build(deps): bump chia from 0.42.0 to 0.42.1 in /keygen-rs

.dockerignore

@@ -0,0 +1,26 @@
+# Build artifacts (out-of-source, copied per Containerfile)
+build/
+build-*/
+target/
+
+# pos2-chip is FetchContent-cloned at CMake configure time inside the
+# container; no need to ship a host-side copy.
+third_party/
+
+# Generated plot files left over from local benchmarks.
+*.plot2
+
+# Editor / tooling
+.vscode/
+.idea/
+.cache/
+compile_commands.json
+
+# Profiling artifacts
+*.nsys-rep
+*.qdrep
+*.qdstrm
+*.ncu-rep
+
+# git history is irrelevant to the build itself.
+.git/

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+
+# Dependabot bumps deps via PR. Two ecosystems:
+#   - cargo: the keygen-rs subcrate's BLS / sha2 / address-codec stack.
+#     The build.rs at repo root only references env state and has no
+#     runtime crate deps, so it doesn't need its own entry.
+#   - github-actions: action versions in .github/workflows/.
+# Weekly cadence keeps PR volume low; bump to daily if security
+# advisories pile up.
+updates:
+  - package-ecosystem: cargo
+    directory: /keygen-rs
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -0,0 +1,148 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  shell:
+    name: ShellCheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install shellcheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+      - name: Lint scripts/
+        # Recurse so scripts/test/install-container-deps/run.sh and any
+        # future helpers under scripts/ stay covered.
+        run: find scripts -name '*.sh' -print0 | xargs -0 shellcheck
+
+  actions:
+    name: actionlint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: reviewdog/action-actionlint@v1
+        with:
+          fail_level: error
+
+  rust:
+    name: Rust (keygen-rs)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: keygen-rs
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: keygen-rs
+      - name: cargo fmt --check
+        run: cargo fmt --all --check
+      - name: cargo check
+        run: cargo check --all-targets --locked || cargo check --all-targets
+      - name: cargo clippy (advisory)
+        run: cargo clippy --all-targets -- -W clippy::all
+        continue-on-error: true
+      - name: cargo test
+        run: cargo test --all-targets
+
+  hadolint:
+    name: hadolint Containerfile
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: hadolint/hadolint-action@v3.3.0
+        with:
+          dockerfile: Containerfile
+          # CUDA / ROCm base images make version-pinning warnings (DL3008,
+          # DL3009) impractical — package versions shift between base image
+          # rolls and the toolkit pin lives in BASE_DEVEL. Same for the
+          # `set -o pipefail` warnings on RUN-with-pipe (DL4006) — those
+          # pipes are bootstrap-time noise, not runtime data paths. Filter
+          # to errors so we still catch real bugs (root, ADD vs COPY,
+          # missing && \, COPY --chown typos, etc.).
+          failure-threshold: error
+
+  compose-config:
+    name: docker compose config validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: docker compose config --quiet
+        # Catches typos in service names / build-arg keys / unresolvable
+        # ${VAR} placeholders without ever pulling a base image. ~5s.
+        run: docker compose -f compose.yaml config --quiet
+
+  typos:
+    name: typos
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: crate-ci/typos@master
+
+  markdownlint:
+    name: markdownlint README
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: DavidAnson/markdownlint-cli2-action@v23
+        with:
+          globs: README.md
+
+  install-container-deps-dryrun:
+    name: install-container-deps.sh — dry-run fixtures
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Diff --dry-run output against fixtures
+        # Runs --dry-run for every (distro × engine × gpu) tuple in
+        # arch / ubuntu / fedora containers and diffs against the
+        # checked-in fixtures under scripts/test/install-container-deps/.
+        # No mutating sudo calls — completes in ~60s.
+        run: scripts/test/install-container-deps/run.sh
+
+  install-container-deps-smoke:
+    name: install-container-deps.sh smoke (${{ matrix.engine }} ${{ matrix.gpu }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - engine: podman
+            gpu: cpu
+          - engine: podman
+            gpu: amd
+          - engine: docker
+            gpu: cpu
+        # NVIDIA smoke is intentionally skipped: nvidia-ctk cdi generate
+        # needs a real GPU + driver to populate the spec, and the dry-run
+        # fixtures already cover the planning logic for that path.
+    steps:
+      - uses: actions/checkout@v6
+      - name: Real install in ubuntu:24.04 + assert idempotent re-run
+        env:
+          ENGINE: ${{ matrix.engine }}
+          GPU: ${{ matrix.gpu }}
+        # Validates that engine + GPU-runtime packages actually install
+        # from the real apt repos (catches package-name drift / repo
+        # availability), and that re-running the script is a no-op.
+        run: |
+          docker run --rm \
+              -e ENGINE -e GPU \
+              -v "$PWD/scripts:/s:ro" \
+              docker.io/ubuntu:24.04 \
+              bash -ec '
+                  apt-get update -qq
+                  apt-get install -y -qq sudo curl ca-certificates gnupg >/dev/null
+                  /s/install-container-deps.sh --engine "$ENGINE" --gpu "$GPU"
+                  # Idempotence: a clean second run must still exit 0.
+                  /s/install-container-deps.sh --engine "$ENGINE" --gpu "$GPU"
+              '

.gitignore

@@ -1,4 +1,5 @@
 build/
+build-*/
 *.plot2
 .cache/
 compile_commands.json
@@ -18,3 +19,4 @@ target/
 # pos2-chip is fetched here automatically by CMake at configure time.
 # See CMakeLists.txt → FetchContent_Declare(pos2_chip).
 third_party/
+docs/

.markdownlint.json

@@ -0,0 +1,12 @@
+{
+  "_comment": "README is prose-heavy and includes terminal output, wide tables, and mixed list markers. Disable rules that produce noise without catching real issues. MD051 is also disabled because markdownlint's link-fragment slug algorithm differs from GitHub's (e.g. `### Multi-GPU: --devices` slugs differently between the two).",
+  "MD004": false,
+  "MD013": false,
+  "MD026": false,
+  "MD028": false,
+  "MD031": false,
+  "MD032": false,
+  "MD040": false,
+  "MD051": false,
+  "MD060": false
+}