From a766ef18b66a701e49e62415a1d1262c6adc74d4 Mon Sep 17 00:00:00 2001
From: palinatolmach <11912158+palinatolmach@users.noreply.github.com>
Date: Sun, 9 Aug 2026 17:54:00 +0000
Subject: [PATCH 01/22] .github/workflows/test-pr.yml: bump actions/checkout to
 v7, actions/setup-python to v7

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/test-pr.yml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index bd20200bb2..1ffc383fcb 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: 'Setup Python 3.10'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: '3.10'
       - name: 'Get uv release'
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: 'Get uv release'
         id: uv_release
         run: |
@@ -55,7 +55,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: 'Get uv release'
         id: uv_release
         run: |
@@ -75,7 +75,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           submodules: recursive
       - name: 'Set up Docker'
@@ -138,7 +138,7 @@ jobs:
     timeout-minutes: ${{ matrix.timeout }}
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: 'Check out select submodules'
         run: |
           set -eux
@@ -169,7 +169,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           # Check out pull request HEAD instead of merge commit.
           ref: ${{ github.event.pull_request.head.sha }}

From 741eb4c77504fd7132b513bf76200f7ccff52d09 Mon Sep 17 00:00:00 2001
From: palinatolmach <11912158+palinatolmach@users.noreply.github.com>
Date: Sun, 9 Aug 2026 17:54:00 +0000
Subject: [PATCH 02/22] .github/workflows/test-pr.yml: pin astral-sh/setup-uv
 to v9.0.0

setup-uv does not publish a floating major tag for v7+, so @v9 does not
resolve on runners; pin the exact version.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/test-pr.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index 1ffc383fcb..2314850093 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -23,7 +23,7 @@ jobs:
         run: |
           echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
       - name: 'Run code quality checks'
@@ -43,7 +43,7 @@ jobs:
         run: |
           echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
       - name: 'Run unit tests'
@@ -61,7 +61,7 @@ jobs:
         run: |
           echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v6
+        uses: astral-sh/setup-uv@v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
       - name: 'Run profiling'

From 27c30095365a784707db056440f79c2c16567158 Mon Sep 17 00:00:00 2001
From: palinatolmach <11912158+palinatolmach@users.noreply.github.com>
Date: Sun, 9 Aug 2026 18:11:33 +0000
Subject: [PATCH 03/22] .github/workflows/{master-push,release}.yml: remove
 secret-based CD

Delete master-push.yml (auto version-bump on every master push via
JENKINS_GITHUB_PAT). Rewrite release.yml as a single secret-less job that,
on a manual push to the `release` branch, bumps package/version, commits it
back to `release`, and creates the v<version> tag + GitHub release -- all via
the built-in GITHUB_TOKEN with `contents: write` and no stored secrets.

The Cachix/kup binary publish, DockerHub image, gh-pages docs, Slack
notifications, and the devops dependents-dispatch all required stored secrets
and are removed; those move to a manual/off-GitHub flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/master-push.yml |  43 -------
 .github/workflows/release.yml     | 182 +++++-------------------------
 2 files changed, 29 insertions(+), 196 deletions(-)
 delete mode 100644 .github/workflows/master-push.yml

diff --git a/.github/workflows/master-push.yml b/.github/workflows/master-push.yml
deleted file mode 100644
index 8721682102..0000000000
--- a/.github/workflows/master-push.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: 'Bump Version and Start Release Job'
-on:
-  push:
-    branches:
-      - 'master'
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: true
-
-jobs:
-  version-bump:
-    name: 'Version Bump'
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-        with:
-          # fetch-depth 0 means deep clone the repo
-          fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.sha }}
-          token: ${{ secrets.JENKINS_GITHUB_PAT}}
-      - name: 'Configure GitHub user'
-        run: |
-          git config user.name rv-jenkins
-          git config user.email devops@runtimeverification.com
-      - name: 'Update version'
-        run: |
-          set -x
-          git checkout -B release origin/release
-          old_master="$(git merge-base origin/master origin/release)"
-          new_master="$(git rev-parse origin/master)"
-          if git diff --exit-code ${old_master} ${new_master} -- package/version; then
-            git merge --no-edit origin/master
-            ./package/version.sh bump
-          else
-            git merge --no-edit --strategy-option=theirs origin/master
-          fi
-          ./package/version.sh sub
-          if git add --update && git commit --no-edit --allow-empty --message "Set Version: $(cat package/version)"; then
-            git push origin release
-            git tag "release-$(cat package/version)" origin/master
-            git push origin "release-$(cat package/version)"
-          fi
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4dbd05a430..b69c668cd8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,166 +7,42 @@ concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
 
+# Uses only the auto-issued, per-run GITHUB_TOKEN (no stored secrets); every
+# other permission scope is implicitly dropped to none. Runs only on push to
+# the trusted `release` branch and executes only in-repo scripts (version.sh,
+# gh) -- never untrusted PR code -- so the write-scoped token is never exposed
+# to third-party code. The Nix/Cachix binary caches and docs are published
+# outside GitHub Actions. A release is cut by pushing the `release` branch
+# manually (e.g. merging master into it); this workflow then bumps the version,
+# commits it back to `release`, and creates the `v<version>` tag + release.
+permissions:
+  contents: write
+
 jobs:
-  draft-release:
-    name: 'Draft Release'
+  release:
+    name: 'Bump version and create release'
     runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.make-release.outputs.version }}
     steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-      - name: 'Make release'
-        id: 'make-release'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -x
-          VERSION=v$(cat package/version)
-          gh release create ${VERSION}                  \
-            --repo runtimeverification/evm-semantics  \
-            --draft                                     \
-            --title ${VERSION}                          \
-            --target ${{ github.sha }}
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-
-  nix-cache:
-    name: 'Populate Nix Caches'
-    strategy:
-      matrix:
-        include:
-          - runner: normal
-          - runner: ARM64
-    runs-on: ${{ matrix.runner }}
-    needs: draft-release
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
+      - name: 'Check out release branch'
+        uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.push.head.sha }}
+          ref: release
           fetch-depth: 0
-      - name: 'Build KEVM'
+      - name: 'Configure git identity'
         run: |
-          GC_DONT_GC=1 nix build --extra-experimental-features 'nix-command flakes' --print-build-logs
-      - name: 'Push KEVM dependencies to nix cache'
-        uses: workflow/nix-shell-action@v3.0.3
-        env:
-          GC_DONT_GC: 1
-          CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
-        with:
-          packages: jq
-          script: |
-            kevm=$(nix build --extra-experimental-features 'nix-command flakes' .#kevm --json | jq -r '.[].outputs | to_entries[].value')
-            drv=$(nix-store --query --deriver ${kevm})
-            nix-store --query --requisites --include-outputs ${drv} | cachix push k-framework || true
-      - name: 'Publish KEVM to k-framework-binary cache'
-        uses: workflow/nix-shell-action@v3.0.3
-        env:
-          GC_DONT_GC: '1'
-          CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PRIVATE_KFB_TOKEN }}'
-          OWNER_REPO: '${{ github.repository }}'
-          REV: '${{ github.sha }}'
-        with:
-          packages: jq
-          script: |
-            export PATH="$(nix build github:runtimeverification/kup --no-link --json | jq -r '.[].outputs | to_entries[].value')/bin:$PATH"
-            kup publish k-framework-binary .#kevm --keep-days 180 || true
-            # Cachix has not been responding to 'cachix pin' requests made under the hood by kup. Verify the push and pin manually.
-            .github/scripts/check-cachix-pin.sh
-      - name: 'On failure, delete drafted release'
-        if: failure()
+          git config user.name 'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
+      - name: 'Bump version, commit, push, and create release'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          set -x
-          VERSION=v$(cat package/version)
-          gh release delete ${VERSION}                  \
+          set -euxo pipefail
+          ./package/version.sh bump
+          ./package/version.sh sub
+          VERSION="v$(cat package/version)"
+          git commit --all --message "Set Version: ${VERSION}"
+          git push origin HEAD:release
+          gh release create "${VERSION}"              \
             --repo runtimeverification/evm-semantics  \
-            --yes                                       \
-            --cleanup-tag
-      - name: 'Post failure to channel'
-        if: failure()
-        uses: slackapi/slack-github-action@v1.24.0
-        with:
-          channel-id: "#kevm-notifications"
-          slack-message: "Failed to create KEVM release: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-        env:
-            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-
-  make-release:
-    name: 'Cut Release'
-    runs-on: ubuntu-latest
-    needs: [draft-release, nix-cache]
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.push.head.sha }}
-          fetch-depth: 0
-      - name: 'Make release'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -x
-          VERSION=v$(cat package/version)
-          gh release edit ${VERSION}                    \
-            --repo runtimeverification/evm-semantics  \
-            --draft=false
-      - name: 'Update dependents'
-        run: |
-          set -x
-          VERSION=$(cat package/version)
-          curl --fail                                                          \
-            -X POST                                                            \
-            -H "Accept: application/vnd.github+json"                           \
-            -H "Authorization: Bearer ${{ secrets.JENKINS_GITHUB_PAT }}"       \
-            -H "X-GitHub-Api-Version: 2022-11-28"                              \
-            https://api.github.com/repos/runtimeverification/devops/dispatches \
-            -d '{"event_type":"on-demand-test","client_payload":{"repo":"runtimeverification/evm-semantics","version":"'${VERSION}'"}}'
-
-  gh-pages:
-    name: 'Publish GH Pages'
-    runs-on: ubuntu-latest
-    needs: [make-release]
-    steps:
-      - name: 'Check out gh-pages'
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          submodules: true
-          ref: ${{ github.event.push.head.sha }}
-      - run: |
-         git config --global user.email 'devops@runtimeverification.com'
-         git config --global user.name  'rv-jenkins'
-      - name: 'Publish gh-pages'
-        run: |
-          git checkout -B gh-pages
-          cd web
-          npm install
-          npm run build
-          npm run build-sitemap
-          cd -
-          mv web/public_content ./
-          rm -rf $(find . -maxdepth 1 -not -name public_content -a -not -name .git -a -not -name .gitmodules -a -not -path . -a -not -path .. -a -not -name CNAME)
-          mv public_content/* ./
-          rm -rf public_content
-          git add ./
-          git commit -m 'gh-pages: Updated the website'
-          git merge --strategy ours origin/gh-pages --allow-unrelated-histories
-          git push origin gh-pages
-      - name: 'Post failure to channel'
-        if: failure()
-        uses: slackapi/slack-github-action@v1.24.0
-        with:
-          channel-id: "#kevm-notifications"
-          slack-message: "Failed to create KEVM release: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-        env:
-            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-      - name: 'Post success to channel'
-        if: success()
-        uses: slackapi/slack-github-action@v1.24.0
-        with:
-          channel-id: "#kevm-notifications"
-          slack-message: "Created KEVM release: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-        env:
-            SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+            --title "${VERSION}"                       \
+            --target "$(git rev-parse HEAD)"

From 714e9819a7ed1bcc72d91f308326e642f5c5445f Mon Sep 17 00:00:00 2001
From: palinatolmach <11912158+palinatolmach@users.noreply.github.com>
Date: Sun, 9 Aug 2026 18:11:33 +0000
Subject: [PATCH 04/22] .github/workflows/update-version.yml: remove
 dependency-bump automation

Automated deps bump/push required JENKINS_GITHUB_PAT and CACHIX_PUBLIC_TOKEN.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/update-version.yml | 84 ----------------------------
 1 file changed, 84 deletions(-)
 delete mode 100644 .github/workflows/update-version.yml

diff --git a/.github/workflows/update-version.yml b/.github/workflows/update-version.yml
deleted file mode 100644
index 28b6a60724..0000000000
--- a/.github/workflows/update-version.yml
+++ /dev/null
@@ -1,84 +0,0 @@
-name: 'Update Version'
-on:
-  push:
-    branches:
-      - '_update-deps/runtimeverification/blockchain-k-plugin'
-      - '_update-deps/runtimeverification/k'
-      - '_update-deps/runtimeverification/rv-nix-tools'
-      - '_update-deps-cron/uv2nix'
-      - '_update-deps-cron/pyproject-build-systems'
-  workflow_dispatch:
-# Stop in progress workflows on the same branch and same workflow to use latest committed code
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-
-  update-versions:
-    name: 'Update Dependency Versions'
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-        with:
-          submodules: true
-          token: ${{ secrets.JENKINS_GITHUB_PAT }}
-      - name: 'Configure GitHub user'
-        run: |
-          git config user.name devops
-          git config user.email devops@runtimeverification.com
-      - name: 'Get uv release'
-        id: uv_release
-        run: |
-          UV2NIX_VERSION=$(cat deps/uv2nix)
-          UV_VERSION=$(curl -s https://raw.githubusercontent.com/pyproject-nix/uv2nix/$(cat deps/uv2nix)/pkgs/uv-bin/srcs.json | jq -r .version)
-          [[ "${UV_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
-          echo ${UV_VERSION} > deps/uv_release
-          git add deps/uv_release && git commit -m "Sync uv version: uv ${UV_VERSION}" || true
-          echo uv_version=${UV_VERSION} >> "${GITHUB_OUTPUT}"
-      - name: 'Install uv'
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: ${{ steps.uv_release.outputs.uv_version }}
-      - name: 'Update pyk release tag'
-        run: |
-          K_VERSION=$(cat deps/k_release)
-          sed -i 's!    "kframework==[0-9\.]*",!    "kframework=='${K_VERSION}'",!' kevm-pyk/pyproject.toml
-          if ! grep -q "kframework==$K_VERSION" kevm-pyk/pyproject.toml; then
-            echo "Update failed: kframework==$K_VERSION not found"; exit 1
-          fi
-          uv --project kevm-pyk lock --upgrade
-          git add kevm-pyk/ && git commit -m "kevm-pyk/: sync uv files pyk version ${K_VERSION}" || true
-      - name: 'Update plugin release file'
-        run: |
-          BKP_VERSION=$(git -C kevm-pyk/src/kevm_pyk/kproj/plugin rev-parse HEAD)
-          echo ${BKP_VERSION} > deps/blockchain-k-plugin_release
-          git add deps/blockchain-k-plugin_release && git commit -m "deps/blockchain-k-plugin_release: sync release file version ${BKP_VERSION}" || true
-      - name: 'Install Nix/Cachix'
-        uses: cachix/install-nix-action@v31.5.1
-        with:
-          install_url: https://releases.nixos.org/nix/nix-2.30.1/install
-          extra_nix_config: |
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-      - uses: cachix/cachix-action@v12
-        with:
-          name: k-framework
-          authToken: ${{ secrets.CACHIX_PUBLIC_TOKEN }}
-      - name: 'Update nix flake inputs'
-        run: |
-          K_VERSION=v$(cat deps/k_release)
-          BKP_VERSION=$(cat deps/blockchain-k-plugin_release)
-          UV2NIX_VERSION=$(cat deps/uv2nix)
-          PYPROJECT_BUILD_SYSTEMS_VERSION=$(cat deps/pyproject-build-systems)
-          RV_NIX_TOOLS_VERSION=$(cat deps/rv-nix-tools)
-          sed -i 's!    k-framework.url = "github:runtimeverification/k/[v0-9\.]*"!    k-framework.url = "github:runtimeverification/k/'"${K_VERSION}"'"!' flake.nix
-          sed -i 's!        "github:runtimeverification/blockchain-k-plugin/[0-9a-f]*"!        "github:runtimeverification/blockchain-k-plugin/'"${BKP_VERSION}"'"!' flake.nix
-          sed -i 's!    uv2nix.url = "github:pyproject-nix/uv2nix/[a-z0-9\.]*"!    uv2nix.url = "github:pyproject-nix/uv2nix/'"${UV2NIX_VERSION}"'"!' flake.nix
-          sed -i 's!    pyproject-build-systems.url = "github:pyproject-nix/build-system-pkgs/[a-z0-9\.]*"!    pyproject-build-systems.url = "github:pyproject-nix/build-system-pkgs/'"${PYPROJECT_BUILD_SYSTEMS_VERSION}"'"!' flake.nix
-          sed -i 's!    rv-nix-tools.url = "github:runtimeverification/rv-nix-tools/[a-z0-9\.]*"!    rv-nix-tools.url = "github:runtimeverification/rv-nix-tools/'"${RV_NIX_TOOLS_VERSION}"'"!' flake.nix
-          nix run .#update-from-submodules
-          nix flake update
-          git add flake.nix flake.lock && git commit -m 'flake.{nix,lock}: update Nix derivations' || true
-      - name: 'Push updates'
-        run: git push

From 09a35e94bc32b3d01204567c6214dc11c83017b0 Mon Sep 17 00:00:00 2001
From: palinatolmach <11912158+palinatolmach@users.noreply.github.com>
Date: Sun, 9 Aug 2026 18:11:33 +0000
Subject: [PATCH 05/22] .github/scripts/check-cachix-pin.sh: remove cachix-pin
 verification

Only referenced by the removed release nix-cache job.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/scripts/check-cachix-pin.sh | 99 -----------------------------
 1 file changed, 99 deletions(-)
 delete mode 100755 .github/scripts/check-cachix-pin.sh

diff --git a/.github/scripts/check-cachix-pin.sh b/.github/scripts/check-cachix-pin.sh
deleted file mode 100755
index db5439cf31..0000000000
--- a/.github/scripts/check-cachix-pin.sh
+++ /dev/null
@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Kup relies on cachix registry k-framework-binary.
-CACHE="k-framework-binary"
-OWNER_REPO="${OWNER_REPO:-$(git remote get-url origin | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##')}"
-REV="${REV:-${GITHUB_SHA:-$(git rev-parse HEAD)}}"
-UNAME_S="$(uname -s)"
-UNAME_M="$(uname -m)"
-case "${UNAME_S}-${UNAME_M}" in
-  Linux-x86_64) SYSTEM="x86_64-linux" ;;
-  Linux-aarch64 | Linux-arm64) SYSTEM="aarch64-linux" ;;
-  Darwin-x86_64) SYSTEM="x86_64-darwin" ;;
-  Darwin-arm64) SYSTEM="aarch64-darwin" ;;
-  *)
-    echo "Unsupported platform: ${UNAME_S}-${UNAME_M}" >&2
-    exit 1
-    ;;
-esac
-PIN_API_URL="https://app.cachix.org/api/v1/cache/${CACHE}/pin"
-CHECK_PACKAGES=(kevm)
-
-SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/stdout}"
-
-# Append to the GitHub step summary when set; always print to stdout for live job logs.
-summary_and_log() {
-  if [[ "${SUMMARY}" == "/dev/stdout" ]]; then
-    cat
-  else
-    tee -a "${SUMMARY}"
-  fi
-}
-
-{
-  echo "## Cachix Publish Summary"
-  echo "CACHE: $CACHE"
-  echo "OWNER_REPO: $OWNER_REPO"
-  echo "REV: $REV"
-  echo "SYSTEM: $SYSTEM"
-  echo "PACKAGES: ${CHECK_PACKAGES[*]}"
-} >> "$SUMMARY"
-
-# Verify push + pin together for each package. Both can become visible with delay.
-PIN_VISIBILITY_TIMEOUT_SECONDS=120 # 2 minutes
-PIN_VISIBILITY_INTERVAL_SECONDS=5  # 5 seconds
-PIN_VISIBILITY_ATTEMPTS=$((PIN_VISIBILITY_TIMEOUT_SECONDS / PIN_VISIBILITY_INTERVAL_SECONDS))
-for i in $(seq 1 "$PIN_VISIBILITY_ATTEMPTS"); do
-  PIN_JSON="$(curl -fsSL "${PIN_API_URL}?q=${REV}")"
-  ALL_OK=1
-
-  for PKG in "${CHECK_PACKAGES[@]}"; do
-    KEY="github:${OWNER_REPO}/${REV}#packages.${SYSTEM}.${PKG}"
-    STORE_PATH="$(
-      echo "$PIN_JSON" \
-        | jq -r --arg k "$KEY" 'map(select(.name == $k)) | first | (.lastRevision.storePath // .storePath // .store_path // .path // "")'
-    )"
-    if [ -z "$STORE_PATH" ]; then
-      PIN_STATUS="pin-missing"
-      PUSH_STATUS="000"
-      ALL_OK=0
-      {
-        echo "key-${PKG}: ${KEY}"
-        echo "pin-status-${PKG}: ${PIN_STATUS}"
-        echo "push-http-${PKG}: ${PUSH_STATUS}"
-      } | summary_and_log
-      continue
-    fi
-
-    PIN_STATUS="pin-ok"
-    HASH="$(basename "$STORE_PATH" | cut -d- -f1)"
-    PUSH_NARINFO_URL="https://${CACHE}.cachix.org/${HASH}.narinfo"
-    PUSH_STATUS="$(curl -sS -o /dev/null -w '%{http_code}' "$PUSH_NARINFO_URL")" || PUSH_STATUS="000"
-    if [ "$PUSH_STATUS" != "200" ]; then
-      ALL_OK=0
-    fi
-
-    {
-      echo "key-${PKG}: ${KEY}"
-      echo "store-path-${PKG}: ${STORE_PATH}"
-      echo "pin-status-${PKG}: ${PIN_STATUS}"
-      echo "push-http-${PKG}: ${PUSH_STATUS}"
-    } | summary_and_log
-  done
-
-  if [ "$ALL_OK" = "1" ]; then
-    echo "cachix-status: push-and-pin-ok-for-all-packages" >> "$SUMMARY"
-    exit 0
-  fi
-
-  RETRY_MSG="cachix-check-attempt-${i}: not-ready, retrying in ${PIN_VISIBILITY_INTERVAL_SECONDS}s"
-  printf '%s\n' "$RETRY_MSG" | summary_and_log
-  sleep "$PIN_VISIBILITY_INTERVAL_SECONDS"
-done
-
-echo "cachix-status: push-or-pin-missing-after-${PIN_VISIBILITY_TIMEOUT_SECONDS}s-for-at-least-one-package" >> "$SUMMARY"
-# Pin API bulk JSON goes to job logs only (step summary stays readable); helps if the response shape changes.
-echo "check-cachix-pin: raw Cachix pin API response (last fetch):" >&2
-echo "$PIN_JSON" >&2
-exit 1

From a070e56e7c3fdfc28db9e88c135708e16e05618d Mon Sep 17 00:00:00 2001
From: palinatolmach <11912158+palinatolmach@users.noreply.github.com>
Date: Sun, 9 Aug 2026 18:29:16 +0000
Subject: [PATCH 06/22] .github/workflows/release.yml: shorten header comment

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b69c668cd8..2eb361cb69 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,14 +7,8 @@ concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
 
-# Uses only the auto-issued, per-run GITHUB_TOKEN (no stored secrets); every
-# other permission scope is implicitly dropped to none. Runs only on push to
-# the trusted `release` branch and executes only in-repo scripts (version.sh,
-# gh) -- never untrusted PR code -- so the write-scoped token is never exposed
-# to third-party code. The Nix/Cachix binary caches and docs are published
-# outside GitHub Actions. A release is cut by pushing the `release` branch
-# manually (e.g. merging master into it); this workflow then bumps the version,
-# commits it back to `release`, and creates the `v<version>` tag + release.
+# Uses only the built-in GITHUB_TOKEN to cut a release on a push to the
+# `release` branch: this bumps the version, then creates the v<version> release.
 permissions:
   contents: write
 

From a279462a9feab25a03c377ac9e4dc6d8cda4e508 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Mon, 10 Aug 2026 12:40:33 +0300
Subject: [PATCH 07/22] release.yml: set cancel-in-progress to false

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2eb361cb69..5d6ae4e086 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,7 @@ on:
       - 'release'
 concurrency:
   group: ${{ github.workflow }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 # Uses only the built-in GITHUB_TOKEN to cut a release on a push to the
 # `release` branch: this bumps the version, then creates the v<version> release.

From 42767ea44423979df417bcd5e06caa38b550beeb Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Mon, 10 Aug 2026 12:44:48 +0300
Subject: [PATCH 08/22] release.yml: drop the 'with:' block

---
 .github/workflows/release.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5d6ae4e086..cd4033d3ab 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,9 +19,6 @@ jobs:
     steps:
       - name: 'Check out release branch'
         uses: actions/checkout@v7
-        with:
-          ref: release
-          fetch-depth: 0
       - name: 'Configure git identity'
         run: |
           git config user.name 'github-actions[bot]'

From 95fdf0f1270625d9395b3b9c2899b74651fc6ebe Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Mon, 10 Aug 2026 13:15:11 +0300
Subject: [PATCH 09/22] version.sh: run uv --project kevm-pyk lock

---
 .github/workflows/release.yml | 11 +++++++++++
 package/version.sh            |  2 ++
 2 files changed, 13 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cd4033d3ab..7fcdd89c81 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,6 +23,17 @@ jobs:
         run: |
           git config user.name 'github-actions[bot]'
           git config user.email 'github-actions[bot]@users.noreply.github.com'
+      - name: 'Get uv release'
+        id: uv_release
+        run: |
+          echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
+      - name: 'Install uv'
+        uses: astral-sh/setup-uv@v9.0.0
+        with:
+          version: ${{ steps.uv_release.outputs.uv_version }}
+          # The lock step runs once per release; a restored cache would only add a
+          # writable input to a workflow that publishes.
+          enable-cache: false
       - name: 'Bump version, commit, push, and create release'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/package/version.sh b/package/version.sh
index bb81c828a6..f0b1f6924a 100755
--- a/package/version.sh
+++ b/package/version.sh
@@ -29,6 +29,8 @@ version_sub() {
     local version
     version="$(cat $version_file)"
     sed --in-place 's/^version = ".*"$/version = "'${version}'"/' kevm-pyk/pyproject.toml
+    # uv.lock records the workspace package version too; re-lock so it cannot drift from the manifest.
+    uv --project kevm-pyk lock
 }
 
 version_command="$1" ; shift

From 940a37c82cec03628a3a2fece79fa4eddc089591 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Mon, 10 Aug 2026 14:48:02 +0300
Subject: [PATCH 10/22] workflows: pin commit SHA's instead of version numbers

---
 .github/workflows/release.yml |  4 ++--
 .github/workflows/test-pr.yml | 20 ++++++++++----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7fcdd89c81..88719b894b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out release branch'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: 'Configure git identity'
         run: |
           git config user.name 'github-actions[bot]'
@@ -28,7 +28,7 @@ jobs:
         run: |
           echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v9.0.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
           # The lock step runs once per release; a restored cache would only add a
diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index 2314850093..1eb1e2532e 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: 'Setup Python 3.10'
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.10'
       - name: 'Get uv release'
@@ -23,7 +23,7 @@ jobs:
         run: |
           echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v9.0.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
       - name: 'Run code quality checks'
@@ -37,13 +37,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: 'Get uv release'
         id: uv_release
         run: |
           echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v9.0.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
       - name: 'Run unit tests'
@@ -55,13 +55,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: 'Get uv release'
         id: uv_release
         run: |
           echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v9.0.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
       - name: 'Run profiling'
@@ -75,7 +75,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           submodules: recursive
       - name: 'Set up Docker'
@@ -138,7 +138,7 @@ jobs:
     timeout-minutes: ${{ matrix.timeout }}
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: 'Check out select submodules'
         run: |
           set -eux
@@ -169,7 +169,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           # Check out pull request HEAD instead of merge commit.
           ref: ${{ github.event.pull_request.head.sha }}

From 785673fccd9091d30cd81ddd42d1b4adc77dc7aa Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Mon, 10 Aug 2026 15:01:40 +0300
Subject: [PATCH 11/22] release.yml: refactor gh release create command

---
 .github/workflows/release.yml | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 88719b894b..1b7a303359 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,7 +8,10 @@ concurrency:
   cancel-in-progress: false
 
 # Uses only the built-in GITHUB_TOKEN to cut a release on a push to the
-# `release` branch: this bumps the version, then creates the v<version> release.
+# `release` branch: this bumps the version, then drafts the v<version> release.
+# The draft is published by hand. `release` only ever receives merges from `master`,
+# which test-pr.yml has already tested, so the one thing no CI covers is the merge
+# resolution itself — that is what the human check before publishing is for.
 permissions:
   contents: write
 
@@ -34,7 +37,7 @@ jobs:
           # The lock step runs once per release; a restored cache would only add a
           # writable input to a workflow that publishes.
           enable-cache: false
-      - name: 'Bump version, commit, push, and create release'
+      - name: 'Bump version, commit, push, and draft release'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -44,7 +47,8 @@ jobs:
           VERSION="v$(cat package/version)"
           git commit --all --message "Set Version: ${VERSION}"
           git push origin HEAD:release
-          gh release create "${VERSION}"              \
-            --repo runtimeverification/evm-semantics  \
-            --title "${VERSION}"                       \
-            --target "$(git rev-parse HEAD)"
+          gh release create "${VERSION}"     \
+            --draft                          \
+            --title "${VERSION}"             \
+            --target "$(git rev-parse HEAD)" \
+            --generate-notes

From d825b52e137cdeacd9ae18206cb40b1573bbfdf8 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Mon, 10 Aug 2026 15:16:51 +0300
Subject: [PATCH 12/22] test-pr.yml: set read-only permissions

---
 .github/workflows/test-pr.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index 1eb1e2532e..d982d9622a 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -7,6 +7,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# No job here writes to the repository, so the token stays read-only regardless of
+# the repository default. release.yml is the only workflow that needs contents: write.
+permissions:
+  contents: read
+
 jobs:
   kevm-pyk-code-quality-checks:
     name: 'Code Quality Checks'

From 4fcaf89cf2f6755aee4e018f556b4859d98ae9f4 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Mon, 10 Aug 2026 16:29:18 +0300
Subject: [PATCH 13/22] version.sh: cleanup

---
 package/version.sh | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/package/version.sh b/package/version.sh
index f0b1f6924a..033edab851 100755
--- a/package/version.sh
+++ b/package/version.sh
@@ -7,20 +7,15 @@ fatal() { echo "[FATAL] $@" ; exit 1 ; }
 
 version_file="package/version"
 
+# Bumps the patch level. Starting a new major/minor line means setting `package/version`
+# by hand first; the first release of that line is then X.Y.1, not X.Y.0.
 version_bump() {
-    local version release_commit version_major version_minor version_patch new_version current_version current_version_major current_version_minor current_version_patch
-    version="$(cat ${version_file})"
-    version_major="$(echo ${version} | cut --delimiter '.' --field 1)"
-    version_minor="$(echo ${version} | cut --delimiter '.' --field 2)"
-    version_patch="$(echo ${version} | cut --delimiter '.' --field 3)"
-    current_version="$(cat ${version_file})"
-    current_version_major="$(echo ${current_version} | cut --delimiter '.' --field 1)"
-    current_version_minor="$(echo ${current_version} | cut --delimiter '.' --field 2)"
-    current_version_patch="$(echo ${current_version} | cut --delimiter '.' --field 3)"
-    new_version="${version}"
-    if [[ "${version_major}" == "${current_version_major}" ]] && [[ "${version_minor}" == "${current_version_minor}" ]]; then
-        new_version="${version_major}.${version_minor}.$((version_patch + 1))"
-    fi
+    local version version_major version_minor version_patch new_version
+    version="$(cat "${version_file}")"
+    version_major="$(echo "${version}" | cut --delimiter '.' --field 1)"
+    version_minor="$(echo "${version}" | cut --delimiter '.' --field 2)"
+    version_patch="$(echo "${version}" | cut --delimiter '.' --field 3)"
+    new_version="${version_major}.${version_minor}.$((version_patch + 1))"
     echo "${new_version}" > "${version_file}"
     notif "Version: ${new_version}"
 }

From 48b61268c4ff9612996cb22de8586a199895de84 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Mon, 10 Aug 2026 16:32:24 +0300
Subject: [PATCH 14/22] test-pr.yml: update docker invocation

---
 .github/workflows/test-pr.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index d982d9622a..5e74c1e331 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -100,7 +100,9 @@ jobs:
       - name: 'Tear down Docker'
         if: always()
         run: |
-          docker stop --time=0 kevm-ci-concrete-${{ github.sha }}
+          # Best effort: the container does not exist if 'Set up Docker' failed, and a
+          # non-zero exit here would mask the step that actually failed.
+          docker stop --timeout=0 kevm-ci-concrete-${{ github.sha }} || true
 
   test-prove:
     name: 'Proofs: ${{ matrix.name }}'
@@ -159,7 +161,9 @@ jobs:
       - name: 'Tear down Docker'
         if: always()
         run: |
-          docker stop --time=0 kevm-ci-haskell-${{ matrix.test-suite }}-${{ github.sha }}
+          # Best effort: the container does not exist if 'Set up Docker' failed, and a
+          # non-zero exit here would mask the step that actually failed.
+          docker stop --timeout=0 kevm-ci-haskell-${{ matrix.test-suite }}-${{ github.sha }} || true
 
   nix:
     name: 'Nix'

From 004f0011ca6c7dd2fd275c6e59a931d9298a3d78 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Wed, 12 Aug 2026 12:17:20 +0300
Subject: [PATCH 15/22] temporarily remove release.yml

---
 .github/workflows/release.yml | 54 -----------------------------------
 package/version.sh            | 23 ++++++++-------
 2 files changed, 13 insertions(+), 64 deletions(-)
 delete mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 1b7a303359..0000000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: 'Release'
-on:
-  push:
-    branches:
-      - 'release'
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-# Uses only the built-in GITHUB_TOKEN to cut a release on a push to the
-# `release` branch: this bumps the version, then drafts the v<version> release.
-# The draft is published by hand. `release` only ever receives merges from `master`,
-# which test-pr.yml has already tested, so the one thing no CI covers is the merge
-# resolution itself — that is what the human check before publishing is for.
-permissions:
-  contents: write
-
-jobs:
-  release:
-    name: 'Bump version and create release'
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Check out release branch'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - name: 'Configure git identity'
-        run: |
-          git config user.name 'github-actions[bot]'
-          git config user.email 'github-actions[bot]@users.noreply.github.com'
-      - name: 'Get uv release'
-        id: uv_release
-        run: |
-          echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
-      - name: 'Install uv'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
-        with:
-          version: ${{ steps.uv_release.outputs.uv_version }}
-          # The lock step runs once per release; a restored cache would only add a
-          # writable input to a workflow that publishes.
-          enable-cache: false
-      - name: 'Bump version, commit, push, and draft release'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euxo pipefail
-          ./package/version.sh bump
-          ./package/version.sh sub
-          VERSION="v$(cat package/version)"
-          git commit --all --message "Set Version: ${VERSION}"
-          git push origin HEAD:release
-          gh release create "${VERSION}"     \
-            --draft                          \
-            --title "${VERSION}"             \
-            --target "$(git rev-parse HEAD)" \
-            --generate-notes
diff --git a/package/version.sh b/package/version.sh
index 033edab851..bb81c828a6 100755
--- a/package/version.sh
+++ b/package/version.sh
@@ -7,15 +7,20 @@ fatal() { echo "[FATAL] $@" ; exit 1 ; }
 
 version_file="package/version"
 
-# Bumps the patch level. Starting a new major/minor line means setting `package/version`
-# by hand first; the first release of that line is then X.Y.1, not X.Y.0.
 version_bump() {
-    local version version_major version_minor version_patch new_version
-    version="$(cat "${version_file}")"
-    version_major="$(echo "${version}" | cut --delimiter '.' --field 1)"
-    version_minor="$(echo "${version}" | cut --delimiter '.' --field 2)"
-    version_patch="$(echo "${version}" | cut --delimiter '.' --field 3)"
-    new_version="${version_major}.${version_minor}.$((version_patch + 1))"
+    local version release_commit version_major version_minor version_patch new_version current_version current_version_major current_version_minor current_version_patch
+    version="$(cat ${version_file})"
+    version_major="$(echo ${version} | cut --delimiter '.' --field 1)"
+    version_minor="$(echo ${version} | cut --delimiter '.' --field 2)"
+    version_patch="$(echo ${version} | cut --delimiter '.' --field 3)"
+    current_version="$(cat ${version_file})"
+    current_version_major="$(echo ${current_version} | cut --delimiter '.' --field 1)"
+    current_version_minor="$(echo ${current_version} | cut --delimiter '.' --field 2)"
+    current_version_patch="$(echo ${current_version} | cut --delimiter '.' --field 3)"
+    new_version="${version}"
+    if [[ "${version_major}" == "${current_version_major}" ]] && [[ "${version_minor}" == "${current_version_minor}" ]]; then
+        new_version="${version_major}.${version_minor}.$((version_patch + 1))"
+    fi
     echo "${new_version}" > "${version_file}"
     notif "Version: ${new_version}"
 }
@@ -24,8 +29,6 @@ version_sub() {
     local version
     version="$(cat $version_file)"
     sed --in-place 's/^version = ".*"$/version = "'${version}'"/' kevm-pyk/pyproject.toml
-    # uv.lock records the workspace package version too; re-lock so it cannot drift from the manifest.
-    uv --project kevm-pyk lock
 }
 
 version_command="$1" ; shift

From d577dc00d36f88ac13248f1219acd3baeff031a6 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Wed, 12 Aug 2026 12:31:07 +0300
Subject: [PATCH 16/22] address zizmor findings

---
 .github/actions/with-docker/action.yml | 22 +++++++++++++++-------
 .github/workflows/test-pr.yml          | 12 +++++++++++-
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/.github/actions/with-docker/action.yml b/.github/actions/with-docker/action.yml
index 1ab3314dcd..9ff324e62b 100644
--- a/.github/actions/with-docker/action.yml
+++ b/.github/actions/with-docker/action.yml
@@ -43,13 +43,13 @@ runs:
     run: |
       set -euxo pipefail
 
-      CONTAINER_NAME=${{ inputs.container-name }}
-      SUBDIR=${{ inputs.subdir }}
-      BASE_OS=${{ inputs.os }}
-      BASE_DISTRO=${{ inputs.distro }}
-      DOCKERFILE=${{ inputs.dockerfile }}
-      LLVM_VERSION=${{ inputs.llvm }}
-      TAG_NAME=${{ inputs.tag-name }}
+      CONTAINER_NAME=${INPUTS_CONTAINER_NAME}
+      SUBDIR=${INPUTS_SUBDIR}
+      BASE_OS=${INPUTS_OS}
+      BASE_DISTRO=${INPUTS_DISTRO}
+      DOCKERFILE=${INPUTS_DOCKERFILE}
+      LLVM_VERSION=${INPUTS_LLVM}
+      TAG_NAME=${INPUTS_TAG_NAME}
 
       USER=github-user
       GROUP=${USER}
@@ -83,3 +83,11 @@ runs:
 
       docker cp . ${CONTAINER_NAME}:/home/${USER}/workspace
       docker exec ${CONTAINER_NAME} chown -R ${USER}:${GROUP} /home/${USER}
+    env:
+      INPUTS_CONTAINER_NAME: ${{ inputs.container-name }}
+      INPUTS_SUBDIR: ${{ inputs.subdir }}
+      INPUTS_OS: ${{ inputs.os }}
+      INPUTS_DISTRO: ${{ inputs.distro }}
+      INPUTS_DOCKERFILE: ${{ inputs.dockerfile }}
+      INPUTS_LLVM: ${{ inputs.llvm }}
+      INPUTS_TAG_NAME: ${{ inputs.tag-name }}
diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index 5e74c1e331..843bbe6ef3 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -8,7 +8,7 @@ concurrency:
   cancel-in-progress: true
 
 # No job here writes to the repository, so the token stays read-only regardless of
-# the repository default. release.yml is the only workflow that needs contents: write.
+# the repository default.
 permissions:
   contents: read
 
@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: 'Check out code'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: 'Setup Python 3.10'
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
@@ -43,6 +45,8 @@ jobs:
     steps:
       - name: 'Check out code'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: 'Get uv release'
         id: uv_release
         run: |
@@ -61,6 +65,8 @@ jobs:
     steps:
       - name: 'Check out code'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: 'Get uv release'
         id: uv_release
         run: |
@@ -83,6 +89,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           submodules: recursive
+          persist-credentials: false
       - name: 'Set up Docker'
         uses: ./.github/actions/with-docker
         with:
@@ -146,6 +153,8 @@ jobs:
     steps:
       - name: 'Check out code'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: 'Check out select submodules'
         run: |
           set -eux
@@ -182,6 +191,7 @@ jobs:
         with:
           # Check out pull request HEAD instead of merge commit.
           ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
       - name: 'Check out select submodules'
         run: |
           set -eux

From d3bc3cb96d4b9094469b63bc70a96fd046cc1135 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Wed, 12 Aug 2026 12:49:36 +0300
Subject: [PATCH 17/22] action.yml: address review comments

---
 .github/actions/with-docker/action.yml | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/.github/actions/with-docker/action.yml b/.github/actions/with-docker/action.yml
index 9ff324e62b..579ea2c933 100644
--- a/.github/actions/with-docker/action.yml
+++ b/.github/actions/with-docker/action.yml
@@ -39,18 +39,16 @@ runs:
   using: 'composite'
   steps:
   - name: 'Set up Docker'
+    env:
+      CONTAINER_NAME: ${{ inputs.container-name }}
+      BASE_DISTRO: ${{ inputs.distro }}
+      DOCKERFILE: ${{ inputs.dockerfile }}
+      LLVM_VERSION: ${{ inputs.llvm }}
+      TAG_NAME: ${{ inputs.tag-name }}
     shell: bash {0}
     run: |
       set -euxo pipefail
 
-      CONTAINER_NAME=${INPUTS_CONTAINER_NAME}
-      SUBDIR=${INPUTS_SUBDIR}
-      BASE_OS=${INPUTS_OS}
-      BASE_DISTRO=${INPUTS_DISTRO}
-      DOCKERFILE=${INPUTS_DOCKERFILE}
-      LLVM_VERSION=${INPUTS_LLVM}
-      TAG_NAME=${INPUTS_TAG_NAME}
-
       USER=github-user
       GROUP=${USER}
       Z3_VERSION=$(cat deps/z3)
@@ -83,11 +81,3 @@ runs:
 
       docker cp . ${CONTAINER_NAME}:/home/${USER}/workspace
       docker exec ${CONTAINER_NAME} chown -R ${USER}:${GROUP} /home/${USER}
-    env:
-      INPUTS_CONTAINER_NAME: ${{ inputs.container-name }}
-      INPUTS_SUBDIR: ${{ inputs.subdir }}
-      INPUTS_OS: ${{ inputs.os }}
-      INPUTS_DISTRO: ${{ inputs.distro }}
-      INPUTS_DOCKERFILE: ${{ inputs.dockerfile }}
-      INPUTS_LLVM: ${{ inputs.llvm }}
-      INPUTS_TAG_NAME: ${{ inputs.tag-name }}

From 1bdce2783d3c68a73ee6d835ee22d9b008f6f027 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Wed, 12 Aug 2026 13:22:09 +0300
Subject: [PATCH 18/22] .github/actions/with-docker, workflows/Dockerfile: drop
 the unused distro plumbing

---
 .github/actions/with-docker/action.yml | 63 +++++++++-----------------
 .github/workflows/Dockerfile           |  1 -
 2 files changed, 21 insertions(+), 43 deletions(-)

diff --git a/.github/actions/with-docker/action.yml b/.github/actions/with-docker/action.yml
index 579ea2c933..8e2367a45c 100644
--- a/.github/actions/with-docker/action.yml
+++ b/.github/actions/with-docker/action.yml
@@ -3,37 +3,18 @@ description: 'Run a given stage with Docker Image'
 inputs:
   container-name:
     description: 'Docker container name to use'
-    type: string
     required: true
   tag-name:
     description: 'Docker image tag to use'
-    type: string
     required: false
     default: runtimeverificationinc/kevm
-  subdir:
-    description: 'Subdirectory where code is cloned.'
-    required: false
-    type: string
-    default: './'
-  os:
-    description: 'OS to setup Docker for.'
-    required: false
-    type: string
-    default: 'ubuntu'
-  distro:
-    description: 'Distribution to setup Docker for.'
-    required: false
-    type: string
-    default: 'jammy'
   llvm:
     description: 'LLVM version to use.'
     required: false
-    type: number
     default: 14
   dockerfile:
     description: 'Hardcode the path of the dockerfile to use.'
     required: false
-    type: string
     default: '.github/workflows/Dockerfile'
 runs:
   using: 'composite'
@@ -41,7 +22,6 @@ runs:
   - name: 'Set up Docker'
     env:
       CONTAINER_NAME: ${{ inputs.container-name }}
-      BASE_DISTRO: ${{ inputs.distro }}
       DOCKERFILE: ${{ inputs.dockerfile }}
       LLVM_VERSION: ${{ inputs.llvm }}
       TAG_NAME: ${{ inputs.tag-name }}
@@ -57,27 +37,26 @@ runs:
       USER_ID=1000
       GROUP_ID=${USER_ID}
 
-      docker build . --file ${DOCKERFILE}        \
-        --tag ${TAG_NAME}                        \
-        --build-arg USER_ID=${USER_ID}           \
-        --build-arg GROUP_ID=${GROUP_ID}         \
-        --build-arg USER=${USER}                 \
-        --build-arg GROUP=${GROUP}               \
-        --build-arg BASE_DISTRO=${BASE_DISTRO}   \
-        --build-arg K_VERSION=${K_VERSION}       \
-        --build-arg Z3_VERSION=${Z3_VERSION}     \
-        --build-arg LLVM_VERSION=${LLVM_VERSION} \
-        --build-arg UV_VERSION=${UV_VERSION}
+      docker build . --file "${DOCKERFILE}"         \
+        --tag "${TAG_NAME}"                         \
+        --build-arg USER_ID="${USER_ID}"            \
+        --build-arg GROUP_ID="${GROUP_ID}"          \
+        --build-arg USER="${USER}"                  \
+        --build-arg GROUP="${GROUP}"                \
+        --build-arg K_VERSION="${K_VERSION}"        \
+        --build-arg Z3_VERSION="${Z3_VERSION}"      \
+        --build-arg LLVM_VERSION="${LLVM_VERSION}"  \
+        --build-arg UV_VERSION="${UV_VERSION}"
 
-      docker run                          \
-        --name ${CONTAINER_NAME}          \
-        --rm                              \
-        --interactive                     \
-        --tty                             \
-        --detach                          \
-        --user root                       \
-        --workdir /home/${USER}/workspace \
-        ${TAG_NAME}
+      docker run                            \
+        --name "${CONTAINER_NAME}"          \
+        --rm                                \
+        --interactive                       \
+        --tty                               \
+        --detach                            \
+        --user root                         \
+        --workdir "/home/${USER}/workspace" \
+        "${TAG_NAME}"
 
-      docker cp . ${CONTAINER_NAME}:/home/${USER}/workspace
-      docker exec ${CONTAINER_NAME} chown -R ${USER}:${GROUP} /home/${USER}
+      docker cp . "${CONTAINER_NAME}":"/home/${USER}/workspace"
+      docker exec "${CONTAINER_NAME}" chown -R "${USER}:${GROUP}" "/home/${USER}"
diff --git a/.github/workflows/Dockerfile b/.github/workflows/Dockerfile
index 75bcf51e40..e77cd1ac58 100644
--- a/.github/workflows/Dockerfile
+++ b/.github/workflows/Dockerfile
@@ -1,6 +1,5 @@
 ARG Z3_VERSION
 ARG K_VERSION
-ARG BASE_DISTRO
 ARG LLVM_VERSION
 
 ARG Z3_VERSION

From d8e0c75f5a9f528c02a9bc7eaf874d40b775a898 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Wed, 12 Aug 2026 13:22:26 +0300
Subject: [PATCH 19/22] actionlint: fix findings

---
 .github/workflows/test-pr.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index 843bbe6ef3..941030fb7f 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -28,7 +28,7 @@ jobs:
       - name: 'Get uv release'
         id: uv_release
         run: |
-          echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
+          echo "uv_version=$(cat deps/uv_release)" >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
         uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
@@ -50,7 +50,7 @@ jobs:
       - name: 'Get uv release'
         id: uv_release
         run: |
-          echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
+          echo "uv_version=$(cat deps/uv_release)" >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
         uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
@@ -70,7 +70,7 @@ jobs:
       - name: 'Get uv release'
         id: uv_release
         run: |
-          echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
+          echo "uv_version=$(cat deps/uv_release)" >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
         uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:

From 1cd4b876fb5a76c52223fc8994182f9b4da9a251 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Wed, 12 Aug 2026 13:40:14 +0300
Subject: [PATCH 20/22] add workflow to run actionlint and zizmor

---
 .github/actionlint.yaml              |  6 +++
 .github/workflows/lint-workflows.yml | 56 ++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+)
 create mode 100644 .github/actionlint.yaml
 create mode 100644 .github/workflows/lint-workflows.yml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000000..b0cd5f4698
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,6 @@
+# Custom labels for the self-hosted runners; actionlint cannot discover them.
+self-hosted-runner:
+  labels:
+    - normal
+    - fast
+    - ARM64
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
new file mode 100644
index 0000000000..c2fc08c6fa
--- /dev/null
+++ b/.github/workflows/lint-workflows.yml
@@ -0,0 +1,56 @@
+name: 'Lint Workflows'
+on:
+  pull_request:
+    branches:
+      - 'master'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: 'actionlint'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Check out code'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: 'Install actionlint'
+        env:
+          # Pin the release and verify it, both values should be updated together.
+          ACTIONLINT_VERSION: '1.7.12'
+          ACTIONLINT_SHA256: '8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8'
+        run: |
+          set -euxo pipefail
+          curl --fail --silent --show-error --location --output actionlint.tar.gz \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  actionlint.tar.gz" | sha256sum --check --strict
+          tar --extract --gzip --file actionlint.tar.gz actionlint
+      - name: 'Run actionlint'
+        run: ./actionlint -color
+
+  zizmor:
+    name: 'zizmor'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Check out code'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: 'Get uv release'
+        id: uv_release
+        run: |
+          echo "uv_version=$(cat deps/uv_release)" >> "${GITHUB_OUTPUT}"
+      - name: 'Install uv'
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
+        with:
+          version: ${{ steps.uv_release.outputs.uv_version }}
+          enable-cache: false
+      - name: 'Run zizmor'
+        env:
+          ZIZMOR_VERSION: '1.29.0'
+        run: uvx "zizmor@${ZIZMOR_VERSION}" --offline .github/

From 6e75b7c90e27fb4b6a18e56f5be5ab7382cfbef9 Mon Sep 17 00:00:00 2001
From: Andrei <16517508+anvacaru@users.noreply.github.com>
Date: Wed, 12 Aug 2026 14:05:35 +0300
Subject: [PATCH 21/22] lint-workflows: use zizmor-action instead of uvx

---
 .github/workflows/lint-workflows.yml | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
index c2fc08c6fa..15809975e2 100644
--- a/.github/workflows/lint-workflows.yml
+++ b/.github/workflows/lint-workflows.yml
@@ -36,21 +36,18 @@ jobs:
   zizmor:
     name: 'zizmor'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write  # upload SARIF, so findings annotate the diff
     steps:
       - name: 'Check out code'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
-      - name: 'Get uv release'
-        id: uv_release
-        run: |
-          echo "uv_version=$(cat deps/uv_release)" >> "${GITHUB_OUTPUT}"
-      - name: 'Install uv'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
-        with:
-          version: ${{ steps.uv_release.outputs.uv_version }}
-          enable-cache: false
       - name: 'Run zizmor'
-        env:
-          ZIZMOR_VERSION: '1.29.0'
-        run: uvx "zizmor@${ZIZMOR_VERSION}" --offline .github/
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054  # v0.6.2
+        with:
+          version: '1.29.0'
+          online-audits: false
+          inputs: .github/
+          advanced-security: true

From 1d51acb09c1af259672da941123f79a302c30f28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andrei=20V=C4=83caru?=
 <16517508+anvacaru@users.noreply.github.com>
Date: Wed, 12 Aug 2026 14:19:09 +0300
Subject: [PATCH 22/22] Update .github/workflows/lint-workflows.yml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Tamás Tóth <tothtamas28@users.noreply.github.com>
---
 .github/workflows/lint-workflows.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
index 15809975e2..aec14283a2 100644
--- a/.github/workflows/lint-workflows.yml
+++ b/.github/workflows/lint-workflows.yml
@@ -49,5 +49,4 @@ jobs:
         with:
           version: '1.29.0'
           online-audits: false
-          inputs: .github/
           advanced-security: true