ci: add consensus spec drift detection

.github/check-consensus-spec-values.py

@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""
+Compares a generated config.yaml against the upstream consensus-specs config.
+
+Exits non-zero if any non-excluded fields have different values or are missing
+from our config relative to the upstream spec.
+"""
+
+import argparse
+import sys
+import urllib.request
+
+import yaml
+
+
+# Fields that are intentionally testnet-specific or explicitly excluded from comparison.
+EXCLUDED_FIELDS = {
+    # Network identity - intentionally differs for testnets
+    "CONFIG_NAME",
+    # Merge transition - testnets start post-merge with TTD=0
+    "TERMINAL_TOTAL_DIFFICULTY",
+    # Genesis params - testnet-configurable
+    "MIN_GENESIS_ACTIVE_VALIDATOR_COUNT",
+    "MIN_GENESIS_TIME",
+    "GENESIS_FORK_VERSION",
+    "GENESIS_DELAY",
+    # Fork versions - testnet-specific values
+    "ALTAIR_FORK_VERSION",
+    "BELLATRIX_FORK_VERSION",
+    "CAPELLA_FORK_VERSION",
+    "DENEB_FORK_VERSION",
+    "ELECTRA_FORK_VERSION",
+    "FULU_FORK_VERSION",
+    "GLOAS_FORK_VERSION",
+    "HEZE_FORK_VERSION",
+    "EIP7928_FORK_VERSION",
+    "EIP8025_FORK_VERSION",
+    # Fork activation epochs - testnets activate all forks at epoch 0
+    "ALTAIR_FORK_EPOCH",
+    "BELLATRIX_FORK_EPOCH",
+    "CAPELLA_FORK_EPOCH",
+    "DENEB_FORK_EPOCH",
+    "ELECTRA_FORK_EPOCH",
+    "FULU_FORK_EPOCH",
+    # Deposit contract - testnet-configurable
+    "DEPOSIT_CHAIN_ID",
+    "DEPOSIT_NETWORK_ID",
+    "DEPOSIT_CONTRACT_ADDRESS",
+    # Blob schedule - explicitly excluded
+    "BLOB_SCHEDULE",
+    # Deprecated field moved to preset files, not present in spec configs
+    "SECONDS_PER_SLOT",
+}
+
+
+def load_yaml(path_or_url: str) -> dict:
+    if path_or_url.startswith("http://") or path_or_url.startswith("https://"):
+        with urllib.request.urlopen(path_or_url) as response:
+            return yaml.safe_load(response.read().decode())
+    with open(path_or_url) as f:
+        return yaml.safe_load(f)
+
+
+def compare_configs(our_config: dict, spec_config: dict) -> bool:
+    failures = []
+    warnings = []
+
+    spec_keys = {k for k in spec_config if k not in EXCLUDED_FIELDS}
+    our_keys = {k for k in our_config if k not in EXCLUDED_FIELDS}
+
+    for key in sorted(spec_keys - our_keys):
+        failures.append(
+            f"  MISSING in our config: {key!r}  (spec has: {spec_config[key]!r})"
+        )
+
+    for key in sorted(spec_keys & our_keys):
+        spec_val = spec_config[key]
+        our_val = our_config[key]
+        if spec_val != our_val:
+            failures.append(
+                f"  MISMATCH {key!r}:\n"
+                f"    ours: {our_val!r}\n"
+                f"    spec: {spec_val!r}"
+            )
+
+    for key in sorted(our_keys - spec_keys):
+        warnings.append(
+            f"  EXTRA field in our config (not in spec): {key!r} = {our_config[key]!r}"
+        )
+
+    if warnings:
+        print("Warnings (fields present in our config but not in the upstream spec):")
+        for w in warnings:
+            print(w)
+        print()
+
+    if failures:
+        print(f"FAILED: {len(failures)} issue(s) found:")
+        for failure in failures:
+            print(failure)
+        return False
+
+    print(f"OK: all {len(spec_keys & our_keys)} comparable spec fields match.")
+    return True
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Compare our generated config.yaml against the upstream consensus-specs config"
+    )
+    parser.add_argument(
+        "--our-config",
+        required=True,
+        help="Path to our generated config.yaml",
+    )
+    parser.add_argument(
+        "--spec-config",
+        required=True,
+        help="Path or HTTPS URL to the upstream consensus-spec config.yaml",
+    )
+    args = parser.parse_args()
+
+    our_config = load_yaml(args.our_config)
+    spec_config = load_yaml(args.spec_config)
+
+    if not compare_configs(our_config, spec_config):
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/check-consensus-spec-values.yml

@@ -0,0 +1,44 @@
+name: Check consensus spec values
+
+on:
+  schedule:
+    - cron: '0 8 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check-consensus-spec-values:
+    name: Check consensus spec values (${{ matrix.preset }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - preset: mainnet
+            args_file: network_params.yaml
+          - preset: minimal
+            args_file: .github/tests/minimal.yaml
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/docker-login
+        with:
+          username: ethpandaops
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Setup Kurtosis
+        uses: ./.github/actions/kurtosis-install
+      - name: Run genesis
+        run: |
+          kurtosis run ${{ github.workspace }} --enclave spec-check-${{ matrix.preset }} --args-file ${{ matrix.args_file }} --verbosity detailed --image-download always
+      - name: Check consensus spec values
+        run: |
+          pip install pyyaml --quiet
+          curl -fsSL \
+            "https://raw.githubusercontent.com/ethereum/consensus-specs/master/configs/${{ matrix.preset }}.yaml" \
+            -o /tmp/spec.yaml
+          kurtosis files download spec-check-${{ matrix.preset }} el_cl_genesis_data /tmp/genesis
+          python3 .github/check-consensus-spec-values.py \
+            --our-config /tmp/genesis/config.yaml \
+            --spec-config /tmp/spec.yaml

.github/workflows/check-typos.yml

@@ -13,4 +13,4 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check for typos
-        uses: crate-ci/typos@631208b7aac2daa8b707f55e7331f9112b0e062d # v1.44.0
+        uses: crate-ci/typos@a8d8e187146634c459c27ade2d3e338569378720 # v1.44.0

.github/workflows/per-pr.yml

@@ -8,21 +8,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  run_starlark:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/docker-login
-        with:
-          username: ethpandaops
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Setup Kurtosis
-        uses: ./.github/actions/kurtosis-install
-      - name: Run Starlark
-        run: |
-          kurtosis run ${{ github.workspace }} --args-file network_params.yaml --verbosity detailed --image-download always
-
   run_with_args:
     strategy:
       matrix:
@@ -34,7 +19,8 @@ jobs:
             "./.github/tests/mix-persistence.yaml",
             "./.github/tests/mix-public.yaml",
             "./.github/tests/minimal.yaml",
-            "./network_params.yaml"
+            "./network_params.yaml",
+            "."
           ]
     runs-on: ubuntu-latest
     steps:
@@ -48,7 +34,61 @@ jobs:
         uses: ./.github/actions/kurtosis-install
       - name: Run Starlark
         run: |
-          kurtosis run ${{ github.workspace }} --args-file ${{ matrix.file_name }} --verbosity detailed --image-download always
+          if [[ "${{ matrix.file_name }}" == "." ]]; then
+            echo "ENCLAVE=default" >> "$GITHUB_ENV"
+            kurtosis run ${{ github.workspace }} --enclave "default" --verbosity detailed --image-download always
+          else
+            enclave=$(basename "${{ matrix.file_name }}" .yaml | tr '_.' '--')
+            echo "ENCLAVE=$enclave" >> "$GITHUB_ENV"
+            kurtosis run ${{ github.workspace }} --enclave "$enclave" --args-file ${{ matrix.file_name }} --verbosity detailed --image-download always
+          fi
+      - name: Upload genesis config
+        if: matrix.file_name == '.' || matrix.file_name == './network_params.yaml' || matrix.file_name == './.github/tests/minimal.yaml'
+        run: kurtosis files download "$ENCLAVE" el_cl_genesis_data /tmp/genesis-$ENCLAVE
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        if: matrix.file_name == '.' || matrix.file_name == './network_params.yaml' || matrix.file_name == './.github/tests/minimal.yaml'
+        with:
+          name: genesis-config-${{ env.ENCLAVE }}
+          path: /tmp/genesis-${{ env.ENCLAVE }}/config.yaml
+          retention-days: 1
+
+  check-consensus-spec-values:
+    name: Check consensus spec values (${{ matrix.label }})
+    needs: run_with_args
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: default
+            artifact: genesis-config-default
+            preset: mainnet
+          - label: network-params
+            artifact: genesis-config-network-params
+            preset: mainnet
+          - label: minimal
+            artifact: genesis-config-minimal
+            preset: minimal
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ matrix.artifact }}
+          path: /tmp/genesis
+      - name: Install pyyaml
+        run: pip install pyyaml --quiet
+      - name: Download upstream consensus-specs config
+        run: |
+          curl -fsSL \
+            "https://raw.githubusercontent.com/ethereum/consensus-specs/master/configs/${{ matrix.preset }}.yaml" \
+            -o /tmp/spec.yaml
+      - name: Compare genesis config.yaml against upstream spec
+        run: |
+          python3 .github/check-consensus-spec-values.py \
+            --our-config /tmp/genesis/config.yaml \
+            --spec-config /tmp/spec.yaml
 
   lint:
     runs-on: ubuntu-latest

src/package_io/input_parser.star

@@ -1426,7 +1426,7 @@ def default_network_params():
         "ejection_balance": 16000000000,
         "eth1_follow_distance": 2048,
         "min_validator_withdrawability_delay": 256,
-        "min_builder_withdrawability_delay": 4096,
+        "min_builder_withdrawability_delay": 64,
         "shard_committee_period": 256,
         "attestation_due_bps_gloas": 2500,
         "aggregate_due_bps_gloas": 5000,
@@ -1506,7 +1506,7 @@ def default_minimal_network_params():
         "ejection_balance": 16000000000,
         "eth1_follow_distance": 16,
         "min_validator_withdrawability_delay": 256,
-        "min_builder_withdrawability_delay": 8,
+        "min_builder_withdrawability_delay": 2,
         "shard_committee_period": 64,
         "attestation_due_bps_gloas": 2500,
         "aggregate_due_bps_gloas": 5000,