Merge zellic => veridise try 3

.github/workflows/test.yml

@@ -1,12 +1,15 @@
+# CI workflow for seismic-solidity
 name: Tests
 
 on:
   push:
     branches:
       - seismic
+      - merge-audits-2
   pull_request:
     branches:
       - seismic
+      - merge-audits-2
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -22,60 +25,148 @@ jobs:
     timeout-minutes: 120
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
       - uses: dtolnay/rust-toolchain@stable
-      # TODO: move lower after works
-      - name: Clone seismic-revm repo
-        run: |
-          git clone https://github.com/SeismicSystems/seismic-revm.git /tmp/seismic-revm
-          echo "SEISMIC_REVM_PATH=/tmp/seismic-revm" >> $GITHUB_ENV
-          echo "seismic-revm cloned to: /tmp/seismic-revm"
-      - uses: Swatinem/rust-cache@v2
+
+      # Restore build cache (based on target branch for PRs, current branch for pushes)
+      - name: Restore build cache
+        uses: actions/cache/restore@v4
         with:
-          shared-key: "semantic-test-cache"
-          workspaces: /tmp/seismic-revm
-      - name: Build seismic-revm
-        run: |
-          cd $SEISMIC_REVM_PATH
-          cargo build -p revme
-          echo "SEISMIC_REVME_EXEC=$SEISMIC_REVM_PATH/target/debug/revme" >> $GITHUB_ENV 
-      - name: Install & configure ccache
+          path: build
+          key: build-${{ runner.os }}-${{ github.base_ref || github.ref_name }}
+
+      # Combined dependency installation (saves ~15-20s by avoiding duplicate apt-get update)
+      - name: Install dependencies & ccache
         run: |
           set -euo pipefail
           sudo apt-get update
-          sudo apt-get install -y ccache
-          ccache --set-config=cache_dir=$HOME/.ccache
-          ccache --set-config=max_size=1G
+          sudo apt-get install -y ccache build-essential python3 python3-pip zlib1g-dev libboost-all-dev libssl-dev
           mkdir -p ~/.ccache
-          ccache --show-config | grep cache_dir
+
       - name: Restore ccache
-        uses: actions/cache@v4
+        uses: actions/cache/restore@v4
         with:
           path: ~/.ccache
-          key: ccache-${{ hashFiles('**/CMakeLists.txt') }}
-          restore-keys: ccache-
+          key: ccache-${{ runner.os }}-${{ github.base_ref || github.ref_name }}
 
-      - name: Install dependencies
+      # Configure ccache AFTER restore to ensure settings aren't overwritten
+      - name: Configure ccache
         run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential python3 python3-pip zlib1g-dev libboost-all-dev libssl-dev
+          ccache --set-config=cache_dir=$HOME/.ccache
+          ccache --set-config=max_size=2G
+          # CRITICAL: hash_dir=false allows cache hits even when build paths differ between CI runs
+          ccache --set-config=hash_dir=false
+          ccache --set-config=base_dir=$GITHUB_WORKSPACE
 
       - name: Build ssolc
         run: |
           set -euo pipefail
+          echo "Building with $(nproc) parallel jobs"
+          echo "=== ccache stats BEFORE build ==="
+          ccache -s
           mkdir -p build
           cd build
-          cmake .. -DCMAKE_BUILD_TYPE=Debug \
-                 -DPEDANTIC=OFF \
-                 -DCMAKE_C_COMPILER_LAUNCHER=ccache \
-                 -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+          # Only run cmake configure if CMakeCache.txt doesn't exist.
+          # cmake --build will automatically re-run cmake if CMakeLists.txt changed.
+          if [ ! -f CMakeCache.txt ]; then
+            echo "No CMakeCache.txt found, running cmake configure..."
+            cmake .. -DCMAKE_BUILD_TYPE=Debug \
+                   -DPEDANTIC=OFF \
+                   -DCMAKE_C_COMPILER_LAUNCHER=ccache \
+                   -DCMAKE_CXX_COMPILER_LAUNCHER=ccache
+          else
+            echo "CMakeCache.txt exists, skipping configure step"
+          fi
           cmake --build . --config Debug -j $(nproc)
+          echo "=== ccache stats AFTER build ==="
+          ccache -s
       - name: Run soltest
         run: ./scripts/soltest.sh
-      - name: Run semantic tests
+
+      # TODO: Remove the hardcoded commit checkout once we merge the --skip-via-ir flag into the seismic branch of seismic-revm
+      - name: Clone seismic-revm repo
+        run: |
+          git clone https://github.com/SeismicSystems/seismic-revm.git /tmp/seismic-revm
+          cd /tmp/seismic-revm
+          git checkout e962e2174e097e69284cf9cbbbf7bc15e5d718cf
+          echo "SEISMIC_REVM_PATH=/tmp/seismic-revm" >> $GITHUB_ENV
+          echo "seismic-revm cloned to: /tmp/seismic-revm"
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: "semantic-test-cache"
+          workspaces: /tmp/seismic-revm
+      - name: Build seismic-revm
+        run: |
+          cd $SEISMIC_REVM_PATH
+          cargo build -p revme
+          echo "SEISMIC_REVME_EXEC=$SEISMIC_REVM_PATH/target/debug/revme" >> $GITHUB_ENV
+
+      - name: Setup semantic test environment
         run: |
-          set -euo pipefail
           SSOLC_EXEC="$GITHUB_WORKSPACE/build/solc/solc"
           [ -x "$SSOLC_EXEC" ] || { echo "Error: solc not found at $SSOLC_EXEC"; exit 1; }
           [ -x "$SEISMIC_REVME_EXEC" ] || { echo "Error: revme executable not found at $SEISMIC_REVME_EXEC"; exit 1; }
-          SEMANTIC_TESTS_DIR="$GITHUB_WORKSPACE/test/libsolidity/semanticTests"
-          RUST_LOG=info RUST_BACKTRACE=1 $SEISMIC_REVME_EXEC semantics --keep-going -s "$SSOLC_EXEC" -t "$SEMANTIC_TESTS_DIR" 2>&1
+          echo "SSOLC_EXEC=$SSOLC_EXEC" >> $GITHUB_ENV
+          echo "SEMANTIC_TESTS_DIR=$GITHUB_WORKSPACE/test/libsolidity/semanticTests" >> $GITHUB_ENV
+
+          # Create a bash function for running semantic tests and export it
+          cat >> $GITHUB_ENV << 'SCRIPT_EOF'
+          RUN_SEMANTIC_TESTS<<EOF
+          run_semantic_tests() {
+            RUST_LOG=info \
+            RUST_BACKTRACE=1 \
+            $SEISMIC_REVME_EXEC semantics \
+              --keep-going \
+              -s "$SSOLC_EXEC" \
+              -t "$SEMANTIC_TESTS_DIR" \
+              --unsafe-via-ir \
+              "$@" \
+              2>&1
+          }
+          EOF
+          SCRIPT_EOF
+      - name: Run semantic tests (no optimizer, no IR)
+        run: |
+          set -euo pipefail
+          eval "$RUN_SEMANTIC_TESTS"
+          run_semantic_tests
+      - name: Run semantic tests (with optimizer, no IR)
+        run: |
+          set -euo pipefail
+          eval "$RUN_SEMANTIC_TESTS"
+          run_semantic_tests --optimize --optimizer-runs 200
+      - name: Run semantic tests (no optimizer, --via-ir)
+        run: |
+          set -euo pipefail
+          eval "$RUN_SEMANTIC_TESTS"
+          run_semantic_tests --via-ir
+      - name: Run semantic tests (with optimizer, --via-ir)
+        run: |
+          set -euo pipefail
+          eval "$RUN_SEMANTIC_TESTS"
+          run_semantic_tests --via-ir --optimize --optimizer-runs 200
+
+      # Save caches only on push to target branches (after PR merge)
+      # Delete old caches first since GitHub caches are immutable
+      - name: Delete old caches
+        if: github.event_name == 'push'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh cache delete "build-${{ runner.os }}-${{ github.ref_name }}" --repo ${{ github.repository }} || true
+          gh cache delete "ccache-${{ runner.os }}-${{ github.ref_name }}" --repo ${{ github.repository }} || true
+
+      - name: Save build cache
+        if: github.event_name == 'push'
+        uses: actions/cache/save@v4
+        with:
+          path: build
+          key: build-${{ runner.os }}-${{ github.ref_name }}
+
+      - name: Save ccache
+        if: github.event_name == 'push'
+        uses: actions/cache/save@v4
+        with:
+          path: ~/.ccache
+          key: ccache-${{ runner.os }}-${{ github.ref_name }}