feat: publish the pallet-revive genesis with each release

.github/actions/setup-foundry/action.yml

@@ -0,0 +1,15 @@
+name: Setup Foundry
+description: Installs the foundry version this repo is known to build with.
+
+# One place for the version, so unpinning is one edit and not ten.
+#
+# Pinned at v1.7.1 because v1.8.0 breaks two things here: its linter aborts on
+# DotnsPopControllerInvariant.t.sol, which kills `forge build` everywhere, and `forge doc`
+# moved to Vocs, so deploy-docs.yml's mdbook step finds no book.toml. Fix both before unpinning.
+
+runs:
+  using: composite
+  steps:
+    - uses: foundry-rs/foundry-toolchain@v1
+      with:
+        version: v1.7.1

.github/workflows/4naly3er.yml

@@ -36,9 +36,7 @@ jobs:
           submodules: recursive
           fetch-depth: 0
 
-      - uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: stable
+      - uses: ./.github/actions/setup-foundry
 
       - uses: actions/setup-python@v5
         with:

.github/workflows/contract-coverage.yml

@@ -35,9 +35,7 @@ jobs:
         with:
           submodules: recursive
 
-      - uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: stable
+      - uses: ./.github/actions/setup-foundry
 
       - uses: oven-sh/setup-bun@v2
         with:

.github/workflows/deploy-contracts.yml

@@ -68,9 +68,7 @@ jobs:
           no-cache: true
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: stable
+        uses: ./.github/actions/setup-foundry
 
       - name: Make scripts executable
         run: chmod +x setup.bash

.github/workflows/deploy-docs.yml

@@ -39,9 +39,7 @@ jobs:
         with:
           submodules: recursive
 
-      - uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: stable
+      - uses: ./.github/actions/setup-foundry
 
       - name: Install mdbook
         run: |

.github/workflows/format-lint-product.yml

@@ -16,9 +16,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: stable
+      - uses: ./.github/actions/setup-foundry
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest

.github/workflows/gas-report.yml

@@ -56,9 +56,7 @@ jobs:
 
       - id: foundry_toolchain
         continue-on-error: true
-        uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: stable
+        uses: ./.github/actions/setup-foundry
       - name: Retry Foundry install on transient failure
         if: steps.foundry_toolchain.outcome == 'failure'
         run: |

.github/workflows/genesis-extractor-test.yml

@@ -0,0 +1,30 @@
+name: Genesis Extractor Test
+
+# The release builds a pallet-revive genesis artifact from the deploy stages. The full build
+# needs anvil, forge and the deployer keys, so it stays a release step; the state-to-GenesisConfig
+# conversion is pure JSON and is worth checking on every PR that touches it. Without this, a
+# broken extractor would only surface when a release is cut.
+on:
+  pull_request:
+    paths:
+      - "scripts/genesis/**"
+      - ".github/workflows/genesis-extractor-test.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  genesis-extractor-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Test the genesis extractor
+        run: node --test scripts/genesis/extract-genesis.test.mjs
+
+      - name: Check the builder parses
+        run: bash -n scripts/genesis/build-genesis.sh

.github/workflows/publish-prerelease.yml

@@ -23,6 +23,10 @@ concurrency:
 jobs:
   beta-release:
     runs-on: ubuntu-latest
+    # Baked into the genesis registry, so it decides which networks the artifact suits.
+    # Job-level: five steps name the file derived from it and must not disagree.
+    env:
+      DOTNS_TLD: test
     steps:
       # On workflow_dispatch the tag does not exist yet; the release step creates it
       # from the branch this run was started on. Read through an env var rather than
@@ -79,9 +83,7 @@ jobs:
         with:
           submodules: recursive
 
-      - uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: stable
+      - uses: ./.github/actions/setup-foundry
 
       - uses: oven-sh/setup-bun@v2
         with:
@@ -109,6 +111,21 @@ jobs:
           FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
         run: forge test -vv
 
+      # pallet-revive genesis, built from the code this tag ships. Unlike deployments.json
+      # below — which is withheld from a pre-release because it records a *previous* live
+      # deployment of different code — this genesis is a fresh deploy of exactly this commit,
+      # so its addresses and its ABIs do come from the same release.
+      #
+      # Present on pre-releases as well as releases so the asset sets do not diverge, and so
+      # this step is exercised before a real release depends on it.
+      - name: Build pallet-revive genesis
+        env:
+          FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
+          FACTORY_DEPLOYER_KEY: ${{ secrets.FACTORY_DEPLOYER_KEY }}
+          DOTNS_ADMIN_KEY: ${{ secrets.DOTNS_ADMIN_KEY }}
+          DOTNS_ADMIN_MNEMONIC: ${{ secrets.DOTNS_ADMIN_MNEMONIC }}
+        run: bash scripts/genesis/build-genesis.sh release
+
       - name: Extract ABIs
         run: |
           mkdir -p release/abis
@@ -145,7 +162,8 @@ jobs:
         run: |
           TAG="$RELEASE_TAG"
           cd release
-          zip -r "../dotns-abis-${TAG}.zip" abis/ release-manifest.json
+          zip -r "../dotns-abis-${TAG}.zip" abis/ release-manifest.json \
+            "dotns-genesis-${DOTNS_TLD}.json"
 
       - name: Generate release body
         env:
@@ -193,10 +211,16 @@ jobs:
             echo ""
             echo "### Deployments"
             echo ""
-            echo "No addresses are published with a pre-release: this code is not deployed yet."
-            echo "Deploy this tag, then cut the release, which carries the addresses it produced."
+            echo "No **live** addresses are published with a pre-release: this code is not"
+            echo "deployed yet, so there is no deployment to record. Deploy this tag, then cut"
+            echo "the release, which carries the addresses it produced."
+            echo ""
+            echo "The genesis attached here is different: it is built by deploying this very"
+            echo "commit to a throwaway chain, so it carries **this commit's own addresses**,"
+            echo "not the previous live deployment's."
             echo ""
             echo "- **Release contents:** [release-manifest.json]($ASSET_BASE/release-manifest.json)"
+            echo "- [dotns-genesis-${DOTNS_TLD}.json]($ASSET_BASE/dotns-genesis-${DOTNS_TLD}.json) — pallet-revive genesis, \`.${DOTNS_TLD}\` TLD, for ${DOTNS_TLD} networks only."
           } >> release-body.md
 
       - name: Create draft pre-release with artifacts
@@ -210,6 +234,7 @@ jobs:
             dotns-abis-*.zip
             release/abis/*.json
             release/release-manifest.json
+            release/dotns-genesis-${{ env.DOTNS_TLD }}.json
           body_path: release-body.md
           draft: true
           prerelease: true
@@ -226,6 +251,7 @@ jobs:
           { cat release/expected-assets.txt
             echo "dotns-abis-${TAG}.zip"
             echo "release-manifest.json"
+            echo "dotns-genesis-${DOTNS_TLD}.json"
           } | sort > "$RUNNER_TEMP/wanted-assets.txt"
           if ! diff -u "$RUNNER_TEMP/wanted-assets.txt" "$RUNNER_TEMP/actual-assets.txt"; then
             echo "::error::Draft pre-release $TAG does not match the expected asset set; delete the draft and re-run."

.github/workflows/publish-release.yml

@@ -23,6 +23,10 @@ concurrency:
 jobs:
   release:
     runs-on: ubuntu-latest
+    # Baked into the genesis registry, so it decides which networks the artifact suits.
+    # Job-level: five steps name the file derived from it and must not disagree.
+    env:
+      DOTNS_TLD: test
     steps:
       # On workflow_dispatch the tag does not exist yet; the release step creates it
       # from the branch this run was started on. Read through an env var rather than
@@ -76,9 +80,7 @@ jobs:
         with:
           submodules: recursive
 
-      - uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: stable
+      - uses: ./.github/actions/setup-foundry
 
       - uses: oven-sh/setup-bun@v2
         with:
@@ -106,6 +108,22 @@ jobs:
           FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
         run: forge test -vv
 
+      # pallet-revive genesis, so a chain can carry DotNS from block zero rather than
+      # deploying it afterwards. Built here rather than downstream: this repo owns the
+      # contracts, the deploy scripts and the CREATE3 factory key that fixes every address,
+      # and the artifact then ships from the same commit as the ABIs beside it.
+      #
+      # The owner key is taken from DOTNS_ADMIN_KEY if set, otherwise derived from
+      # DOTNS_ADMIN_MNEMONIC. It ends up owning the registry, resolvers, registrar, store factory
+      # and beacons in the genesis storage, so the script refuses to run without one.
+      - name: Build pallet-revive genesis
+        env:
+          FOUNDRY_DISABLE_NIGHTLY_WARNING: "1"
+          FACTORY_DEPLOYER_KEY: ${{ secrets.FACTORY_DEPLOYER_KEY }}
+          DOTNS_ADMIN_KEY: ${{ secrets.DOTNS_ADMIN_KEY }}
+          DOTNS_ADMIN_MNEMONIC: ${{ secrets.DOTNS_ADMIN_MNEMONIC }}
+        run: bash scripts/genesis/build-genesis.sh release
+
       - name: Extract ABIs
         run: |
           mkdir -p release/abis
@@ -140,7 +158,8 @@ jobs:
         run: |
           TAG="$RELEASE_TAG"
           cd release
-          zip -r "../dotns-abis-${TAG}.zip" abis/ deployments.json release-manifest.json
+          zip -r "../dotns-abis-${TAG}.zip" abis/ deployments.json release-manifest.json \
+            "dotns-genesis-${DOTNS_TLD}.json"
 
       - name: Generate release body
         env:
@@ -195,6 +214,17 @@ jobs:
             echo ""
             echo "- **Addresses:** [deployments.json]($ASSET_BASE/deployments.json)"
             echo "- **Release contents:** [release-manifest.json]($ASSET_BASE/release-manifest.json)"
+
+            # The genesis is TLD-specific, so the body has to say which TLD it carries —
+            # a reader choosing an artifact for their chain needs that before they download it.
+            echo ""
+            echo "### Genesis"
+            echo ""
+            echo "Pallet-revive genesis state, for a chain that should carry DotNS from block zero"
+            echo "rather than deploying it afterwards."
+            echo ""
+            echo "- [dotns-genesis-${DOTNS_TLD}.json]($ASSET_BASE/dotns-genesis-${DOTNS_TLD}.json) — registry initialised with the **\`.${DOTNS_TLD}\` TLD**, so it suits **${DOTNS_TLD} networks only** (this is what previewnet uses). Not for a production chain."
+            echo "- Contract addresses are in [deployments.json]($ASSET_BASE/deployments.json); they derive from the CREATE3 factory, not from the TLD."
           } >> release-body.md
 
           # `gh release view` with no tag resolves through /releases/latest, which skips
@@ -222,6 +252,7 @@ jobs:
             release/abis/*.json
             release/deployments.json
             release/release-manifest.json
+            release/dotns-genesis-${{ env.DOTNS_TLD }}.json
           body_path: release-body.md
           draft: true
           prerelease: false
@@ -239,6 +270,7 @@ jobs:
             echo "dotns-abis-${TAG}.zip"
             echo "deployments.json"
             echo "release-manifest.json"
+            echo "dotns-genesis-${DOTNS_TLD}.json"
           } | sort > "$RUNNER_TEMP/wanted-assets.txt"
           if ! diff -u "$RUNNER_TEMP/wanted-assets.txt" "$RUNNER_TEMP/actual-assets.txt"; then
             echo "::error::Draft release $TAG does not match the expected asset set; delete the draft and re-run."

.github/workflows/push_checking.yml

@@ -53,9 +53,7 @@ jobs:
         with:
           submodules: recursive
 
-      - uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: stable
+      - uses: ./.github/actions/setup-foundry
 
       - uses: oven-sh/setup-bun@v2
         with:

.github/workflows/slither.yaml

@@ -35,9 +35,7 @@ jobs:
         with:
           submodules: recursive
 
-      - uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: stable
+      - uses: ./.github/actions/setup-foundry
 
       - uses: actions/setup-python@v5
         with: