ci: return of the chef

.github/workflows/build-publish-partnerchains-dev.yml

@@ -43,4 +43,5 @@ jobs:
           echo "[net]" >> "$HOME"/.cargo/config
           echo "git-fetch-with-cli = true" >> "$HOME"/.cargo/config
 
-          . ./.envrc && earthly --ci --push +partnerchains-dev
+          # No --ci/--strict: +partnerchains-dev -> +node-image -> +build -> +cache-probe (LOCALLY).
+          . ./.envrc && earthly --push +partnerchains-dev

.github/workflows/continuous-integration-checks.yml

@@ -57,7 +57,11 @@ jobs:
       - name: Run build
         if: steps.guard.outputs.hit != 'true'
         run: |
-          . ./.envrc && earthly --ci +check
+          # No --ci/--strict: +check -> +check-rust-prepare -> +cache-probe uses
+          # LOCALLY (host registry probe), which strict mode forbids. The probe is
+          # a read-only existence check that falls back to cooking on miss, so
+          # build reproducibility is unaffected.
+          . ./.envrc && earthly +check
 
       - uses: ./.github/actions/tree-cache-guard/save
         if: steps.guard.outputs.hit != 'true'
@@ -102,7 +106,8 @@ jobs:
       - name: Run feature unification check
         if: steps.guard.outputs.hit != 'true'
         run: |
-          . ./.envrc && earthly --ci +check-feature-unification
+          # No --ci/--strict: reaches +cache-probe (LOCALLY) via +check-rust-prepare.
+          . ./.envrc && earthly +check-feature-unification
 
       - uses: ./.github/actions/tree-cache-guard/save
         if: steps.guard.outputs.hit != 'true'

.github/workflows/continuous-integration-test.yml

@@ -94,7 +94,7 @@ jobs:
             --secret GITHUB_TOKEN="$GITHUB_TOKEN" \
             --secret DOCKERHUB_USER="$DOCKERHUB_USER" \
             --secret DOCKERHUB_TOKEN="$DOCKERHUB_TOKEN" \
-            --strict $PUSH_FLAG \
+            $PUSH_FLAG \
             --remote-cache=ghcr.io/midnightntwrk/midnight-node:cache-test \
             +test --CACHE_KEY="$CACHE_KEY"
 

.github/workflows/continuous-integration.yml

@@ -487,56 +487,6 @@ jobs:
         with:
           key: ${{ steps.guard.outputs.key }}
 
-  # Test pallet-midnight fixture tests - these do NOT require toolkit-js
-  test-pallet-fixtures:
-    permissions:
-      contents: read
-      actions: write
-    name: Test Pallet Fixtures
-    runs-on: ubuntu-latest
-    env:
-      FORCE_COLOR: 1
-    steps:
-      - name: Checkout node repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
-        with:
-          submodules: true
-
-      - id: guard
-        uses: ./.github/actions/tree-cache-guard
-
-      - uses: EarthBuild/actions-setup@cae2d9ab68894d8402751fe42e07c7cca0272f7f
-        if: steps.guard.outputs.hit != 'true'
-        with:
-          version: v0.8.16
-          github-token: ${{ github.token }}
-          use-cache: false
-
-      - name: Free disk space
-        if: steps.guard.outputs.hit != 'true' && runner.environment != 'self-hosted'
-        run: scripts/free-disk-space.sh
-
-      - name: Run pallet fixture tests
-        if: steps.guard.outputs.hit != 'true'
-        env:
-          # See +test's `Run build` step for why EARTHLY_GIT_BRANCH is unsafe
-          # under actions/checkout; reach for the actual head/ref name instead.
-          GITHUB_REF_RAW: ${{ github.event_name == 'pull_request' && github.head_ref || github.ref_name }}
-        run: |
-          CACHE_KEY=$(printf '%s' "$GITHUB_REF_RAW" | tr -c 'A-Za-z0-9._-' '-')
-          if [ -z "$CACHE_KEY" ]; then
-            echo "::error::could not derive CACHE_KEY from refs (head_ref=$GITHUB_REF_RAW)"
-            exit 1
-          fi
-          echo "Using CACHE_KEY=$CACHE_KEY"
-          . ./.envrc && earthly -P --strict \
-            +test-pallet-fixtures --CACHE_KEY="$CACHE_KEY"
-
-      - uses: ./.github/actions/tree-cache-guard/save
-        if: steps.guard.outputs.hit != 'true'
-        with:
-          key: ${{ steps.guard.outputs.key }}
-
   # Gate job for toolkit E2E tests - if this fails, toolkit E2E tests are skipped
   test-toolkit:
     permissions:

.github/workflows/nightly-build-check.yml

@@ -42,4 +42,5 @@ jobs:
           echo "[net]" >> "$HOME"/.cargo/config
           echo "git-fetch-with-cli = true" >> "$HOME"/.cargo/config
 
-          . ./.envrc && earthly -P --ci --platform=linux/amd64 +node-image
+          # No --ci/--strict: +node-image -> +build -> +build-prepare -> +cache-probe (LOCALLY).
+          . ./.envrc && earthly -P --platform=linux/amd64 +node-image

.github/workflows/seed-deps-cache.yml

@@ -0,0 +1,100 @@
+name: Seed deps cache
+
+# One-shot workflow_dispatch to force-cook and push the cargo-chef deps image
+# to ghcr.io/midnightntwrk/midnight-node-deps. Run this once after the
+# cook-build target or Cargo.toml changes so subsequent CI pulls the image
+# from the registry instead of cooking locally.
+#
+# Why --no-cache: earthly silently skips SAVE IMAGE --push when it considers
+# the target cached (even if buildkit layers re-ran). --no-cache forces
+# earthly's own target-level cache bypass, ensuring the push fires.
+
+on:
+  workflow_dispatch:
+
+# no top-level permissions
+permissions:
+  contents: read
+
+jobs:
+  seed-arm64:
+    name: Cook and push deps (arm64)
+    runs-on: ubuntu-latest-8-core-arm64
+    timeout-minutes: 120
+    permissions:
+      contents: read
+    env:
+      FORCE_COLOR: 1
+    steps:
+      - uses: EarthBuild/actions-setup@cae2d9ab68894d8402751fe42e07c7cca0272f7f
+        with:
+          version: v0.8.16
+          github-token: ${{ github.token }}
+          use-cache: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+        with:
+          submodules: true
+
+      - name: Login to GHCR
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee #v4.2.0
+        with:
+          registry: ghcr.io
+          username: MidnightCI
+          password: ${{ secrets.MIDNIGHTCI_PACKAGES_WRITE }}
+
+      - name: Cook and push deps
+        env:
+          EARTHLY_REMOTE_CACHE: ""
+          ACTIONS_CACHE_URL: ""
+          ACTIONS_RUNTIME_URL: ""
+        run: |
+          mkdir -p "$HOME/.cargo"
+          printf '[net]\ngit-fetch-with-cli = true\n' >> "$HOME/.cargo/config"
+          . ./.envrc
+          earthly --no-cache --push +seed-deps --ALLOW_CACHE_PUSH=true
+
+  seed-amd64:
+    name: Cook and push deps (amd64)
+    runs-on: [self-hosted, "tier:large"]
+    timeout-minutes: 180
+    permissions:
+      contents: read
+    env:
+      FORCE_COLOR: 1
+    steps:
+      - uses: EarthBuild/actions-setup@cae2d9ab68894d8402751fe42e07c7cca0272f7f
+        with:
+          version: v0.8.16
+          github-token: ${{ github.token }}
+          use-cache: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+        with:
+          submodules: true
+
+      - name: Isolate docker config (self-hosted shared HOME)
+        run: |
+          mkdir -p "$RUNNER_TEMP/.docker"
+          echo "DOCKER_CONFIG=$RUNNER_TEMP/.docker" >> "$GITHUB_ENV"
+
+      - name: Login to GHCR
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee #v4.2.0
+        with:
+          registry: ghcr.io
+          username: MidnightCI
+          password: ${{ secrets.MIDNIGHTCI_PACKAGES_WRITE }}
+
+      - name: Cook and push deps
+        env:
+          TMPDIR: ${{ runner.temp }}
+          EARTHLY_REMOTE_CACHE: ""
+          ACTIONS_CACHE_URL: ""
+          ACTIONS_RUNTIME_URL: ""
+        run: |
+          mkdir -p "$HOME/.cargo"
+          printf '[net]\ngit-fetch-with-cli = true\n' >> "$HOME/.cargo/config"
+          . ./.envrc
+          earthly --no-cache --push +seed-deps --ALLOW_CACHE_PUSH=true

Cargo.toml

@@ -367,6 +367,18 @@ sp-weights = { default-features = false, git = "https://github.com/paritytech/po
 
 [profile.release]
 panic = "unwind"
+# file:line in backtraces for our own crates (node, toolkit, pallets, tests),
+# without the size/cost of full (=2) debug info. Single source of truth: identical
+# across every release consumer, so they share the cooked-dependency cache image.
+debug = "line-tables-only"
+
+# ...but NOT for dependencies. The substrate/polkadot-sdk dep graph dominates debug
+# size (~1 GB of .debug_str type-names alone); we rarely need file:line inside it.
+# Stripping debug from deps keeps the node binary and the cooked-deps cache image
+# lean while preserving line numbers in the frames we actually debug. Final binaries
+# additionally get their debug sections zlib-compressed post-link (Earthfile +build).
+[profile.release.package."*"]
+debug = 0
 
 [profile.production]
 inherits = "release"