central_systest_blobs: move blobs.json storage out of git, into GCS

[dorimedini-starkware]

No description provided.

[reviewable-StarkWare]

This change is 

[dorimedini-starkware]

• starknet_api: add and use StateRoots::EMPTY #13980
• central_systest_blobs: add some invokes #13978
• central_systest_blobs: support reverting invokes #13977
• central_systest_blobs: implement invoke from deploy function for code sharing #13976
• central_systest_blobs: deploy test contract(s) #13975
• central_systest_blobs: declare the test contract #13974
• central_systest_blobs: expect operator and fee token addresses #13973
• central_systest_blobs: deploy token contract #13972
• central_systest_blobs: sort state diff in preconfirmed block #13971
• central_systest_blobs: deploy operator account #13970
• central_systest_blobs: initial block production #13969
• central_systest_blobs: sort hashsets when dumping #13968
• central_systest_blobs: implement blob creation from blocks #13967
• central_systest_blobs: implement block production, given txs #13966
• blockifier: implement conversion from commitment state diff to state maps #13965
• central_systest_blobs: implement preconfirmed block creation #13964
• central_systest_blobs: first two bootstrap declares #13963
• central_systest_blobs: refactor skeleton into structured factory #13962
• central_systest_blobs: move blobs.json storage out of git, into GCS #13946 👈 (View in Graphite)
• apollo_consensus_orchestrator: add Deserialize for testing #13945
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Artifacts upload workflows:

• Started at 2026-05-03T09:13:11Z
• Started at 2026-05-03T09:17:31Z
• Started at 2026-05-03T09:27:40Z
• Started at 2026-05-03T10:07:33Z
• Started at 2026-05-03T10:12:00Z
• Started at 2026-05-03T10:25:32Z
• Started at 2026-05-03T12:36:02Z
• Started at 2026-05-03T13:09:16Z
• Started at 2026-05-03T14:13:57Z
• Started at 2026-05-03T15:44:17Z
• Started at 2026-05-03T15:44:54Z
• Started at 2026-05-03T15:50:41Z
• Started at 2026-05-03T16:01:48Z
• Started at 2026-05-04T09:42:38Z
• Started at 2026-05-04T09:52:52Z
• Started at 2026-05-05T11:04:15Z

[cursor]

PR Summary

Medium Risk
Introduces an external dependency (GCS) into the regression test and CI via new auth/secret requirements, so failures can come from credentials, network, or object-versioning behavior rather than code changes.

Overview
Moves systest blob fixtures out of git and into GCS. The central_systest_blobs regression test now fetches the expected blobs.json from a GCS bucket keyed by a tracked generation, and in UPDATE_EXPECT mode uploads a new generation (without overwriting existing objects) and updates resources/blob_file_generation.

CI is updated to support this. The run-tests GitHub Actions job now authenticates to Google Cloud using SYSTEST_BLOBS_READ_ACCESS_KEY before running tests, and the crate adds google-cloud-storage/http (plus testing features/deps adjustments) to support the new GCS-based workflow.

^{Reviewed by Cursor Bugbot for commit 42786bd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[dorimedini-starkware]

@dorimedini-starkware resolved 1 discussion.
Reviewable status: 0 of 7 files reviewed, all discussions resolved (waiting on idan-starkware and nimrod-starkware).

[nimrod-starkware]

@nimrod-starkware reviewed 4 files and all commit messages, and made 1 comment.
Reviewable status: 4 of 7 files reviewed, 1 unresolved discussion (waiting on dorimedini-starkware and idan-starkware).

---

crates/central_systest_blobs/src/cende_blob_regression_test.rs line 60 at r4 (raw file):

        .parse()
        .unwrap()
}

what is the ID for the first time? how do you store the json for the first time?

Code quote:

fn current_generation() -> usize {
    let path = current_dir().unwrap().join(BLOBS_GENERATION_FILE);
    fs::read_to_string(path.clone())
        .unwrap_or_else(|error| panic!("Failed to read file {path:?}: {error}"))
        .trim()
        .parse()
        .unwrap()
}

[dorimedini-starkware]

@dorimedini-starkware made 1 comment.
Reviewable status: 4 of 8 files reviewed, 1 unresolved discussion (waiting on idan-starkware and nimrod-starkware).

---

crates/central_systest_blobs/src/cende_blob_regression_test.rs line 60 at r4 (raw file):

Previously, nimrod-starkware wrote…

what is the ID for the first time? how do you store the json for the first time?

started 0, then i ran the test with UPDATE_EXPECT=1, the JSON was pushed to GCS with ID 1.

[dorimedini-starkware]

@dorimedini-starkware made 1 comment.
Reviewable status: 2 of 8 files reviewed, 2 unresolved discussions (waiting on idan-starkware and nimrod-starkware).

---

crates/central_systest_blobs/src/cende_blob_regression_test.rs line 240 at r6 (raw file):

    };
    Client::new(client_config)
}

@idan-starkware WDYT of this?

Code quote:

async fn gcs_client() -> Client {
    // Try ADC first (CI service accounts, or `gcloud auth application-default login`).
    // Fall back to user credentials from `gcloud auth login`.
    let client_config = if let Ok(config) = ClientConfig::default().with_auth().await {
        config
    } else {
        let account = String::from_utf8(
            std::process::Command::new("gcloud")
                .args(["config", "get-value", "account"])
                .output()
                .expect("failed to run `gcloud config get-value account`")
                .stdout,
        )
        .expect("gcloud output is not UTF-8")
        .trim()
        .to_string();
        let home = std::env::var("HOME").expect("HOME not set");
        let creds_path = format!("{home}/.config/gcloud/legacy_credentials/{account}/adc.json");
        let creds = google_cloud_auth::credentials::CredentialsFile::new_from_file(creds_path)
            .await
            .expect("Failed to load gcloud user credentials. Run `gcloud auth login`.");
        ClientConfig::default()
            .with_credentials(creds)
            .await
            .expect("Failed to create GCS client config. Did you run `gcloud auth login`?")
    };
    Client::new(client_config)
}

[dorimedini-starkware]

@dorimedini-starkware reviewed 1 file.
Reviewable status: 2 of 8 files reviewed, 2 unresolved discussions (waiting on idan-starkware and nimrod-starkware).

[dorimedini-starkware]

@dorimedini-starkware resolved 1 discussion.
Reviewable status: 1 of 8 files reviewed, 1 unresolved discussion (waiting on idan-starkware and nimrod-starkware).

[nimrod-starkware]

@nimrod-starkware made 1 comment and resolved 1 discussion.
Reviewable status: 1 of 8 files reviewed, 1 unresolved discussion (waiting on dorimedini-starkware and idan-starkware).

---

crates/central_systest_blobs/src/cende_blob_regression_test.rs line 238 at r12 (raw file):

        }
    }
    next_generation

Why isnt it guaranteed that next_generation is free?

Code quote:

    let mut next_generation = current_generation() + 1;
    loop {
        match fetch_raw_blobs_at_generation(client, next_generation).await {
            Ok(_) => next_generation += 1,
            Err(GcsError::Response(ErrorResponse { code: GCS_ERROR_CODE_NOT_FOUND, .. })) => break,
            Err(GcsError::HttpClient(error))
                if error.status() == Some(http::StatusCode::NOT_FOUND) =>
            {
                break;
            }
            Err(e) => panic!("Failed to fetch blobs at generation {next_generation}: {e}"),
        }
    }
    next_generation

[dorimedini-starkware]

@dorimedini-starkware made 1 comment.
Reviewable status: 1 of 8 files reviewed, 1 unresolved discussion (waiting on idan-starkware and nimrod-starkware).

---

crates/central_systest_blobs/src/cende_blob_regression_test.rs line 238 at r12 (raw file):

Previously, nimrod-starkware wrote…

Why isnt it guaranteed that next_generation is free?

say you have branches A->B->main.
all are currently in generation X.
on A you make some changes, and you need to iterate a bit until it works, so when you're done you're at generation X+7.
then you checkout B and realize you still need to regenerate the blobs.
If I don't check for next available slot, fixing on B will end up with generation X+1 instead of X+8

[nimrod-starkware]

@nimrod-starkware reviewed 5 files and all commit messages, made 1 comment, and resolved 1 discussion.
Reviewable status: 6 of 8 files reviewed, all discussions resolved (waiting on idan-starkware).

[dorimedini-starkware]

@dorimedini-starkware reviewed 5 files and all commit messages.
Reviewable status: 6 of 8 files reviewed, all discussions resolved (waiting on idan-starkware).

[dorimedini-starkware]

@dorimedini-starkware reviewed 2 files.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on idan-starkware).