647 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
       # Read the pinned leanSpec commit from the Makefile (single source of truth)
       - name: Get leanSpec pinned commit
         id: lean-spec
-        run: echo "commit=$(grep 'LEAN_SPEC_COMMIT_HASH' Makefile | sed 's/.*:=//')" >> $GITHUB_OUTPUT
+        run: echo "commit=$(sed -n 's/^LEAN_SPEC_COMMIT_HASH:= *//p' Makefile)" >> $GITHUB_OUTPUT
 
       - name: Cache test fixtures
         id: cache-fixtures

From 39b3a1a14e4b44c678adc75070a69c8c8264009f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Gr=C3=BCner?=
 <47506558+MegaRedHand@users.noreply.github.com>
Date: Wed, 11 Feb 2026 17:35:27 -0300
Subject: [PATCH 3/3] fix(ci): touch fixtures dir to prevent make from
 regenerating

Intermediate CI steps (uv sync, key downloads) modify files inside
leanSpec/, updating its mtime after fixtures were generated.
This makes `make` think fixtures are stale and re-runs the fill
recipe, which fails on a non-empty output directory.
---
 .github/workflows/ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8a7c647..3bede38 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,6 +108,11 @@ jobs:
         working-directory: leanSpec
         run: uv run fill --fork=Devnet --scheme prod -o fixtures -n 2
 
+      # Ensure make sees fixtures as up-to-date (its timestamp must be
+      # newer than leanSpec/, which intermediate steps may have modified).
+      - name: Mark fixtures as up-to-date
+        run: touch leanSpec/fixtures
+
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
         with: