ci: migrate Catalyst workflows to Taiko

[davidtaikocha]

Summary

• Consolidate Rust formatting, Clippy, spelling, tests, and dependency policy checks into one Taiko-owned CI workflow on GitHub-hosted runners.
• Replace the Nethermind-gated image workflows with a main-node-only Docker workflow for us-docker.pkg.dev/evmchain/images/catalyst-node.
• Validate Docker builds without credentials on pull requests; publish native linux/amd64 and linux/arm64 images by digest and merge them into one manifest on master and v* tags.
• Authenticate GAR publishing with Taiko's existing GitHub OIDC / Workload Identity Federation setup.
• Retire legacy node, P2P, spammer, pytest-old, and split Rust workflows while leaving the existing E2E and Claude workflows unchanged.
• Make BLST_PORTABLE an effective Docker build argument and update Cargo.lock to patched anyhow, crossbeam-epoch, and ruint releases required by the dependency audit.

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-features --exclude p2p-boot-node --locked -- -D warnings
• cargo test --workspace --locked --verbose (129 unit tests plus doc tests)
• typos .
• cargo deny check (passes; retains one existing transitive yanked spin 0.9.8 warning)
• actionlint .github/workflows/*.yml
• docker buildx build --call=check --file Dockerfile .
• Local CI migration contract and staged diff checks

Before merge

• Confirm the pull-request Docker validation job completes. Two local full-build attempts reached the container's Optimism git dependency fetch and made no further progress; they were cancelled without a compile failure.
• Confirm the WIF provider permits taikoxyz/Catalyst and gar-github-action@evmchain.iam.gserviceaccount.com can write us-docker.pkg.dev/evmchain/images/catalyst-node.

[kimo-ice]

Review

The Rust CI half is solid and proven green. The Docker half is the concern: it has never executed, and the PR body describes safeguards that aren't in the diff.

---

Blocking

1. The PR-time Docker validation described in the summary does not exist.

The summary says "Validate Docker builds without credentials on pull requests." There is no such job. docker-build.yml triggers only on push to master, v* tags, and workflow_dispatch — no pull_request. And ci.yml has exactly five jobs: fmt, clippy, typos, test, dependency-audit. No Docker job anywhere.

Consequence: the entire publish path — WIF auth, per-arch digest export, artifact round-trip, imagetools create — first executes on a master push, against the shared production registry. Combined with the PR's own note that two local full builds never got past the Optimism git fetch, nothing has compiled this Dockerfile end to end. Suggest adding a pull_request job with push: false, no auth, amd64 only.

2. Three more description ↔ implementation mismatches. Reviewers approve off the summary, so these matter:

Summary says	Diff does
"GitHub-hosted runners"	self-hosted arc-runner-set / arc-runner-set-arm64
"main-node-only Docker workflow"	matrix also builds + publishes catalyst-p2p-bootnode
"Make BLST_PORTABLE an effective Docker build argument"	removes the build-arg entirely in favor of a Cargo feature

---

High

3. p2p-boot-node scope contradiction. ci.yml excludes it from clippy as "outside the maintained main-node scope" — yet docker-build.yml publishes catalyst-p2p-bootnode to GAR on every master push and tag. Meanwhile cargo test --workspace does not exclude it. So a shipped production image is compiled and tested but deliberately not linted. Either drop it from the publish matrix or drop the clippy exclusion.

4. No build cache on the publish jobs. Four cold full-workspace Rust builds (2 images × 2 arches, 120-min timeouts) per qualifying master push, on self-hosted ARC. The old workflow was gated by if: github.repository == 'NethermindEth/Catalyst', so it never ran in this fork — this PR turns these on for the first time. Worth adding cache-from/cache-to, and considering the old per-image paths scoping so a node-only change doesn't rebuild the bootnode.

---

Verified correct

The BLST portability fix is real, and better than the description suggests. Checked both halves:

• blst 0.3.x build.rs picks portable mode purely from cfg!(feature = "portable") — it never reads a BLST_PORTABLE env var. Master's Dockerfile also never declared ARG BLST_PORTABLE, so the old build-args: BLST_PORTABLE=1 was doubly a no-op.
• cargo tree -e features -i c-kzg on this branch shows c-kzg feature "portable" enabled by exactly one crate: common. alloy-consensus/alloy-eips pull c-kzg with default-features = false, so portable was genuinely off before. Release images really were baking in host-detected ADX/BMI2 — the SIGILL risk in the comment is not hypothetical.

One trade-off not stated: portable is now global, so BLS/KZG gives up ADX/MULX on modern hosts too. Right call for portable release images, but worth making conscious.

WIF config is sound. Provider and service account are byte-identical to taiko-mono's working taiko-client-rs--docker.yml, and every action major version (checkout@v7, upload-artifact@v7, download-artifact@v8, login@v4, buildx@v4, build-push@v7, metadata@v6, auth@v3) matches what taiko-mono runs today. arc-runner-set-arm64 is in active use there. The open question is only whether the provider's attribute condition admits taikoxyz/Catalyst.

E2E workflows are unaffected. They docker buildx build --load locally and use nethermind/catalyst-node only as a local tag — they never pull from Docker Hub. Retiring the Docker Hub publish doesn't break them.

---

Medium / nits

• Docker Hub publishing is dropped silently. nethermind/catalyst-node was public; GAR is not. Any downstream consumer pulling from Docker Hub will silently pin to a stale image. Should be an announced break.
• merge job fragility: if download-artifact matches nothing, ${{ runner.temp }}/digests may not exist and the step dies on working-directory before the script's own empty-digest guard runs. mkdir -p first.
• cancel-in-progress: true on a publish workflow can kill a run between digest push and manifest create, orphaning untagged digests in GAR. Prefer false here.
• CI runs on draft PRs — opened/synchronize fire before ready_for_review, so drafts burn self-hosted runner time. Add a draft == false guard if that's a concern.
• rustup show as installer in .github/actions/setup-rust/action.yml: works today (CI is green, and the p2p Dockerfile does the same), but auto-install on show is deprecated upstream. rustup toolchain install is future-proof.
• Scope creep in Cargo.lock: ruint 1.18→1.20 pulls in six new ark-* 0.6.0 crates. Audit-justified, but a dep-graph change riding in a CI PR deserves a line in the description.
• CODEOWNERS is still Nethermind's — global owners @mskrzypkows @mikhailUshakoff, and *docker*.yml → @nmjustinchan @derrix060. Follow-up for a "migrate to Taiko" effort, out of scope here.
• master has no branch protection, so none of these checks are required to merge — deleting the old workflows breaks nothing, but nothing enforces the new ones either.