Merge branch 'master' into sync

# Conflicts:
#	.github/workflows/ci.yml
#	.gitignore
#	README.md
#	ci/ci.sh
#	src/ctime_tests.c
#	src/tests.c

.github/actions/install-homebrew-valgrind/action.yml

@@ -5,6 +5,7 @@ runs:
   steps:
     - run: |
         brew tap LouisBrunner/valgrind
+        brew trust --formula LouisBrunner/valgrind/valgrind
         brew fetch --HEAD LouisBrunner/valgrind/valgrind
         echo "CI_HOMEBREW_CELLAR_VALGRIND=$(brew --cellar valgrind)" >> "$GITHUB_ENV"
       shell: bash
@@ -16,7 +17,7 @@ runs:
         cat valgrind_fingerprint
       shell: bash
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v5
       id: cache
       with:
         path: ${{ env.CI_HOMEBREW_CELLAR_VALGRIND }}

.github/actions/print-logs/action.yml

@@ -0,0 +1,34 @@
+name: "Print logs"
+description: "Print the log files produced by ci/ci.sh"
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      run: |
+        # Print the log files produced by ci/ci.sh
+
+        # Helper functions
+        group() {
+            title=$1
+            echo "::group::$title"
+        }
+        endgroup() {
+            echo "::endgroup::"
+        }
+        cat_file() {
+            file=$1
+            group "$file"
+            cat "$file"
+            endgroup
+        }
+
+        # Print all *.log files
+        shopt -s nullglob
+        for file in *.log; do
+            cat_file "$file"
+        done
+
+        # Print environment
+        group "CI env"
+        env
+        endgroup

.github/actions/run-in-docker-action/action.yml

@@ -4,37 +4,39 @@ inputs:
   dockerfile:
     description: 'A Dockerfile that defines an image'
     required: true
-  tag:
-    description: 'A tag of an image'
+  scope:
+    description: 'A cached image scope'
     required: true
   command:
     description: 'A command to run in a container'
-    required: false
-    default: ./ci/ci.sh
+    required: true
 runs:
   using: "composite"
   steps:
-    - uses: docker/setup-buildx-action@v3
+    - uses: docker/setup-buildx-action@v4
 
-    - uses: docker/build-push-action@v5
+    - uses: docker/build-push-action@v7
       id: main_builder
       continue-on-error: true
       with:
         context: .
         file: ${{ inputs.dockerfile }}
-        tags: ${{ inputs.tag }}
         load: true
-        cache-from: type=gha
+        cache-from: type=gha,scope=${{ inputs.scope }}
 
-    - uses: docker/build-push-action@v5
+    - uses: docker/build-push-action@v7
       id: retry_builder
       if: steps.main_builder.outcome == 'failure'
       with:
         context: .
         file: ${{ inputs.dockerfile }}
-        tags: ${{ inputs.tag }}
         load: true
-        cache-from: type=gha
+        cache-from: type=gha,scope=${{ inputs.scope }}
+
+    - # Workaround for https://github.com/google/sanitizers/issues/1614 .
+      # The underlying issue has been fixed in clang 18.1.3.
+      run: sudo sysctl -w vm.mmap_rnd_bits=28
+      shell: bash
 
     - # Tell Docker to pass environment variables in `env` into the container.
       run: >
@@ -42,7 +44,8 @@ runs:
           $(echo '${{ toJSON(env) }}' | jq -r 'keys[] | "--env \(.) "') \
           --volume ${{ github.workspace }}:${{ github.workspace }} \
           --workdir ${{ github.workspace }} \
-          ${{ inputs.tag }} bash -c "
+          ${{ case(steps.main_builder.outcome == 'success', steps.main_builder.outputs.imageid, steps.retry_builder.outputs.imageid) }} \
+          bash -c "
             git config --global --add safe.directory ${{ github.workspace }}
             ${{ inputs.command }}
           "

.github/workflows/sync.yml

@@ -0,0 +1,61 @@
+name: Upstream Sync
+
+on:
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+jobs:
+  sync-upstream:
+    runs-on: ubuntu-latest
+    env:
+      UPSTREAM: "https://github.com/bitcoin-core/secp256k1.git"
+      BASE_BRANCH: "master"
+      UPSTREAM_REF: "upstream/master"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.SYNC_PAT }}
+
+      - name: Configure Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Fetch upstream
+        run: |
+          git remote add upstream ${{ env.UPSTREAM }}
+          git fetch upstream
+          gh repo set-default ${{ github.repository }}
+        env:
+          GH_TOKEN: ${{ secrets.SYNC_PAT }}
+
+      - name: Run sync-upstream.sh
+        id: sync
+        run: |
+          OUTPUT=$(./contrib/sync-upstream.sh --switch "${{ env.BASE_BRANCH }}" "${{ env.UPSTREAM_REF }}" 2>&1) || { echo "$OUTPUT"; exit 1; }
+          echo "$OUTPUT"
+          if echo "$OUTPUT" | grep -qv "^No merge commits"; then
+            echo "newcommits=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Skipping further workflow steps."
+          fi
+
+      - name: Push sync branch
+        id: push
+        if: steps.sync.outputs.newcommits == 'true'
+        run: |
+          if git push -u origin HEAD; then
+            echo "pushed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Skipping further workflow steps."
+          fi
+
+      - name: Create pull request
+        if: steps.sync.outputs.newcommits == 'true' && steps.push.outputs.pushed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.SYNC_PAT }}
+        run: ./gh-pr-create.sh