chore: release v0.45.0

.github/ci-groups.yml

@@ -29,4 +29,5 @@ excluded:
   - integration_test  # Requires live Dash node
   - dash-fuzz  # Honggfuzz binary targets, tested by fuzz.yml
   - masternode-seeds-fetcher  # Tooling binary; needs live dashd RPC, exercised by update-masternode-seeds.yml
+  - dash-spv-bench  # Benchmarking binary
   - git-state  # Compile-time proc-macro with no tests, exercised via dash-spv

.github/scripts/check_ci_status.sh

@@ -8,8 +8,27 @@ set -euo pipefail
 PR_NUMBER="$1"
 REPO="$2"
 
-gh pr checks "$PR_NUMBER" --repo "$REPO" --json name,bucket --jq '
-  [.[] | select(.name | test("^(validate-triggers|evaluate)$") | not)] |
+# gh pr checks signals check state through its exit code: 0 when every check
+# passed (and, with --json, also when some failed), 8 when checks are still
+# pending. Any other code is gh itself failing (auth, rate limit, network,
+# unknown PR); surface that instead of misreading it as an empty check set,
+# which would silently strip the label and hide the error. Keep stderr visible.
+set +e
+CHECKS=$(gh pr checks "$PR_NUMBER" --repo "$REPO" --json name,bucket)
+EXIT=$?
+set -e
+
+if [ "$EXIT" -ne 0 ] && [ "$EXIT" -ne 8 ]; then
+  exit "$EXIT"
+fi
+
+if [ -z "$CHECKS" ]; then
+  echo "no_checks"
+  exit 0
+fi
+
+echo "$CHECKS" | jq -r '
+  [.[] | select(.name | test("^(validate-triggers|evaluate|ready-for-review-trigger)$") | not)] |
   if length == 0 then "no_checks"
   elif all(.bucket == "pass" or .bucket == "skipping") then "all_passed"
   elif any(.bucket == "fail") then "has_failures"

.github/scripts/ci_config.py

@@ -153,6 +153,13 @@ def run_group_tests(args):
                 cmd = ["cargo", "test", "-p", crate, "--all-features"]
             result = subprocess.run(cmd)
 
+            if (
+                result.returncode == 0
+                and not coverage
+                and crate == "key-wallet-manager"
+            ):
+                result = subprocess.run(["cargo", "test", "-p", crate])
+
             if result.returncode != 0:
                 failed.append(crate)
                 github_error(f"Test failed for {crate} on {args.os}")

.github/workflows/ready-for-review-trigger.yml

@@ -0,0 +1,25 @@
+name: Ready for Review Trigger
+
+# Fork pull requests run pull_request and pull_request_review events with a
+# read-only token and no secrets, so they cannot add or remove labels. This
+# workflow does nothing but complete, which fires a workflow_run event that the
+# privileged "Ready for Review Label" workflow reacts to with a write token.
+on:
+  pull_request:
+    types: [ready_for_review, labeled, converted_to_draft]
+  pull_request_review:
+    types: [submitted, dismissed]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  relay:
+    name: ready-for-review-trigger
+    runs-on: ubuntu-latest
+    steps:
+      - name: Relay to applier
+        run: echo "Relaying pull request event to the ready-for-review applier via workflow_run."

.github/workflows/ready-for-review.yml

@@ -1,27 +1,33 @@
 name: Ready for Review Label
 
+# Runs only on workflow_run so it holds a write-capable token even for pull
+# requests opened from forks. Events tied to the fork head (pull_request,
+# pull_request_review) get a read-only token and no secrets, so they cannot
+# mutate labels themselves. The companion "Ready for Review Trigger" workflow
+# relays those events here by completing and firing this workflow_run.
 on:
-  pull_request:
-    types: [ready_for_review, labeled]
-  pull_request_review:
-    types: [submitted, dismissed]
   workflow_run:
-    workflows: ["Continuous integration", "Pre-commit Checks", "Sanitizer"]
+    workflows:
+      - "Continuous integration"
+      - "Pre-commit Checks"
+      - "Sanitizer"
+      - "Ready for Review Trigger"
     types: [completed]
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.workflow_run.head_branch }}
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_sha }}
   cancel-in-progress: true
 
 permissions:
+  contents: read
   pull-requests: write
   checks: read
+  issues: write
 
 jobs:
   # Ensure all pull_request-triggered workflows are monitored by workflow_run
   validate-triggers:
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_run'
     steps:
       - uses: actions/checkout@v4
         with:
@@ -34,10 +40,7 @@ jobs:
           SELF=".github/workflows/ready-for-review.yml"
 
           # Extract workflow names from the workflow_run trigger list in this file
-          MONITORED=$(grep -A1 'workflows:' "$SELF" \
-            | grep '\[' \
-            | tr ',' '\n' \
-            | sed 's/.*"\([^"]*\)".*/\1/')
+          MONITORED=$(grep -E '^\s+- "' "$SELF" | sed 's/.*"\([^"]*\)".*/\1/')
 
           MISSING=""
           for f in .github/workflows/*.yml; do
@@ -73,14 +76,6 @@ jobs:
 
   evaluate:
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-      checks: read
-      issues: write
-    # Skip non-CodeRabbit reviews
-    if: >-
-      github.event_name != 'pull_request_review' ||
-      github.event.review.user.login == 'coderabbitai[bot]'
     steps:
       - uses: actions/checkout@v4
         with:
@@ -90,54 +85,42 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPO: ${{ github.repository }}
-          EVENT_NAME: ${{ github.event_name }}
-          EVENT_ACTION: ${{ github.event.action }}
-          REVIEW_STATE: ${{ github.event.review.state }}
-          PR_NUMBER_DIRECT: ${{ github.event.pull_request.number }}
-          LABEL_NAME: ${{ github.event.label.name }}
-          PULL_REQUESTS_JSON: ${{ toJson(github.event.workflow_run.pull_requests) }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
         run: |
-          # On review dismissal or changes requested, remove label and exit
-          if [ "$EVENT_NAME" = "pull_request_review" ]; then
-            if [ "$EVENT_ACTION" = "dismissed" ] || [ "$REVIEW_STATE" = "changes_requested" ]; then
-              echo "CodeRabbit review dismissed or changes requested, removing label."
-              gh pr edit "$PR_NUMBER_DIRECT" --repo "$REPO" --remove-label "ready-for-review" || true
-              exit 0
-            fi
-          fi
-
-          # On merge-conflict label, remove ready-for-review and exit
-          if [ "$EVENT_NAME" = "pull_request" ] && [ "$EVENT_ACTION" = "labeled" ]; then
-            if [ "$LABEL_NAME" = "merge-conflict" ]; then
-              echo "Merge conflict detected, removing ready-for-review label."
-              gh pr edit "$PR_NUMBER_DIRECT" --repo "$REPO" --remove-label "ready-for-review" || true
-            fi
-            exit 0
-          fi
-
-          # Collect PR numbers depending on the event type
-          if [ "$EVENT_NAME" = "workflow_run" ]; then
-            PR_NUMBERS=$(echo "$PULL_REQUESTS_JSON" | jq -r '.[].number')
-          else
-            PR_NUMBERS="$PR_NUMBER_DIRECT"
-          fi
+          # Resolve the PR(s) for the head commit. github.event.workflow_run's
+          # pull_requests array is empty for fork PRs, and the commit-to-PR
+          # endpoint does not index fork heads, so match the head sha against
+          # the list of open PRs, which works regardless of where the branch
+          # lives. Matching the exact sha also ignores stale runs whose commit
+          # the PR has already moved past.
+          PR_NUMBERS=$(gh api --paginate "repos/$REPO/pulls?state=open&per_page=100" \
+            --jq ".[] | select(.head.sha == \"$HEAD_SHA\") | .number")
 
           if [ -z "$PR_NUMBERS" ]; then
-            echo "No associated pull requests found, skipping."
+            echo "No open pull request found for $HEAD_SHA, skipping."
             exit 0
           fi
 
           for PR_NUMBER in $PR_NUMBERS; do
             echo "=== Checking PR #$PR_NUMBER ==="
 
-            # Skip draft PRs
-            IS_DRAFT=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json isDraft --jq '.isDraft')
-            if [ "$IS_DRAFT" = "true" ]; then
-              echo "PR is a draft. Skipping."
+            PR_JSON=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json isDraft,labels)
+
+            if [ "$(echo "$PR_JSON" | jq -r '.isDraft')" = "true" ]; then
+              echo "PR is a draft. Removing ready-for-review label if present."
+              gh pr edit "$PR_NUMBER" --repo "$REPO" --remove-label "ready-for-review" || true
               continue
             fi
 
-            # Check if CodeRabbit has approved
+            # A merge conflict disqualifies the PR regardless of the other gates.
+            if [ "$(echo "$PR_JSON" | jq -r '[.labels[].name] | index("merge-conflict") != null')" = "true" ]; then
+              echo "Merge conflict present. Removing ready-for-review label if present."
+              gh pr edit "$PR_NUMBER" --repo "$REPO" --remove-label "ready-for-review" || true
+              continue
+            fi
+
+            # Check if CodeRabbit has approved. A dismissed or changes-requested
+            # review leaves the latest state != APPROVED and removes the label.
             CODERABBIT_STATE=$(gh api --paginate "repos/$REPO/pulls/$PR_NUMBER/reviews" | jq -rs '
               add
               | map(select(.user.login == "coderabbitai[bot]"))
@@ -148,7 +131,8 @@ jobs:
             echo "CodeRabbit review state: $CODERABBIT_STATE"
 
             if [ "$CODERABBIT_STATE" != "APPROVED" ]; then
-              echo "CodeRabbit has not approved. Skipping."
+              echo "CodeRabbit has not approved. Removing label if present."
+              gh pr edit "$PR_NUMBER" --repo "$REPO" --remove-label "ready-for-review" || true
               continue
             fi
 

.github/workflows/sanitizer.yml

@@ -18,6 +18,13 @@ on:
 permissions:
   contents: read
 
+# Pinned nightly: nightly-2026-07-14 (rustc daf2e5e18) ICEs while expanding the
+# libtest harness for dash-spv-ffi ("attribute is missing tokens:
+# rustc_test_entrypoint_marker" in rustc_ast/src/attr/mod.rs). Bump or restore
+# the floating `nightly` once a fixed nightly ships.
+env:
+  SANITIZER_TOOLCHAIN: nightly-2026-07-13
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -28,8 +35,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@nightly
+      - uses: dtolnay/rust-toolchain@master
         with:
+          toolchain: ${{ env.SANITIZER_TOOLCHAIN }}
           components: rust-src
 
       - name: Run tests with ASAN
@@ -41,20 +49,21 @@ jobs:
           SKIP_DASHD_TESTS: 1
         run: |
           # FFI crates (C interop)
-          cargo +nightly test -Zbuild-std --target x86_64-unknown-linux-gnu \
+          cargo "+$SANITIZER_TOOLCHAIN" test -Zbuild-std --target x86_64-unknown-linux-gnu \
             -p key-wallet-ffi -p dash-spv-ffi --lib --tests
 
           # Core crypto crates (unsafe optimizations)
-          cargo +nightly test -Zbuild-std --target x86_64-unknown-linux-gnu \
+          cargo "+$SANITIZER_TOOLCHAIN" test -Zbuild-std --target x86_64-unknown-linux-gnu \
             -p dashcore -p dashcore_hashes --lib --tests
 
   tsan:
     name: Thread Sanitizer
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@nightly
+      - uses: dtolnay/rust-toolchain@master
         with:
+          toolchain: ${{ env.SANITIZER_TOOLCHAIN }}
           components: rust-src
 
       - name: Run tests with TSAN
@@ -65,5 +74,5 @@ jobs:
           SKIP_DASHD_TESTS: 1
         run: |
           # Async crate with concurrent code
-          cargo +nightly test -Zbuild-std --target x86_64-unknown-linux-gnu \
+          cargo "+$SANITIZER_TOOLCHAIN" test -Zbuild-std --target x86_64-unknown-linux-gnu \
             -p dash-spv --lib --tests

.gitignore

@@ -50,3 +50,4 @@ __pycache__/
 
 # Build scripts artifacts
 *.log
+target-linux/