refactor(lint): read the HIR through gcx

.changelog/anvil-simulated-block-size.md

@@ -0,0 +1,5 @@
+---
+anvil: patch
+---
+
+Included the encoded block size in `eth_simulateV1` responses.

.changelog/consolidate-symbolic-call-state-machines.md

@@ -0,0 +1,6 @@
+---
+forge: patch
+foundry-evm-symbolic: patch
+---
+
+Consolidated symbolic call-path execution and child-outcome joining into shared state machines without changing symbolic execution behavior.

.changelog/lint-hir-through-gcx.md

@@ -0,0 +1,5 @@
+---
+forge: patch
+---
+
+Internal cleanup of the Solidity linter: analyses read the HIR through the global context instead of carrying a separate handle; lint behavior is unchanged.

.changelog/skip-yul-literal-instead-of-constant.md

@@ -0,0 +1,5 @@
+---
+forge: patch
+---
+
+Ignored inline assembly in the `literal-instead-of-constant` lint.

.github/scripts/format.sh

@@ -9,4 +9,4 @@ while IFS= read -r -d '' file; do
 done < <(find testdata -name '*.sol' ! -name Vm.sol ! -name console.sol -print0)
 
 # Run forge fmt on all found files
-cargo run --bin forge -- fmt "$@" "${sol_files[@]}"
+cargo run --locked --bin forge -- fmt "$@" "${sol_files[@]}"

.github/workflows/benchmarks-nightly.yml

@@ -11,8 +11,15 @@ env:
   RUSTC_WRAPPER: "sccache"
 
 jobs:
+  cargo-cooldown:
+    if: github.event_name != 'schedule' || github.repository == 'foundry-rs/foundry'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/cargo-cooldown.yml
+
   run-benchmarks:
     name: Run Nightly Benchmarks
+    needs: cargo-cooldown
     if: github.event_name != 'schedule' || github.repository == 'foundry-rs/foundry'
     runs-on: depot-ubuntu-24.04-32
     permissions:

.github/workflows/benchmarks.yml

@@ -19,8 +19,14 @@ env:
   RUSTC_WRAPPER: "sccache"
 
 jobs:
+  cargo-cooldown:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/cargo-cooldown.yml
+
   run-benchmarks:
     name: Run All Benchmarks
+    needs: cargo-cooldown
     runs-on: depot-ubuntu-24.04-32
     permissions:
       contents: read
@@ -49,27 +55,6 @@ jobs:
         with:
           toolchain: stable
 
-      - uses: rui314/setup-mold@7e4f20ad28a2e8ca6fd0892ccf72e2abb706b9c3 # v1
-
-      - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
-
-      - name: Setup Foundry
-        env:
-          FOUNDRY_DIR: ${{ github.workspace }}/.foundry
-          GITHUB_WORKSPACE: ${{ github.workspace }}
-        run: |
-          ./.github/scripts/setup-foundryup.sh
-          printf '%s\n' "$GITHUB_WORKSPACE/.foundry/bin" >> "$GITHUB_PATH"
-
-      - name: Build benchmark binary
-        run: cargo build --locked --release --bin foundry-bench
-
-      - name: Install hyperfine
-        run: |
-          curl -L https://github.com/sharkdp/hyperfine/releases/download/v1.19.0/hyperfine-v1.19.0-x86_64-unknown-linux-gnu.tar.gz | tar xz
-          sudo mv hyperfine-v1.19.0-x86_64-unknown-linux-gnu/hyperfine /usr/local/bin/
-          rm -rf hyperfine-v1.19.0-x86_64-unknown-linux-gnu
-
       # When 'local' is requested, build origin/master from source in a separate
       # worktree and benchmark it as the baseline (labelled 'master') against
       # this branch (labelled 'local'). This compares against master itself, not
@@ -88,6 +73,11 @@ jobs:
             git worktree add --detach ../foundry-baseline "$base_sha"
             echo "versions=master=../foundry-baseline,local" >> "$GITHUB_OUTPUT"
             echo "is_source_comparison=true" >> "$GITHUB_OUTPUT"
+            if [[ -f ../foundry-baseline/cooldown.toml ]]; then
+              echo "baseline_strict_project_config=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "baseline_strict_project_config=false" >> "$GITHUB_OUTPUT"
+            fi
             printf '%s' "$base_sha" > benches/baseline-ref.txt
             printf '%s' "$candidate_sha" > benches/candidate-ref.txt
             git rev-list --count "${candidate_sha}..${base_sha}" > benches/behind-count.txt
@@ -103,6 +93,36 @@ jobs:
             echo "is_source_comparison=false" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Enforce baseline Cargo dependency cooldown
+        if: steps.prep.outputs.is_source_comparison == 'true'
+        uses: tempoxyz/gh-actions/actions/cargo-cooldown@0aa93238d85fd085d7901320b670cc6adb7a02f3 # main
+        env:
+          RUSTC_WRAPPER: ""
+        with:
+          strict-project-config: ${{ steps.prep.outputs.baseline_strict_project_config }}
+          working-directory: ../foundry-baseline
+
+      - uses: rui314/setup-mold@7e4f20ad28a2e8ca6fd0892ccf72e2abb706b9c3 # v1
+
+      - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
+
+      - name: Setup Foundry
+        env:
+          FOUNDRY_DIR: ${{ github.workspace }}/.foundry
+          GITHUB_WORKSPACE: ${{ github.workspace }}
+        run: |
+          ./.github/scripts/setup-foundryup.sh
+          printf '%s\n' "$GITHUB_WORKSPACE/.foundry/bin" >> "$GITHUB_PATH"
+
+      - name: Build benchmark binary
+        run: cargo build --locked --release --bin foundry-bench
+
+      - name: Install hyperfine
+        run: |
+          curl -L https://github.com/sharkdp/hyperfine/releases/download/v1.19.0/hyperfine-v1.19.0-x86_64-unknown-linux-gnu.tar.gz | tar xz
+          sudo mv hyperfine-v1.19.0-x86_64-unknown-linux-gnu/hyperfine /usr/local/bin/
+          rm -rf hyperfine-v1.19.0-x86_64-unknown-linux-gnu
+
       - name: Run forge test benchmarks
         env:
           FOUNDRY_DIR: ${{ github.workspace }}/.foundry

.github/workflows/cargo-cooldown.yml

@@ -0,0 +1,28 @@
+name: Cargo dependency cooldown
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Reject newly published crates
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      RUSTC_WRAPPER: ""
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
+        with:
+          toolchain: stable
+      - name: Enforce Cargo dependency cooldown
+        uses: tempoxyz/gh-actions/actions/cargo-cooldown@0aa93238d85fd085d7901320b670cc6adb7a02f3 # main
+        with:
+          strict-project-config: true

.github/workflows/ci-mpp.yml

@@ -27,11 +27,17 @@ env:
   RUSTC_WRAPPER: "sccache"
 
 jobs:
+  cargo-cooldown:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/cargo-cooldown.yml
+
   mpp-check:
     # Skip on PRs from forks (only run for branches in foundry-rs/foundry, i.e. maintainer PRs).
     if: |
       github.event_name != 'pull_request' ||
       github.event.pull_request.head.repo.full_name == github.repository
+    needs: cargo-cooldown
     runs-on: depot-ubuntu-latest
     timeout-minutes: 60
     permissions:

.github/workflows/ci-tempo.yml

@@ -38,13 +38,20 @@ env:
   RUSTC_WRAPPER: "sccache"
 
 jobs:
+  cargo-cooldown:
+    if: github.event_name != 'schedule' || github.repository == 'foundry-rs/foundry'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/cargo-cooldown.yml
+
   tempo-check:
     # Skip on PRs from forks and Dependabot, which cannot access the RPC secrets.
     if: |
       (github.event_name != 'schedule' || github.repository == 'foundry-rs/foundry') &&
       (github.event_name != 'pull_request' ||
       (github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.user.login != 'dependabot[bot]'))
+    needs: cargo-cooldown
     runs-on: depot-ubuntu-latest-16
     timeout-minutes: 60
     permissions:
@@ -134,7 +141,7 @@ jobs:
   issue:
     name: Open an issue
     runs-on: ubuntu-latest
-    needs: [tempo-check]
+    needs: [cargo-cooldown, tempo-check]
     if: failure() && github.event_name == 'schedule'
     permissions:
       contents: read

.github/workflows/ci.yml

@@ -17,6 +17,11 @@ env:
   RUSTC_WRAPPER: "sccache"
 
 jobs:
+  cargo-cooldown:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/cargo-cooldown.yml
+
   test:
     uses: ./.github/workflows/test.yml
     permissions:
@@ -36,6 +41,7 @@ jobs:
       id-token: write
 
   doctest:
+    needs: cargo-cooldown
     runs-on: depot-ubuntu-latest
     timeout-minutes: 30
     permissions:
@@ -56,6 +62,7 @@ jobs:
       - run: cargo test --workspace --doc --locked
 
   no-default-features:
+    needs: cargo-cooldown
     runs-on: depot-ubuntu-latest
     timeout-minutes: 30
     permissions:
@@ -74,6 +81,7 @@ jobs:
   touch-id-link:
     name: touch-id link (macOS)
     if: github.event_name == 'push'
+    needs: cargo-cooldown
     runs-on: depot-macos-latest
     timeout-minutes: 45
     permissions:
@@ -145,6 +153,7 @@ jobs:
           node --test .github/scripts/tests/test-create-tag.js
 
   clippy:
+    needs: cargo-cooldown
     runs-on: depot-ubuntu-latest
     timeout-minutes: 30
     permissions:
@@ -180,6 +189,7 @@ jobs:
       - run: cargo fmt --all --check
 
   forge-fmt:
+    needs: cargo-cooldown
     runs-on: depot-ubuntu-latest
     timeout-minutes: 30
     permissions:
@@ -203,6 +213,7 @@ jobs:
         run: ./.github/scripts/format.sh --check
 
   deny:
+    needs: cargo-cooldown
     uses: tempoxyz/ci/.github/workflows/deny.yml@268b3ce142717ff86c58fbbcc3abc3f109f0fb8d # main
     permissions:
       contents: read
@@ -249,12 +260,14 @@ jobs:
     if: always()
     permissions: {}
     needs:
+      - cargo-cooldown
       - test
       - docs
       - doctest
       - no-default-features
       - touch-id-link
       - typos
+      - shellcheck
       - github-scripts
       - clippy
       - rustfmt

.github/workflows/crate-checks.yml

@@ -16,7 +16,14 @@ env:
   RUSTC_WRAPPER: "sccache"
 
 jobs:
+  cargo-cooldown:
+    if: github.event_name != 'schedule' || github.repository == 'foundry-rs/foundry'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/cargo-cooldown.yml
+
   crate-checks:
+    needs: cargo-cooldown
     if: github.event_name != 'schedule' || github.repository == 'foundry-rs/foundry'
     runs-on: depot-ubuntu-latest
     timeout-minutes: 30
@@ -40,7 +47,7 @@ jobs:
   issue:
     name: Open an issue
     runs-on: ubuntu-latest
-    needs: [crate-checks]
+    needs: [cargo-cooldown, crate-checks]
     if: failure()
     permissions:
       contents: read

.github/workflows/docker-publish.yml

@@ -32,8 +32,14 @@ env:
   RUST_FEATURES: aws-kms,gcp-kms,turnkey,cli,asm-keccak,js-tracer,monad,optimism
 
 jobs:
+  cargo-cooldown:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/cargo-cooldown.yml
+
   build:
     name: build, sign, and stage
+    needs: cargo-cooldown
     runs-on: depot-ubuntu-latest
     permissions:
       attestations: write

.github/workflows/docs.yml

@@ -18,7 +18,13 @@ env:
   RUSTC_WRAPPER: "sccache"
 
 jobs:
+  cargo-cooldown:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/cargo-cooldown.yml
+
   docs:
+    needs: cargo-cooldown
     runs-on: depot-ubuntu-latest
     timeout-minutes: 30
     permissions:

.github/workflows/release.yml

@@ -24,6 +24,12 @@ env:
   RUST_FEATURES: aws-kms,gcp-kms,turnkey,cli,asm-keccak,js-tracer,monad,optimism
 
 jobs:
+  cargo-cooldown:
+    if: github.event_name != 'schedule' || github.repository == 'foundry-rs/foundry'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/cargo-cooldown.yml
+
   prepare:
     name: Prepare release
     if: github.event_name != 'schedule' || github.repository == 'foundry-rs/foundry'
@@ -317,7 +323,7 @@ jobs:
     name: release ${{ matrix.target }} (${{ matrix.runner }})
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 240
-    needs: prepare
+    needs: [cargo-cooldown, prepare]
     if: ${{ needs.prepare.outputs.skip_assets != 'true' }}
     strategy:
       fail-fast: false
@@ -639,6 +645,7 @@ jobs:
     name: Open an issue
     runs-on: ubuntu-latest
     needs: [
+      cargo-cooldown,
       prepare,
       release-docker,
       release-docker-metadata,