refactor(ci): decouple from upstream Parity infrastructure

Replace Parity-specific infrastructure dependencies with Pezkuwi's own:
- S3 release uploads → GitHub Releases (gh CLI)
- parity-zombienet runner labels → pezkuwi-runner
- Grafana/Loki log URLs → disabled (use GH artifacts)
- Matrix notifications → disabled (pending Pezkuwi Matrix)
- paritytech issue links → pezkuwi tracking issues
- paritytech Docker image refs → pezkuwi-sdk-frame in cmd.py
- Add mirror-ci-image.yml workflow for GHCR image mirroring
- Document upstream shared tools (resolc, try-runtime, evm-test-suite)

.github/actions/zombienet-sdk/action.yml

@@ -95,7 +95,7 @@ runs:
         else
           export RUN_IN_CI=1
           # no need to check other runner variables. for k8s they shall store the same value
-          if [[ $ZOMBIENET_SDK_DEFAULT_RUNNER == "parity-zombienet" ]]; then
+          if [[ $ZOMBIENET_SDK_DEFAULT_RUNNER == "pezkuwi-runner" ]]; then
             export ZOMBIE_K8S_CI_NAMESPACE=$(cat /data/namespace)
           fi
         fi

.github/actions/zombienet/action.yml

@@ -93,7 +93,7 @@ runs:
             "$TEST_DEFINITION"
         else
           # no need to check other runner variables. for k8s they shall store the same value
-          if [[ $ZOMBIENET_DEFAULT_RUNNER == "parity-zombienet" ]]; then
+          if [[ $ZOMBIENET_DEFAULT_RUNNER == "pezkuwi-runner" ]]; then
             export ZOMBIE_K8S_CI_NAMESPACE=$(cat /data/namespace)
           fi
 

.github/scripts/check-each-crate.py

@@ -3,7 +3,7 @@
 # A script that checks each workspace crate individually.
 # It's relevant to check workspace crates individually because otherwise their compilation problems
 # due to feature misconfigurations won't be caught, as exemplified by
-# https://github.com/paritytech/substrate/issues/12705
+# https://github.com/pezkuwichain/pezkuwi-sdk/issues/163 (upstream tracking)
 #
 # `check-each-crate.py target_group groups_total`
 #

.github/scripts/cmd/cmd.py

@@ -21,7 +21,7 @@ runtimeNames = list(map(lambda x: x['name'], runtimesMatrix))
 common_args = {
     '--quiet': {"action": "store_true", "help": "Won't print start/end/failed messages in PR"},
     '--clean': {"action": "store_true", "help": "Clean up the previous bot's & author's comments in PR"},
-    '--image': {"help": "Override docker image '--image docker.io/paritytech/ci-unified:latest'"},
+    '--image': {"help": "Override docker image '--image ghcr.io/pezkuwichain/ci-unified:latest'"},
 }
 
 def print_and_log(message, output_file='/tmp/cmd/command_output.log'):
@@ -414,7 +414,7 @@ def main():
 
                 print(f'-- config: {config}')
                 if runtime == 'dev':
-                    # to support sub-modules (https://github.com/paritytech/command-bot/issues/275)
+                    # to support sub-modules
                     search_manifest_path = f"cargo metadata --locked --format-version 1 --no-deps | jq -r '.packages[] | select(.name == \"{pallet.replace('_', '-')}\") | .manifest_path'"
                     print(f'-- running: {search_manifest_path}')
                     manifest_path = os.popen(search_manifest_path).read()
@@ -427,9 +427,9 @@ def main():
                     print(f'-- package_dir: {package_dir}')
                     print(f'-- manifest_path: {manifest_path}')
                     output_path = os.path.join(package_dir, "src", "weights.rs")
-                    # TODO: we can remove once all pallets in dev runtime are migrated to polkadot-sdk-frame
+                    # TODO: we can remove once all pallets in dev runtime are migrated to pezkuwi-sdk-frame
                     try:
-                        uses_polkadot_sdk_frame = "true" in os.popen(f"cargo metadata --locked --format-version 1 --no-deps | jq -r '.packages[] | select(.name == \"{pallet.replace('_', '-')}\") | .dependencies | any(.name == \"polkadot-sdk-frame\")'").read()
+                        uses_polkadot_sdk_frame = "true" in os.popen(f"cargo metadata --locked --format-version 1 --no-deps | jq -r '.packages[] | select(.name == \"{pallet.replace('_', '-')}\") | .dependencies | any(.name == \"pezkuwi-sdk-frame\")'").read()
                         print(f'uses_polkadot_sdk_frame: {uses_polkadot_sdk_frame}')
                     # Empty output from the previous os.popen command
                     except StopIteration:

.github/scripts/common/lib.sh

@@ -92,11 +92,13 @@ structure_message() {
 
 # Post a message to a matrix room
 # body: '{body: "JSON string produced by structure_message"}'
-# room_id: !fsfSRjgjBWEWffws:matrix.parity.io
+# room_id: Pezkuwi project Matrix room
 # access_token: see https://matrix.org/docs/guides/client-server-api/
 # Usage: send_message $body (json formatted) $room_id $access_token
+# NOTE: Update the Matrix homeserver URL when Pezkuwi Matrix is set up
 send_message() {
-  curl -XPOST -d "$1" "https://m.parity.io/_matrix/client/r0/rooms/$2/send/m.room.message?access_token=$3"
+  echo "::warning::Matrix notification skipped - no Pezkuwi Matrix server configured yet"
+  # curl -XPOST -d "$1" "https://matrix.pezkuwi.io/_matrix/client/r0/rooms/$2/send/m.room.message?access_token=$3"
 }
 
 # Pretty-printing functions
@@ -144,7 +146,7 @@ has_runtime_changes() {
 # with only the bootnode specified and test whether that bootnode provides peers
 # The optional third argument is the index of the bootnode in the list of bootnodes, this is just used to pick an ephemeral
 # port for the node to run on. If you're only testing one, it'll just use the first ephemeral port
-# BOOTNODE: /dns/pezkuwi-connect-0.parity.io/tcp/443/wss/p2p/12D3KooWEPmjoRpDSUuiTjvyNDd8fejZ9eNWH5bE965nyBMDrB4o
+# BOOTNODE: Pezkuwi bootnode address (to be configured for mainnet)
 # CHAINSPEC_FILE: /path/to/pezkuwi.json
 check_bootnode(){
     BOOTNODE=$1
@@ -332,34 +334,10 @@ fetch_release_artifacts_from_s3() {
 }
 
 # Pass the name of the binary as input, it will
-# return the s3 base url
+# return the release download base URL (GitHub Releases)
 function get_s3_url_base() {
-    name=$1
+    # All binaries served from GitHub Releases
-    case $name in
+    printf "https://github.com/pezkuwichain/pezkuwi-sdk/releases/download"
-      pezkuwi | pezkuwi-execute-worker | pezkuwi-prepare-worker )
-        printf "https://releases.parity.io/pezkuwi"
-        ;;
-
-      pezkuwi-teyrchain)
-        printf "https://releases.parity.io/pezkuwi-teyrchain"
-        ;;
-
-      pezkuwi-omni-node)
-        printf "https://releases.parity.io/pezkuwi-omni-node"
-        ;;
-
-      chain-spec-builder)
-        printf "https://releases.parity.io/chain-spec-builder"
-        ;;
-
-      frame-omni-bencher)
-        printf "https://releases.parity.io/frame-omni-bencher"
-        ;;
-      *)
-        printf "UNSUPPORTED BINARY $name"
-        exit 1
-        ;;
-    esac
 }
 
 

.github/scripts/process-logs-zombienet.sh

@@ -4,8 +4,9 @@ set -euo pipefail
 # This script processes logs produced by nodes spawned using the zombienet-sdk framework.
 # The logs are prepared for upload as GitHub artifacts.
 # If Loki logging is available, the corresponding log URLs are also printed.
-# NOTE: P2838773B5F7DE937 is the loki.cicd until we switch to loki.zombienet
+# NOTE: Loki URL disabled - Pezkuwi does not use external Grafana.
-LOKI_URL_FOR_NODE='https://grafana.teleport.parity.io/explore?orgId=1&left=%7B%22datasource%22:%22P2838773B5F7DE937%22,%22queries%22:%5B%7B%22refId%22:%22A%22,%22datasource%22:%7B%22type%22:%22loki%22,%22uid%22:%22P2838773B5F7DE937%22%7D,%22editorMode%22:%22code%22,%22expr%22:%22%7Bzombie_ns%3D%5C%22{{namespace}}%5C%22,zombie_node%3D%5C%22{{podName}}%5C%22%7D%22,%22queryType%22:%22range%22%7D%5D,%22range%22:%7B%22from%22:%22{{from}}%22,%22to%22:%22{{to}}%22%7D%7D'
+# Zombienet logs are available as GitHub Actions artifacts.
+LOKI_URL_FOR_NODE=''
 
 LOKI_DIR_FOR_NATIVE_LOGS="/tmp/zombienet"
 

.github/scripts/release/release_lib.sh

@@ -118,9 +118,12 @@ set_pezkuwi_teyrchain_binary_version() {
 }
 
 
+# Upload release artifacts to GitHub Releases using gh CLI.
+# Pezkuwi SDK uses GitHub Releases instead of external S3 buckets.
+#
+# input: product, version, target
+# output: none
 upload_s3_release() {
-    alias aws='podman run --rm -it docker.io/paritytech/awscli -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_BUCKET aws'
-
     product=$1
     version=$2
     target=$3
@@ -129,78 +132,50 @@ upload_s3_release() {
     echo "Working on version:  $version "
     echo "Working on platform: $target "
 
-    URL_BASE=$(get_s3_url_base $product)
-
-    echo "Current content, should be empty on new uploads:"
-    aws s3 ls "s3://${URL_BASE}/${version}/${target}" --recursive --human-readable --summarize || true
-    echo "Content to be uploaded:"
     artifacts="release-artifacts/$target/$product/"
+    echo "Content to be uploaded:"
     ls "$artifacts"
-    aws s3 sync --acl public-read "$artifacts" "s3://${URL_BASE}/${version}/${target}"
+
-    echo "Uploaded files:"
+    # Upload each artifact to the GitHub Release
-    aws s3 ls "s3://${URL_BASE}/${version}/${target}" --recursive --human-readable --summarize
+    for file in "$artifacts"/*; do
-    echo "✅ The release should be at https://${URL_BASE}/${version}/${target}"
+      [ -f "$file" ] || continue
+      echo "Uploading: $file"
+      gh release upload "$version" "$file" --clobber || true
+    done
+
+    echo "✅ Release artifacts uploaded to https://github.com/pezkuwichain/pezkuwi-sdk/releases/tag/${version}"
 }
 
-# Upload runtimes artifacts to s3 release bucket
+# Upload runtimes artifacts to GitHub Releases.
 #
 # input: version (stable release tag e.g. pezkuwi-stable2412 or pezkuwi-stable2412-rc1)
 # output: none
 upload_s3_runtimes_release_artifacts() {
-  alias aws='podman run --rm -it docker.io/paritytech/awscli -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_BUCKET aws'
-
   version=$1
 
   echo "Working on version: $version "
 
-  echo "Current content, should be empty on new uploads:"
-  aws s3 ls "s3://releases.parity.io/pezkuwi/runtimes/${version}/" --recursive --human-readable --summarize || true
-  echo "Content to be uploaded:"
   artifacts="artifacts/runtimes/"
+  echo "Content to be uploaded:"
   ls "$artifacts"
-  aws s3 sync --acl public-read "$artifacts" "s3://releases.parity.io/pezkuwi/runtimes/${version}/"
+
-  echo "Uploaded files:"
+  # Create release if it doesn't exist
-  aws s3 ls "s3://releases.parity.io/pezkuwi/runtimes/${version}/" --recursive --human-readable --summarize
+  gh release view "$version" &>/dev/null || \
-  echo "✅ The release should be at https://releases.parity.io/pezkuwi/runtimes/${version}"
+    gh release create "$version" --title "$version" --notes "Runtime release $version" --draft
+
+  for file in "$artifacts"/*; do
+    [ -f "$file" ] || continue
+    echo "Uploading: $file"
+    gh release upload "$version" "$file" --clobber || true
+  done
+
+  echo "✅ Runtimes uploaded to https://github.com/pezkuwichain/pezkuwi-sdk/releases/tag/${version}"
 }
 
 
 # Pass the name of the binary as input, it will
-# return the s3 base url
+# return the GitHub release download base URL
 function get_s3_url_base() {
-    name=$1
+    # All binaries are now served from GitHub Releases
-    case $name in
+    printf "github.com/pezkuwichain/pezkuwi-sdk/releases/download"
-      pezkuwi | pezkuwi-execute-worker | pezkuwi-prepare-worker )
-        printf "releases.parity.io/pezkuwi"
-        ;;
-
-      pezkuwi-teyrchain)
-        printf "releases.parity.io/pezkuwi-teyrchain"
-        ;;
-
-      pezkuwi-omni-node)
-        printf "releases.parity.io/pezkuwi-omni-node"
-        ;;
-
-      chain-spec-builder)
-        printf "releases.parity.io/chain-spec-builder"
-        ;;
-
-      frame-omni-bencher)
-        printf "releases.parity.io/frame-omni-bencher"
-        ;;
-      substrate-node)
-        printf "releases.parity.io/substrate-node"
-        ;;
-      eth-rpc)
-        printf "releases.parity.io/eth-rpc"
-        ;;
-      subkey)
-        printf "releases.parity.io/subkey"
-        ;;
-      *)
-        printf "UNSUPPORTED BINARY $name"
-        exit 1
-        ;;
-    esac
 }

.github/workflows/check-runtime-migration.yml

@@ -85,6 +85,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Download CLI
+        # NOTE: try-runtime-cli is an upstream shared tool from paritytech/try-runtime-cli
         run: |
           curl -sL https://github.com/paritytech/try-runtime-cli/releases/download/v0.8.0/try-runtime-x86_64-unknown-linux-musl -o try-runtime
           chmod +x ./try-runtime

.github/workflows/mirror-ci-image.yml

@@ -0,0 +1,41 @@
+# Mirror upstream CI image to GHCR so we control our own build infrastructure.
+# Runs manually or when .github/env changes (new CI image version).
+name: Mirror CI Image
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths: [".github/env"]
+
+permissions:
+  packages: write
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Read source image from env file
+        id: source
+        run: |
+          SOURCE_IMAGE=$(grep '^IMAGE=' .github/env | cut -d'"' -f2)
+          TAG=$(echo "$SOURCE_IMAGE" | cut -d: -f2)
+          echo "source=$SOURCE_IMAGE" >> "$GITHUB_OUTPUT"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "Source: $SOURCE_IMAGE"
+
+      - name: Log in to GHCR
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Pull, tag, and push to GHCR
+        run: |
+          docker pull "${{ steps.source.outputs.source }}"
+          docker tag "${{ steps.source.outputs.source }}" "ghcr.io/pezkuwichain/ci-unified:${{ steps.source.outputs.tag }}"
+          docker push "ghcr.io/pezkuwichain/ci-unified:${{ steps.source.outputs.tag }}"
+          echo "Mirrored to ghcr.io/pezkuwichain/ci-unified:${{ steps.source.outputs.tag }}"

.github/workflows/release-reusable-rc-build.yml

@@ -205,6 +205,7 @@ jobs:
          run: brew install solidity
 
        - name: Install resolc
+         # NOTE: resolc is an upstream shared tool from paritytech/revive (EVM compiler)
          run: |
             VERSION="0.3.0"
             ASSET_URL="https://github.com/paritytech/revive/releases/download/v$VERSION/resolc-universal-apple-darwin"

.github/workflows/tests-evm.yml

@@ -34,6 +34,7 @@ jobs:
       - name: Update the Installed Python
         run: apt-get update && apt-get install -y python3-pip python3
       - name: Installing the Latest Resolc
+        # NOTE: resolc is an upstream shared tool from paritytech/revive (EVM compiler)
         run: |
           VERSION="0.5.0"
           ASSET_URL="https://github.com/paritytech/revive/releases/download/v$VERSION/resolc-x86_64-unknown-linux-musl"
@@ -119,6 +120,7 @@ jobs:
           cargo build --locked --release -p pez-revive-dev-node --bin pez-revive-dev-node
 
       - name: Checkout evm-tests
+        # NOTE: evm-test-suite is an upstream shared test suite from paritytech
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: paritytech/evm-test-suite

.github/workflows/tests-misc.yml

@@ -472,6 +472,7 @@ jobs:
           solc-select use 0.8.30
           solc --version
       - name: Install resolc
+        # NOTE: resolc is an upstream shared tool from paritytech/revive (EVM compiler)
         run: |
           source $HOME/.cargo/env
           VERSION="0.5.0"

.github/zombienet-env

@@ -1,23 +1,23 @@
 # zombienet settings
 ZOMBIENET_PROVIDER=native
 ZOMBIENET_IMAGE_FOR_NATIVE=docker.io/pezkuwichain/zombienet:v1.3.133
-ZOMBIENET_DEFAULT_RUNNER_FOR_NATIVE=parity-zombienet-native-default
+ZOMBIENET_DEFAULT_RUNNER_FOR_NATIVE=pezkuwi-runner
-ZOMBIENET_LARGE_RUNNER_FOR_NATIVE=parity-zombienet-native-large
+ZOMBIENET_LARGE_RUNNER_FOR_NATIVE=pezkuwi-runner
-ZOMBIENET_DEFAULT_RUNNER_FOR_NATIVE_PERSISTENT=parity-zombienet-native-default-persistent
+ZOMBIENET_DEFAULT_RUNNER_FOR_NATIVE_PERSISTENT=pezkuwi-runner
-ZOMBIENET_LARGE_RUNNER_FOR_NATIVE_PERSISTENT=parity-zombienet-native-large-persistent
+ZOMBIENET_LARGE_RUNNER_FOR_NATIVE_PERSISTENT=pezkuwi-runner
 ZOMBIENET_IMAGE_FOR_K8S=docker.io/pezkuwichain/zombienet:v1.3.133
-ZOMBIENET_RUNNER_FOR_K8S=parity-zombienet
+ZOMBIENET_RUNNER_FOR_K8S=pezkuwi-runner
 DEBUG=zombie,zombie::network-node,zombie::kube::client::logs
 
 # zombienet-sdk settings
 ZOMBIE_PROVIDER=native
-ZOMBIENET_SDK_IMAGE_FOR_NATIVE=docker.io/pezkuwichain/ci-unified:bullseye-1.84.1-2025-01-28-v202502131220
+ZOMBIENET_SDK_IMAGE_FOR_NATIVE=ghcr.io/pezkuwichain/ci-unified:bullseye-1.88.0-2025-06-27-v202511141243
-ZOMBIENET_SDK_DEFAULT_RUNNER_FOR_NATIVE=parity-zombienet-native-default
+ZOMBIENET_SDK_DEFAULT_RUNNER_FOR_NATIVE=pezkuwi-runner
-ZOMBIENET_SDK_LARGE_RUNNER_FOR_NATIVE=parity-zombienet-native-large
+ZOMBIENET_SDK_LARGE_RUNNER_FOR_NATIVE=pezkuwi-runner
-ZOMBIENET_SDK_DEFAULT_RUNNER_FOR_NATIVE_PERSISTENT=parity-zombienet-native-default-persistent
+ZOMBIENET_SDK_DEFAULT_RUNNER_FOR_NATIVE_PERSISTENT=pezkuwi-runner
-ZOMBIENET_SDK_LARGE_RUNNER_FOR_NATIVE_PERSISTENT=parity-zombienet-native-large-persistent
+ZOMBIENET_SDK_LARGE_RUNNER_FOR_NATIVE_PERSISTENT=pezkuwi-runner
 ZOMBIENET_SDK_IMAGE_FOR_K8S=docker.io/pezkuwichain/zombienet:v1.3.133
-ZOMBIENET_SDK_RUNNER_FOR_K8S=parity-zombienet
+ZOMBIENET_SDK_RUNNER_FOR_K8S=pezkuwi-runner
 RUST_LOG=info,zombienet_orchestrator=trace,cumulus_zombienet_sdk_helpers=debug
 
 # common settings