refactor github action upload flow

[noam-starkware]

Type

• feature
• bugfix
• dev (no functional changes, no API changes)
• fmt (formatting, renaming)
• build
• docs
• testing

Description

Breaking changes?

• yes
• no

---

This change is 

[cursor]

PR Summary

Low Risk
Low risk refactor of CI workflow logic; main risk is misnaming/paths in the new composite action causing missing or misrouted uploaded artifacts.

Overview
Refactors the artifact upload workflow by extracting the repeated arch-specific Rust build/rename/upload steps into a new composite GitHub Action (.github/actions/build-arch-binary).

The workflow now calls this action for each target CPU (znver{3,4,5}, emeraldrapids, sapphirerapids, graniterapids), standardizing the target-cpu build flags, binary renaming from hyphens to underscores, and the GCS destination naming convention.

^{Reviewed by Cursor Bugbot for commit b20163c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.16%. Comparing base (9824175) to head (b20163c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #340   +/-   ##
=======================================
  Coverage   53.16%   53.16%           
=======================================
  Files          35       35           
  Lines        5295     5295           
=======================================
  Hits         2815     2815           
  Misses       2480     2480           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[semgrep-code-starkware-libs]

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

🥳 Fixed in commit 4b9d4a7 🥳

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b20163c. Configure here.}

[cursor]

Composite action has undeclared dependency on SHORT_HASH

Medium Severity

The composite action references ${{ env.SHORT_HASH }} in the upload destination but never declares it as an input parameter, unlike arch and binary_name. This creates a hidden contract with the calling workflow. If the action is reused in a context where SHORT_HASH isn't set, the destination path silently includes an empty segment, uploading artifacts to the wrong location with no error. Making SHORT_HASH (or a commit_hash equivalent) an explicit required input would make the action self-contained and safe to reuse.

Additional Locations (1)

• .github/actions/build-arch-binary/action.yml#L3-L10

 

^{Reviewed by Cursor Bugbot for commit b20163c. Configure here.}

[noam-starkware]

We invoke via the upload script which defines the hash so I don't think this is an issue and passing the value seems redundant since it's already in scope at invoke time.

[noam-starkware]

@noam-starkware made 1 comment.
Reviewable status: 0 of 2 files reviewed, 2 unresolved discussions (waiting on YairVaknin-starkware).

[noam-starkware]

We invoke via the upload script which defines the hash so I don't think this is an issue and passing the value seems redundant since it's already in scope at invoke time.

[YairVaknin-starkware]

@YairVaknin-starkware reviewed 2 files and all commit messages, and made 1 comment.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on noam-starkware).

---

a discussion (no related file):
Have u created a dummy commit over this branch so the push binaries workflow runs for pushes to this branch to test it works?

[noam-starkware]

@noam-starkware made 1 comment and resolved 1 discussion.
Reviewable status: all files reviewed, 2 unresolved discussions (waiting on YairVaknin-starkware).

---

a discussion (no related file):

Previously, YairVaknin-starkware wrote…

Have u created a dummy commit over this branch so the push binaries workflow runs for pushes to this branch to test it works?

Yes, sorry, I thought I wrote this here. I compiled an exmaple and made sure the resulting bins are equivalent to the one from the base on main.