ci: unify dependency profiles across PR and nightly runs

[galargh]

This PR expands the version combinations we test foc-devnet with.

The general setup is to test in 3 modes/profiles:

• default: pinned version numbers of all dependencies (in this context, that means: Lotus, Curio, filecoin-services, Synapse SDK, and filecoin-pin)
• stability: latest releases of the dependencies (used in nightly builds)
• frontier: latest commits of the dependencies (used in nightly builds)

To track all of this, I introduce a JSON dependency manifest (ci/dependency-profiles.json) which describes these profiles: what version to use, where to get it from (git vs npm), etc.

I also fixed the dependency-version-dependent cache setup and updated the test scenarios to use the dependencies tracked by the manifest.

Testing

• Run the test scenarios on a PR on this branch - https://github.com/FilOzone/foc-devnet/actions/runs/28303973070/job/83856996242?pr=128
  • Success
• Run the nightly tests from this branch - https://github.com/FilOzone/foc-devnet/actions/runs/28303344010
  • Success

TODO

• When installing filecoin-pin, pin multiformats to the version that synapse-sdk accepts.

[BigLep]

@rvagg : I know you have been doing various work here. It may be good to get quick signal if this is moving in the same direction you have been.

[galargh]

Can we add a pnpm-lockfile to https://github.com/FilOzone/synapse-sdk/? This would make the builds here more deterministic.

[Copilot]

Pull request overview

This PR introduces a dependency-profile system for CI so PR and nightly runs can test foc-devnet against pinned, stable-release, and latest-commit variants of key dependencies, while producing resolved, immutable metadata for caching and reporting.

Changes:

• Added a dependency profiles manifest (ci/dependency-profiles.json) plus a resolver/verifier script to resolve profiles to immutable commits/versions and emit CI outputs/env.
• Updated CI workflows to use the profile resolver for foc-devnet init arguments and to base caches on verified Lotus/Curio checkouts.
• Updated scenarios to consume resolved dependency metadata (Synapse SDK + filecoin-pin) and to include resolved dependency information in scenario reports; added unit tests for the resolver and scenario dependency wiring.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/tests/test_scenario_dependencies.py	Adds tests ensuring scenario helpers consume resolved metadata correctly (table rendering, synapse checkout, filecoin-pin setup paths).
scripts/tests/test_resolve_ci_dependencies.py	Adds unit tests for tag selection, npm resolution, override validation, init arg generation, and checkout verification outputs.
scripts/resolve-ci-dependencies.py	New resolver/verifier CLI for dependency profiles; emits init args + env vars and verifies cloned checkouts for cache keys.
scripts/lint.sh	Expands Black formatting scope to scripts/ and runs the new Python unit tests.
scenarios/test_multi_copy_upload.py	Makes filecoin-pin install/build depend on resolved metadata; supports npm vs git source and propagates overrides.
scenarios/synapse.py	Uses resolved metadata to clone/check out a specific synapse-sdk commit and applies pnpm workspace overrides.
scenarios/report.py	Switches to --notty and adds a “Resolved dependencies” section to scenario reports.
scenarios/dependencies.py	New helper module to load resolved CI dependency metadata and render it as a markdown table.
README_ADVANCED.md	Documents dependency profile resolution and the env vars exposed to scenarios.
ci/README.md	Documents the dependency profile manifest, strategies, overrides policy, and current consumers.
ci/dependency-profiles.json	Adds the canonical manifest defining default/stability/frontier selections for Lotus/Curio/filecoin-services/synapse-sdk/filecoin-pin.
.github/workflows/ci_run.yml	Replaces init_flags with profile-based resolution, adds verification step, and updates caching keys to depend on verified checkouts.
.github/workflows/ci_pull_request.yml	Switches PR CI to call ci_run.yml with profile: default.
.github/workflows/ci_nightly.yml	Switches nightly matrix runs to pass profile: stability / profile: frontier instead of init flags.

[BigLep]

My worry is we don't have a forcing function to keep default updated. Maybe it should be a PR comment (e.g., "This CI run isn't using the latest stable releases. Ensure this is intentional, and otherwise consider updating as part of this PR.")

Lets have @rvagg at least provide feedback on the direction to make sure it isn't counter to his thinking, even if he assigns someone else to review.