Skip to content

soldeer migration #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thedavidmeister merged 5 commits into from
May 14, 2026
Merged

soldeer migration #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
53dcb1a
soldeer migration
thedavidmeister May 14, 2026
74d7a9f
test: add prod tests for vendored Flare interfaces + apply fmt
thedavidmeister May 14, 2026
6a69720
test: expand prod coverage + regenerate pointers
thedavidmeister May 14, 2026
e69c31b
chore: bump rain.cli (aligns transitive rainix with direct one)
thedavidmeister May 14, 2026
63107e8
fix: move bytecode_hash/cbor_metadata out of [soldeer] scope
thedavidmeister May 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 25 additions & 18 deletions .github/workflows/git-clean.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,26 +1,33 @@
name: Git is clean
on: [push]

jobs:
git-clean:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: nixbuild/nix-quick-install-action@v30
with:
submodules: recursive
fetch-depth: 0

- uses: DeterminateSystems/nix-installer-action@main
- uses: DeterminateSystems/magic-nix-cache-action@main

# Build metas etc. required to do a correct pointer build.
- run: nix develop -c rain-flare-prelude

- run: nix develop -c forge script ./script/BuildPointers.sol

# Format the repo after generating pointers so that the pointer files are
# formatted too.
- run: nix develop -c forge fmt

# Check if the repo is clean after generating pointers and formatting.
- run: git diff --exit-code
nix_conf: |
keep-env-derivations = true
keep-outputs = true
- name: Restore and save Nix store
uses: nix-community/cache-nix-action@v6
with:
primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
restore-prefixes-first-match: nix-${{ runner.os }}-
gc-max-store-size-linux: 1G
- name: Install soldeer dependencies
if: hashFiles('soldeer.lock') != ''
run: nix develop github:rainlanguage/rainix#sol-shell -c forge soldeer install
- name: Regenerate meta files
run: nix run .#rain-flare-prelude
- name: Regenerate pointer artifacts
run: nix develop github:rainlanguage/rainix#sol-shell -c forge script ./script/BuildPointers.sol
- name: Format
run: nix develop github:rainlanguage/rainix#sol-shell -c forge fmt
- name: Assert committed artifacts match freshly built
run: |
if ! git diff --exit-code; then
echo "::error::Committed meta or pointer artifacts are stale. Regenerate and commit."
exit 1
fi
16 changes: 16 additions & 0 deletions .github/workflows/manual-sol-artifacts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
name: Manual sol artifacts
on:
workflow_dispatch:
inputs:
suite:
description: "The suite to deploy"
required: true
type: choice
options:
- flare-ftso-words
jobs:
deploy:
uses: rainlanguage/rainix/.github/workflows/rainix-manual-sol-artifacts.yaml@main
with:
suite: ${{ inputs.suite }}
secrets: inherit
53 changes: 0 additions & 53 deletions .github/workflows/manual-sol-artifacts.yml
View file
Open in desktop

This file was deleted.

8 changes: 8 additions & 0 deletions .github/workflows/publish-soldeer.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
name: Publish to Soldeer
on:
push:
tags: ["v*"]
jobs:
publish:
uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify all reusable workflow references are pinned (no branch/tag refs).
rg -nP '^\s*uses:\s*rainlanguage/rainix/\.github/workflows/.*@' .github/workflows \
  | sed -n 'p'
echo
echo "Any line ending with `@main` or `@v`* should be pinned to a full SHA."

Repository: rainlanguage/rain.flare

Length of output: 487

Pin reusable workflow to an immutable commit SHA.

Line 7 uses @main, which is mutable and can change behavior/security without changes in this repo. Pin to a full commit SHA for reproducibility and supply-chain safety. This issue affects multiple workflow files in the repository (.github/workflows/rainix-sol.yaml:5 and manual-sol-artifacts.yaml:13 also use @main).

Suggested change 
-    uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main
+    uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@<full_commit_sha>
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-soldeer.yaml at line 7, The reusable workflow
reference currently uses a mutable ref ("uses:
rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main"); change this
to pin a full commit SHA (replace "@main" with the repository commit SHA) so the
workflow is immutable and reproducible, and update every other workflow that
uses the same reusable-workflow reference to the same pinned SHA to keep them
consistent.

secrets: inherit
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

# First, let's find and read the workflow file
find . -name "publish-soldeer.yaml" -type f

Repository: rainlanguage/rain.flare

Length of output: 108

🏁 Script executed:

# Look for GitHub workflow files to understand the repository structure
git ls-files '.github/workflows/'

Repository: rainlanguage/rain.flare

Length of output: 217

🏁 Script executed:

cat -n .github/workflows/publish-soldeer.yaml

Repository: rainlanguage/rain.flare

Length of output: 289

🏁 Script executed:

# Let's check if there are other workflow files that might show patterns for secret passing
cat -n .github/workflows/git-clean.yaml

Repository: rainlanguage/rain.flare

Length of output: 1616

🏁 Script executed:

# Check for any documentation or comments about what secrets are needed
rg -i "secret" .github/workflows/ -A 2 -B 2

Repository: rainlanguage/rain.flare

Length of output: 698

🏁 Script executed:

# Let's check if there's any documentation about required secrets
rg "secrets" . --type md -i

Repository: rainlanguage/rain.flare

Length of output: 49

🏁 Script executed:

# Check if there's a README or docs that mention secrets
find . -name "README*" -o -name "SECURITY*" -o -name "docs" -type d

Repository: rainlanguage/rain.flare

Length of output: 79

🏁 Script executed:

# Check all workflow files for secret usage patterns
cat -n .github/workflows/rainix-sol.yaml

Repository: rainlanguage/rain.flare

Length of output: 247

🏁 Script executed:

# Let's check the README to understand the repository structure and any notes about secrets
cat -n README.md | head -100

Repository: rainlanguage/rain.flare

Length of output: 4739

🏁 Script executed:

# Check if there are any GitHub environment files or configuration
find . -name ".env*" -o -name "*.env" | head -20

Repository: rainlanguage/rain.flare

Length of output: 49

🏁 Script executed:

# Search for any credential or token references in the workflows
rg "token|credential|auth" .github/workflows/ -i

Repository: rainlanguage/rain.flare

Length of output: 49

🏁 Script executed:

# Let's search for any soldeer-related configuration or documentation
rg "soldeer" . -i -A 3

Repository: rainlanguage/rain.flare

Length of output: 3651

🏁 Script executed:

# Check if there's a flake.nix that might hint at what dependencies/secrets are needed
if [ -f flake.nix ]; then cat -n flake.nix | head -50; fi

Repository: rainlanguage/rain.flare

Length of output: 1759

🏁 Script executed:

# Let's check if there are any comments or documentation about what secrets are needed
rg "github.com/rainlanguage/rainix" . -A 5 -B 5

Repository: rainlanguage/rain.flare

Length of output: 49

🏁 Script executed:

# Search for any environment or secrets configuration in the workflows
rg "env|SECRETS|token" .github/workflows/ -i

Repository: rainlanguage/rain.flare

Length of output: 320

🏁 Script executed:

# Let's check if there are any other GitHub workflows in the rainix repository reference
rg "rainlanguage/rainix" . -r

Repository: rainlanguage/rain.flare

Length of output: 481

🏁 Script executed:

# Let's look at the manual-sol-artifacts workflow to understand the pattern
cat -n .github/workflows/manual-sol-artifacts.yaml

Repository: rainlanguage/rain.flare

Length of output: 555

🌐 Web query:

GitHub Actions secrets inherit best practices security risks

💡 Result:

GitHub Actions secrets inheritance refers to the secrets: inherit feature in reusable (called) workflows, which passes all secrets from the calling workflow to the called one. This simplifies secret passing but introduces security risks if not managed properly.[1][2] Best practices: - Avoid secrets: inherit in reusable workflows; explicitly list and pass only required secrets to enforce least privilege and limit exposure.[3] - Use environment secrets with protection rules (required reviewers, branch restrictions) for sensitive operations instead of broad repository or organization secrets.[4][5] - Set permissions blocks at workflow and job levels to minimize GITHUB_TOKEN access, defaulting to read-only where possible.[6][7] - Reference secrets individually in steps (e.g., env: MY_SECRET: ${{ secrets.MY_SECRET }}) rather than broadly, as GitHub only injects explicitly referenced secrets.[8][9] - For reusable workflows, centralize secrets in the called repo's environments and reference via environment: in jobs.[10] - Rotate secrets regularly, audit usage, and register transformed secrets (e.g., base64) to ensure log redaction.[6][11] - Prefer OIDC for cloud providers over long-lived secrets to reduce exposure.[12] Security risks: - Write access to a repo allows viewing/overwriting all repo secrets (including environment ones via API, bypassing reviewers).[13][6] - secrets: inherit exposes all caller secrets to the reusable workflow, increasing blast radius if the reusable workflow or runner is compromised.[3][14] - Compromised workflows/runners can exfiltrate injected secrets (redaction isn't foolproof against obfuscation).[14][8] - Fork PRs from pull_request_target or untrusted triggers may access secrets if not restricted.[9][14] - Organization secrets propagate broadly if not scoped by policy.[11][5] Example safe reusable workflow call: jobs: call-reusable: uses: org/repo/.github/workflows/reusable.yml@main secrets: REQUIRED_SECRET: ${{ secrets.REQUIRED_SECRET }} # Explicit, not inherit [1][2]

Citations:

Pass only required secrets explicitly; avoid secrets: inherit.

Line 8 forwards all secrets to an external reusable workflow, which increases exposure and violates least-privilege boundaries. Instead, explicitly pass only the secrets needed for the publish operation (e.g., SOLDEER_TOKEN or similar credentials).

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-soldeer.yaml at line 8, Replace the broad
"secrets: inherit" usage with an explicit secrets mapping for the reusable
workflow: remove the "secrets: inherit" line and pass only the required secrets
(e.g., SOLDEER_TOKEN, NPM_TOKEN, or whatever publish credentials the reusable
workflow expects) by adding a secrets block mapping each required input to the
corresponding repository secret (for example mapping SOLDEER_TOKEN to ${{
secrets.SOLDEER_TOKEN }}); ensure the secret names match the parameters expected
by the called workflow so only least-privilege credentials are forwarded instead
of inheriting all secrets.

6 changes: 6 additions & 0 deletions .github/workflows/rainix-sol.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
name: rainix-sol
on: [push]
jobs:
rainix-sol:
uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main
secrets: inherit
35 changes: 0 additions & 35 deletions .github/workflows/rainix.yml
View file
Open in desktop

This file was deleted.

4 changes: 3 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
# Compiler files
cache/
out/
dependencies/

# Ignores development broadcast logs
!/broadcast
Expand All @@ -13,4 +14,5 @@ docs/
# Dotenv file
.env

meta
.direnv
.pre-commit-config.yaml
9 changes: 0 additions & 9 deletions .gitmodules
View file
Open in desktop

This file was deleted.

30 changes: 30 additions & 0 deletions .soldeerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
.DS_Store
.cargo
.coderabbit.yaml
.devcontainer.json
.envrc
.gas-snapshot
.git
.github
.gitignore
.gitmodules
.pre-commit-config.yaml
.prettierignore
.soldeerignore
.vscode
CLAUDE.md
/audit
/cache
/dependencies
/flake.lock
/flake.nix
/foundry.lock
/foundry.toml
/lib
/out
/remappings.txt
/slither.config.json
/soldeer.lock
/REUSE.toml
/deployments
/meta
18 changes: 18 additions & 0 deletions LICENSES/MIT.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
MIT License

Copyright (c) <year> <copyright holders>

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
associated documentation files (the "Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial
portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
USE OR OTHER DEALINGS IN THE SOFTWARE.
31 changes: 20 additions & 11 deletions REUSE.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,17 +2,26 @@ version = 1

[[annotations]]
path = [
".gas-snapshot",
".github/workflows/**/",
".gitignore",
".gitmodules",
"README.md",
"flake.lock",
"flake.nix",
"foundry.toml",
"slither.config.json",
"REUSE.toml",
"foundry.lock",
".gas-snapshot",
".github/workflows/**/",
".gitignore",
".soldeerignore",
"README.md",
"flake.lock",
"flake.nix",
"foundry.toml",
"meta/**/",
"remappings.txt",
"slither.config.json",
"REUSE.toml",
"soldeer.lock",
"src/generated/**/",
]
SPDX-FileCopyrightText = "Copyright (c) 2020 Rain Open Source Software Ltd"
SPDX-License-Identifier = "LicenseRef-DCL-1.0"

# Vendored Flare interface files (upstream MIT, see LICENSES/MIT.txt).
[[annotations]]
path = ["src/vendor/**/"]
SPDX-FileCopyrightText = "Copyright (c) 2024 Flare Foundation"
SPDX-License-Identifier = "MIT"
Loading
Loading