From f2cf9d9736af9bdfa223eefd5d589b48b88e7b7c Mon Sep 17 00:00:00 2001
From: OmarTawfik <15987992+OmarTawfik@users.noreply.github.com>
Date: Mon, 29 Jul 2024 02:27:23 -0700
Subject: [PATCH] reuse devcontainer image in github actions

This is needed to run benchmarking tests in CI using the same `valgrind` binaries we install in the devcontainer.
Also moved the cache steps to a common action to avoid duplication.
---
 .github/actions/cache/restore/action.yml      |  18 ++
 .github/actions/cache/save/action.yml         |  18 ++
 .github/workflows/_jobs_ci.yml                |  56 -------
 .github/workflows/_jobs_github_pages.yml      |  63 -------
 .github/workflows/_jobs_publish.yml           | 100 -----------
 .github/workflows/_jobs_sanctuary.yml         |  76 ---------
 .github/workflows/benchmark.yml               |  42 +++++
 .github/workflows/ci.yml                      |  66 +++++++-
 .github/workflows/deploy.yml                  |  40 -----
 .github/workflows/publish.yml                 | 158 ++++++++++++++++++
 .github/workflows/sanctuary.yml               |  58 ++++++-
 .../src/commands/publish/changesets/mod.rs    |  10 +-
 12 files changed, 350 insertions(+), 355 deletions(-)
 create mode 100644 .github/actions/cache/restore/action.yml
 create mode 100644 .github/actions/cache/save/action.yml
 delete mode 100644 .github/workflows/_jobs_ci.yml
 delete mode 100644 .github/workflows/_jobs_github_pages.yml
 delete mode 100644 .github/workflows/_jobs_publish.yml
 delete mode 100644 .github/workflows/_jobs_sanctuary.yml
 create mode 100644 .github/workflows/benchmark.yml
 delete mode 100644 .github/workflows/deploy.yml
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/actions/cache/restore/action.yml b/.github/actions/cache/restore/action.yml
new file mode 100644
index 0000000000..a510bf29da
--- /dev/null
+++ b/.github/actions/cache/restore/action.yml
@@ -0,0 +1,18 @@
+name: "cache/restore"
+
+runs:
+  using: "composite"
+  steps:
+    - name: "Restore Cache"
+      uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
+      with:
+        # __SLANG_CI_CACHE_PATHS__ (keep in sync)
+        key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
+        path: |
+          ~/.cache/hermit/
+          ~/.local/share/virtualenvs/
+          .hermit/
+        restore-keys: |
+          cache-${{ github.ref_name }}-
+          cache-main-
+          cache-
diff --git a/.github/actions/cache/save/action.yml b/.github/actions/cache/save/action.yml
new file mode 100644
index 0000000000..c28d84cfc6
--- /dev/null
+++ b/.github/actions/cache/save/action.yml
@@ -0,0 +1,18 @@
+name: "cache/save"
+
+runs:
+  using: "composite"
+  steps:
+    - name: "Repossess files from devcontainer user"
+      shell: "bash"
+      run: "sudo chown -R $USER:$USER $GITHUB_WORKSPACE"
+
+    - name: "Save Cache"
+      uses: "actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
+      with:
+        # __SLANG_CI_CACHE_PATHS__ (keep in sync)
+        key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
+        path: |
+          ~/.cache/hermit/
+          ~/.local/share/virtualenvs/
+          .hermit/
diff --git a/.github/workflows/_jobs_ci.yml b/.github/workflows/_jobs_ci.yml
deleted file mode 100644
index 51dc600e33..0000000000
--- a/.github/workflows/_jobs_ci.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: "jobs/ci"
-
-on:
-  # Run when invoked from other workflows:
-  workflow_call: {}
-
-jobs:
-  run:
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-
-    steps:
-      #
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      # Cache is updated in this workflow, and reused in subsequent workflows.
-      # Note: always start with a fresh cache when running on the main branch.
-      #
-
-      - name: "Clone repository"
-        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
-
-      - name: "Restore CI cache"
-        if: "${{ github.ref_name != 'main' }}"
-        uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          restore-keys: |
-            cache-${{ github.ref_name }}-
-            cache-main-
-            cache-
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
-
-      #
-      # Run all CI steps in order: _SLANG_INFRA_CI_STEPS_ORDERED_ (keep in sync)
-      #
-
-      - run: "scripts/bin/infra setup"
-      - run: "scripts/bin/infra check"
-      - run: "scripts/bin/infra test"
-      - run: "scripts/bin/infra lint"
-
-      #
-      # Update cache files:
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      #
-
-      - name: "Save cache"
-        uses: "actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
diff --git a/.github/workflows/_jobs_github_pages.yml b/.github/workflows/_jobs_github_pages.yml
deleted file mode 100644
index f9cb8da407..0000000000
--- a/.github/workflows/_jobs_github_pages.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-name: "jobs/github-pages"
-
-on:
-  # Run when invoked from other workflows:
-  workflow_call: {}
-
-jobs:
-  prepare:
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-
-    steps:
-      #
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      # Cache is updated in the "ci" workflow, then reused here.
-      #
-
-      - name: "Clone repository"
-        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
-
-      - name: "Restore CI cache"
-        uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          restore-keys: |
-            cache-${{ github.ref_name }}-
-            cache-main-
-            cache-
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
-
-      #
-      # Deploy to GitHub Pages:
-      #
-
-      - run: "scripts/bin/infra setup pipenv"
-      - run: "scripts/bin/infra check mkdocs"
-
-      - name: "Configure GitHub Pages"
-        uses: "actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d"
-
-      - name: "Upload artifacts"
-        uses: "actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa"
-        with:
-          path: "documentation/target/site" # _SLANG_MKDOCS_DOCUMENTATION_SITE_DIR_ (keep in sync)
-
-  deploy:
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-    needs: "prepare"
-
-    permissions:
-      pages: "write" # to deploy to Pages
-      id-token: "write" # to verify the deployment originates from an appropriate source
-
-    steps:
-      - name: "Deploy to GitHub Pages"
-        id: "deployment"
-        uses: "actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e"
-
-    environment:
-      name: "github-pages"
-      url: "${{ steps.deployment.outputs.page_url }}"
diff --git a/.github/workflows/_jobs_publish.yml b/.github/workflows/_jobs_publish.yml
deleted file mode 100644
index 825c692fd3..0000000000
--- a/.github/workflows/_jobs_publish.yml
+++ /dev/null
@@ -1,100 +0,0 @@
-name: "jobs/publish"
-
-on:
-  # Run when invoked from other workflows:
-  workflow_call: {}
-
-jobs:
-  changesets:
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-
-    permissions:
-      contents: "write" # to create new branches and releases
-      pull-requests: "write" # to create new pull requests for changesets
-
-    steps:
-      #
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      # Cache is updated in the "ci" workflow, then reused here.
-      #
-
-      - name: "Clone repository"
-        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
-
-      - name: "Restore CI cache"
-        uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          restore-keys: |
-            cache-${{ github.ref_name }}-
-            cache-main-
-            cache-
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
-
-      #
-      # Publish Changesets:
-      #
-
-      - run: "scripts/bin/infra setup npm"
-
-      - id: "changesets"
-        uses: "changesets/action@aba318e9165b45b7948c60273e0b72fce0a64eb9"
-        with:
-          title: "Bump Slang Version"
-          commit: "Bump Slang Version"
-          createGithubReleases: false
-          version: "scripts/bin/infra publish changesets"
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-
-    outputs:
-      hasChangesets: "${{ steps.changesets.outputs.hasChangesets }}"
-
-  assets:
-    needs: "changesets"
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-
-    if: "${{ needs.changesets.outputs.hasChangesets == 'false' }}"
-
-    steps:
-      #
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      # Cache is updated in the "ci" workflow, then reused here.
-      #
-
-      - name: "Clone repository"
-        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
-
-      - name: "Restore CI cache"
-        uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          restore-keys: |
-            cache-${{ github.ref_name }}-
-            cache-main-
-            cache-
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
-
-      #
-      # Build and Publish:
-      #
-
-      - run: "scripts/bin/infra setup cargo npm"
-
-      - run: "scripts/bin/infra publish npm"
-        env:
-          NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
-
-      - run: "scripts/bin/infra publish cargo"
-        env:
-          CARGO_REGISTRY_TOKEN: "${{ secrets.CARGO_REGISTRY_TOKEN }}"
-
-      - run: "scripts/bin/infra publish github-release"
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/_jobs_sanctuary.yml b/.github/workflows/_jobs_sanctuary.yml
deleted file mode 100644
index d71d1fb19f..0000000000
--- a/.github/workflows/_jobs_sanctuary.yml
+++ /dev/null
@@ -1,76 +0,0 @@
-name: "jobs/sanctuary"
-
-on:
-  # Run when invoked from other workflows:
-  workflow_call:
-    inputs:
-      chain:
-        description: "Name of the chain/sanctuary to run against, e.g. 'ethereum' or 'tron'."
-        required: true
-        type: "string"
-      network:
-        description: "Name of the sub-network to run against, e.g. 'mainnet' or 'testnet'."
-        required: true
-        type: "string"
-
-jobs:
-  sanctuary:
-    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
-
-    strategy:
-      fail-fast: false # Continue running all shards even if some fail.
-      matrix:
-        shard_index:
-          - 0
-          - 1
-          - 2
-          - 3
-          - 4
-          - 5
-          - 6
-          - 7
-          - 8
-          - 9
-          - 10
-          - 11
-          - 12
-          - 13
-          - 14
-          - 15
-
-    env:
-      SHARDS_COUNT: 16 # Length of the 'shard_index' array above.
-
-    steps:
-      #
-      # _DEVCONTAINER_PREPARATION_STEPS_ (keep in sync)
-      # Cache is updated in the "ci" workflow, then reused here.
-      #
-
-      - name: "Clone repository"
-        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
-
-      - name: "Restore CI cache"
-        uses: "actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9"
-        with:
-          key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
-          restore-keys: |
-            cache-${{ github.ref_name }}-
-            cache-main-
-            cache-
-          path: |
-            ~/.cache/hermit/
-            ~/.local/share/virtualenvs/
-            .hermit/
-
-      #
-      # Run Sanctuary Tests:
-      #
-
-      - run: "scripts/bin/infra setup cargo"
-
-      - run: |
-          scripts/bin/infra run --release --bin "solidity_testing_sanctuary" -- \
-            --shards-count ${{ env.SHARDS_COUNT }} \
-            --shard-index ${{ matrix.shard_index }} \
-            "${{ inputs.chain }}" "${{ inputs.network }}"
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
new file mode 100644
index 0000000000..19006fc62b
--- /dev/null
+++ b/.github/workflows/benchmark.yml
@@ -0,0 +1,42 @@
+name: "benchmark"
+
+on:
+  # Run using manual triggers from GitHub UI:
+  # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
+  workflow_dispatch: {}
+
+  # Run on pushes to any branch:
+  push: {}
+
+# Queue up benchmark workflows for the same branch, so that results are reported in order:
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref_name }}"
+  cancel-in-progress: false
+
+jobs:
+  run:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+
+    # Only run on the main repo (not forks):
+    if: "${{ github.repository == 'NomicFoundation/slang' }}"
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      - name: "Restore Cache"
+        uses: "./.github/actions/cache/restore"
+
+      - name: "infra setup cargo"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "setup cargo"
+
+      - name: "infra perf benchmark"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "perf benchmark"
+        env:
+          BENCHER_API_TOKEN: "${{ secrets.BENCHER_API_TOKEN }}"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6894a551b..5a85de366b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,20 +5,68 @@ on:
   # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
   workflow_dispatch: {}
 
-  # Run on every pull request (external branches):
+  # Run on every pull request:
   pull_request: {}
 
-  # Run on pushes to internal branches:
-  # Except 'main', which is handled by 'deploy.yml'.
-  push:
-    branches-ignore:
-      - "main"
+  # Run on pushes to any branch:
+  push: {}
 
 # In the event that there is a new push to the ref, cancel any running jobs because they are now obsolete, wasting resources.
 concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
+  group: "${{ github.workflow }}-${{ github.ref_name }}"
   cancel-in-progress: true
 
 jobs:
-  ci:
-    uses: "./.github/workflows/_jobs_ci.yml"
+  run:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+
+    permissions:
+      actions: "write" # to trigger other workflows
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      # Cache is updated in this workflow, and reused in subsequent workflows.
+      # Always start with a fresh cache when running on the main branch.
+      - name: "Restore Cache"
+        if: "${{ github.ref_name != 'main' }}"
+        uses: "./.github/actions/cache/restore"
+
+      #
+      # Run all CI steps in order: _SLANG_INFRA_CI_STEPS_ORDERED_ (keep in sync)
+      #
+
+      - name: "infra setup"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "setup"
+
+      - name: "infra check"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "check"
+
+      - name: "infra test"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "test"
+
+      - name: "infra lint"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "lint"
+
+      - name: "Save Cache"
+        uses: "./.github/actions/cache/save"
+
+      # If running on the main repo (not forks), and on the 'main' branch, trigger the 'publish' workflow:
+      - name: "Trigger Publish Workflow"
+        if: "${{ github.repository == 'NomicFoundation/slang' && github.ref_name == 'main' }}"
+        run: "gh workflow run 'publish' --repo '${{ github.repository }}' --ref '${{ github.ref_name }}'"
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
deleted file mode 100644
index 535ee4028f..0000000000
--- a/.github/workflows/deploy.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-name: "deploy"
-
-on:
-  # Run using manual triggers from GitHub UI:
-  # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
-  workflow_dispatch: {}
-
-  # Run on pushes to 'main' branch':
-  push:
-    branches:
-      - "main"
-
-# We publish multiple packages for each version.
-# Wait for any deploys in-progress to complete, before starting a new one:
-concurrency:
-  group: "${{ github.workflow }}"
-  cancel-in-progress: false
-
-jobs:
-  ci:
-    uses: "./.github/workflows/_jobs_ci.yml"
-
-  github-pages:
-    uses: "./.github/workflows/_jobs_github_pages.yml"
-    if: "${{ github.repository == 'NomicFoundation/slang' }}" # skip running in forks
-    needs: "ci"
-
-    permissions:
-      pages: "write" # to deploy to Pages
-      id-token: "write" # to verify the deployment originates from an appropriate source
-
-  publish:
-    uses: "./.github/workflows/_jobs_publish.yml"
-    if: "${{ github.repository == 'NomicFoundation/slang' }}" # skip running in forks
-    needs: "ci"
-
-    secrets: "inherit"
-    permissions:
-      contents: "write" # to create new branches and releases
-      pull-requests: "write" # to create new pull requests for changesets
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000000..69b72700bf
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,158 @@
+name: "publish"
+
+on:
+  # Run using manual triggers from GitHub UI.
+  # It will also be invoked from the 'ci' workflow when it succeeds on the 'main' branch.
+  # https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow
+  workflow_dispatch: {}
+
+# Wait for any other publish workflows in-progress to complete, before starting a new one:
+concurrency:
+  group: "${{ github.workflow }}"
+  cancel-in-progress: false
+
+jobs:
+  checkPreconditions:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+
+    # Only run on the main repo (not forks), and only on the 'main' branch:
+    if: "${{ github.repository == 'NomicFoundation/slang' && github.ref_name == 'main' }}"
+
+    steps:
+      - name: "Check Preconditions"
+        shell: "bash"
+        run: "echo 'All preconditions met.'"
+
+  buildDocs:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+    needs: "checkPreconditions"
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      - name: "Restore Cache"
+        uses: "./.github/actions/cache/restore"
+
+      - name: "infra setup pipenv"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "setup pipenv"
+
+      - name: "infra check mkdocs"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "check mkdocs"
+
+      - name: "Configure Pages"
+        uses: "actions/configure-pages@1f0c5cde4bc74cd7e1254d0cb4de8d49e9068c7d"
+
+      - name: "Upload Artifacts"
+        uses: "actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa"
+        with:
+          path: "documentation/target/site" # _SLANG_MKDOCS_DOCUMENTATION_SITE_DIR_ (keep in sync)
+
+  deployDocs:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+    needs: "buildDocs"
+
+    permissions:
+      pages: "write" # to deploy to Pages
+      id-token: "write" # to verify the deployment originates from an appropriate source
+
+    steps:
+      - name: "Deploy Pages"
+        id: "deployment"
+        uses: "actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e"
+
+    environment:
+      name: "github-pages"
+      url: "${{ steps.deployment.outputs.page_url }}"
+
+  consumeChangesets:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+    needs: "checkPreconditions"
+
+    permissions:
+      contents: "write" # to create new branches and releases
+      pull-requests: "write" # to create new pull requests for changesets
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      - name: "Restore Cache"
+        uses: "./.github/actions/cache/restore"
+
+      - name: "infra setup cargo npm"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "setup cargo npm"
+
+      - name: "infra publish changesets"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "publish changesets"
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: "Create/Update Changesets Pull Request"
+        id: "runChangesets"
+        uses: "changesets/action@aba318e9165b45b7948c60273e0b72fce0a64eb9"
+        with:
+          title: "Bump Slang Version"
+          commit: "Bump Slang Version"
+          createGithubReleases: false
+          version: "git stash pop" # Stash created by 'infra publish changesets'
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+
+    outputs:
+      hasChangesets: "${{ steps.runChangesets.outputs.hasChangesets }}"
+
+  artifacts:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+    needs: "consumeChangesets"
+
+    if: "${{ needs.consumeChangesets.outputs.hasChangesets == 'false' }}"
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      - name: "Restore Cache"
+        uses: "./.github/actions/cache/restore"
+
+      - name: "infra setup cargo npm"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "setup cargo npm"
+
+      - name: "infra publish npm"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "publish npm"
+        env:
+          NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
+
+      - name: "infra publish cargo"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "publish cargo"
+        env:
+          CARGO_REGISTRY_TOKEN: "${{ secrets.CARGO_REGISTRY_TOKEN }}"
+
+      - name: "infra publish github-release"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "publish github-release"
+        env:
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/sanctuary.yml b/.github/workflows/sanctuary.yml
index 695de9c20c..fbc1bbd153 100644
--- a/.github/workflows/sanctuary.yml
+++ b/.github/workflows/sanctuary.yml
@@ -7,18 +7,58 @@ on:
     inputs:
       chain:
         description: "Name of the chain/sanctuary to run against, e.g. 'ethereum' or 'tron'."
-        default: "ethereum"
-        required: true
         type: "string"
+        required: true
+        default: "ethereum"
       network:
         description: "Name of the sub-network to run against, e.g. 'mainnet' or 'testnet'."
-        default: "mainnet"
-        required: true
         type: "string"
+        required: true
+        default: "mainnet"
 
 jobs:
-  ci:
-    uses: "./.github/workflows/_jobs_sanctuary.yml"
-    with:
-      chain: "${{ inputs.chain }}"
-      network: "${{ inputs.network }}"
+  run:
+    runs-on: "ubuntu-22.04" # _SLANG_DEV_CONTAINER_BASE_IMAGE_ (keep in sync)
+
+    strategy:
+      fail-fast: false # Continue running all shards even if some fail.
+      matrix:
+        shard_index:
+          - 0
+          - 1
+          - 2
+          - 3
+          - 4
+          - 5
+          - 6
+          - 7
+          - 8
+          - 9
+          - 10
+          - 11
+          - 12
+          - 13
+          - 14
+          - 15
+
+    env:
+      SHARDS_COUNT: 16 # Length of the 'shard_index' array above.
+
+    steps:
+      - name: "Checkout Repository"
+        uses: "actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332"
+
+      - name: "Restore Cache"
+        uses: "./.github/actions/cache/restore"
+
+      - name: "infra setup cargo"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "setup cargo"
+
+      - name: "infra run solidity_testing_sanctuary"
+        uses: "./.devcontainer"
+        with:
+          entrypoint: "./scripts/bin/infra"
+          args: "run --release --bin solidity_testing_sanctuary -- --shards-count ${{ env.SHARDS_COUNT }} --shard-index ${{ matrix.shard_index }} ${{ inputs.chain }} ${{ inputs.network }}"
diff --git a/crates/infra/cli/src/commands/publish/changesets/mod.rs b/crates/infra/cli/src/commands/publish/changesets/mod.rs
index 9d9bf9a9db..4186f025aa 100644
--- a/crates/infra/cli/src/commands/publish/changesets/mod.rs
+++ b/crates/infra/cli/src/commands/publish/changesets/mod.rs
@@ -81,9 +81,15 @@ pub fn publish_changesets() -> Result<()> {
         }
     }
 
+    Command::new("git")
+        .args(["stash", "push"])
+        .flag("--include-untracked")
+        .property("--message", "applied changesets")
+        .run()?;
+
     println!();
-    println!("Source files are now updated.");
-    println!("The calling CI workflow will now publish them in a pull request.");
+    println!("Source files are now updated with the new version, and stored in a 'git stash'.");
+    println!("The calling CI workflow will now use this stash to create a PR if needed.");
     println!();
 
     Ok(())