From 3feae978878b875a09d8e578af01aaff0d53e688 Mon Sep 17 00:00:00 2001
From: spencer-tb <spencer.tb@ethereum.org>
Date: Fri, 3 Jul 2026 14:42:51 +0100
Subject: [PATCH 01/14] feat(ci): nightly full fill of all tests and fixture
 formats

---
 .github/workflows/nightly-fill.yaml | 74 +++++++++++++++++++++++++++++
 Justfile                            | 17 +++++++
 2 files changed, 91 insertions(+)
 create mode 100644 .github/workflows/nightly-fill.yaml

diff --git a/.github/workflows/nightly-fill.yaml b/.github/workflows/nightly-fill.yaml
new file mode 100644
index 00000000000..9970e09e836
--- /dev/null
+++ b/.github/workflows/nightly-fill.yaml
@@ -0,0 +1,74 @@
+name: Nightly Fill
+
+# Runs at 02:00 UTC: the self-hosted runners are past the EU/US daytime
+# peaks and results are ready before the EU morning.
+on:
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: Check for new commits
+    runs-on: ubuntu-latest
+    outputs:
+      run: ${{ steps.check.outputs.run }}
+    steps:
+      - name: Check for commits in the last 25 hours
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          since=$(date -u -d "25 hours ago" +%Y-%m-%dT%H:%M:%SZ)
+          count=$(gh api "repos/${GITHUB_REPOSITORY}/commits?sha=${GITHUB_SHA}&since=${since}&per_page=1" --jq length)
+          if [ "$count" -gt 0 ] || [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "No new commits since $since; skipping nightly fill."
+          fi
+
+  fill-nightly:
+    name: fill-nightly (${{ matrix.label }})
+    runs-on: [self-hosted-ghr, size-xl-x64]
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
+    timeout-minutes: 720
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: pre-shanghai
+            from_fork: Frontier
+            until_fork: Paris
+          - label: shanghai-cancun
+            from_fork: Shanghai
+            until_fork: Cancun
+          - label: prague
+            from_fork: Prague
+            until_fork: Prague
+          - label: osaka
+            from_fork: Osaka
+            until_fork: Osaka
+          - label: amsterdam
+            from_fork: Amsterdam
+            until_fork: Amsterdam
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          submodules: recursive
+      - uses: ./.github/actions/setup-uv
+        with:
+          python-version: "3.14"
+      - uses: ./.github/actions/setup-env
+      - name: Run nightly fill (${{ matrix.label }})
+        run: just fill-nightly --from ${{ matrix.from_fork }} --until ${{ matrix.until_fork }}
+        env:
+          PYTEST_XDIST_AUTO_NUM_WORKERS: auto
diff --git a/Justfile b/Justfile
index c3b7de95a5c..9091cd882c1 100644
--- a/Justfile
+++ b/Justfile
@@ -124,6 +124,23 @@ fill *args:
         "$@" \
         tests
 
+# Fill all tests (slow included) in all fixture formats
+[group('consensus tests')]
+fill-nightly *args:
+    @mkdir -p "{{ output_dir }}/fill-nightly/tmp" "{{ output_dir }}/fill-nightly/logs"
+    uv run fill \
+        -n {{ xdist_workers }} --dist=loadgroup \
+        --skip-index \
+        --generate-all-formats \
+        --output="{{ output_dir }}/fill-nightly/fixtures" \
+        --basetemp="{{ output_dir }}/fill-nightly/tmp" \
+        --log-to "{{ output_dir }}/fill-nightly/logs" \
+        --clean \
+        --until "{{ latest_fork }}" \
+        --durations=100 \
+        "$@" \
+        tests
+
 # --- Integration Tests ---
 
 # Fill the base coverage consensus tests using EELS with PyPy

From 68fe21d43485dd155130be2a7d0958a4308cb82d Mon Sep 17 00:00:00 2001
From: spencer-tb <spencer.tb@ethereum.org>
Date: Mon, 6 Jul 2026 13:26:19 +0100
Subject: [PATCH 02/14] chore(ci): address review comments

---
 .github/workflows/nightly-fill.yaml | 114 ++++++++++++++++++++++------
 1 file changed, 89 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/nightly-fill.yaml b/.github/workflows/nightly-fill.yaml
index 9970e09e836..97e9bcf1e16 100644
--- a/.github/workflows/nightly-fill.yaml
+++ b/.github/workflows/nightly-fill.yaml
@@ -13,53 +13,73 @@ concurrency:
 
 permissions:
   contents: read
+  # Needed to look up the last successful nightly run and to download the
+  # per-range fixture artifacts in the `combine` job.
+  actions: read
 
 jobs:
-  changes:
-    name: Check for new commits
+  setup:
+    name: Check commits and build fork matrix
     runs-on: ubuntu-latest
     outputs:
       run: ${{ steps.check.outputs.run }}
+      matrix: ${{ steps.matrix.outputs.matrix }}
     steps:
-      - name: Check for commits in the last 25 hours
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          submodules: false
+      - name: List commits since the last successful nightly fill
         id: check
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          since=$(date -u -d "25 hours ago" +%Y-%m-%dT%H:%M:%SZ)
-          count=$(gh api "repos/${GITHUB_REPOSITORY}/commits?sha=${GITHUB_SHA}&since=${since}&per_page=1" --jq length)
+          # Head SHA of the last nightly run that filled successfully. Using
+          # the last *success* (rather than a fixed time window) means a
+          # nightly that fails or is skipped keeps re-running until it goes
+          # green, and no commit slips through unfilled.
+          last_sha=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/workflows/nightly-fill.yaml/runs?status=success&per_page=1" \
+            --jq '.workflow_runs[0].head_sha // ""')
+
+          if [ -n "$last_sha" ]; then
+            commits=$(gh api \
+              "repos/${GITHUB_REPOSITORY}/compare/${last_sha}...${GITHUB_SHA}" \
+              --jq '.commits[] | "- \(.sha[0:7]) \(.commit.message | split("\n")[0])"')
+          else
+            # No prior successful run recorded; fill to establish a baseline.
+            commits="- (no previous successful nightly fill found)"
+          fi
+
+          count=$(printf '%s\n' "$commits" | grep -c . || true)
           if [ "$count" -gt 0 ] || [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
             echo "run=true" >> "$GITHUB_OUTPUT"
+            {
+              echo "### Commits since last successful nightly fill"
+              printf '%s\n' "$commits"
+            } >> "$GITHUB_STEP_SUMMARY"
           else
             echo "run=false" >> "$GITHUB_OUTPUT"
-            echo "No new commits since $since; skipping nightly fill."
+            echo "No new commits since the last successful nightly fill; skipping." \
+              >> "$GITHUB_STEP_SUMMARY"
           fi
 
+      - name: Build fork matrix from the shared config
+        id: matrix
+        # Reuse .github/configs/fork-ranges.yaml (the same split the release
+        # workflow uses) so the fork coverage is defined in one place.
+        run: |
+          echo "matrix=$(yq -o=json -I=0 '.' .github/configs/fork-ranges.yaml)" >> "$GITHUB_OUTPUT"
+
   fill-nightly:
     name: fill-nightly (${{ matrix.label }})
     runs-on: [self-hosted-ghr, size-xl-x64]
-    needs: changes
-    if: needs.changes.outputs.run == 'true'
+    needs: setup
+    if: needs.setup.outputs.run == 'true'
     timeout-minutes: 720
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - label: pre-shanghai
-            from_fork: Frontier
-            until_fork: Paris
-          - label: shanghai-cancun
-            from_fork: Shanghai
-            until_fork: Cancun
-          - label: prague
-            from_fork: Prague
-            until_fork: Prague
-          - label: osaka
-            from_fork: Osaka
-            until_fork: Osaka
-          - label: amsterdam
-            from_fork: Amsterdam
-            until_fork: Amsterdam
+        include: ${{ fromJson(needs.setup.outputs.matrix) }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -69,6 +89,50 @@ jobs:
           python-version: "3.14"
       - uses: ./.github/actions/setup-env
       - name: Run nightly fill (${{ matrix.label }})
-        run: just fill-nightly --from ${{ matrix.from_fork }} --until ${{ matrix.until_fork }}
+        run: just fill-nightly --from ${{ matrix.from }} --until ${{ matrix.until }}
         env:
           PYTEST_XDIST_AUTO_NUM_WORKERS: auto
+      - name: Upload per-range fixtures (${{ matrix.label }})
+        # Intermediate split, merged into a single artifact by `combine`.
+        # Uploaded even on failure so a regressed fill can still be inspected.
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: fixtures__${{ matrix.label }}
+          path: .just/fill-nightly/fixtures
+          include-hidden-files: true
+          if-no-files-found: warn
+          retention-days: 1
+
+  combine:
+    name: Combine fixtures
+    runs-on: [self-hosted-ghr, size-xl-x64]
+    needs: [setup, fill-nightly]
+    # Run even if some ranges failed, so partial fixtures are still published.
+    if: ${{ !cancelled() && needs.setup.outputs.run == 'true' }}
+    steps:
+      - name: Resolve short commit SHA
+        id: sha
+        run: echo "short=${GITHUB_SHA:0:8}" >> "$GITHUB_OUTPUT"
+      - name: Download per-range fixtures
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh run download "${{ github.run_id }}" -p "fixtures__*" --dir split \
+            || echo "No per-range fixture artifacts found."
+      - name: Merge into a single fixtures tree
+        run: |
+          mkdir -p "fixtures_${{ steps.sha.outputs.short }}"
+          for d in split/fixtures__*/; do
+            [ -d "$d" ] || continue
+            rsync -a "$d" "fixtures_${{ steps.sha.outputs.short }}/"
+          done
+      - name: Upload combined fixtures
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          # Keyed by commit so a downloaded set maps back to what filled it.
+          name: fixtures_${{ steps.sha.outputs.short }}
+          path: fixtures_${{ steps.sha.outputs.short }}
+          include-hidden-files: true
+          if-no-files-found: warn
+          retention-days: 5

From a4d5c66381a74d524176d46eff8a13a144ce55f3 Mon Sep 17 00:00:00 2001
From: spencer-tb <spencer.tb@ethereum.org>
Date: Mon, 6 Jul 2026 13:57:55 +0100
Subject: [PATCH 03/14] chore(ci): rotating fifo size 5 artifact retention

---
 .github/workflows/nightly-fill.yaml | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/nightly-fill.yaml b/.github/workflows/nightly-fill.yaml
index 97e9bcf1e16..1439f9a29c4 100644
--- a/.github/workflows/nightly-fill.yaml
+++ b/.github/workflows/nightly-fill.yaml
@@ -110,6 +110,10 @@ jobs:
     needs: [setup, fill-nightly]
     # Run even if some ranges failed, so partial fixtures are still published.
     if: ${{ !cancelled() && needs.setup.outputs.run == 'true' }}
+    permissions:
+      contents: read
+      # Write is needed to delete superseded fixture artifacts (rotation).
+      actions: write
     steps:
       - name: Resolve short commit SHA
         id: sha
@@ -135,4 +139,25 @@ jobs:
           path: fixtures_${{ steps.sha.outputs.short }}
           include-hidden-files: true
           if-no-files-found: warn
-          retention-days: 5
+          # Outer bound only; the real policy is "keep the last 5 builds",
+          # enforced by the rotation step below.
+          retention-days: 90
+      - name: Rotate — keep only the last 5 nightly fixture sets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Combined nightly artifacts are named `fixtures_<8-hex-sha>`. List
+          # them newest-first and delete everything past the 5 most recent.
+          # Release artifacts (`fixtures_<feature>`) and per-range splits
+          # (`fixtures__<label>`) don't match the sha pattern, so are untouched.
+          gh api --paginate "repos/${GITHUB_REPOSITORY}/actions/artifacts" \
+            --jq '.artifacts[]
+                  | select(.expired == false)
+                  | select(.name | test("^fixtures_[0-9a-f]{8}$"))
+                  | "\(.created_at) \(.id)"' \
+            | sort -r \
+            | awk 'NR>5 {print $2}' \
+            | while read -r id; do
+                echo "Deleting superseded fixture artifact id=${id}"
+                gh api -X DELETE "repos/${GITHUB_REPOSITORY}/actions/artifacts/${id}"
+              done

From a99af7af57e0bda50a872578a59882599f5792b0 Mon Sep 17 00:00:00 2001
From: danceratopz <danceratopz@gmail.com>
Date: Mon, 13 Jul 2026 11:07:27 +0200
Subject: [PATCH 04/14] refactor(ci): extract shared fill-release just recipe

Move the fill flags shared by all fixture releases (`-n`, `--no-html`,
`--durations=100`, `--log-level=DEBUG`) out of the inline fill step in
`.github/actions/build-fixtures` into a new `just fill-release` recipe.
Callers append the feature's fill params, fork range and output via
pass-through args; for repeated flags, the last occurrence wins. The
xdist worker count is plumbed via `PYTEST_XDIST_AUTO_NUM_WORKERS`
(`xdist: auto` in `evm.yaml` for all EVM types, unchanged).

Reimplement `fill-nightly` as a thin wrapper around `fill-release` so
the nightly fill shares the release flags. Deliberate changes to the
nightly invocation: it gains `--no-html` and `--log-level=DEBUG`, and
it drops flags that defaults already provide: `--dist=loadgroup` and
the trailing `tests` path (both defaults in `pytest-fill.ini`), and
the explicit `-n` (now supplied by `fill-release`, same value).
---
 .github/actions/build-fixtures/action.yaml | 13 ++++++++-----
 Justfile                                   | 19 ++++++++++++++-----
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/.github/actions/build-fixtures/action.yaml b/.github/actions/build-fixtures/action.yaml
index 719c3221a75..2bd8d636480 100644
--- a/.github/actions/build-fixtures/action.yaml
+++ b/.github/actions/build-fixtures/action.yaml
@@ -50,6 +50,8 @@ runs:
       run: sudo apt-get install -y pigz
     - name: Generate fixtures using fill
       shell: bash
+      env:
+        PYTEST_XDIST_AUTO_NUM_WORKERS: ${{ steps.evm-builder.outputs.xdist }}
       run: |
         IS_SPLIT="${{ inputs.split_label }}"
 
@@ -61,13 +63,14 @@ runs:
           FORK_ARGS=""
         fi
 
+        EVM_ARGS=""
+        if [ "${{ steps.evm-builder.outputs.impl }}" != "eels" ]; then
+          EVM_ARGS="--evm-bin=${{ steps.evm-builder.outputs.evm-bin }}"
+        fi
+
         # Allow exit code 5 (NO_TESTS_COLLECTED) for fork ranges with no tests.
         EXIT_CODE=0
-        if [ "${{ steps.evm-builder.outputs.impl }}" = "eels" ]; then
-          uv run fill -n ${{ steps.evm-builder.outputs.xdist }} ${{ steps.properties.outputs.fill-params }} $FORK_ARGS $OUTPUT_ARG --build-name ${{ inputs.release_name }} --no-html --durations=100 --log-level=DEBUG || EXIT_CODE=$?
-        else
-          uv run fill -n ${{ steps.evm-builder.outputs.xdist }} --evm-bin=${{ steps.evm-builder.outputs.evm-bin }} ${{ steps.properties.outputs.fill-params }} $FORK_ARGS $OUTPUT_ARG --build-name ${{ inputs.release_name }} --no-html --durations=100 --log-level=DEBUG || EXIT_CODE=$?
-        fi
+        just fill-release $EVM_ARGS ${{ steps.properties.outputs.fill-params }} $FORK_ARGS $OUTPUT_ARG --build-name ${{ inputs.release_name }} || EXIT_CODE=$?
         if [ "$EXIT_CODE" -ne 0 ] && [ "$EXIT_CODE" -ne 5 ]; then
           exit "$EXIT_CODE"
         fi
diff --git a/Justfile b/Justfile
index 9091cd882c1..4c1f4c1aaf7 100644
--- a/Justfile
+++ b/Justfile
@@ -124,12 +124,23 @@ fill *args:
         "$@" \
         tests
 
+# Callers append the feature params, fork range and output; last flag wins.
+# Fill fixtures with the flags shared by all fixture releases
+[group('consensus tests')]
+fill-release *args:
+    uv run fill \
+        -n {{ xdist_workers }} \
+        --output="{{ output_dir }}/fill-release/fixtures" \
+        --no-html \
+        --durations=100 \
+        --log-level=DEBUG \
+        "$@"
+
 # Fill all tests (slow included) in all fixture formats
 [group('consensus tests')]
 fill-nightly *args:
     @mkdir -p "{{ output_dir }}/fill-nightly/tmp" "{{ output_dir }}/fill-nightly/logs"
-    uv run fill \
-        -n {{ xdist_workers }} --dist=loadgroup \
+    just fill-release \
         --skip-index \
         --generate-all-formats \
         --output="{{ output_dir }}/fill-nightly/fixtures" \
@@ -137,9 +148,7 @@ fill-nightly *args:
         --log-to "{{ output_dir }}/fill-nightly/logs" \
         --clean \
         --until "{{ latest_fork }}" \
-        --durations=100 \
-        "$@" \
-        tests
+        "$@"
 
 # --- Integration Tests ---
 

From 67438f7ef37fdade437c790926b84fbccfa1bf92 Mon Sep 17 00:00:00 2001
From: danceratopz <danceratopz@gmail.com>
Date: Mon, 13 Jul 2026 11:14:02 +0200
Subject: [PATCH 05/14] feat(ci): run the fixture release flow nightly

Replace the standalone nightly-fill workflow with a schedule trigger on
`release_fixtures.yaml`: scheduled runs fill the new `nightly` feature
(`--until=Amsterdam --generate-all-formats`, slow tests included)
through the exact release pipeline (matrix generation, `build-fixtures`,
index merge and tarball) and skip only the `release` job, so no tag or
draft release is created. The nightly is thereby a daily rehearsal of
the release flow itself.

Scheduled runs skip when there are no new commits since the last
successful scheduled run (query filtered with `event=schedule` so
manual releases never advance the nightly baseline) and list the new
commits in the step summary. `fail-fast` is disabled on schedule so
every fork range reports. `run-name` distinguishes nightly runs from
manual releases in the run history.

Artifact retention replaces the FIFO rotation of the standalone
workflow: the combined `fixtures_nightly.tar.gz` is kept for 5 days
(roughly the last five nightly builds at a daily cadence) and split
intermediates for 1 day, via a new `split_retention_days` input on the
`build-fixtures` action. Manual releases keep the repo defaults.

Remove the `fill-nightly` recipe: the nightly fill now goes through
`fill-release` inside `build-fixtures`, gaining the fixture index and
release tarball packaging that the standalone workflow lacked.
---
 .github/actions/build-fixtures/action.yaml |   4 +
 .github/configs/feature.yaml               |   7 +
 .github/workflows/nightly-fill.yaml        | 163 ---------------------
 .github/workflows/release_fixtures.yaml    |  79 +++++++++-
 Justfile                                   |  14 --
 docs/dev/releasing_tests.md                |   4 +
 6 files changed, 90 insertions(+), 181 deletions(-)
 delete mode 100644 .github/workflows/nightly-fill.yaml

diff --git a/.github/actions/build-fixtures/action.yaml b/.github/actions/build-fixtures/action.yaml
index 2bd8d636480..18c6fcce126 100644
--- a/.github/actions/build-fixtures/action.yaml
+++ b/.github/actions/build-fixtures/action.yaml
@@ -13,6 +13,9 @@ inputs:
   split_label:
     description: "Label for this fork-range split. Empty for unsplit builds."
     default: ""
+  split_retention_days:
+    description: "retention-days for the split fixture artifact. Empty for the repo default."
+    default: ""
   evm:
     description: "Override the evm impl. Defaults to the feature's evm-type."
     default: ""
@@ -99,3 +102,4 @@ runs:
         include-hidden-files: true
         path: fixtures_${{ inputs.release_name }}/
         if-no-files-found: ignore
+        retention-days: ${{ inputs.split_retention_days }}
diff --git a/.github/configs/feature.yaml b/.github/configs/feature.yaml
index 39297ec6e84..6aadc6f0097 100644
--- a/.github/configs/feature.yaml
+++ b/.github/configs/feature.yaml
@@ -9,6 +9,13 @@ tests:
   evm-type: eels
   fill-params: --until=BPO4 --generate-all-formats
 
+# Filled by the scheduled nightly run of the `release_fixtures` workflow:
+# all tests (slow included), all fixture formats, up to the dev fork. Not
+# meant for tagged releases.
+nightly:
+  evm-type: eels
+  fill-params: --until=Amsterdam --generate-all-formats
+
 benchmark:
   evm-type: benchmark
   fill-params: --fork=Osaka --generate-all-formats --gas-benchmark-values 1,5,10,30,60,100,150 ./tests/benchmark/compute --maxprocesses=30 --dist=worksteal
diff --git a/.github/workflows/nightly-fill.yaml b/.github/workflows/nightly-fill.yaml
deleted file mode 100644
index 1439f9a29c4..00000000000
--- a/.github/workflows/nightly-fill.yaml
+++ /dev/null
@@ -1,163 +0,0 @@
-name: Nightly Fill
-
-# Runs at 02:00 UTC: the self-hosted runners are past the EU/US daytime
-# peaks and results are ready before the EU morning.
-on:
-  schedule:
-    - cron: "0 2 * * *"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  # Needed to look up the last successful nightly run and to download the
-  # per-range fixture artifacts in the `combine` job.
-  actions: read
-
-jobs:
-  setup:
-    name: Check commits and build fork matrix
-    runs-on: ubuntu-latest
-    outputs:
-      run: ${{ steps.check.outputs.run }}
-      matrix: ${{ steps.matrix.outputs.matrix }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          submodules: false
-      - name: List commits since the last successful nightly fill
-        id: check
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          # Head SHA of the last nightly run that filled successfully. Using
-          # the last *success* (rather than a fixed time window) means a
-          # nightly that fails or is skipped keeps re-running until it goes
-          # green, and no commit slips through unfilled.
-          last_sha=$(gh api \
-            "repos/${GITHUB_REPOSITORY}/actions/workflows/nightly-fill.yaml/runs?status=success&per_page=1" \
-            --jq '.workflow_runs[0].head_sha // ""')
-
-          if [ -n "$last_sha" ]; then
-            commits=$(gh api \
-              "repos/${GITHUB_REPOSITORY}/compare/${last_sha}...${GITHUB_SHA}" \
-              --jq '.commits[] | "- \(.sha[0:7]) \(.commit.message | split("\n")[0])"')
-          else
-            # No prior successful run recorded; fill to establish a baseline.
-            commits="- (no previous successful nightly fill found)"
-          fi
-
-          count=$(printf '%s\n' "$commits" | grep -c . || true)
-          if [ "$count" -gt 0 ] || [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then
-            echo "run=true" >> "$GITHUB_OUTPUT"
-            {
-              echo "### Commits since last successful nightly fill"
-              printf '%s\n' "$commits"
-            } >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "run=false" >> "$GITHUB_OUTPUT"
-            echo "No new commits since the last successful nightly fill; skipping." \
-              >> "$GITHUB_STEP_SUMMARY"
-          fi
-
-      - name: Build fork matrix from the shared config
-        id: matrix
-        # Reuse .github/configs/fork-ranges.yaml (the same split the release
-        # workflow uses) so the fork coverage is defined in one place.
-        run: |
-          echo "matrix=$(yq -o=json -I=0 '.' .github/configs/fork-ranges.yaml)" >> "$GITHUB_OUTPUT"
-
-  fill-nightly:
-    name: fill-nightly (${{ matrix.label }})
-    runs-on: [self-hosted-ghr, size-xl-x64]
-    needs: setup
-    if: needs.setup.outputs.run == 'true'
-    timeout-minutes: 720
-    strategy:
-      fail-fast: false
-      matrix:
-        include: ${{ fromJson(needs.setup.outputs.matrix) }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          submodules: recursive
-      - uses: ./.github/actions/setup-uv
-        with:
-          python-version: "3.14"
-      - uses: ./.github/actions/setup-env
-      - name: Run nightly fill (${{ matrix.label }})
-        run: just fill-nightly --from ${{ matrix.from }} --until ${{ matrix.until }}
-        env:
-          PYTEST_XDIST_AUTO_NUM_WORKERS: auto
-      - name: Upload per-range fixtures (${{ matrix.label }})
-        # Intermediate split, merged into a single artifact by `combine`.
-        # Uploaded even on failure so a regressed fill can still be inspected.
-        if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: fixtures__${{ matrix.label }}
-          path: .just/fill-nightly/fixtures
-          include-hidden-files: true
-          if-no-files-found: warn
-          retention-days: 1
-
-  combine:
-    name: Combine fixtures
-    runs-on: [self-hosted-ghr, size-xl-x64]
-    needs: [setup, fill-nightly]
-    # Run even if some ranges failed, so partial fixtures are still published.
-    if: ${{ !cancelled() && needs.setup.outputs.run == 'true' }}
-    permissions:
-      contents: read
-      # Write is needed to delete superseded fixture artifacts (rotation).
-      actions: write
-    steps:
-      - name: Resolve short commit SHA
-        id: sha
-        run: echo "short=${GITHUB_SHA:0:8}" >> "$GITHUB_OUTPUT"
-      - name: Download per-range fixtures
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh run download "${{ github.run_id }}" -p "fixtures__*" --dir split \
-            || echo "No per-range fixture artifacts found."
-      - name: Merge into a single fixtures tree
-        run: |
-          mkdir -p "fixtures_${{ steps.sha.outputs.short }}"
-          for d in split/fixtures__*/; do
-            [ -d "$d" ] || continue
-            rsync -a "$d" "fixtures_${{ steps.sha.outputs.short }}/"
-          done
-      - name: Upload combined fixtures
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          # Keyed by commit so a downloaded set maps back to what filled it.
-          name: fixtures_${{ steps.sha.outputs.short }}
-          path: fixtures_${{ steps.sha.outputs.short }}
-          include-hidden-files: true
-          if-no-files-found: warn
-          # Outer bound only; the real policy is "keep the last 5 builds",
-          # enforced by the rotation step below.
-          retention-days: 90
-      - name: Rotate — keep only the last 5 nightly fixture sets
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          # Combined nightly artifacts are named `fixtures_<8-hex-sha>`. List
-          # them newest-first and delete everything past the 5 most recent.
-          # Release artifacts (`fixtures_<feature>`) and per-range splits
-          # (`fixtures__<label>`) don't match the sha pattern, so are untouched.
-          gh api --paginate "repos/${GITHUB_REPOSITORY}/actions/artifacts" \
-            --jq '.artifacts[]
-                  | select(.expired == false)
-                  | select(.name | test("^fixtures_[0-9a-f]{8}$"))
-                  | "\(.created_at) \(.id)"' \
-            | sort -r \
-            | awk 'NR>5 {print $2}' \
-            | while read -r id; do
-                echo "Deleting superseded fixture artifact id=${id}"
-                gh api -X DELETE "repos/${GITHUB_REPOSITORY}/actions/artifacts/${id}"
-              done
diff --git a/.github/workflows/release_fixtures.yaml b/.github/workflows/release_fixtures.yaml
index 7ac44ac4f66..3e07b86962c 100644
--- a/.github/workflows/release_fixtures.yaml
+++ b/.github/workflows/release_fixtures.yaml
@@ -1,6 +1,15 @@
 name: Create Fixture Release
 
+run-name: ${{ github.event_name == 'schedule' && 'Nightly Fill' || format('Create Fixture Release {0}@{1}', inputs.feature, inputs.version) }}
+
+# Scheduled runs fill the `nightly` feature (all tests, all fixture formats,
+# dev fork included) through the exact release pipeline, but skip the
+# `release` job, so no tag or draft release is created. The cron fires at
+# 02:00 UTC: the self-hosted runners are past the EU/US daytime peaks and
+# results are ready before the EU morning.
 on:
+  schedule:
+    - cron: "0 2 * * *"
   workflow_dispatch:
     inputs:
       feature:
@@ -28,10 +37,17 @@ on:
         required: false
         type: string
 
+concurrency:
+  # Scheduled runs queue behind an in-flight nightly (never cancel a fill);
+  # manual releases are unconstrained (each run gets a unique group).
+  group: ${{ github.event_name == 'schedule' && 'nightly-fill' || github.run_id }}
+  cancel-in-progress: false
+
 jobs:
   setup:
     runs-on: ubuntu-latest
     outputs:
+      run: ${{ steps.check.outputs.run }}
       build_matrix: ${{ steps.matrix.outputs.build_matrix }}
       feature_name: ${{ steps.matrix.outputs.feature_name }}
       combine_labels: ${{ steps.matrix.outputs.combine_labels }}
@@ -47,12 +63,56 @@ jobs:
         run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
       - uses: ./.github/actions/setup-uv
 
+      - name: Check for new commits (scheduled runs)
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Manual releases always run.
+          if [ "$GITHUB_EVENT_NAME" != "schedule" ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Head SHA of the last scheduled run that filled successfully.
+          # Comparing against the last *success* (rather than a fixed time
+          # window) means a nightly that fails or is skipped keeps re-running
+          # until it goes green, and no commit slips through unfilled.
+          last_sha=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/workflows/release_fixtures.yaml/runs?status=success&event=schedule&per_page=1" \
+            --jq '.workflow_runs[0].head_sha // ""')
+
+          if [ -n "$last_sha" ]; then
+            commits=$(gh api \
+              "repos/${GITHUB_REPOSITORY}/compare/${last_sha}...${GITHUB_SHA}" \
+              --jq '.commits[] | "- \(.sha[0:7]) \(.commit.message | split("\n")[0])"')
+          else
+            # No prior successful nightly recorded; fill to get a baseline.
+            commits="- (no previous successful nightly fill found)"
+          fi
+
+          count=$(printf '%s\n' "$commits" | grep -c . || true)
+          if [ "$count" -gt 0 ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+            {
+              echo "### Commits since last successful nightly fill"
+              printf '%s\n' "$commits"
+            } >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+            echo "No new commits since the last successful nightly fill; skipping." \
+              >> "$GITHUB_STEP_SUMMARY"
+          fi
+
       - name: Validate input and generate build matrix
         id: matrix
         shell: bash
         env:
-          INPUT_FEATURE: ${{ inputs.feature }}
-          INPUT_VERSION: ${{ inputs.version }}
+          # Scheduled runs have no inputs: fill the `nightly` feature; the
+          # placeholder version passes validation and is otherwise unused
+          # because the `release` job is skipped for scheduled runs.
+          INPUT_FEATURE: ${{ inputs.feature || 'nightly' }}
+          INPUT_VERSION: ${{ inputs.version || 'v0.0.0' }}
           INPUT_BRANCH: ${{ inputs.branch }}
           INPUT_EVM: ${{ inputs.evm }}
         run: |
@@ -70,10 +130,13 @@ jobs:
   build:
     name: fill (${{ matrix.label || matrix.feature }})
     needs: setup
+    if: needs.setup.outputs.run == 'true'
     runs-on: [self-hosted-ghr, size-gigachungus-x64]
     timeout-minutes: 1440
     strategy:
-      fail-fast: true
+      # A release must be complete, so abort on the first failed range; a
+      # nightly wants every range's result for debugging.
+      fail-fast: ${{ github.event_name != 'schedule' }}
       matrix:
         include: ${{ fromJson(needs.setup.outputs.build_matrix) }}
     steps:
@@ -88,6 +151,9 @@ jobs:
           from_fork: ${{ matrix.from_fork }}
           until_fork: ${{ matrix.until_fork }}
           split_label: ${{ matrix.label }}
+          # Nightly splits are intermediates consumed by `combine` right
+          # away; don't retain them for the repo-default period.
+          split_retention_days: ${{ github.event_name == 'schedule' && '1' || '' }}
           evm: ${{ inputs.evm }}
           evm_repo: ${{ inputs.evm_repo }}
           evm_ref: ${{ inputs.evm_ref }}
@@ -154,11 +220,16 @@ jobs:
         with:
           name: fixtures_${{ needs.setup.outputs.feature_name }}
           path: ${{ steps.tarball.outputs.path }}
+          # Keep roughly the last five nightly tarballs; release tarballs
+          # keep the repo default since the release job attaches them to a
+          # draft release anyway.
+          retention-days: ${{ github.event_name == 'schedule' && '5' || '' }}
 
   release:
     runs-on: ubuntu-latest
     needs: [setup, build, combine]
-    if: always() && needs.build.result == 'success' && (needs.combine.result == 'success' || needs.combine.result == 'skipped')
+    # Scheduled runs stop after `combine`: no tag, no draft release.
+    if: always() && github.event_name == 'workflow_dispatch' && needs.build.result == 'success' && (needs.combine.result == 'success' || needs.combine.result == 'skipped')
     permissions:
       contents: write
     steps:
diff --git a/Justfile b/Justfile
index 4c1f4c1aaf7..dde18b56c59 100644
--- a/Justfile
+++ b/Justfile
@@ -136,20 +136,6 @@ fill-release *args:
         --log-level=DEBUG \
         "$@"
 
-# Fill all tests (slow included) in all fixture formats
-[group('consensus tests')]
-fill-nightly *args:
-    @mkdir -p "{{ output_dir }}/fill-nightly/tmp" "{{ output_dir }}/fill-nightly/logs"
-    just fill-release \
-        --skip-index \
-        --generate-all-formats \
-        --output="{{ output_dir }}/fill-nightly/fixtures" \
-        --basetemp="{{ output_dir }}/fill-nightly/tmp" \
-        --log-to "{{ output_dir }}/fill-nightly/logs" \
-        --clean \
-        --until "{{ latest_fork }}" \
-        "$@"
-
 # --- Integration Tests ---
 
 # Fill the base coverage consensus tests using EELS with PyPy
diff --git a/docs/dev/releasing_tests.md b/docs/dev/releasing_tests.md
index 0259159c0f8..3e103cf0c67 100644
--- a/docs/dev/releasing_tests.md
+++ b/docs/dev/releasing_tests.md
@@ -108,3 +108,7 @@ The release is created as a draft; review and publish it from the GitHub release
     # them explicitly with --generate-all-formats
     uv run fill --generate-all-formats --output=fixtures.tar.gz tests/
     ```
+
+## Nightly fill
+
+The same workflow also runs on a nightly schedule (02:00 UTC) as a release rehearsal: it fills the `nightly` feature (all tests, slow included, all fixture formats, up to the dev fork) through the exact release pipeline, but stops after `combine`, so no tag or release is created. Each run uploads a `fixtures_nightly.tar.gz` workflow artifact with a 5-day retention. A scheduled run skips itself when there are no new commits since the last successful nightly fill; a failed nightly keeps re-running until it goes green, so no commit slips through unfilled.

From cb0ff45d7ccd87902a04b0fc810a1bb0a1d629b8 Mon Sep 17 00:00:00 2001
From: danceratopz <danceratopz@gmail.com>
Date: Mon, 13 Jul 2026 12:10:49 +0200
Subject: [PATCH 06/14] chore(ci): remove duplicate benchmark entry from
 evm.yaml

The `benchmark` key appeared twice with identical values. The two
readers of this file disagree on which duplicate wins (the awk snippet
in `build-evm-base` matches the first, `yaml.safe_load` keeps the
last), so a future edit to only one copy would apply inconsistently.
Keep the first occurrence.
---
 .github/configs/evm.yaml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.github/configs/evm.yaml b/.github/configs/evm.yaml
index 621ad39623d..b36b347d981 100644
--- a/.github/configs/evm.yaml
+++ b/.github/configs/evm.yaml
@@ -17,12 +17,6 @@ evmone:
   evm-bin: evmone
   xdist: auto
   targets: ["evmone-cli"]
-benchmark:
-  impl: geth
-  repo: ethereum/go-ethereum
-  ref: master
-  evm-bin: evm
-  xdist: auto
 besu:
   impl: besu
   repo: hyperledger/besu

From 3fe48d441cd4285783aad17c08baf31be8c7104c Mon Sep 17 00:00:00 2001
From: danceratopz <danceratopz@gmail.com>
Date: Mon, 13 Jul 2026 12:13:34 +0200
Subject: [PATCH 07/14] refactor(ci): validate the evm override in
 generate_build_matrix.py

Move the `evm` override check from inline bash in the release
workflow's setup step into `validate_inputs`, where the rest of the
dispatch input validation already lives and is unit-tested. The check
becomes a YAML key lookup instead of a line-anchored grep.
---
 .github/scripts/generate_build_matrix.py      | 20 +++++++++++++------
 .github/scripts/tests/test_release_scripts.py | 15 ++++++++++++++
 .github/workflows/release_fixtures.yaml       | 13 ++++--------
 docs/dev/releasing_tests.md                   |  1 +
 4 files changed, 34 insertions(+), 15 deletions(-)

diff --git a/.github/scripts/generate_build_matrix.py b/.github/scripts/generate_build_matrix.py
index 02fde3087dc..200bdb788ad 100644
--- a/.github/scripts/generate_build_matrix.py
+++ b/.github/scripts/generate_build_matrix.py
@@ -10,7 +10,7 @@
 Validate release inputs and generate the build matrix for release
 fixture workflows.
 
-Usage: `generate_build_matrix.py <feature> <version> [branch]`.
+Usage: `generate_build_matrix.py <feature> <version> [branch] [evm]`.
 
 First validate the dispatch inputs (see `validate_inputs`), then read
 `.github/configs/feature.yaml` and emit a flat JSON build matrix suitable
@@ -31,6 +31,7 @@
 
 FEATURE_CONFIG = Path(".github/configs/feature.yaml")
 FORK_RANGES_CONFIG = Path(".github/configs/fork-ranges.yaml")
+EVM_CONFIG = Path(".github/configs/evm.yaml")
 
 VERSION_RE = re.compile(r"^v[0-9]+\.[0-9]+\.[0-9]+$")
 
@@ -81,12 +82,13 @@ def fail(message: str) -> NoReturn:
     sys.exit(1)
 
 
-def validate_inputs(feature: str, version: str, branch: str) -> None:
+def validate_inputs(feature: str, version: str, branch: str, evm: str) -> None:
     """
     Validate the release dispatch inputs before building a matrix.
 
-    Centralize the feature/version checks here so they are unit-testable
-    rather than living as inline bash in the release workflow.
+    Centralize the feature/version/evm checks here so they are
+    unit-testable rather than living as inline bash in the release
+    workflow.
 
     For `<feat>-devnet` releases the major version (`X` of `vX.Y.Z`)
     must equal the devnet number encoded in the release branch, so a
@@ -97,6 +99,10 @@ def validate_inputs(feature: str, version: str, branch: str) -> None:
     if not VERSION_RE.match(version):
         fail(f"version '{version}' must match vX.Y.Z (e.g. v20.0.0)")
 
+    # An `evm` override must name a key in evm.yaml.
+    if evm and evm not in load_config(EVM_CONFIG):
+        fail(f"evm '{evm}' is not a key in {EVM_CONFIG}")
+
     # A bare `devnet` has no friendly `<feat>-` prefix to tag with.
     if feature in ("devnet", "-devnet"):
         fail("devnet releases require a <feat>- prefix, e.g. bal-devnet")
@@ -207,7 +213,8 @@ def main() -> None:
     args = sys.argv[1:]
     if len(args) < 2:
         print(
-            "Usage: generate_build_matrix.py <feature> <version> [branch]",
+            "Usage: generate_build_matrix.py "
+            "<feature> <version> [branch] [evm]",
             file=sys.stderr,
         )
         sys.exit(1)
@@ -215,8 +222,9 @@ def main() -> None:
     name = args[0]
     version = args[1]
     branch = args[2] if len(args) > 2 else ""
+    evm = args[3] if len(args) > 3 else ""
 
-    validate_inputs(name, version, branch)
+    validate_inputs(name, version, branch, evm)
 
     config = load_config(FEATURE_CONFIG)
     fork_ranges = load_config(FORK_RANGES_CONFIG) or []
diff --git a/.github/scripts/tests/test_release_scripts.py b/.github/scripts/tests/test_release_scripts.py
index a74c4c67c08..48a8f9ef4c2 100644
--- a/.github/scripts/tests/test_release_scripts.py
+++ b/.github/scripts/tests/test_release_scripts.py
@@ -170,6 +170,21 @@ def test_devnet_matching_major_passes(self):
         out = parse_matrix_output(result.stdout)
         assert out["feature_name"] == "glamsterdam-devnet"
 
+    def test_unknown_evm_fails(self):
+        """Verify an evm override missing from evm.yaml is rejected."""
+        result = run_script(
+            BUILD_MATRIX_SCRIPT, "tests", "v24.0.0", "", "nonexistent"
+        )
+        assert result.returncode == 1
+        assert "not a key" in result.stderr
+
+    def test_known_evm_passes(self):
+        """Verify an evm override that is a key in evm.yaml passes."""
+        result = run_script(
+            BUILD_MATRIX_SCRIPT, "tests", "v24.0.0", "", "evmone"
+        )
+        assert result.returncode == 0
+
 
 class TestCreateReleaseTarball:
     """Test create_release_tarball.py."""
diff --git a/.github/workflows/release_fixtures.yaml b/.github/workflows/release_fixtures.yaml
index 3e07b86962c..26f833832ed 100644
--- a/.github/workflows/release_fixtures.yaml
+++ b/.github/workflows/release_fixtures.yaml
@@ -116,16 +116,11 @@ jobs:
           INPUT_BRANCH: ${{ inputs.branch }}
           INPUT_EVM: ${{ inputs.evm }}
         run: |
-          # An `evm` override must name a key in evm.yaml; the feature,
-          # version and devnet-branch validation lives in (and is unit-tested
-          # via) generate_build_matrix.py.
-          if [ -n "$INPUT_EVM" ] && ! grep -qE "^${INPUT_EVM}:" .github/configs/evm.yaml; then
-            echo "::error::evm '$INPUT_EVM' is not a key in .github/configs/evm.yaml"
-            exit 1
-          fi
-
+          # The feature, version, devnet-branch and evm-override validation
+          # lives in (and is unit-tested via) generate_build_matrix.py.
           uv run -q .github/scripts/generate_build_matrix.py \
-            "$INPUT_FEATURE" "$INPUT_VERSION" "$INPUT_BRANCH" >> "$GITHUB_OUTPUT"
+            "$INPUT_FEATURE" "$INPUT_VERSION" "$INPUT_BRANCH" "$INPUT_EVM" \
+            >> "$GITHUB_OUTPUT"
 
   build:
     name: fill (${{ matrix.label || matrix.feature }})
diff --git a/docs/dev/releasing_tests.md b/docs/dev/releasing_tests.md
index 3e103cf0c67..8184a635ab7 100644
--- a/docs/dev/releasing_tests.md
+++ b/docs/dev/releasing_tests.md
@@ -34,6 +34,7 @@ Input validation runs in
 (unit-tested) before any fixtures are built, and fails fast on:
 
 - an empty `feature` or a `version` that is not `vX.Y.Z`;
+- an `evm` override that is not a key in `.github/configs/evm.yaml`;
 - a bare `devnet` feature name (must carry a `<feat>-` prefix, e.g. `bal-devnet`);
 - a `<feat>-devnet-<n>` feature name — the devnet index belongs in the `version` major, not
   the feature name (so `feature=bal-devnet-7` is rejected in favour of

From 4960b3635f7f5114b40089365461ef5e1915e3fb Mon Sep 17 00:00:00 2001
From: danceratopz <danceratopz@gmail.com>
Date: Mon, 13 Jul 2026 12:15:32 +0200
Subject: [PATCH 08/14] refactor(ci): extract the nightly commit check into a
 standalone script

Move the inline bash of the "Check for new commits" step into
`.github/scripts/check_new_commits.py`, following the pattern of the
other release helper scripts (`uv run`-able, unit-tested). The
last-success baseline semantics, the dispatch short-circuit, the
no-baseline bootstrap and the empty-commit-list handling now have unit
tests (via a fake `gh` on `PATH`); the workflow step shrinks to a
single command.
---
 .github/scripts/check_new_commits.py          | 109 +++++++++++++++++
 .github/scripts/tests/test_release_scripts.py | 112 ++++++++++++++++++
 .github/workflows/release_fixtures.yaml       |  36 +-----
 3 files changed, 222 insertions(+), 35 deletions(-)
 create mode 100644 .github/scripts/check_new_commits.py

diff --git a/.github/scripts/check_new_commits.py b/.github/scripts/check_new_commits.py
new file mode 100644
index 00000000000..c828371c76d
--- /dev/null
+++ b/.github/scripts/check_new_commits.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env -S uv run --script
+#
+# /// script
+# requires-python = ">=3.12"
+# ///
+"""
+Decide whether a scheduled nightly fill has new commits to fill.
+
+Usage: `check_new_commits.py` (all inputs come from the environment).
+
+Compare the current commit against the head SHA of the last successful
+*scheduled* run of the release workflow. Using the last success (rather
+than a fixed time window) means a nightly that fails or is skipped
+keeps re-running until it goes green, and no commit slips through
+unfilled; filtering on scheduled runs means manual releases never
+advance the nightly baseline. Manual (`workflow_dispatch`) runs always
+run.
+
+Read `GITHUB_EVENT_NAME`, `GITHUB_REPOSITORY` and `GITHUB_SHA` from the
+environment and query the GitHub API via the `gh` CLI (authenticated by
+`GH_TOKEN`). Print `run=true|false` to stdout for `$GITHUB_OUTPUT` and
+append the new-commit list (or a skip notice) to the
+`$GITHUB_STEP_SUMMARY` file.
+"""
+
+import json
+import os
+import subprocess
+import sys
+
+WORKFLOW_FILE = "release_fixtures.yaml"
+
+
+def gh_api(path: str) -> str:
+    """Return the stdout of `gh api <path>`, exiting non-zero on error."""
+    result = subprocess.run(
+        ["gh", "api", path], capture_output=True, text=True
+    )
+    if result.returncode != 0:
+        print(f"Error: gh api {path} failed:", file=sys.stderr)
+        print(result.stderr, file=sys.stderr)
+        sys.exit(1)
+    return result.stdout
+
+
+def last_successful_nightly_sha(repository: str) -> str:
+    """Return the head SHA of the last successful scheduled run."""
+    runs = json.loads(
+        gh_api(
+            f"repos/{repository}/actions/workflows/{WORKFLOW_FILE}"
+            "/runs?status=success&event=schedule&per_page=1"
+        )
+    )["workflow_runs"]
+    return str(runs[0]["head_sha"]) if runs else ""
+
+
+def commits_since(repository: str, last_sha: str, head_sha: str) -> list[str]:
+    """Return `- <sha> <subject>` lines for commits after *last_sha*."""
+    compare = json.loads(
+        gh_api(f"repos/{repository}/compare/{last_sha}...{head_sha}")
+    )
+    return [
+        f"- {c['sha'][:7]} {(c['commit']['message'].splitlines() or [''])[0]}"
+        for c in compare["commits"]
+    ]
+
+
+def append_summary(text: str) -> None:
+    """Append *text* to the GitHub step summary, or stderr if unset."""
+    summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+    if summary_path:
+        with open(summary_path, "a") as f:
+            f.write(text + "\n")
+    else:
+        print(text, file=sys.stderr)
+
+
+def main() -> None:
+    """Print `run=true|false` and write the step summary."""
+    if os.environ["GITHUB_EVENT_NAME"] != "schedule":
+        # Manual releases always run.
+        print("run=true")
+        return
+
+    repository = os.environ["GITHUB_REPOSITORY"]
+    head_sha = os.environ["GITHUB_SHA"]
+
+    last_sha = last_successful_nightly_sha(repository)
+    if last_sha:
+        commits = commits_since(repository, last_sha, head_sha)
+    else:
+        # No prior successful nightly recorded; fill to get a baseline.
+        commits = ["- (no previous successful nightly fill found)"]
+
+    if commits:
+        print("run=true")
+        append_summary(
+            "### Commits since last successful nightly fill\n"
+            + "\n".join(commits)
+        )
+    else:
+        print("run=false")
+        append_summary(
+            "No new commits since the last successful nightly fill; skipping."
+        )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/scripts/tests/test_release_scripts.py b/.github/scripts/tests/test_release_scripts.py
index 48a8f9ef4c2..ed3d89cbff9 100644
--- a/.github/scripts/tests/test_release_scripts.py
+++ b/.github/scripts/tests/test_release_scripts.py
@@ -6,6 +6,7 @@
 """
 
 import json
+import os
 import subprocess
 import tarfile
 from pathlib import Path
@@ -16,6 +17,7 @@
 BUILD_MATRIX_SCRIPT = SCRIPTS_DIR / "generate_build_matrix.py"
 TARBALL_SCRIPT = SCRIPTS_DIR / "create_release_tarball.py"
 MERGE_INDEX_SCRIPT = SCRIPTS_DIR / "merge_index_files.py"
+CHECK_COMMITS_SCRIPT = SCRIPTS_DIR / "check_new_commits.py"
 
 
 def run_script(script: Path, *args: str) -> subprocess.CompletedProcess:
@@ -186,6 +188,116 @@ def test_known_evm_passes(self):
         assert result.returncode == 0
 
 
+# Fake `gh` served from PATH: answers the two API calls the commit-check
+# script makes with canned JSON from env vars, and fails loudly on any
+# other (or unconfigured) call.
+FAKE_GH = """#!/usr/bin/env bash
+case "$2" in
+  *actions/workflows*) response="$FAKE_GH_RUNS" ;;
+  *compare*) response="$FAKE_GH_COMPARE" ;;
+  *) response="" ;;
+esac
+if [ -z "$response" ]; then
+  echo "unexpected gh call: $*" >&2
+  exit 1
+fi
+printf '%s' "$response"
+"""
+
+
+class TestCheckNewCommits:
+    """Test check_new_commits.py."""
+
+    def run_check(
+        self,
+        tmp_path: Path,
+        event_name: str,
+        runs: str = "",
+        compare: str = "",
+    ) -> tuple[subprocess.CompletedProcess, Path]:
+        """Run the script with a fake `gh` on PATH; return it + summary."""
+        bin_dir = tmp_path / "bin"
+        bin_dir.mkdir(exist_ok=True)
+        fake_gh = bin_dir / "gh"
+        fake_gh.write_text(FAKE_GH)
+        fake_gh.chmod(0o755)
+
+        summary = tmp_path / "summary.md"
+        env = os.environ.copy()
+        env["PATH"] = f"{bin_dir}:{env['PATH']}"
+        env["GITHUB_EVENT_NAME"] = event_name
+        env["GITHUB_REPOSITORY"] = "ethereum/execution-specs"
+        env["GITHUB_SHA"] = "b" * 40
+        env["GITHUB_STEP_SUMMARY"] = str(summary)
+        env["FAKE_GH_RUNS"] = runs
+        env["FAKE_GH_COMPARE"] = compare
+
+        result = subprocess.run(
+            ["uv", "run", "-q", str(CHECK_COMMITS_SCRIPT)],
+            capture_output=True,
+            text=True,
+            cwd=REPO_ROOT,
+            env=env,
+        )
+        return result, summary
+
+    def test_dispatch_always_runs_without_api_calls(self, tmp_path):
+        """Verify a manual dispatch runs and never calls the API."""
+        # The fake `gh` fails every call (no canned responses), so a
+        # zero exit proves the script made no API call.
+        result, summary = self.run_check(tmp_path, "workflow_dispatch")
+        assert result.returncode == 0
+        assert result.stdout.strip() == "run=true"
+        assert not summary.exists()
+
+    def test_schedule_without_prior_run_fills_baseline(self, tmp_path):
+        """Verify the first scheduled run fills to get a baseline."""
+        result, summary = self.run_check(
+            tmp_path, "schedule", runs='{"workflow_runs": []}'
+        )
+        assert result.returncode == 0
+        assert result.stdout.strip() == "run=true"
+        assert "no previous successful" in summary.read_text()
+
+    def test_schedule_with_new_commits_runs(self, tmp_path):
+        """Verify new commits since the baseline trigger a run."""
+        commit = {
+            "sha": "abcdef1" + "0" * 33,
+            "commit": {"message": "feat(x): subject\n\nbody"},
+        }
+        result, summary = self.run_check(
+            tmp_path,
+            "schedule",
+            runs=json.dumps({"workflow_runs": [{"head_sha": "a" * 40}]}),
+            compare=json.dumps({"commits": [commit]}),
+        )
+        assert result.returncode == 0
+        assert result.stdout.strip() == "run=true"
+        text = summary.read_text()
+        assert "### Commits since last successful nightly fill" in text
+        # Short SHA plus the commit subject, without the body.
+        assert "- abcdef1 feat(x): subject" in text
+        assert "body" not in text
+
+    def test_schedule_without_new_commits_skips(self, tmp_path):
+        """Verify no commits since the baseline skips the run."""
+        result, summary = self.run_check(
+            tmp_path,
+            "schedule",
+            runs=json.dumps({"workflow_runs": [{"head_sha": "b" * 40}]}),
+            compare=json.dumps({"commits": []}),
+        )
+        assert result.returncode == 0
+        assert result.stdout.strip() == "run=false"
+        assert "skipping" in summary.read_text()
+
+    def test_gh_failure_fails_the_check(self, tmp_path):
+        """Verify a failing `gh` call fails the script."""
+        result, _ = self.run_check(tmp_path, "schedule")
+        assert result.returncode == 1
+        assert "gh api" in result.stderr
+
+
 class TestCreateReleaseTarball:
     """Test create_release_tarball.py."""
 
diff --git a/.github/workflows/release_fixtures.yaml b/.github/workflows/release_fixtures.yaml
index 26f833832ed..2753e627bf0 100644
--- a/.github/workflows/release_fixtures.yaml
+++ b/.github/workflows/release_fixtures.yaml
@@ -68,41 +68,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          # Manual releases always run.
-          if [ "$GITHUB_EVENT_NAME" != "schedule" ]; then
-            echo "run=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Head SHA of the last scheduled run that filled successfully.
-          # Comparing against the last *success* (rather than a fixed time
-          # window) means a nightly that fails or is skipped keeps re-running
-          # until it goes green, and no commit slips through unfilled.
-          last_sha=$(gh api \
-            "repos/${GITHUB_REPOSITORY}/actions/workflows/release_fixtures.yaml/runs?status=success&event=schedule&per_page=1" \
-            --jq '.workflow_runs[0].head_sha // ""')
-
-          if [ -n "$last_sha" ]; then
-            commits=$(gh api \
-              "repos/${GITHUB_REPOSITORY}/compare/${last_sha}...${GITHUB_SHA}" \
-              --jq '.commits[] | "- \(.sha[0:7]) \(.commit.message | split("\n")[0])"')
-          else
-            # No prior successful nightly recorded; fill to get a baseline.
-            commits="- (no previous successful nightly fill found)"
-          fi
-
-          count=$(printf '%s\n' "$commits" | grep -c . || true)
-          if [ "$count" -gt 0 ]; then
-            echo "run=true" >> "$GITHUB_OUTPUT"
-            {
-              echo "### Commits since last successful nightly fill"
-              printf '%s\n' "$commits"
-            } >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "run=false" >> "$GITHUB_OUTPUT"
-            echo "No new commits since the last successful nightly fill; skipping." \
-              >> "$GITHUB_STEP_SUMMARY"
-          fi
+          uv run -q .github/scripts/check_new_commits.py >> "$GITHUB_OUTPUT"
 
       - name: Validate input and generate build matrix
         id: matrix

From 78e25fbbc45031646b19cb9cc7eb31df5e0f2c5a Mon Sep 17 00:00:00 2001
From: danceratopz <danceratopz@gmail.com>
Date: Mon, 13 Jul 2026 12:59:37 +0200
Subject: [PATCH 09/14] fix(ci): refresh a quiet nightly before its artifact
 retention lapses

With the nightly skipping itself when there are no new commits, a quiet
stretch longer than the five-day artifact retention would leave no live
nightly tarball. Re-run the fill once the last successful scheduled run
is four days old: a release-shaped artifact then always exists within
the retention window, and the release pipeline keeps getting exercised
during quiet periods.
---
 .github/scripts/check_new_commits.py          | 39 +++++++++++++++++--
 .github/scripts/tests/test_release_scripts.py | 35 +++++++++++++++--
 .github/workflows/release_fixtures.yaml       |  7 ++--
 docs/dev/releasing_tests.md                   |  2 +-
 4 files changed, 72 insertions(+), 11 deletions(-)

diff --git a/.github/scripts/check_new_commits.py b/.github/scripts/check_new_commits.py
index c828371c76d..1aeefd12979 100644
--- a/.github/scripts/check_new_commits.py
+++ b/.github/scripts/check_new_commits.py
@@ -16,6 +16,11 @@
 advance the nightly baseline. Manual (`workflow_dispatch`) runs always
 run.
 
+A quiet stretch with no new commits still refreshes: once the last
+successful fill is `REFRESH_AGE` old, the nightly re-runs anyway, so a
+live artifact always exists within the workflow's five-day retention
+and the release pipeline keeps getting exercised.
+
 Read `GITHUB_EVENT_NAME`, `GITHUB_REPOSITORY` and `GITHUB_SHA` from the
 environment and query the GitHub API via the `gh` CLI (authenticated by
 `GH_TOKEN`). Print `run=true|false` to stdout for `$GITHUB_OUTPUT` and
@@ -27,9 +32,15 @@
 import os
 import subprocess
 import sys
+from datetime import datetime, timedelta, timezone
 
 WORKFLOW_FILE = "release_fixtures.yaml"
 
+# Re-run a quiet nightly once the last successful fill is this old, so
+# a fresh artifact is uploaded before the previous one lapses (the
+# workflow retains scheduled tarballs for five days).
+REFRESH_AGE = timedelta(days=4)
+
 
 def gh_api(path: str) -> str:
     """Return the stdout of `gh api <path>`, exiting non-zero on error."""
@@ -43,15 +54,28 @@ def gh_api(path: str) -> str:
     return result.stdout
 
 
-def last_successful_nightly_sha(repository: str) -> str:
-    """Return the head SHA of the last successful scheduled run."""
+def last_successful_nightly(repository: str) -> tuple[str, str]:
+    """
+    Return the head SHA and creation time of the last scheduled run.
+
+    Only successful scheduled runs count; return empty strings when
+    none exists yet.
+    """
     runs = json.loads(
         gh_api(
             f"repos/{repository}/actions/workflows/{WORKFLOW_FILE}"
             "/runs?status=success&event=schedule&per_page=1"
         )
     )["workflow_runs"]
-    return str(runs[0]["head_sha"]) if runs else ""
+    if not runs:
+        return "", ""
+    return str(runs[0]["head_sha"]), str(runs[0]["created_at"])
+
+
+def is_stale(created_at: str) -> bool:
+    """Return whether a run created at *created_at* is due a refresh."""
+    created = datetime.fromisoformat(created_at)
+    return datetime.now(timezone.utc) - created >= REFRESH_AGE
 
 
 def commits_since(repository: str, last_sha: str, head_sha: str) -> list[str]:
@@ -85,7 +109,7 @@ def main() -> None:
     repository = os.environ["GITHUB_REPOSITORY"]
     head_sha = os.environ["GITHUB_SHA"]
 
-    last_sha = last_successful_nightly_sha(repository)
+    last_sha, last_created = last_successful_nightly(repository)
     if last_sha:
         commits = commits_since(repository, last_sha, head_sha)
     else:
@@ -98,6 +122,13 @@ def main() -> None:
             "### Commits since last successful nightly fill\n"
             + "\n".join(commits)
         )
+    elif is_stale(last_created):
+        print("run=true")
+        append_summary(
+            "No new commits, but the last nightly fill is older than "
+            f"{REFRESH_AGE.days} days; refreshing before its artifact "
+            "retention lapses."
+        )
     else:
         print("run=false")
         append_summary(
diff --git a/.github/scripts/tests/test_release_scripts.py b/.github/scripts/tests/test_release_scripts.py
index ed3d89cbff9..3d2f5c2e50a 100644
--- a/.github/scripts/tests/test_release_scripts.py
+++ b/.github/scripts/tests/test_release_scripts.py
@@ -9,6 +9,7 @@
 import os
 import subprocess
 import tarfile
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
 SCRIPTS_DIR = Path(__file__).parent.parent
@@ -259,6 +260,21 @@ def test_schedule_without_prior_run_fills_baseline(self, tmp_path):
         assert result.stdout.strip() == "run=true"
         assert "no previous successful" in summary.read_text()
 
+    @staticmethod
+    def runs_json(age: timedelta, head_sha: str = "b" * 40) -> str:
+        """Return a last-successful-run response created *age* ago."""
+        created = datetime.now(timezone.utc) - age
+        return json.dumps(
+            {
+                "workflow_runs": [
+                    {
+                        "head_sha": head_sha,
+                        "created_at": created.isoformat(),
+                    }
+                ]
+            }
+        )
+
     def test_schedule_with_new_commits_runs(self, tmp_path):
         """Verify new commits since the baseline trigger a run."""
         commit = {
@@ -268,7 +284,7 @@ def test_schedule_with_new_commits_runs(self, tmp_path):
         result, summary = self.run_check(
             tmp_path,
             "schedule",
-            runs=json.dumps({"workflow_runs": [{"head_sha": "a" * 40}]}),
+            runs=self.runs_json(timedelta(hours=25), head_sha="a" * 40),
             compare=json.dumps({"commits": [commit]}),
         )
         assert result.returncode == 0
@@ -280,17 +296,30 @@ def test_schedule_with_new_commits_runs(self, tmp_path):
         assert "body" not in text
 
     def test_schedule_without_new_commits_skips(self, tmp_path):
-        """Verify no commits since the baseline skips the run."""
+        """Verify no commits since a recent baseline skips the run."""
         result, summary = self.run_check(
             tmp_path,
             "schedule",
-            runs=json.dumps({"workflow_runs": [{"head_sha": "b" * 40}]}),
+            # Just inside the refresh age: pin the four-day boundary.
+            runs=self.runs_json(timedelta(days=3, hours=23)),
             compare=json.dumps({"commits": []}),
         )
         assert result.returncode == 0
         assert result.stdout.strip() == "run=false"
         assert "skipping" in summary.read_text()
 
+    def test_schedule_stale_quiet_baseline_refreshes(self, tmp_path):
+        """Verify a quiet nightly re-runs once its artifact nears expiry."""
+        result, summary = self.run_check(
+            tmp_path,
+            "schedule",
+            runs=self.runs_json(timedelta(days=4, hours=1)),
+            compare=json.dumps({"commits": []}),
+        )
+        assert result.returncode == 0
+        assert result.stdout.strip() == "run=true"
+        assert "refreshing" in summary.read_text()
+
     def test_gh_failure_fails_the_check(self, tmp_path):
         """Verify a failing `gh` call fails the script."""
         result, _ = self.run_check(tmp_path, "schedule")
diff --git a/.github/workflows/release_fixtures.yaml b/.github/workflows/release_fixtures.yaml
index 2753e627bf0..5e23f751082 100644
--- a/.github/workflows/release_fixtures.yaml
+++ b/.github/workflows/release_fixtures.yaml
@@ -181,9 +181,10 @@ jobs:
         with:
           name: fixtures_${{ needs.setup.outputs.feature_name }}
           path: ${{ steps.tarball.outputs.path }}
-          # Keep roughly the last five nightly tarballs; release tarballs
-          # keep the repo default since the release job attaches them to a
-          # draft release anyway.
+          # Keep nightly tarballs for five days; a quiet nightly re-runs
+          # after four (see check_new_commits.py), so a live artifact
+          # always exists. Release tarballs keep the repo default since
+          # the release job attaches them to a draft release anyway.
           retention-days: ${{ github.event_name == 'schedule' && '5' || '' }}
 
   release:
diff --git a/docs/dev/releasing_tests.md b/docs/dev/releasing_tests.md
index 8184a635ab7..9369d44558a 100644
--- a/docs/dev/releasing_tests.md
+++ b/docs/dev/releasing_tests.md
@@ -112,4 +112,4 @@ The release is created as a draft; review and publish it from the GitHub release
 
 ## Nightly fill
 
-The same workflow also runs on a nightly schedule (02:00 UTC) as a release rehearsal: it fills the `nightly` feature (all tests, slow included, all fixture formats, up to the dev fork) through the exact release pipeline, but stops after `combine`, so no tag or release is created. Each run uploads a `fixtures_nightly.tar.gz` workflow artifact with a 5-day retention. A scheduled run skips itself when there are no new commits since the last successful nightly fill; a failed nightly keeps re-running until it goes green, so no commit slips through unfilled.
+The same workflow also runs on a nightly schedule (02:00 UTC) as a release rehearsal: it fills the `nightly` feature (all tests, slow included, all fixture formats, up to the dev fork) through the exact release pipeline, but stops after `combine`, so no tag or release is created. Each run uploads a `fixtures_nightly.tar.gz` workflow artifact with a 5-day retention. A scheduled run skips itself when there are no new commits since the last successful nightly fill; a failed nightly keeps re-running until it goes green, so no commit slips through unfilled. A quiet stretch without commits still re-fills once the last successful nightly is four days old, so a live artifact always exists within the five-day retention.

From 24a8f3dc6f5e5813fea4d34290cdd5882413190d Mon Sep 17 00:00:00 2001
From: spencer-tb <spencer.tb@ethereum.org>
Date: Tue, 14 Jul 2026 11:41:23 +0100
Subject: [PATCH 10/14] fix(ci): anchor the nightly baseline on runs that
 actually filled

---
 .github/scripts/check_new_commits.py          | 58 +++++++----
 .github/scripts/tests/test_release_scripts.py | 96 ++++++++++++++++---
 2 files changed, 121 insertions(+), 33 deletions(-)

diff --git a/.github/scripts/check_new_commits.py b/.github/scripts/check_new_commits.py
index 1aeefd12979..da778daf459 100644
--- a/.github/scripts/check_new_commits.py
+++ b/.github/scripts/check_new_commits.py
@@ -8,18 +8,21 @@
 
 Usage: `check_new_commits.py` (all inputs come from the environment).
 
-Compare the current commit against the head SHA of the last successful
-*scheduled* run of the release workflow. Using the last success (rather
-than a fixed time window) means a nightly that fails or is skipped
-keeps re-running until it goes green, and no commit slips through
-unfilled; filtering on scheduled runs means manual releases never
-advance the nightly baseline. Manual (`workflow_dispatch`) runs always
-run.
+Compare the current commit against the head SHA of the last scheduled
+run of the release workflow that actually filled: the newest successful
+*scheduled* run that uploaded artifacts. A quiet nightly skips its
+build jobs yet still concludes as a successful run, so plain success is
+no evidence of a fill. Anchoring on real fills means a nightly that
+fails or skips keeps re-running until a fill goes green and no commit
+slips through unfilled; filtering on scheduled runs means manual
+releases never advance the nightly baseline. Manual
+(`workflow_dispatch`) runs always run.
 
 A quiet stretch with no new commits still refreshes: once the last
-successful fill is `REFRESH_AGE` old, the nightly re-runs anyway, so a
-live artifact always exists within the workflow's five-day retention
-and the release pipeline keeps getting exercised.
+fill is `REFRESH_AGE` old -- or its artifact is no longer live -- the
+nightly re-runs anyway, so a live artifact always exists within the
+workflow's five-day retention and the release pipeline keeps getting
+exercised.
 
 Read `GITHUB_EVENT_NAME`, `GITHUB_REPOSITORY` and `GITHUB_SHA` from the
 environment and query the GitHub API via the `gh` CLI (authenticated by
@@ -54,22 +57,32 @@ def gh_api(path: str) -> str:
     return result.stdout
 
 
-def last_successful_nightly(repository: str) -> tuple[str, str]:
+def last_real_nightly(repository: str) -> tuple[str, str, bool]:
     """
-    Return the head SHA and creation time of the last scheduled run.
-
-    Only successful scheduled runs count; return empty strings when
-    none exists yet.
+    Return the head SHA, creation time and artifact liveness of the
+    last scheduled run that actually filled.
+
+    A skipped nightly still concludes as a successful scheduled run,
+    so taking the newest success as the baseline would let skip-runs
+    keep resetting the refresh clock while the last real artifact
+    quietly expires. Walk the recent successful scheduled runs and
+    take the newest one that uploaded artifacts, reporting whether any
+    of them is still live. Return empty strings when none exists yet.
     """
     runs = json.loads(
         gh_api(
             f"repos/{repository}/actions/workflows/{WORKFLOW_FILE}"
-            "/runs?status=success&event=schedule&per_page=1"
+            "/runs?status=success&event=schedule&per_page=10"
         )
     )["workflow_runs"]
-    if not runs:
-        return "", ""
-    return str(runs[0]["head_sha"]), str(runs[0]["created_at"])
+    for run in runs:
+        artifacts = json.loads(
+            gh_api(f"repos/{repository}/actions/runs/{run['id']}/artifacts")
+        )["artifacts"]
+        if artifacts:
+            live = any(not a["expired"] for a in artifacts)
+            return str(run["head_sha"]), str(run["created_at"]), live
+    return "", "", False
 
 
 def is_stale(created_at: str) -> bool:
@@ -109,7 +122,7 @@ def main() -> None:
     repository = os.environ["GITHUB_REPOSITORY"]
     head_sha = os.environ["GITHUB_SHA"]
 
-    last_sha, last_created = last_successful_nightly(repository)
+    last_sha, last_created, artifact_live = last_real_nightly(repository)
     if last_sha:
         commits = commits_since(repository, last_sha, head_sha)
     else:
@@ -122,6 +135,11 @@ def main() -> None:
             "### Commits since last successful nightly fill\n"
             + "\n".join(commits)
         )
+    elif not artifact_live:
+        print("run=true")
+        append_summary(
+            "No new commits, but no live fixture artifact exists; refilling."
+        )
     elif is_stale(last_created):
         print("run=true")
         append_summary(
diff --git a/.github/scripts/tests/test_release_scripts.py b/.github/scripts/tests/test_release_scripts.py
index 3d2f5c2e50a..0d82eeb5fe6 100644
--- a/.github/scripts/tests/test_release_scripts.py
+++ b/.github/scripts/tests/test_release_scripts.py
@@ -189,12 +189,20 @@ def test_known_evm_passes(self):
         assert result.returncode == 0
 
 
-# Fake `gh` served from PATH: answers the two API calls the commit-check
-# script makes with canned JSON from env vars, and fails loudly on any
-# other (or unconfigured) call.
+# Fake `gh` served from PATH: answers the three API calls the
+# commit-check script makes with canned JSON from env vars, and fails
+# loudly on any other (or unconfigured) call. Per-run artifact
+# responses come from `FAKE_GH_ARTIFACTS_<run_id>`, falling back to
+# `FAKE_GH_ARTIFACTS`.
 FAKE_GH = """#!/usr/bin/env bash
 case "$2" in
   *actions/workflows*) response="$FAKE_GH_RUNS" ;;
+  */artifacts)
+    run_id="${2##*/runs/}"
+    run_id="${run_id%%/*}"
+    var="FAKE_GH_ARTIFACTS_${run_id}"
+    response="${!var:-$FAKE_GH_ARTIFACTS}"
+    ;;
   *compare*) response="$FAKE_GH_COMPARE" ;;
   *) response="" ;;
 esac
@@ -205,6 +213,11 @@ def test_known_evm_passes(self):
 printf '%s' "$response"
 """
 
+# Canned artifact-list responses for the fake `gh`.
+LIVE_ARTIFACTS = '{"artifacts": [{"expired": false}]}'
+EXPIRED_ARTIFACTS = '{"artifacts": [{"expired": true}]}'
+NO_ARTIFACTS = '{"artifacts": []}'
+
 
 class TestCheckNewCommits:
     """Test check_new_commits.py."""
@@ -215,6 +228,8 @@ def run_check(
         event_name: str,
         runs: str = "",
         compare: str = "",
+        artifacts: str = "",
+        per_run_artifacts: dict[int, str] | None = None,
     ) -> tuple[subprocess.CompletedProcess, Path]:
         """Run the script with a fake `gh` on PATH; return it + summary."""
         bin_dir = tmp_path / "bin"
@@ -232,6 +247,9 @@ def run_check(
         env["GITHUB_STEP_SUMMARY"] = str(summary)
         env["FAKE_GH_RUNS"] = runs
         env["FAKE_GH_COMPARE"] = compare
+        env["FAKE_GH_ARTIFACTS"] = artifacts
+        for run_id, response in (per_run_artifacts or {}).items():
+            env[f"FAKE_GH_ARTIFACTS_{run_id}"] = response
 
         result = subprocess.run(
             ["uv", "run", "-q", str(CHECK_COMMITS_SCRIPT)],
@@ -261,18 +279,24 @@ def test_schedule_without_prior_run_fills_baseline(self, tmp_path):
         assert "no previous successful" in summary.read_text()
 
     @staticmethod
-    def runs_json(age: timedelta, head_sha: str = "b" * 40) -> str:
-        """Return a last-successful-run response created *age* ago."""
+    def run_json(
+        age: timedelta, head_sha: str = "b" * 40, run_id: int = 1
+    ) -> dict:
+        """Return one workflow-run object created *age* ago."""
         created = datetime.now(timezone.utc) - age
+        return {
+            "id": run_id,
+            "head_sha": head_sha,
+            "created_at": created.isoformat(),
+        }
+
+    @classmethod
+    def runs_json(
+        cls, age: timedelta, head_sha: str = "b" * 40, run_id: int = 1
+    ) -> str:
+        """Return a last-successful-run response created *age* ago."""
         return json.dumps(
-            {
-                "workflow_runs": [
-                    {
-                        "head_sha": head_sha,
-                        "created_at": created.isoformat(),
-                    }
-                ]
-            }
+            {"workflow_runs": [cls.run_json(age, head_sha, run_id)]}
         )
 
     def test_schedule_with_new_commits_runs(self, tmp_path):
@@ -286,6 +310,7 @@ def test_schedule_with_new_commits_runs(self, tmp_path):
             "schedule",
             runs=self.runs_json(timedelta(hours=25), head_sha="a" * 40),
             compare=json.dumps({"commits": [commit]}),
+            artifacts=LIVE_ARTIFACTS,
         )
         assert result.returncode == 0
         assert result.stdout.strip() == "run=true"
@@ -303,6 +328,7 @@ def test_schedule_without_new_commits_skips(self, tmp_path):
             # Just inside the refresh age: pin the four-day boundary.
             runs=self.runs_json(timedelta(days=3, hours=23)),
             compare=json.dumps({"commits": []}),
+            artifacts=LIVE_ARTIFACTS,
         )
         assert result.returncode == 0
         assert result.stdout.strip() == "run=false"
@@ -315,11 +341,55 @@ def test_schedule_stale_quiet_baseline_refreshes(self, tmp_path):
             "schedule",
             runs=self.runs_json(timedelta(days=4, hours=1)),
             compare=json.dumps({"commits": []}),
+            artifacts=LIVE_ARTIFACTS,
+        )
+        assert result.returncode == 0
+        assert result.stdout.strip() == "run=true"
+        assert "refreshing" in summary.read_text()
+
+    def test_schedule_skip_runs_do_not_reset_refresh(self, tmp_path):
+        """
+        Verify skip-runs neither advance the baseline nor its clock.
+
+        A quiet nightly that skips its build still concludes as a
+        successful scheduled run; if it counted as the baseline, a
+        stretch of skip-runs would keep resetting the refresh clock
+        while the last real artifact quietly expired.
+        """
+        runs = json.dumps(
+            {
+                "workflow_runs": [
+                    # Newest success skipped its build: no artifacts.
+                    self.run_json(timedelta(hours=1), run_id=2),
+                    # The last real fill is past the refresh age.
+                    self.run_json(timedelta(days=4, hours=1), run_id=1),
+                ]
+            }
+        )
+        result, summary = self.run_check(
+            tmp_path,
+            "schedule",
+            runs=runs,
+            compare=json.dumps({"commits": []}),
+            per_run_artifacts={2: NO_ARTIFACTS, 1: LIVE_ARTIFACTS},
         )
         assert result.returncode == 0
         assert result.stdout.strip() == "run=true"
         assert "refreshing" in summary.read_text()
 
+    def test_schedule_dead_artifact_refills(self, tmp_path):
+        """Verify a fill whose artifact is gone refills immediately."""
+        result, summary = self.run_check(
+            tmp_path,
+            "schedule",
+            runs=self.runs_json(timedelta(days=1)),
+            compare=json.dumps({"commits": []}),
+            artifacts=EXPIRED_ARTIFACTS,
+        )
+        assert result.returncode == 0
+        assert result.stdout.strip() == "run=true"
+        assert "no live fixture artifact" in summary.read_text()
+
     def test_gh_failure_fails_the_check(self, tmp_path):
         """Verify a failing `gh` call fails the script."""
         result, _ = self.run_check(tmp_path, "schedule")

From 48e593877ff4167a1b4b86abf0a84832602d5be8 Mon Sep 17 00:00:00 2001
From: spencer-tb <spencer.tb@ethereum.org>
Date: Tue, 14 Jul 2026 11:41:23 +0100
Subject: [PATCH 11/14] feat(ci): fill the mainnet tests feature in the nightly
 run

---
 .github/configs/feature.yaml            | 10 +++-------
 .github/workflows/release_fixtures.yaml | 20 +++++++++++---------
 docs/dev/releasing_tests.md             |  2 +-
 3 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/.github/configs/feature.yaml b/.github/configs/feature.yaml
index 6aadc6f0097..398541b7e65 100644
--- a/.github/configs/feature.yaml
+++ b/.github/configs/feature.yaml
@@ -5,17 +5,13 @@
 # Any `<feat>-devnet` input resolves to the shared `devnet` entry but keeps
 # its name in the tag; the devnet number lives in the version (X), not the
 # feature name, so this file needs no edits for new devnets.
+# `tests` is also what the scheduled nightly run of the `release_fixtures`
+# workflow fills: mainnet forks only, so the rotating nightly artifact is a
+# release-ready rehearsal of the next tests@ release.
 tests:
   evm-type: eels
   fill-params: --until=BPO4 --generate-all-formats
 
-# Filled by the scheduled nightly run of the `release_fixtures` workflow:
-# all tests (slow included), all fixture formats, up to the dev fork. Not
-# meant for tagged releases.
-nightly:
-  evm-type: eels
-  fill-params: --until=Amsterdam --generate-all-formats
-
 benchmark:
   evm-type: benchmark
   fill-params: --fork=Osaka --generate-all-formats --gas-benchmark-values 1,5,10,30,60,100,150 ./tests/benchmark/compute --maxprocesses=30 --dist=worksteal
diff --git a/.github/workflows/release_fixtures.yaml b/.github/workflows/release_fixtures.yaml
index 5e23f751082..afa83f309b3 100644
--- a/.github/workflows/release_fixtures.yaml
+++ b/.github/workflows/release_fixtures.yaml
@@ -2,11 +2,12 @@ name: Create Fixture Release
 
 run-name: ${{ github.event_name == 'schedule' && 'Nightly Fill' || format('Create Fixture Release {0}@{1}', inputs.feature, inputs.version) }}
 
-# Scheduled runs fill the `nightly` feature (all tests, all fixture formats,
-# dev fork included) through the exact release pipeline, but skip the
-# `release` job, so no tag or draft release is created. The cron fires at
-# 02:00 UTC: the self-hosted runners are past the EU/US daytime peaks and
-# results are ready before the EU morning.
+# Scheduled runs fill the mainnet `tests` feature (all tests, all fixture
+# formats, up to the latest mainnet fork -- no dev forks) through the exact
+# release pipeline, but skip the `release` job, so no tag or draft release
+# is created: a rotating, always-available artifact of the mainnet
+# fixtures. The cron fires at 02:00 UTC: the self-hosted runners are past
+# the EU/US daytime peaks and results are ready before the EU morning.
 on:
   schedule:
     - cron: "0 2 * * *"
@@ -74,10 +75,11 @@ jobs:
         id: matrix
         shell: bash
         env:
-          # Scheduled runs have no inputs: fill the `nightly` feature; the
-          # placeholder version passes validation and is otherwise unused
-          # because the `release` job is skipped for scheduled runs.
-          INPUT_FEATURE: ${{ inputs.feature || 'nightly' }}
+          # Scheduled runs have no inputs: fill the mainnet `tests`
+          # feature; the placeholder version passes validation and is
+          # otherwise unused because the `release` job is skipped for
+          # scheduled runs.
+          INPUT_FEATURE: ${{ inputs.feature || 'tests' }}
           INPUT_VERSION: ${{ inputs.version || 'v0.0.0' }}
           INPUT_BRANCH: ${{ inputs.branch }}
           INPUT_EVM: ${{ inputs.evm }}
diff --git a/docs/dev/releasing_tests.md b/docs/dev/releasing_tests.md
index 9369d44558a..cc25bc01d95 100644
--- a/docs/dev/releasing_tests.md
+++ b/docs/dev/releasing_tests.md
@@ -112,4 +112,4 @@ The release is created as a draft; review and publish it from the GitHub release
 
 ## Nightly fill
 
-The same workflow also runs on a nightly schedule (02:00 UTC) as a release rehearsal: it fills the `nightly` feature (all tests, slow included, all fixture formats, up to the dev fork) through the exact release pipeline, but stops after `combine`, so no tag or release is created. Each run uploads a `fixtures_nightly.tar.gz` workflow artifact with a 5-day retention. A scheduled run skips itself when there are no new commits since the last successful nightly fill; a failed nightly keeps re-running until it goes green, so no commit slips through unfilled. A quiet stretch without commits still re-fills once the last successful nightly is four days old, so a live artifact always exists within the five-day retention.
+The same workflow also runs on a nightly schedule (02:00 UTC) as a release rehearsal: it fills the mainnet `tests` feature (all tests, slow included, all fixture formats, up to the latest mainnet fork — dev forks are not included) through the exact release pipeline, but stops after `combine`, so no tag or release is created. Each run uploads the `fixtures_tests` workflow artifact (containing `fixtures.tar.gz`) with a 5-day retention: a rotating, always-available build of the mainnet fixtures, effectively a `tests@` release candidate on demand. A scheduled run skips itself when there are no new commits since the last nightly that actually filled — a skipped or failed nightly never advances that baseline, so no commit slips through unfilled. A quiet stretch without commits still re-fills once the last fill is four days old, or its artifact is gone, so a live artifact always exists within the five-day retention.

From 62adf10eed2c1983f9d847d81d82333cc6a8b431 Mon Sep 17 00:00:00 2001
From: danceratopz <danceratopz@gmail.com>
Date: Wed, 15 Jul 2026 17:27:37 +0200
Subject: [PATCH 12/14] feat(ci): promote a nightly fill to a draft tests
 release (#31)

Co-authored-by: spencer-tb <spencer.tb@ethereum.org>
---
 .github/scripts/resolve_cached_release.py     | 282 +++++++++++++++++
 .github/scripts/tests/test_release_scripts.py | 291 +++++++++++++++++-
 .github/workflows/release_fixtures.yaml       |  89 +++++-
 docs/dev/releasing_tests.md                   |  92 +++---
 4 files changed, 687 insertions(+), 67 deletions(-)
 create mode 100644 .github/scripts/resolve_cached_release.py

diff --git a/.github/scripts/resolve_cached_release.py b/.github/scripts/resolve_cached_release.py
new file mode 100644
index 00000000000..b2f12431784
--- /dev/null
+++ b/.github/scripts/resolve_cached_release.py
@@ -0,0 +1,282 @@
+#!/usr/bin/env -S uv run --script
+#
+# /// script
+# requires-python = ">=3.12"
+# ///
+"""
+Resolve the nightly fill whose artifact a cached release reuses.
+
+Usage: `resolve_cached_release.py` (all inputs come from the
+environment).
+
+Dispatching `release_fixtures.yaml` with the `cached` flag drafts a
+`tests@` release from the newest nightly artifact instead of
+refilling: the scheduled nightly runs already build the mainnet
+`tests` feature into a release-shaped `fixtures_<commit>` artifact.
+The `commit` input picks the nightly built at that commit instead of
+the newest one. This script validates the request, picks the nightly
+run whose artifact the release job downloads, and pins the exact
+commit that run built so the release tag lands on it.
+
+Checks performed, failing fast on the first violation:
+
+- The release is for the `tests` feature on the default branch (no
+  `branch` input): that is what the nightly fills.
+- `INPUT_VERSION` matches `vX.Y.Z` and is greater than the newest
+  existing `tests@` tag (releases always move forward; anything
+  unusual belongs in a fresh fill).
+- The resolved run is a successful *scheduled* run of
+  `release_fixtures.yaml` with a live (unexpired) tarball artifact
+  named for the run's own commit: the newest one, or with
+  `INPUT_COMMIT` (7+ hex characters) the one built at that commit.
+  Skip-runs upload no artifacts and expired fills cannot be
+  downloaded, so both are passed over.
+- The resolved commit contains the newest existing `tests@` release,
+  so a cached release never regresses content (re-releasing the same
+  commit stays allowed).
+- The resolved commit is an ancestor of the current branch head.
+  Commits after it are listed in the step summary so the releaser can
+  see what the release will NOT contain.
+
+Read `GITHUB_REPOSITORY`, `GITHUB_SHA`, `INPUT_FEATURE`,
+`INPUT_BRANCH`, `INPUT_VERSION` and `INPUT_COMMIT` from the
+environment and query the
+GitHub API via the `gh` CLI (authenticated by `GH_TOKEN`). Print
+`run_id`, `target_sha` and `artifact_name` as `key=value` lines for
+`$GITHUB_OUTPUT`.
+"""
+
+import json
+import os
+import re
+import subprocess
+import sys
+from typing import NoReturn
+
+WORKFLOW_FILE = "release_fixtures.yaml"
+
+# The combined-tarball artifact a nightly `tests` fill uploads is
+# named for the short hash of the built commit; only that artifact is
+# ever reused by a cached release.
+ARTIFACT_PREFIX = "fixtures"
+
+VERSION_RE = re.compile(r"^v([0-9]+)\.([0-9]+)\.([0-9]+)$")
+COMMIT_RE = re.compile(r"^[0-9a-f]{7,40}$")
+
+
+def artifact_name(head_sha: str) -> str:
+    """Return the tarball artifact name of a nightly built at *head_sha*."""
+    return f"{ARTIFACT_PREFIX}_{head_sha[:7]}"
+
+
+def fail(message: str) -> NoReturn:
+    """Print an error to stderr and exit non-zero."""
+    print(f"Error: {message}", file=sys.stderr)
+    sys.exit(1)
+
+
+def gh_api(path: str) -> str:
+    """Return the stdout of `gh api <path>`, exiting non-zero on error."""
+    result = subprocess.run(
+        ["gh", "api", path], capture_output=True, text=True
+    )
+    if result.returncode != 0:
+        print(f"Error: gh api {path} failed:", file=sys.stderr)
+        print(result.stderr, file=sys.stderr)
+        sys.exit(1)
+    return result.stdout
+
+
+def append_summary(text: str) -> None:
+    """Append *text* to the GitHub step summary, or stderr if unset."""
+    summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
+    if summary_path:
+        with open(summary_path, "a") as f:
+            f.write(text + "\n")
+    else:
+        print(text, file=sys.stderr)
+
+
+def parse_version(version: str) -> tuple[int, int, int]:
+    """Return the (major, minor, patch) tuple of a `vX.Y.Z` version."""
+    m = VERSION_RE.match(version)
+    if not m:
+        fail(f"version '{version}' must match vX.Y.Z (e.g. v5.0.0)")
+    major, minor, patch = (int(g) for g in m.groups())
+    return major, minor, patch
+
+
+def newest_tests_tag(repository: str) -> str:
+    """
+    Return the newest existing `tests@vX.Y.Z` tag, or "" when none.
+
+    The `tests@` ref prefix cannot match any other feature's tags
+    (those are namespaced `tests-<feature>@`), so every match is a
+    mainnet tests release.
+    """
+    refs = json.loads(
+        gh_api(f"repos/{repository}/git/matching-refs/tags/tests@")
+    )
+    tags = [ref["ref"].removeprefix("refs/tags/") for ref in refs]
+    versioned = [
+        (parse_version(tag.removeprefix("tests@")), tag)
+        for tag in tags
+        if VERSION_RE.match(tag.removeprefix("tests@"))
+    ]
+    if not versioned:
+        return ""
+    return max(versioned)[1]
+
+
+def has_live_tests_artifact(
+    repository: str, run_id: str, head_sha: str
+) -> bool:
+    """
+    Return whether *run_id* has a live tarball artifact.
+
+    The artifact name is derived from the run's own head SHA, so a
+    name that does not match the commit it claims to be built from is
+    passed over.
+    """
+    artifacts = json.loads(
+        gh_api(f"repos/{repository}/actions/runs/{run_id}/artifacts")
+    )["artifacts"]
+    name = artifact_name(head_sha)
+    return any(a["name"] == name and not a["expired"] for a in artifacts)
+
+
+def cached_run(repository: str, commit: str) -> tuple[str, str]:
+    """
+    Return the (run id, head SHA) of the nightly run to reuse.
+
+    Take the newest successful scheduled run with a live artifact, or
+    with *commit* the run built at that commit (skip-runs upload no
+    artifacts and expired fills cannot be downloaded, so both are
+    passed over). On a commit miss, list the reusable nightlies.
+    """
+    runs = json.loads(
+        gh_api(
+            f"repos/{repository}/actions/workflows/{WORKFLOW_FILE}"
+            "/runs?status=success&event=schedule&per_page=10"
+        )
+    )["workflow_runs"]
+    live: list[str] = []
+    for run in runs:
+        run_id, head_sha = str(run["id"]), str(run["head_sha"])
+        if not has_live_tests_artifact(repository, run_id, head_sha):
+            continue
+        if not commit or head_sha.startswith(commit):
+            return run_id, head_sha
+        live.append(head_sha[:7])
+    if commit:
+        available = ", ".join(live) if live else "none"
+        fail(
+            f"no nightly with a live artifact was built at {commit} "
+            f"(reusable nightlies: {available}); dispatch a fresh fill "
+            "instead"
+        )
+    fail(
+        f"no scheduled run of {WORKFLOW_FILE} with a live "
+        f"`{ARTIFACT_PREFIX}_<commit>` artifact found; dispatch a fresh "
+        "fill instead"
+    )
+
+
+def ensure_not_behind(repository: str, prev_tag: str, target_sha: str) -> None:
+    """
+    Fail when *target_sha* does not contain the *prev_tag* release.
+
+    A cached release must never regress content: the resolved nightly
+    has to be at or after the newest `tests@` tag. Re-releasing the
+    identical commit stays allowed.
+    """
+    compare = json.loads(
+        gh_api(f"repos/{repository}/compare/{prev_tag}...{target_sha}")
+    )
+    if compare["status"] not in ("identical", "ahead"):
+        fail(
+            f"the resolved nightly ({target_sha}) does not contain the "
+            f"newest tests release ({prev_tag}); a cached release must "
+            "not regress content"
+        )
+
+
+def commits_after(
+    repository: str, target_sha: str, head_sha: str
+) -> list[str]:
+    """
+    Return `- <sha> <subject>` lines for commits after *target_sha*.
+
+    Fail when *target_sha* is not an ancestor of *head_sha*: a nightly
+    built from a rewritten or foreign branch must not be released.
+    """
+    compare = json.loads(
+        gh_api(f"repos/{repository}/compare/{target_sha}...{head_sha}")
+    )
+    if compare["status"] not in ("identical", "ahead"):
+        fail(
+            f"nightly commit {target_sha} is not an ancestor of "
+            f"{head_sha} (compare status: {compare['status']})"
+        )
+    return [
+        f"- {c['sha'][:7]} {(c['commit']['message'].splitlines() or [''])[0]}"
+        for c in compare["commits"]
+    ]
+
+
+def main() -> None:
+    """Print the resolved run for `$GITHUB_OUTPUT` and the summary."""
+    repository = os.environ["GITHUB_REPOSITORY"]
+    head_sha = os.environ["GITHUB_SHA"]
+    version = os.environ["INPUT_VERSION"]
+
+    if os.environ.get("INPUT_FEATURE") != "tests":
+        fail("cached releases are only available for feature=tests")
+    if os.environ.get("INPUT_BRANCH"):
+        fail(
+            "cached releases reuse a default-branch nightly; drop the "
+            "`branch` input or dispatch a fresh fill"
+        )
+
+    commit = os.environ.get("INPUT_COMMIT", "")
+    if commit and not COMMIT_RE.match(commit):
+        fail(f"commit '{commit}' must be 7 to 40 lowercase hex characters")
+
+    requested = parse_version(version)
+    prev_tag = newest_tests_tag(repository)
+    if prev_tag and requested <= parse_version(
+        prev_tag.removeprefix("tests@")
+    ):
+        fail(
+            f"version '{version}' must be greater than the newest "
+            f"tests release ({prev_tag})"
+        )
+
+    run_id, target_sha = cached_run(repository, commit)
+    if prev_tag:
+        ensure_not_behind(repository, prev_tag, target_sha)
+    missing = commits_after(repository, target_sha, head_sha)
+
+    print(f"run_id={run_id}")
+    print(f"target_sha={target_sha}")
+    print(f"artifact_name={artifact_name(target_sha)}")
+
+    run_url = f"https://github.com/{repository}/actions/runs/{run_id}"
+    append_summary(
+        f"Reusing nightly fill run [{run_id}]({run_url}) "
+        f"(built at `{target_sha}`) for the `tests@{version}` draft."
+    )
+    if missing:
+        append_summary(
+            "### Commits NOT included in this release\n"
+            + "\n".join(missing)
+            + "\n\nDispatch a fresh fill to include them."
+        )
+    else:
+        append_summary(
+            "The nightly is up to date with the current branch head."
+        )
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/scripts/tests/test_release_scripts.py b/.github/scripts/tests/test_release_scripts.py
index 0d82eeb5fe6..0aebb23915b 100644
--- a/.github/scripts/tests/test_release_scripts.py
+++ b/.github/scripts/tests/test_release_scripts.py
@@ -19,6 +19,7 @@
 TARBALL_SCRIPT = SCRIPTS_DIR / "create_release_tarball.py"
 MERGE_INDEX_SCRIPT = SCRIPTS_DIR / "merge_index_files.py"
 CHECK_COMMITS_SCRIPT = SCRIPTS_DIR / "check_new_commits.py"
+RESOLVE_CACHED_SCRIPT = SCRIPTS_DIR / "resolve_cached_release.py"
 
 
 def run_script(script: Path, *args: str) -> subprocess.CompletedProcess:
@@ -189,9 +190,9 @@ def test_known_evm_passes(self):
         assert result.returncode == 0
 
 
-# Fake `gh` served from PATH: answers the three API calls the
-# commit-check script makes with canned JSON from env vars, and fails
-# loudly on any other (or unconfigured) call. Per-run artifact
+# Fake `gh` served from PATH: answers the API calls the commit-check
+# and cached-release scripts make with canned JSON from env vars, and
+# fails loudly on any other (or unconfigured) call. Per-run artifact
 # responses come from `FAKE_GH_ARTIFACTS_<run_id>`, falling back to
 # `FAKE_GH_ARTIFACTS`.
 FAKE_GH = """#!/usr/bin/env bash
@@ -203,6 +204,8 @@ def test_known_evm_passes(self):
     var="FAKE_GH_ARTIFACTS_${run_id}"
     response="${!var:-$FAKE_GH_ARTIFACTS}"
     ;;
+  *matching-refs*) response="$FAKE_GH_TAGS" ;;
+  *compare/tests@*) response="$FAKE_GH_COMPARE_TAG" ;;
   *compare*) response="$FAKE_GH_COMPARE" ;;
   *) response="" ;;
 esac
@@ -397,6 +400,288 @@ def test_gh_failure_fails_the_check(self, tmp_path):
         assert "gh api" in result.stderr
 
 
+# Canned responses for the cached-release script. Unlike the commit
+# check, it matches artifacts by the commit-derived
+# `fixtures_<short sha>` name, so the canned listings are built
+# per head SHA.
+TESTS_TAGS = json.dumps(
+    [{"ref": "refs/tags/tests@v3.1.2"}, {"ref": "refs/tags/tests@v4.0.0"}]
+)
+NO_TAGS = "[]"
+UP_TO_DATE = json.dumps({"status": "identical", "commits": []})
+
+
+def artifact_listing(head_sha: str, expired: bool = False) -> str:
+    """Return an artifact listing with a tarball named for *head_sha*."""
+    return json.dumps(
+        {
+            "artifacts": [
+                {
+                    "name": f"fixtures_{head_sha[:7]}",
+                    "expired": expired,
+                }
+            ]
+        }
+    )
+
+
+class TestResolveCachedRelease:
+    """Test resolve_cached_release.py."""
+
+    def run_resolve(
+        self,
+        tmp_path: Path,
+        version: str,
+        feature: str = "tests",
+        branch: str = "",
+        commit: str = "",
+        runs: str = "",
+        artifacts: str = "",
+        per_run_artifacts: dict[int, str] | None = None,
+        tags: str = "",
+        compare: str = "",
+        tag_compare: str = UP_TO_DATE,
+    ) -> tuple[subprocess.CompletedProcess, Path]:
+        """Run the script with a fake `gh` on PATH; return it + summary."""
+        bin_dir = tmp_path / "bin"
+        bin_dir.mkdir(exist_ok=True)
+        fake_gh = bin_dir / "gh"
+        fake_gh.write_text(FAKE_GH)
+        fake_gh.chmod(0o755)
+
+        summary = tmp_path / "summary.md"
+        env = os.environ.copy()
+        env["PATH"] = f"{bin_dir}:{env['PATH']}"
+        env["GITHUB_REPOSITORY"] = "ethereum/execution-specs"
+        env["GITHUB_SHA"] = "b" * 40
+        env["GITHUB_STEP_SUMMARY"] = str(summary)
+        env["INPUT_VERSION"] = version
+        env["INPUT_FEATURE"] = feature
+        env["INPUT_BRANCH"] = branch
+        env["INPUT_COMMIT"] = commit
+        env["FAKE_GH_RUNS"] = runs
+        env["FAKE_GH_ARTIFACTS"] = artifacts
+        env["FAKE_GH_TAGS"] = tags
+        env["FAKE_GH_COMPARE"] = compare
+        env["FAKE_GH_COMPARE_TAG"] = tag_compare
+        for run_id, response in (per_run_artifacts or {}).items():
+            env[f"FAKE_GH_ARTIFACTS_{run_id}"] = response
+
+        result = subprocess.run(
+            ["uv", "run", "-q", str(RESOLVE_CACHED_SCRIPT)],
+            capture_output=True,
+            text=True,
+            cwd=REPO_ROOT,
+            env=env,
+        )
+        return result, summary
+
+    @staticmethod
+    def parse_outputs(stdout: str) -> dict[str, str]:
+        """Parse the key=value lines written for `$GITHUB_OUTPUT`."""
+        return dict(line.split("=", 1) for line in stdout.strip().splitlines())
+
+    @staticmethod
+    def runs_json(*runs: dict) -> str:
+        """Return a workflow-runs listing response."""
+        return json.dumps({"workflow_runs": list(runs)})
+
+    def test_reuses_newest_run_with_live_artifact(self, tmp_path):
+        """Verify skip-runs and expired fills are passed over."""
+        commit = {
+            "sha": "abcdef1" + "0" * 33,
+            "commit": {"message": "feat(x): subject\n\nbody"},
+        }
+        result, summary = self.run_resolve(
+            tmp_path,
+            "v4.0.1",
+            runs=self.runs_json(
+                # Newest success skipped its build: no artifacts.
+                {"id": 3, "head_sha": "c" * 40},
+                {"id": 2, "head_sha": "a" * 40},
+                {"id": 1, "head_sha": "d" * 40},
+            ),
+            per_run_artifacts={
+                3: NO_ARTIFACTS,
+                2: artifact_listing("a" * 40),
+                1: artifact_listing("d" * 40, expired=True),
+            },
+            tags=TESTS_TAGS,
+            compare=json.dumps({"status": "ahead", "commits": [commit]}),
+        )
+        assert result.returncode == 0
+        out = self.parse_outputs(result.stdout)
+        assert out["run_id"] == "2"
+        assert out["target_sha"] == "a" * 40
+        assert out["artifact_name"] == "fixtures_aaaaaaa"
+        text = summary.read_text()
+        assert "### Commits NOT included in this release" in text
+        # Short SHA plus the commit subject, without the body.
+        assert "- abcdef1 feat(x): subject" in text
+        assert "body" not in text
+
+    def test_up_to_date_nightly_resolves_cleanly(self, tmp_path):
+        """Verify no missing-commit section when nothing landed since."""
+        result, summary = self.run_resolve(
+            tmp_path,
+            "v4.0.1",
+            runs=self.runs_json({"id": 2, "head_sha": "b" * 40}),
+            artifacts=artifact_listing("b" * 40),
+            tags=TESTS_TAGS,
+            compare=UP_TO_DATE,
+        )
+        assert result.returncode == 0
+        text = summary.read_text()
+        assert "up to date" in text
+        assert "NOT included" not in text
+
+    def test_first_release_without_tags_resolves(self, tmp_path):
+        """Verify a cached release works before any tests@ tag exists."""
+        result, _ = self.run_resolve(
+            tmp_path,
+            "v1.0.0",
+            runs=self.runs_json({"id": 2, "head_sha": "b" * 40}),
+            artifacts=artifact_listing("b" * 40),
+            tags=NO_TAGS,
+            compare=UP_TO_DATE,
+        )
+        assert result.returncode == 0
+        assert self.parse_outputs(result.stdout)["run_id"] == "2"
+
+    def test_non_tests_feature_fails(self, tmp_path):
+        """Verify only the tests feature can release cached."""
+        # The fake `gh` fails every call (no canned responses), so a
+        # clean feature error proves the guard fires before the API.
+        result, _ = self.run_resolve(tmp_path, "v4.0.1", feature="bal-devnet")
+        assert result.returncode == 1
+        assert "only available for feature=tests" in result.stderr
+
+    def test_branch_input_fails(self, tmp_path):
+        """Verify a cached release rejects a branch input."""
+        result, _ = self.run_resolve(
+            tmp_path, "v4.0.1", branch="devnets/bal/7"
+        )
+        assert result.returncode == 1
+        assert "drop the `branch` input" in result.stderr
+
+    def test_bad_version_format_fails(self, tmp_path):
+        """Verify a non vX.Y.Z version is rejected before any API call."""
+        result, _ = self.run_resolve(tmp_path, "4.0.1")
+        assert result.returncode == 1
+        assert "must match vX.Y.Z" in result.stderr
+
+    def test_version_not_greater_than_newest_tag_fails(self, tmp_path):
+        """Verify the version must move past the newest tests@ tag."""
+        result, _ = self.run_resolve(tmp_path, "v4.0.0", tags=TESTS_TAGS)
+        assert result.returncode == 1
+        assert "must be greater" in result.stderr
+        assert "tests@v4.0.0" in result.stderr
+
+    def test_no_reusable_run_fails(self, tmp_path):
+        """Verify a helpful error when every artifact has expired."""
+        result, _ = self.run_resolve(
+            tmp_path,
+            "v4.0.1",
+            runs=self.runs_json({"id": 2, "head_sha": "a" * 40}),
+            artifacts=artifact_listing("a" * 40, expired=True),
+            tags=TESTS_TAGS,
+        )
+        assert result.returncode == 1
+        assert "dispatch a fresh fill instead" in result.stderr
+
+    def test_mismatched_artifact_name_is_skipped(self, tmp_path):
+        """Verify an artifact named for another commit is not reused."""
+        result, _ = self.run_resolve(
+            tmp_path,
+            "v4.0.1",
+            runs=self.runs_json({"id": 2, "head_sha": "a" * 40}),
+            # Live, but named for a different commit than the run built.
+            artifacts=artifact_listing("f" * 40),
+            tags=TESTS_TAGS,
+        )
+        assert result.returncode == 1
+        assert "dispatch a fresh fill instead" in result.stderr
+
+    def test_commit_input_selects_that_nightly(self, tmp_path):
+        """Verify `commit` picks an older nightly over the newest."""
+        result, _ = self.run_resolve(
+            tmp_path,
+            "v4.0.1",
+            commit="d" * 7,
+            runs=self.runs_json(
+                {"id": 3, "head_sha": "c" * 40},
+                {"id": 2, "head_sha": "a" * 40},
+                {"id": 1, "head_sha": "d" * 40},
+            ),
+            per_run_artifacts={
+                3: NO_ARTIFACTS,
+                2: artifact_listing("a" * 40),
+                1: artifact_listing("d" * 40),
+            },
+            tags=TESTS_TAGS,
+            compare=UP_TO_DATE,
+        )
+        assert result.returncode == 0
+        out = self.parse_outputs(result.stdout)
+        assert out["run_id"] == "1"
+        assert out["target_sha"] == "d" * 40
+        assert out["artifact_name"] == "fixtures_ddddddd"
+
+    def test_commit_input_without_match_fails(self, tmp_path):
+        """Verify a commit with no live nightly lists the candidates."""
+        result, _ = self.run_resolve(
+            tmp_path,
+            "v4.0.1",
+            commit="beef111",
+            runs=self.runs_json({"id": 2, "head_sha": "a" * 40}),
+            artifacts=artifact_listing("a" * 40),
+            tags=TESTS_TAGS,
+        )
+        assert result.returncode == 1
+        assert "was built at beef111" in result.stderr
+        assert "aaaaaaa" in result.stderr
+
+    def test_bad_commit_format_fails(self, tmp_path):
+        """Verify a malformed commit is rejected before any lookup."""
+        result, _ = self.run_resolve(
+            tmp_path, "v4.0.1", commit="xyz", tags=TESTS_TAGS
+        )
+        assert result.returncode == 1
+        assert "hex characters" in result.stderr
+
+    def test_release_behind_previous_fails(self, tmp_path):
+        """Verify a nightly older than the newest release is rejected."""
+        result, _ = self.run_resolve(
+            tmp_path,
+            "v4.0.1",
+            runs=self.runs_json({"id": 2, "head_sha": "a" * 40}),
+            artifacts=artifact_listing("a" * 40),
+            tags=TESTS_TAGS,
+            tag_compare=json.dumps({"status": "behind", "commits": []}),
+        )
+        assert result.returncode == 1
+        assert "must not regress content" in result.stderr
+
+    def test_diverged_nightly_fails(self, tmp_path):
+        """Verify a nightly off the branch history is not reused."""
+        result, _ = self.run_resolve(
+            tmp_path,
+            "v4.0.1",
+            runs=self.runs_json({"id": 2, "head_sha": "a" * 40}),
+            artifacts=artifact_listing("a" * 40),
+            tags=TESTS_TAGS,
+            compare=json.dumps({"status": "diverged", "commits": []}),
+        )
+        assert result.returncode == 1
+        assert "not an ancestor" in result.stderr
+
+    def test_gh_failure_fails_the_resolution(self, tmp_path):
+        """Verify a failing `gh` call fails the script."""
+        result, _ = self.run_resolve(tmp_path, "v4.0.1")
+        assert result.returncode == 1
+        assert "gh api" in result.stderr
+
+
 class TestCreateReleaseTarball:
     """Test create_release_tarball.py."""
 
diff --git a/.github/workflows/release_fixtures.yaml b/.github/workflows/release_fixtures.yaml
index afa83f309b3..63e950cf7f5 100644
--- a/.github/workflows/release_fixtures.yaml
+++ b/.github/workflows/release_fixtures.yaml
@@ -1,6 +1,6 @@
 name: Create Fixture Release
 
-run-name: ${{ github.event_name == 'schedule' && 'Nightly Fill' || format('Create Fixture Release {0}@{1}', inputs.feature, inputs.version) }}
+run-name: ${{ github.event_name == 'schedule' && 'Nightly Fill' || format('Create Fixture Release {0}@{1}{2}', inputs.feature, inputs.version, (inputs.cached || inputs.commit != '') && ' (cached)' || '') }}
 
 # Scheduled runs fill the mainnet `tests` feature (all tests, all fixture
 # formats, up to the latest mainnet fork -- no dev forks) through the exact
@@ -8,6 +8,11 @@ run-name: ${{ github.event_name == 'schedule' && 'Nightly Fill' || format('Creat
 # is created: a rotating, always-available artifact of the mainnet
 # fixtures. The cron fires at 02:00 UTC: the self-hosted runners are past
 # the EU/US daytime peaks and results are ready before the EU morning.
+#
+# A manual `tests` release can reuse the newest of those artifacts
+# instead of refilling via the `cached` checkbox: `build` and `combine`
+# are skipped and the `release` job drafts from the nightly's tarball,
+# tagged at the commit the nightly built. Runs in minutes.
 on:
   schedule:
     - cron: "0 2 * * *"
@@ -37,22 +42,39 @@ on:
         description: "Override the t8n tool branch / tag / commit"
         required: false
         type: string
+      cached:
+        description: "Draft from the newest nightly artifact instead of refilling (tests only)"
+        required: false
+        type: boolean
+        default: false
+      commit:
+        description: "Release the nightly built at this commit (7+ hex chars); implies cached. Empty = newest."
+        required: false
+        type: string
 
 concurrency:
-  # Scheduled runs queue behind an in-flight nightly (never cancel a fill);
-  # manual releases are unconstrained (each run gets a unique group).
-  group: ${{ github.event_name == 'schedule' && 'nightly-fill' || github.run_id }}
+  # Scheduled runs queue behind an in-flight nightly (never cancel a
+  # fill). Cached releases serialize too: drafts do not reserve their
+  # tag name, so parallel dispatches of the same version would silently
+  # coexist. Fresh releases are unconstrained (unique group per run).
+  group: ${{ github.event_name == 'schedule' && 'nightly-fill' || (inputs.cached || inputs.commit != '') && 'cached-release' || github.run_id }}
   cancel-in-progress: false
 
 jobs:
   setup:
     runs-on: ubuntu-latest
     outputs:
-      run: ${{ steps.check.outputs.run }}
+      # A cached release skips the fill: `build` (and with it `combine`)
+      # keys off `run`, and the release job downloads the resolved
+      # nightly's artifact and tags the commit it was built from.
+      run: ${{ (inputs.cached || inputs.commit != '') && 'false' || steps.check.outputs.run }}
       build_matrix: ${{ steps.matrix.outputs.build_matrix }}
       feature_name: ${{ steps.matrix.outputs.feature_name }}
       combine_labels: ${{ steps.matrix.outputs.combine_labels }}
-      target_sha: ${{ steps.target_sha.outputs.sha }}
+      target_sha: ${{ steps.cached.outputs.target_sha || steps.target_sha.outputs.sha }}
+      short_sha: ${{ steps.target_sha.outputs.short_sha }}
+      artifact_run_id: ${{ steps.cached.outputs.run_id }}
+      artifact_name: ${{ steps.cached.outputs.artifact_name }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -61,7 +83,14 @@ jobs:
       - name: Resolve target SHA
         id: target_sha
         shell: bash
-        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+        # The short form is a fixed 7-character slice (not `git
+        # rev-parse --short`, whose length can drift): the cached-release
+        # resolver derives artifact names from the API's full SHA and the
+        # two must always agree.
+        run: |
+          sha="$(git rev-parse HEAD)"
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${sha:0:7}" >> "$GITHUB_OUTPUT"
       - uses: ./.github/actions/setup-uv
 
       - name: Check for new commits (scheduled runs)
@@ -71,6 +100,21 @@ jobs:
         run: |
           uv run -q .github/scripts/check_new_commits.py >> "$GITHUB_OUTPUT"
 
+      - name: Resolve the nightly artifact to reuse (cached releases)
+        id: cached
+        if: inputs.cached || inputs.commit != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_FEATURE: ${{ inputs.feature }}
+          INPUT_VERSION: ${{ inputs.version }}
+          INPUT_BRANCH: ${{ inputs.branch }}
+          INPUT_COMMIT: ${{ inputs.commit }}
+        run: |
+          # The feature/branch/version guards, run resolution and
+          # ancestry check live in (and are unit-tested via)
+          # resolve_cached_release.py.
+          uv run -q .github/scripts/resolve_cached_release.py >> "$GITHUB_OUTPUT"
+
       - name: Validate input and generate build matrix
         id: matrix
         shell: bash
@@ -181,7 +225,11 @@ jobs:
       - name: Upload combined fixture tarball
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
-          name: fixtures_${{ needs.setup.outputs.feature_name }}
+          # Name the artifact for the built commit so the rolling
+          # nightly artifacts are tellable apart at a glance; the
+          # cached-release resolver derives this exact name from each
+          # run's head SHA. The tarball inside carries the feature name.
+          name: fixtures_${{ needs.setup.outputs.short_sha }}
           path: ${{ steps.tarball.outputs.path }}
           # Keep nightly tarballs for five days; a quiet nightly re-runs
           # after four (see check_new_commits.py), so a live artifact
@@ -193,9 +241,16 @@ jobs:
     runs-on: ubuntu-latest
     needs: [setup, build, combine]
     # Scheduled runs stop after `combine`: no tag, no draft release.
-    if: always() && github.event_name == 'workflow_dispatch' && needs.build.result == 'success' && (needs.combine.result == 'success' || needs.combine.result == 'skipped')
+    # Cached releases skip the fill, so a skipped `build` is expected;
+    # `setup` must have succeeded explicitly, because a failed `setup`
+    # also leaves `build` skipped and would otherwise start this job
+    # with empty outputs.
+    if: always() && github.event_name == 'workflow_dispatch' && needs.setup.result == 'success' && (needs.build.result == 'success' || ((inputs.cached || inputs.commit != '') && needs.build.result == 'skipped')) && (needs.combine.result == 'success' || needs.combine.result == 'skipped')
     permissions:
       contents: write
+      # Cached releases download the artifact from the resolved
+      # nightly run rather than this one.
+      actions: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -206,11 +261,21 @@ jobs:
       - name: Download release artifacts
         shell: bash
         run: |
-          gh run download ${{ github.run_id }} -p "fixtures_*" --dir ./artifacts
-          rm -rf ./artifacts/fixtures__*/
-          gh run download ${{ github.run_id }} -p "benchmark_genesis_*" --dir ./artifacts || true
+          if [ -n "$ARTIFACT_RUN_ID" ]; then
+            # Cached release: download the resolved nightly's tarball by
+            # exact name -- a young nightly's live split directories
+            # would also match the fixtures_* pattern.
+            gh run download "$ARTIFACT_RUN_ID" -n "$ARTIFACT_NAME" \
+              --dir "./artifacts/$ARTIFACT_NAME"
+          else
+            gh run download ${{ github.run_id }} -p "fixtures_*" --dir ./artifacts
+            rm -rf ./artifacts/fixtures__*/
+            gh run download ${{ github.run_id }} -p "benchmark_genesis_*" --dir ./artifacts || true
+          fi
         env:
           GH_TOKEN: ${{ github.token }}
+          ARTIFACT_RUN_ID: ${{ needs.setup.outputs.artifact_run_id }}
+          ARTIFACT_NAME: ${{ needs.setup.outputs.artifact_name }}
 
       - name: Draft release
         shell: bash
diff --git a/docs/dev/releasing_tests.md b/docs/dev/releasing_tests.md
index cc25bc01d95..ffbfe1cf504 100644
--- a/docs/dev/releasing_tests.md
+++ b/docs/dev/releasing_tests.md
@@ -1,13 +1,8 @@
 # Releasing Test Fixtures
 
-This page covers the mechanics of cutting a test fixture release. For the release types,
-their versioning, and consumption guidance, see
-[EELS Fixture Releases](../running_tests/releases.md).
+This page covers the mechanics of cutting a test fixture release. For the release types, their versioning, and consumption guidance, see [EELS Fixture Releases](../running_tests/releases.md).
 
-Fixture releases are produced by manually dispatching the
-[`release_fixtures.yaml`](https://github.com/ethereum/execution-specs/blob/master/.github/workflows/release_fixtures.yaml)
-workflow. There is no tag to push by hand. The workflow builds the fixtures and, only on
-success, creates the tag and the (draft) GitHub release.
+Fixture releases are produced by manually dispatching the [`release_fixtures.yaml`](https://github.com/ethereum/execution-specs/blob/master/.github/workflows/release_fixtures.yaml) workflow. There is no tag to push by hand. The workflow builds the fixtures and, only on success, drafts the GitHub release; publishing the draft creates the tag.
 
 ```bash
 gh workflow run release_fixtures.yaml -f feature=<feature> -f version=vX.Y.Z [-f branch=<branch>]
@@ -23,32 +18,22 @@ gh workflow run release_fixtures.yaml -f feature=<feature> -f version=vX.Y.Z [-f
 | `evm`      | no                | Override the evm impl (e.g. `geth`, `evmone`). Defaults to the feature's `evm-type` in `feature.yaml`. |
 | `evm_repo` | no                | Override the t8n tool repo (e.g. `ethereum/go-ethereum`).                                              |
 | `evm_ref`  | no                | Override the t8n tool branch / tag / commit.                                                          |
+| `cached`   | no                | Draft from the newest nightly artifact instead of refilling (`tests` only): `build` and `combine` are skipped and the tag targets the nightly's commit. See [Cached releases](#cached-releases). |
+| `commit`   | no                | Release the nightly built at this commit (7+ hex chars) instead of the newest one; implies `cached`. |
 
-`<feature>` must be a key in
-[`.github/configs/feature.yaml`](https://github.com/ethereum/execution-specs/blob/master/.github/configs/feature.yaml)
-(e.g. `tests`, `benchmark`), or a `<feat>-devnet` name that resolves to the shared `devnet`
-feature.
+`<feature>` must be a key in [`.github/configs/feature.yaml`](https://github.com/ethereum/execution-specs/blob/master/.github/configs/feature.yaml) (e.g. `tests`, `benchmark`), or a `<feat>-devnet` name that resolves to the shared `devnet` feature.
 
-Input validation runs in
-[`generate_build_matrix.py`](https://github.com/ethereum/execution-specs/blob/master/.github/scripts/generate_build_matrix.py)
-(unit-tested) before any fixtures are built, and fails fast on:
+Input validation runs in [`generate_build_matrix.py`](https://github.com/ethereum/execution-specs/blob/master/.github/scripts/generate_build_matrix.py) (unit-tested) before any fixtures are built, and fails fast on:
 
 - an empty `feature` or a `version` that is not `vX.Y.Z`;
 - an `evm` override that is not a key in `.github/configs/evm.yaml`;
 - a bare `devnet` feature name (must carry a `<feat>-` prefix, e.g. `bal-devnet`);
-- a `<feat>-devnet-<n>` feature name — the devnet index belongs in the `version` major, not
-  the feature name (so `feature=bal-devnet-7` is rejected in favour of
-  `feature=bal-devnet version=v7.0.0`);
-- a `*-devnet` release missing a `branch`, a `branch` outside the `devnets/<feat>/<n>` shape
-  (e.g. `devnets/bal/7`), or a `version` major that does not equal the devnet number `<n>` in
-  the branch (so `feature=bal-devnet branch=devnets/bal/7` must use `version=v7.*.*`).
+- a `<feat>-devnet-<n>` feature name — the devnet index belongs in the `version` major, not the feature name (so `feature=bal-devnet-7` is rejected in favour of `feature=bal-devnet version=v7.0.0`);
+- a `*-devnet` release missing a `branch`, a `branch` outside the `devnets/<feat>/<n>` shape (e.g. `devnets/bal/7`), or a `version` major that does not equal the devnet number `<n>` in the branch (so `feature=bal-devnet branch=devnets/bal/7` must use `version=v7.*.*`).
 
 ## Devnet releases
 
-Devnet releases must use a `<feat>-devnet` feature name (e.g. `feature=bal-devnet`) and must
-specify the branch to release from. Devnet branches follow the `devnets/<feat>/<n>` scheme
-(e.g. `devnets/bal/7`), and the `version` major must match the devnet number `<n>` in the
-branch:
+Devnet releases must use a `<feat>-devnet` feature name (e.g. `feature=bal-devnet`) and must specify the branch to release from. Devnet branches follow the `devnets/<feat>/<n>` scheme (e.g. `devnets/bal/7`), and the `version` major must match the devnet number `<n>` in the branch:
 
 ```bash
 gh workflow run release_fixtures.yaml -f feature=bal-devnet -f version=v7.0.0 -f branch=devnets/bal/7
@@ -58,14 +43,9 @@ gh workflow run release_fixtures.yaml -f feature=bal-devnet -f version=v7.0.0 -f
 
 On success the workflow:
 
-1. Builds `fixtures_<feature>.tar.gz` (the `tests` feature builds `fixtures.tar.gz`) for the
-   resolved feature (per its `evm-type` and `fill-params` in `feature.yaml`).
-2. Creates the git tag `tests-<feature>@vX.Y.Z` (the `tests` feature tags as `tests@vX.Y.Z`,
-   no doubled prefix) on the released commit (the SHA resolved once from the `branch` HEAD when
-   given, otherwise the dispatch commit).
-3. Publishes a **draft pre-release** to
-   [`ethereum/execution-specs`](https://github.com/ethereum/execution-specs/releases), titled
-   the same as the git tag, with the fixture tarball(s) attached.
+1. Builds `fixtures_<feature>.tar.gz` (the `tests` feature builds `fixtures.tar.gz`) for the resolved feature (per its `evm-type` and `fill-params` in `feature.yaml`).
+2. Drafts a **pre-release** to [`ethereum/execution-specs`](https://github.com/ethereum/execution-specs/releases) with the fixture tarball(s) attached, titled and tagged `tests-<feature>@vX.Y.Z` (the `tests` feature tags as `tests@vX.Y.Z`, no doubled prefix).
+3. Targets the tag at the released commit (the SHA resolved once from the `branch` HEAD when given, otherwise the dispatch commit). The tag name and target are stored as draft metadata; the git tag itself is only created when the draft is published, so an unpublished draft can be edited or deleted without leaving a tag behind.
 
 | Example dispatch | Git tag | Release title | Artifact |
 | ---------------- | ------- | ------------- | -------- |
@@ -76,13 +56,8 @@ The release is created as a draft; review and publish it from the GitHub release
 
 ## Cutting a release
 
-1. **Pick the next version** per the
-   [Versioning Scheme](../running_tests/releases.md#versioning-scheme) for the feature you're
-   releasing (e.g. the next `tests` release after `tests@v24.1.0` is `tests@v24.1.1` for a
-   non-breaking/new-tests bump, or `tests@v24.2.0` for a consensus-breaking spec change).
-2. **Dispatch the workflow** from the
-   [Actions tab](https://github.com/ethereum/execution-specs/actions/workflows/release_fixtures.yaml)
-   or via the CLI:
+1. **Pick the next version** per the [Versioning Scheme](../running_tests/releases.md#versioning-scheme) for the feature you're releasing (e.g. the next `tests` release after `tests@v24.1.0` is `tests@v24.1.1` for a non-breaking/new-tests bump, or `tests@v24.2.0` for a consensus-breaking spec change).
+2. **Dispatch the workflow** from the [Actions tab](https://github.com/ethereum/execution-specs/actions/workflows/release_fixtures.yaml) or via the CLI:
 
    ```bash
    gh workflow run release_fixtures.yaml -f feature=tests -f version=v24.1.1
@@ -90,20 +65,11 @@ The release is created as a draft; review and publish it from the GitHub release
    gh workflow run release_fixtures.yaml -f feature=bal-devnet -f version=v7.0.0 -f branch=devnets/bal/7
    ```
 
-3. **Wait for the build to succeed.** On success the workflow creates the
-   `tests-<feature>@vX.Y.Z` tag on the target commit and drafts the GitHub release with the
-   fixture tarball attached. If any job fails, no tag or release is created — fix the cause
-   and re-dispatch.
-4. **Review and publish the draft.** Open the draft on the
-   [releases page](https://github.com/ethereum/execution-specs/releases), check the
-   auto-generated notes (anchored at the prior release on the same feature via
-   `--notes-start-tag`), and click *Publish release* when ready.
+3. **Wait for the build to succeed.** On success the workflow drafts the GitHub release with the fixture tarball attached. If any job fails, no release is drafted: fix the cause and re-dispatch.
+4. **Review and publish the draft.** Open the draft on the [releases page](https://github.com/ethereum/execution-specs/releases), check the auto-generated notes (anchored at the prior release on the same feature via `--notes-start-tag`), and click *Publish release* when ready. Publishing creates the `tests-<feature>@vX.Y.Z` tag on the target commit; until then a mispicked version can be fixed by editing the draft, with no stray tag to delete.
 
 !!! tip "Release features opt into all fixture formats via `feature.yaml`"
-    Tarball output (`.tar.gz`) does not by itself include the pre-allocation group formats
-    (`BlockchainEngineXFixture`, `BlockchainEngineStatefulFixture`). A release feature
-    requests them by adding `--generate-all-formats` to its `fill-params` in
-    `.github/configs/feature.yaml`:
+    Tarball output (`.tar.gz`) does not by itself include the pre-allocation group formats (`BlockchainEngineXFixture`, `BlockchainEngineStatefulFixture`). A release feature requests them by adding `--generate-all-formats` to its `fill-params` in `.github/configs/feature.yaml`:
     ```console
     # .tar.gz no longer auto-enables all formats (changed in #2702); request
     # them explicitly with --generate-all-formats
@@ -112,4 +78,26 @@ The release is created as a draft; review and publish it from the GitHub release
 
 ## Nightly fill
 
-The same workflow also runs on a nightly schedule (02:00 UTC) as a release rehearsal: it fills the mainnet `tests` feature (all tests, slow included, all fixture formats, up to the latest mainnet fork — dev forks are not included) through the exact release pipeline, but stops after `combine`, so no tag or release is created. Each run uploads the `fixtures_tests` workflow artifact (containing `fixtures.tar.gz`) with a 5-day retention: a rotating, always-available build of the mainnet fixtures, effectively a `tests@` release candidate on demand. A scheduled run skips itself when there are no new commits since the last nightly that actually filled — a skipped or failed nightly never advances that baseline, so no commit slips through unfilled. A quiet stretch without commits still re-fills once the last fill is four days old, or its artifact is gone, so a live artifact always exists within the five-day retention.
+The same workflow also runs on a nightly schedule (02:00 UTC) as a release rehearsal: it fills the mainnet `tests` feature (all tests, slow included, all fixture formats, up to the latest mainnet fork — dev forks are not included) through the exact release pipeline, but stops after `combine`, so no tag or release is created. Each run uploads a `fixtures_<commit>` workflow artifact (short hash of the built commit, containing `fixtures.tar.gz`) with a 5-day retention: a rotating, always-available build of the mainnet fixtures, effectively a `tests@` release candidate on demand. A scheduled run skips itself when there are no new commits since the last nightly that actually filled — a skipped or failed nightly never advances that baseline, so no commit slips through unfilled. A quiet stretch without commits still re-fills once the last fill is four days old, or its artifact is gone, so a live artifact always exists within the five-day retention.
+
+## Cached releases
+
+A `tests@` release can reuse the newest nightly artifact instead of refilling: tick the `cached` checkbox in the dispatch UI, or pass the flag on the CLI:
+
+```bash
+gh workflow run release_fixtures.yaml -f feature=tests -f version=vX.Y.Z -f cached=true
+# or release the nightly built at a specific commit (implies cached):
+gh workflow run release_fixtures.yaml -f feature=tests -f version=vX.Y.Z -f commit=<hash>
+```
+
+The `build` and `combine` jobs are skipped; the `release` job downloads the `fixtures_<commit>` artifact from the newest nightly run that actually filled — or, with the `commit` input, from the nightly built at that commit — and drafts the same release a fresh fill would produce, targeted at the exact commit the nightly built, so publishing it creates the `tests@vX.Y.Z` tag on that commit. The whole run takes minutes on a hosted runner. Review and publish the draft exactly as in [Cutting a release](#cutting-a-release).
+
+The cached path's validation (unit-tested in [`resolve_cached_release.py`](https://github.com/ethereum/execution-specs/blob/master/.github/scripts/resolve_cached_release.py)) fails fast when:
+
+- the `feature` is not `tests`, or a `branch` is given (the nightly fills the default branch);
+- the `version` is not `vX.Y.Z` or does not exceed the newest existing `tests@` tag;
+- no nightly run with a live `fixtures_<commit>` artifact exists — or none matching the `commit` input; the error lists the reusable nightlies (artifacts are retained for five days: past that, dispatch a fresh fill);
+- the resolved nightly does not contain the newest existing `tests@` release (a cached release must never regress content; re-releasing the identical commit is allowed);
+- the nightly's commit is not an ancestor of the current default branch head.
+
+A cached release contains exactly what the resolved nightly filled: commits that landed after it are **not** included, and the run's step summary lists them so the releaser can decide between the cached artifact and a fresh fill.

From 31b87b2116441761491c96328bf1250c53d06c03 Mon Sep 17 00:00:00 2001
From: danceratopz <danceratopz@gmail.com>
Date: Wed, 15 Jul 2026 20:35:34 +0200
Subject: [PATCH 13/14] fix(ci): paginate the tests@ tag listing for cached
 releases

The cached-release resolver read only the first page of
git/matching-refs/tags/tests@ (30 refs). The listing is ordered by
ref name, not version (tests@v9... sorts after tests@v20...), so once
more than 30 tags exist the version-monotonicity and no-regression
checks could baseline on a stale tag. Fetch every page with
--paginate --slurp and flatten before taking the maximum.

The canned tag response in the unit tests now spans two pages so
every test exercises the flattening.
---
 .github/scripts/resolve_cached_release.py     | 24 +++++++++++++++----
 .github/scripts/tests/test_release_scripts.py | 23 +++++++++++-------
 2 files changed, 34 insertions(+), 13 deletions(-)

diff --git a/.github/scripts/resolve_cached_release.py b/.github/scripts/resolve_cached_release.py
index b2f12431784..6c8f9450133 100644
--- a/.github/scripts/resolve_cached_release.py
+++ b/.github/scripts/resolve_cached_release.py
@@ -75,10 +75,16 @@ def fail(message: str) -> NoReturn:
     sys.exit(1)
 
 
-def gh_api(path: str) -> str:
-    """Return the stdout of `gh api <path>`, exiting non-zero on error."""
+def gh_api(path: str, paginate: bool = False) -> str:
+    """
+    Return the stdout of `gh api <path>`, exiting non-zero on error.
+
+    With *paginate*, follow the Link header through every page and
+    return a JSON array of per-page responses (`--slurp`).
+    """
+    flags = ["--paginate", "--slurp"] if paginate else []
     result = subprocess.run(
-        ["gh", "api", path], capture_output=True, text=True
+        ["gh", "api", *flags, path], capture_output=True, text=True
     )
     if result.returncode != 0:
         print(f"Error: gh api {path} failed:", file=sys.stderr)
@@ -113,10 +119,18 @@ def newest_tests_tag(repository: str) -> str:
     The `tests@` ref prefix cannot match any other feature's tags
     (those are namespaced `tests-<feature>@`), so every match is a
     mainnet tests release.
+
+    The listing is paginated in ref-name order, not version order
+    (`tests@v9...` sorts after `tests@v20...`), so every page must be
+    fetched before taking the maximum.
     """
-    refs = json.loads(
-        gh_api(f"repos/{repository}/git/matching-refs/tags/tests@")
+    pages = json.loads(
+        gh_api(
+            f"repos/{repository}/git/matching-refs/tags/tests@",
+            paginate=True,
+        )
     )
+    refs = [ref for page in pages for ref in page]
     tags = [ref["ref"].removeprefix("refs/tags/") for ref in refs]
     versioned = [
         (parse_version(tag.removeprefix("tests@")), tag)
diff --git a/.github/scripts/tests/test_release_scripts.py b/.github/scripts/tests/test_release_scripts.py
index 0aebb23915b..44e6dbcab77 100644
--- a/.github/scripts/tests/test_release_scripts.py
+++ b/.github/scripts/tests/test_release_scripts.py
@@ -192,14 +192,16 @@ def test_known_evm_passes(self):
 
 # Fake `gh` served from PATH: answers the API calls the commit-check
 # and cached-release scripts make with canned JSON from env vars, and
-# fails loudly on any other (or unconfigured) call. Per-run artifact
-# responses come from `FAKE_GH_ARTIFACTS_<run_id>`, falling back to
-# `FAKE_GH_ARTIFACTS`.
+# fails loudly on any other (or unconfigured) call. The API path is
+# the last argument (flags such as `--paginate --slurp` may precede
+# it). Per-run artifact responses come from
+# `FAKE_GH_ARTIFACTS_<run_id>`, falling back to `FAKE_GH_ARTIFACTS`.
 FAKE_GH = """#!/usr/bin/env bash
-case "$2" in
+path="${@: -1}"
+case "$path" in
   *actions/workflows*) response="$FAKE_GH_RUNS" ;;
   */artifacts)
-    run_id="${2##*/runs/}"
+    run_id="${path##*/runs/}"
     run_id="${run_id%%/*}"
     var="FAKE_GH_ARTIFACTS_${run_id}"
     response="${!var:-$FAKE_GH_ARTIFACTS}"
@@ -403,11 +405,16 @@ def test_gh_failure_fails_the_check(self, tmp_path):
 # Canned responses for the cached-release script. Unlike the commit
 # check, it matches artifacts by the commit-derived
 # `fixtures_<short sha>` name, so the canned listings are built
-# per head SHA.
+# per head SHA. The tag listing is fetched with `--paginate --slurp`
+# (a JSON array of pages); spreading the refs over two pages makes
+# every test exercise the page flattening.
 TESTS_TAGS = json.dumps(
-    [{"ref": "refs/tags/tests@v3.1.2"}, {"ref": "refs/tags/tests@v4.0.0"}]
+    [
+        [{"ref": "refs/tags/tests@v3.1.2"}],
+        [{"ref": "refs/tags/tests@v4.0.0"}],
+    ]
 )
-NO_TAGS = "[]"
+NO_TAGS = "[[]]"
 UP_TO_DATE = json.dumps({"status": "identical", "commits": []})
 
 

From 0359068fbbe8c2477c0fdf214398199a09e0d887 Mon Sep 17 00:00:00 2001
From: danceratopz <danceratopz@gmail.com>
Date: Wed, 15 Jul 2026 22:50:21 +0200
Subject: [PATCH 14/14] chore(tooling): stop pytest-xdist warning on
 non-numeric worker env var

just bakes PYTEST_XDIST_AUTO_NUM_WORKERS into the -n value at parse
time, but pytest-xdist also reads the same env var as a numeric
worker-count override in -n auto mode, so transporting "auto"
through it made every fill and test run warn:

    UserWarning: PYTEST_XDIST_AUTO_NUM_WORKERS is not a number:
    {env_var!r}. Ignoring it.

The warning is truthful (xdist falls back to psutil CPU detection
either way), so export the env var empty to child processes: xdist
skips empty values silently, and numeric values never consult the
env var because they produce a plain -n N.
---
 Justfile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Justfile b/Justfile
index dde18b56c59..4e6a97508e5 100644
--- a/Justfile
+++ b/Justfile
@@ -10,6 +10,11 @@ list:
 root := justfile_directory()
 output_dir := root / ".just"
 xdist_workers := env("PYTEST_XDIST_AUTO_NUM_WORKERS", "6")
+
+# The env var's job ends with the `-n` value above; export it empty so
+# pytest-xdist, which reads it as a numeric worker-count override in
+# `-n auto` mode, does not warn on non-numeric values such as "auto".
+export PYTEST_XDIST_AUTO_NUM_WORKERS := ""
 evm_bin := env("EVM_BIN", "evm")
 latest_fork := "Amsterdam"