Split rainix.yaml into per-task slim-shell workflows - #2608
Merged
Conversation
…eusable Resolves #2605. - Add script/build-subgraph.sh: copies the 3 ABIs subgraph.yaml needs from out/ to subgraph/abis/, runs npm ci + graph codegen. Picked up by rainix-copy-artifacts.yaml's build-subgraph.sh hook (rainlanguage/rainix#210); the git diff --exit-code gate catches drift. - Commit subgraph/abis/{Raindex,ERC20,DecimalFloat}.json and subgraph/generated/ (un-gitignored). - .prettierignore: skip subgraph/abis/ so the raw forge JSONs match the copy-artifacts regen byte-for-byte. - subgraph.yaml: ../out/*.sol/*.json -> ./abis/*.json. - test-subgraph.yml: thin wrapper over rainix-subgraph-test reusable (matchstick over committed bindings in the slim subgraph-shell, no forge build or graph codegen on the test path). - Bump rainix to 6ffb49299 (post-#210). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
prep-base.sh and pointers.sh now do the same thing post artifact-commit
(forge soldeer install + forge build) — meta is committed (build-meta.sh
hook) and the double forge build in prep-base was only there for the
meta-regen cycle. Collapse onto pointers.sh.
Also fix shellcheck SC2068 (quote ${keep[@]} array expansions) and
SC2034 (drop unused GREEN/NC vars) in the surviving prep-*.sh.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- script/build-subgraph.sh: jq '{abi}' instead of cp — forge's full
artifact JSON (bytecode/metadata/id) embeds build-host paths that
drift across runners and defeat the rainix-copy-artifacts diff gate.
Graph CLI + matchstick only read `.abi`, so stripping costs nothing.
- subgraph/abis/*.json: regenerated against the new strip.
- REUSE.toml: add .prettierignore (file added by an earlier commit on
this branch, missing from the path list, broke rainix-sol / legal).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
rainlanguage/rainix#212 lands two fixes the consumer side needs: - pkgs.sqlite in rust-build-inputs so rusqlite-using crates compile in slim shells (precondition for the future rainix.yaml refactor). - subgraph-test task does `npm ci` before `docker compose up`, so matchstick finds ./node_modules — unblocks this PR's `subgraph-test` job which is over committed bindings. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replace the single rainix.yaml matrix (full default devshell + dead ./pointers.sh forge build) with one workflow per task on the slim #wasm-shell: - rs-test.yaml — thin wrapper over rainix-rs-test reusable (ubuntu+macos, cargo test in #rust-shell). - rs-static.yaml — thin wrapper over rainix-rs-static reusable. - wasm-artifacts.yaml — cargo build --profile release-wasm. - wasm-test.yaml — cargo test --target wasm32 with wasm-bindgen-test-runner. - wasm-browser-test.yaml — wasm-pack browser tests (keeps chromium). - test-js-bindings.yaml — packages/raindex npm install + build + vitest. Drops cargo-build-release.yaml — the original matrix entry was a release-mode build sanity that rainlang's pattern doesn't include and no observed release-only breakage has shown up. Drops ./pointers.sh from the test path entirely: no raindex rust crate reads forge's out/ at compile or runtime, no sol! macros pointing at it, no shell-outs to forge/cast/anvil. The forge build it ran was dead weight for this matrix. Bumps rainix to c465734 (pulls in pkgs.sqlite for rusqlite + the slim wasm-shell). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
📝 Walkthrough<review_stack_artifact_start /> Single functional cohort covering committed ABI/fixture artifacts and bindings, deterministic regeneration script, prep/flake/devShell updates, CI workflow modernization and additions, and documentation/metadata/template updates.Add committed ABI/fixture JSON and IMulticall3.sol fixture; update Alloy sol! bindings to reference local `./abis/*` and fixture contract sources.range_e29fdbb37ce0 range_0154a1eadf4a range_86dc43a5046e range_6f095cea3b7c range_8999345a07ad range_559176f1d381 range_0a38b1105c4f range_8d76933ce736 range_95ec75dc789e range_1f3fa2b45ec1 range_6754872c0b3f range_4be5f4334ca1 range_9189c90399e1 range_8e7838579c8b range_7d4d80d4ab21 range_b1933ccecae6 range_ac04e508d392 range_cfcd9fd33298 range_cebbd94c48fd range_e539b983ffb6 range_3bc6c982bba9 range_9d7bbd4ea3f7 range_d2554c69bfbb range_c5dc1aa4bfcd range_5b24c67336ca range_b77bc175cf12 range_040de9725332 range_cd74277eb0fb range_561cb040da0e range_c52f81693901 range_d0fa8cdf49ff range_6754872c0b3f range_4be5f4334ca1 range_9189c90399e1 range_8e7838579c8b range_989019ab8d93 range_e29fdbb37ce0Add `script/build.sh` to regenerate ABIs/fixtures deterministically inside `nix develop .#subgraph-shell`; produce subgraph ABIs, bindings ABIs, and test fixtures with deterministic fields; copy pinned IMulticall3.sol into test fixtures.range_dc729e812c7c range_1967e0a444a8 range_989019ab8d93 range_989019ab8d93 range_989019ab8d93 range_afebdbd1d0ef range_3bc6c982bba9 range_3bc6c982bba9Remove or change prep helpers: `prep-base.sh` removed, `pointers.sh` content removed, `prep-all.sh`/`prep-webapp.sh` updated to source pointers and use quoted `"${keep[@]}"`; `flake.nix` exports `wasm-shell`, `subgraph-shell`, `sol-shell`, `rust-shell`.range_d5d0bfc7989b range_0f79db594e28 range_29324734617e range_47d9defc2b57 range_bea1dd60088f range_a6791bad0665 range_d5d0bfc7989b range_0f79db594e28 range_29324734617e range_47d9defc2b57 range_a6791bad0665 range_a6791bad0665 range_a6791bad0665 range_a6791bad0665 range_a6791bad0665 range_a6791bad0665Add targeted workflows (wasm-test, wasm-browser-test, wasm-artifacts, test-js-bindings), rs-test/rs-static reusers, simplify subgraph test to reusable, add Cachix/Nix store/Rust/npm caching, and run builds/tests inside slim devShells (e.g., `.#wasm-shell`).range_82537a14be0e range_b338d8c97705 range_58a771dc28a4 range_e5844cf5d1a7 range_ead7200f877f range_eafd4bd960c7 range_c9db4591b47f range_118f3bd8f591 range_344ce4f220dc range_60a0350f1c7a range_76e59f1bcae9 range_3f9c3d2fc346 range_5c032227e9ef range_b88873e9cdbf range_57194e668cbf range_96a4e25922b5 range_5660d20bb15a range_5366417d5327 range_87a03b246262 range_95fd4685d02a range_1e8b97c04620 range_95de82e3709c range_1e8b97c04620 range_2deb6e83d215 range_99d54679466d range_e002bc7e4846 range_e002bc7e4846Adjust npm release flow to use `nix-quick-install`, Cachix, split WASM binding tests (cargo + npm), run UI builds/tests via `.#wasm-shell`, and update Vercel docs/build workflows to Nix/Cachix + wasm-shell builds.range_87a03b246262 range_95fd4685d02a range_1e8b97c04620 range_e002bc7e4846 range_1e8b97c04620 range_789a3469dee0 range_789a3469dee0 range_789a3469dee0 range_95fd4685d02a range_1e8b97c04620Update AGENTS.md, CLAUDE.md, copilot instructions, many ARCHITECTURE.md/README.md files, AI command templates, add LICENSES (Apache-2.0, MIT), update REUSE.toml, .prettierignore, .envrc, and other metadata/documentation tweaks.range_db8ed2fb0c65 range_ead40973a748 range_1bfd6401a41a range_8732b79a090c range_838468bc6848 range_838468bc6848 range_838468bc6848 range_838468bc6848 range_838468bc6848 range_838468bc6848 range_838468bc6848 range_838468bc6848 range_b81125b84429 range_62ebf759cf60 range_687e58b11016 range_d4a37e8082b0 range_ca16c40323d8 range_994bcf7fe1a8 range_e5a9228df676 range_e6cb741b530c range_e22c380658e9 range_789d5d790ca2 range_838468bc6848 range_994bcf7fe1a8 range_5273e662db2b range_4793c791e1e5 range_fab957cf41ae range_2deb6e83d215 range_99d54679466d range_95de82e3709c range_87a03b246262 range_95fd4685d02a range_e002bc7e4846 range_c9db4591b47f range_118f3bd8f591 range_60a0350f1c7a range_76e59f1bcae9 range_3f9c3d2fc346 range_5c032227e9ef range_b88873e9cdbf range_789a3469dee0 range_e5844cf5d1a7 range_82537a14be0e range_b338d8c97705 range_58a771dc28a4 range_ead7200f877f range_eafd4bd960c7 range_e42900bc15e5 range_e37956566df4 range_5273e662db2b range_989019ab8d93 range_afebdbd1d0ef range_a6791bad0665 range_d5d0bfc7989b range_0f79db594e28 range_29324734617e range_47d9defc2b57 range_bea1dd60088f range_dc729e812c7c range_1967e0a444a8 range_21ec619bd450 range_ca16c40323d8 range_994bcf7fe1a8 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9 range_3bc6c982bba9<unassigned_ranges> ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
|
crates/bindings reads ABIs via `sol!` path args (5 contracts: IRaindexV6,
RaindexV6, ERC20, IERC20Metadata, IInterpreterStoreV3). Without committed
ABIs, any rust crate touching these requires `forge build` first — defeats
the slim-shell story.
Commit the 5 ABIs under crates/bindings/abis/ (jq '{abi}' stripped — forge
JSON bytecode/metadata/id embed build-host paths, non-deterministic across
runners; alloy sol! only reads .abi). Point sol! macros at the new location.
Rename script/build-subgraph.sh -> script/build.sh: one generic
post-CopyArtifacts hook, not "build subgraph" / "build bindings" / etc.
build.sh internally `nix develop -c ...` since the renamed rainix hook
(rainix#213) no longer wraps the call.
# Conflicts: # flake.lock
3 tasks
wasm-test/wasm-browser-test/wasm-artifacts/test-js-bindings invoke cargo directly (not via rainix-rs-test reusable), so they missed the cargo target cache. rainix-rs-test already has it; this matches that.
I missed test_fixtures in the prior sol!-paths sweep. Three more sol!
invocations were reading from out/ and dependencies/, breaking rs-test in
slim #rust-shell.
- Commit crates/test_fixtures/abis/{RaindexV6,RaindexV6SubParser}.json
(jq '{abi, bytecode}' — bytecode kept because both call ::deploy())
- Drop the TOFUTokenDecimals sol! (the generated module was unused
workspace-wide; TOFU_DECIMALS_CREATION_CODE is deployed via raw hex)
- Vendor IMulticall3.sol into crates/test_fixtures/contracts/ so cargo
doesn't need `forge soldeer install` to materialize dependencies/
- Extend script/build.sh to regen the 2 ABIs + cp IMulticall3.sol from
the soldeer dep (diff gate catches drift if forge-std bumps)
cargo check --workspace passes in #rust-shell with no out/ and no
dependencies/.
Pre-existing format drift in markdown + YAML surfaced when the new rs-static workflow runs \`pre-commit run --all-files\` (per rainix's rs-static reusable). Old rainix.yaml never ran the full hook bundle. - denofmt + yamlfmt: applied auto-reformats to 20 .md / .yaml files - .envrc: add \`# shellcheck shell=bash\` directive (SC2148)
Matches main's invocation (rainix.yaml called `nix develop -c test-js-bindings`). Previously I'd routed it through rainix's slim #wasm-shell, which had a different toolchain than the raindex flake's test-js-bindings task and surfaced tsc errors on Symbol.dispose typings.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 11
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
crates/bindings/src/lib.rs (1)
3-46:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRestore full artifact JSON (with bytecode) for deployable
Raindex/ERC20bindings
RaindexandERC20are generated from./abis/RaindexV6.jsonand./abis/ERC20.json, but both ABI JSONs contain nobytecode(and no constructor entries). With no bytecode,alloy::sol!can’t emit deploy helpers likedeploy/deploy_builder, so deploy-related API can be lost for these public contract types. Use the full Forge artifact JSONs for deployable contracts (or switch these bindings to interface-only if deployment is intentionally unsupported).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/bindings/src/lib.rs` around lines 3 - 46, The Raindex and ERC20 bindings use ABI-only JSONs so alloy::sol! cannot emit deploy helpers (deploy/deploy_builder); replace the current ABI-only inputs used in the sol!(...) invocations for Raindex and ERC20 with the full Forge artifact JSONs that include bytecode and constructor entries so deploy helpers are generated, or if deployment is intentionally unsupported, change those sol! declarations to interface-only definitions (e.g., define minimal interface signatures) so it’s explicit; update the sol!(...) uses for the symbols Raindex and ERC20 accordingly and ensure the JSONs you point to contain "bytecode" and constructor metadata.
🧹 Nitpick comments (3)
prep-all.sh (1)
29-30: ⚡ Quick winRun
pointers.shthrough the pinned Nix shell too.This prep step now runs directly on the host while the rest of the script uses
nix develop, so setup reproducibility depends on local tooling for just this part. Wrapping it innix developkeeps the bootstrap path consistent.♻️ Proposed fix
echo "Preparing base setup..." -./pointers.sh +nix develop -i "${keep[@]}" -c ./pointers.shBased on learnings: "Always run commands via Nix using
nix develop -c <command>."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@prep-all.sh` around lines 29 - 30, The prep script currently runs ./pointers.sh directly on the host which breaks reproducibility; change the invocation in prep-all.sh to run pointers.sh inside the pinned Nix shell by replacing the direct call to ./pointers.sh with a nix develop -c invocation (e.g., use nix develop -c ./pointers.sh) so pointers.sh executes with the same Nix environment as the rest of the script; update the call site where "./pointers.sh" appears to use the nix develop -c wrapper and ensure any required environment variables or arguments are passed through the nix develop -c command.script/build.sh (1)
38-39: ⚡ Quick winAvoid hard-coding the forge-std version in this copy path.
dependencies/forge-std-1.16.1/...will break the next forge-std bump even ifIMulticall3.solis still present. Resolve the file through a stable path/glob, or vendor it once and stop copying from a versioned dependency directory.♻️ Proposed fix
mkdir -p crates/test_fixtures/contracts -cp dependencies/forge-std-1.16.1/src/interfaces/IMulticall3.sol crates/test_fixtures/contracts/IMulticall3.sol +multicall3_src="$(find dependencies -path '*/src/interfaces/IMulticall3.sol' -print -quit)" +test -n "$multicall3_src" +cp "$multicall3_src" crates/test_fixtures/contracts/IMulticall3.sol🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@script/build.sh` around lines 38 - 39, The script hard-codes the forge-std version in the copy path which will break on upgrades; update the build step in script/build.sh that copies IMulticall3.sol to resolve the file via a stable path or glob (e.g., search dependencies for "forge-std*/src/interfaces/IMulticall3.sol" or use a vendored crate location) instead of "dependencies/forge-std-1.16.1/..."; ensure the mkdir -p crates/test_fixtures/contracts and the cp step reference the discovered path or the vendored file so future forge-std bumps don't break the copy of IMulticall3.sol..github/workflows/npm-package-release.yml (1)
89-90: ⚡ Quick winRun
pointers.shinsidenix developin the release workflow.This prep step is now executed directly on
ubuntu-latest, so it can drift with runner tooling instead of the repo’s pinned shell. Since Nix is already installed earlier in the job, wrapping it is a cheap way to keep release prep reproducible.♻️ Proposed fix
- - run: ./pointers.sh + - run: nix develop -c ./pointers.shBased on learnings: "Always run commands via Nix using
nix develop -c <command>."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/npm-package-release.yml around lines 89 - 90, The workflow runs ./pointers.sh directly on the runner which can drift; change that invocation to run via Nix by invoking nix develop -c ./pointers.sh so the prep step executes inside the pinned dev shell; update the job step that currently runs ./pointers.sh to call nix develop -c ./pointers.sh instead (refer to the existing pointers.sh run step).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-assessment.yaml:
- Around line 8-13: The workflow call currently pins the reusable workflow to
the branch reference
"rainlanguage/github-chore/.github/workflows/pr-assessment.yml@main" which can
change upstream; replace the "`@main`" ref in the uses entry with a specific
commit SHA (e.g. "@<commit-sha>") so the reusable workflow is pinned to an
immutable version—update the line that starts with uses: to
"rainlanguage/github-chore/.github/workflows/pr-assessment.yml@<commit-sha>" and
keep the existing with: inputs (pr_number, repo, owner, merged) unchanged.
In @.github/workflows/rs-static.yaml:
- Around line 4-6: The reusable workflow reference under the rs-static job
currently pins to the mutable ref
"rainlanguage/rainix/.github/workflows/rainix-rs-static.yaml@main"; replace the
`@main` suffix with a concrete commit SHA (e.g. @<commit-sha>) so the "uses:
rainlanguage/rainix/.github/workflows/rainix-rs-static.yaml@main" line becomes
pinned to a specific commit for deterministic CI execution.
In @.github/workflows/rs-test.yaml:
- Around line 4-6: The rs-test job references the reusable workflow with the
floating ref `rainlanguage/rainix/.github/workflows/rainix-rs-test.yaml@main`;
replace `@main` with a specific commit SHA (e.g. `@<commit-sha>`) so the
`rs-test` job uses a pinned, deterministic version of `rainix-rs-test.yaml`
instead of tracking `main`.
In @.github/workflows/test-js-bindings.yaml:
- Around line 9-29: Update the workflow steps to pin each action usage to a
specific immutable commit SHA (replace uses: actions/checkout@v4,
jlumbroso/free-disk-space@v1.3.1, nixbuild/nix-quick-install-action@v30,
cachix/cachix-action@v15, nix-community/cache-nix-action@v7,
Swatinem/rust-cache@v2 with their corresponding full commit SHAs) and add
persist-credentials: false to the actions/checkout step so the job only has read
access to the repo; keep all existing with: blocks and other inputs unchanged
while only replacing the version tags and adding the persist-credentials field.
In @.github/workflows/test-subgraph.yml:
- Around line 4-6: The reusable workflow reference currently uses the floating
ref "uses:
rainlanguage/rainix/.github/workflows/rainix-subgraph-test.yaml@main"; replace
the "`@main`" suffix with a specific commit SHA (for example "@<commit-sha>") so
the subgraph-test job is pinned to an immutable commit — update the string in
the "uses" field to the chosen commit SHA to make the job reproducible.
In @.github/workflows/wasm-artifacts.yaml:
- Line 30: Replace the remote shell invocation `nix develop
github:rainlanguage/rainix#wasm-shell` with the repo-pinned task
`rainix-wasm-artifacts`; specifically, update the step to call the flake task
(for example `nix run .#rainix-wasm-artifacts -c cargo build --profile
release-wasm --target wasm32-unknown-unknown --lib -p raindex_js_api`) so the
workflow uses the pinned `rainix-wasm-artifacts` task defined in the flake
instead of the remote GitHub shell.
- Around line 9-29: Update the workflow to avoid persisting checkout credentials
and pin actions to immutable SHAs: set actions/checkout@v4 to include
persist-credentials: false, and replace the tag refs for
jlumbroso/free-disk-space@v1.3.1, nixbuild/nix-quick-install-action@v30,
cachix/cachix-action@v15, nix-community/cache-nix-action@v7, and
Swatinem/rust-cache@v2 with their corresponding full commit SHA revisions; keep
the existing inputs (nix_conf, cachix inputs, cache keys, etc.) intact while
swapping the uses: lines to the SHA-pinned refs.
In @.github/workflows/wasm-browser-test.yaml:
- Around line 9-32: Update all GitHub Actions "uses:" references to commit SHAs
rather than mutable tags for actions referenced (e.g., replace
actions/checkout@v4, jlumbroso/free-disk-space@v1.3.1,
nixbuild/nix-quick-install-action@v30, cachix/cachix-action@v15,
nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2 with their specific
commit SHA pins) and modify the actions/checkout step to disable credential
persistence by adding a with: persist-credentials: false entry for the checkout
action; ensure the exact step named or using "actions/checkout" in the workflow
is updated.
In @.github/workflows/wasm-test.yaml:
- Around line 9-29: Update the workflow to pin every third-party action usage to
an immutable commit SHA instead of tags (replace actions like
actions/checkout@v4, jlumbroso/free-disk-space@v1.3.1,
nixbuild/nix-quick-install-action@v30, cachix/cachix-action@v15,
nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2 with their
corresponding commit SHAs) and modify the actions/checkout step (the checkout
action block) to include with: persist-credentials: false to avoid leaking repo
credentials to subsequent steps; keep existing options (like continue-on-error
or with: entries) intact while swapping tags for SHAs.
- Line 30: Replace the remote nix invocation with the repo's flake task: change
the line that runs "nix develop github:rainlanguage/rainix#wasm-shell -c bash -c
..." to use the local flake task "nix develop .#rainix-wasm-test -c bash -c ..."
and keep the same cargo invocation
(CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER=wasm-bindgen-test-runner cargo test
--target wasm32-unknown-unknown --lib -p raindex_quote -p raindex_bindings -p
raindex_js_api -p raindex_common) so the workflow uses the repository-defined
rainix-wasm-test environment instead of the remote rainix-shell.
In `@crates/test_fixtures/contracts/IMulticall3.sol`:
- Line 2: The Solidity pragma in IMulticall3.sol is too loose; update the pragma
statement (the line containing "pragma solidity ...") to pin the compiler to
0.8.25 to match the workspace toolchain (solc = "0.8.25") so this fixture
compiles with the same compiler as the rest of the repo; locate IMulticall3.sol
and replace the current pragma range with the exact 0.8.25 version.
---
Outside diff comments:
In `@crates/bindings/src/lib.rs`:
- Around line 3-46: The Raindex and ERC20 bindings use ABI-only JSONs so
alloy::sol! cannot emit deploy helpers (deploy/deploy_builder); replace the
current ABI-only inputs used in the sol!(...) invocations for Raindex and ERC20
with the full Forge artifact JSONs that include bytecode and constructor entries
so deploy helpers are generated, or if deployment is intentionally unsupported,
change those sol! declarations to interface-only definitions (e.g., define
minimal interface signatures) so it’s explicit; update the sol!(...) uses for
the symbols Raindex and ERC20 accordingly and ensure the JSONs you point to
contain "bytecode" and constructor metadata.
---
Nitpick comments:
In @.github/workflows/npm-package-release.yml:
- Around line 89-90: The workflow runs ./pointers.sh directly on the runner
which can drift; change that invocation to run via Nix by invoking nix develop
-c ./pointers.sh so the prep step executes inside the pinned dev shell; update
the job step that currently runs ./pointers.sh to call nix develop -c
./pointers.sh instead (refer to the existing pointers.sh run step).
In `@prep-all.sh`:
- Around line 29-30: The prep script currently runs ./pointers.sh directly on
the host which breaks reproducibility; change the invocation in prep-all.sh to
run pointers.sh inside the pinned Nix shell by replacing the direct call to
./pointers.sh with a nix develop -c invocation (e.g., use nix develop -c
./pointers.sh) so pointers.sh executes with the same Nix environment as the rest
of the script; update the call site where "./pointers.sh" appears to use the nix
develop -c wrapper and ensure any required environment variables or arguments
are passed through the nix develop -c command.
In `@script/build.sh`:
- Around line 38-39: The script hard-codes the forge-std version in the copy
path which will break on upgrades; update the build step in script/build.sh that
copies IMulticall3.sol to resolve the file via a stable path or glob (e.g.,
search dependencies for "forge-std*/src/interfaces/IMulticall3.sol" or use a
vendored crate location) instead of "dependencies/forge-std-1.16.1/..."; ensure
the mkdir -p crates/test_fixtures/contracts and the cp step reference the
discovered path or the vendored file so future forge-std bumps don't break the
copy of IMulticall3.sol.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a59b21d1-c702-4997-bce9-2782d4b9985f
⛔ Files ignored due to path filters (5)
flake.lockis excluded by!**/*.locksubgraph/generated/Raindex/DecimalFloat.tsis excluded by!**/generated/**subgraph/generated/Raindex/ERC20.tsis excluded by!**/generated/**subgraph/generated/Raindex/Raindex.tsis excluded by!**/generated/**subgraph/generated/schema.tsis excluded by!**/generated/**
📒 Files selected for processing (54)
.envrc.github/copilot-instructions.md.github/workflows/npm-package-release.yml.github/workflows/pr-assessment.yaml.github/workflows/rainix.yaml.github/workflows/rs-static.yaml.github/workflows/rs-test.yaml.github/workflows/test-js-bindings.yaml.github/workflows/test-subgraph.yml.github/workflows/wasm-artifacts.yaml.github/workflows/wasm-browser-test.yaml.github/workflows/wasm-test.yaml.prettierignoreAGENTS.mdCLAUDE.mdLICENSES/Apache-2.0.txtLICENSES/MIT.txtREUSE.tomlai_commands/feature-implementation-plan.mdai_commands/generate-pr-content.mdai_commands/refresh-architecture.mdai_commands/sdk-documentation-update.mdcrates/bindings/ARCHITECTURE.mdcrates/bindings/abis/ERC20.jsoncrates/bindings/abis/IERC20Metadata.jsoncrates/bindings/abis/IInterpreterStoreV3.jsoncrates/bindings/abis/IRaindexV6.jsoncrates/bindings/abis/RaindexV6.jsoncrates/bindings/src/lib.rscrates/cli/src/commands/local_db/README.mdcrates/common/ARCHITECTURE.mdcrates/js_api/ARCHITECTURE.mdcrates/math/ARCHITECTURE.mdcrates/settings/ARCHITECTURE.mdcrates/test_fixtures/abis/RaindexV6.jsoncrates/test_fixtures/abis/RaindexV6SubParser.jsoncrates/test_fixtures/contracts/IMulticall3.solcrates/test_fixtures/src/lib.rspackages/raindex/ARCHITECTURE.mdpackages/raindex/README.mdpackages/ui-components/ARCHITECTURE.mdpackages/ui-components/README.mdpackages/webapp/ARCHITECTURE.mdpackages/webapp/README.mdprep-all.shprep-base.shprep-webapp.shscript/build.shsubgraph/.gitignoresubgraph/abis/DecimalFloat.jsonsubgraph/abis/ERC20.jsonsubgraph/abis/Raindex.jsonsubgraph/docker-compose.ymlsubgraph/subgraph.yaml
💤 Files with no reviewable changes (3)
- .github/workflows/rainix.yaml
- subgraph/.gitignore
- prep-base.sh
Root cause: slim #wasm-shell's shellHook doesn't run npm ci on entry (default devshell's does). My previous workflow ran cd packages/raindex && npm install first, which only installs that package's direct deps — workspace resolution breaks, dist/cjs/index.d.ts gets Symbol.dispose syntax that tsc --lib es2020,dom rejects. Installing from workspace root first (matching what default devshell does for free) fixes it. Verified locally: clean repro in #wasm-shell with workspace-root install → npm test passes (126/126).
`nix develop -c bash <<INNER` exposed the heredoc body on bash's stdin to inner commands. `graph codegen` (and likely `npm ci`) read from stdin and consumed the rest of the script, turning later commands into bogus argv passed to graph codegen. Visible in the copy-artifacts log as graph codegen trying to open a file whose name is the concatenated tail of the heredoc. Switching to `bash -c '...'` (single-quoted body, double-quoted jq filters inside) decouples stdin from the script — same shape as the test-js-bindings workflow which works fine. (Caught by parallel investigation agent. The cachix 403 was a red herring — those happen on every copy-artifacts run but continue-on-error works; the cachix Post step shows conclusion=success in the API even when the body logs the 403.)
Re-export rainix's wasm-shell / subgraph-shell as raindex's local devShells so workflows can do .#wasm-shell / .#subgraph-shell. This uses the flake.lock-pinned rainix rev instead of the live github:rainlanguage/rainix#... reference (which bypassed flake.lock and tracked rainix main). Slim-shell speed is preserved. Also drops bytecode.sourceMap from the committed test_fixtures ABIs — it embeds a solc-file-ID that depends on input traversal order and differs across runners, defeating the copy-artifacts diff gate. sourceMap is debug-only; alloy ::deploy() only reads bytecode.object. (CodeRabbit Group B: legit. Group A on @main pinning and Group C on solidity pragma intentionally skipped — convention/cosmetic.)
prep-all.sh and pointers.sh were thin wrappers; inline their bodies at each caller. Also align all workflows on the same nix infrastructure (nixbuild + cachix-action + cache-nix-action) instead of mixing in Determinate's installer + flakehub-cache, which doesn't share the rainlanguage Cachix that everything else warms. - Delete prep-all.sh, pointers.sh; update REUSE.toml + README + AGENTS to drop the references. - prep-webapp.sh: inline pointers.sh body. - vercel-docs-preview / vercel-docs-prod: replace ./prep-all.sh with a slim #wasm-shell npm install (workspace root) + npm run build + npm run docs. typedoc doesn't read forge artifacts or the raindex-cli, so the prelude + forge build path was dead weight. Switch nix install/cache to nixbuild + cachix + cache-nix-action. vercel CLI pinned to @latest (off @canary). - npm-package-release.yml: swap Determinate + flakehub for nixbuild + cachix + cache-nix-action. Inline pointers.sh body. Keep the rest (release legitimately needs all artifacts). - copilot-setup-steps.yml: inline prep-all.sh body; add cachix; add npm cache. - test-js-bindings, docs-preview, docs-prod, npm-package-release, copilot-setup-steps: add actions/cache@v4 for ~/.npm keyed by package-lock.json hash.
Same pattern as prep-all.sh removal — thin wrapper not worth the indirection. Callers (test-webapp, test-ui-components, vercel-prod, vercel-preview) now do the forge install + forge build + npm builds inline. Dropped the rm -rf target hack from the original script: it nuked the cargo target cache for no real disk-space benefit (target/ on these jobs holds the wasm artifact briefly between raindex and ui-components builds, not a large persistent footprint).
Committed ABIs (crates/bindings/abis/, crates/test_fixtures/abis/) + vendored IMulticall3.sol mean no sol! macro reads out/ or dependencies/ anywhere in the workspace. The wasm/js builds (npm run build for raindex/ui-components/webapp) don't shell out to forge either. So `forge soldeer install + forge build` was dead weight on these workflows — pulling it out. Copilot setup-steps keeps the forge prep deliberately (bootstrap workflow — wants out/ available for any later forge-touching work).
Replaces `nix develop -c` (heavy default devshell) with `nix develop .#wasm-shell -c bash -c '...'`. .#wasm-shell has node + rust which is all the npm builds need (cargo wasm + svelte/ts compile). Saves the default devshell's full-toolchain startup. Drops the `rm -rf target` Cleanup steps inherited from the old prep-webapp.sh — disk-space hack that defeats cargo caching.
Capture the slim-shell / cachix / committed-artifacts / shell-quoting patterns established across this PR so future workflow work follows the same shape.
- flake.nix: re-export .#sol-shell and .#rust-shell (alongside the existing .#wasm-shell / .#subgraph-shell) so all workflows can pin to flake.lock rainix rev. - copilot-setup-steps.yml: drop forge install + forge build entirely (committed ABIs + vendored IMulticall3.sol mean cargo doesn't need them; forge stays available via .#sol-shell on demand). Inline raindex-ui-components-prelude body. Use .#wasm-shell. - npm-package-release.yml: drop forge install + forge build same as above. Drop the two rm -rf target/debug guards that pre-dated the Swatinem/rust-cache add (free-disk-space@v1 + 8G swap handle the budget; the rm was defeating the cache we just added). Switch the remaining nix develop -c calls to .#wasm-shell. - manual-rs-release.yml: .#rust-shell for cargo release (verified cargo-release is in rainix rust-shell). - test-webapp.yaml / test-ui-components.yaml: drop the CARGO_HOME + CARGO_TARGET_DIR env redirect (legacy from prep-webapp era). It was sending cargo output to .cargo/target/, but packages/raindex/scripts/buildPackage.js hardcodes ../../target/... for wasm-bindgen — the redirect made wasm-bindgen fail to find the .wasm.
5 workflows (test-js-bindings, copilot-setup-steps, vercel-docs-*,
npm-package-release) cached ~/.npm with the same key (runner.os +
package-lock hash), so when they ran in parallel only one could
\"reserve\" the cache; the others logged \"Failed to save: Unable
to reserve cache with key ... another job may be creating this
cache\".
Adding \`\${{ github.workflow }}\` to the primary key gives each
workflow its own save slot. The generic \`restore-keys: npm-\${{
runner.os }}-\` prefix means a cold workflow still picks up a peer
workflow's saved cache as fallback — best of both: no collision on
save, cross-workflow warm restore.
The 6 workflows (deploy-subgraph, manual-rs-release, test-webapp,
test-ui-components, vercel-preview, vercel-prod) installed nix but
didn't pull from the shared rainlanguage Cachix — so cargo + wasm
deps were rebuilt from source every run. Adding cachix-action@v15
(continue-on-error, useDaemon:false) right after nix install.
Also adds \`prefix-key: rust-\${{ github.workflow }}\` to every
Swatinem/rust-cache@v2 invocation (8 workflows). rust-cache's
default key includes job-id but two workflows (test-webapp,
test-ui-components) share \`test\` as a job name and run in
parallel — their rust-cache saves were racing for the same key
(\"Failed to save: Unable to reserve cache...\"). Workflow-scoped
prefix-key separates them.
Push (path-filtered) covers PR-branch commits already. Having both push + pull_request triggers fired two workflow runs per SHA — they raced on the same npm cache key and one always logged 'Failed to save: Unable to reserve cache'.
Previous push:paths only triggered when the workflow yml itself changed — so PR commits to other files never ran the bootstrap. pull_request: (no paths) fires on every PR sync. Push events are dropped to avoid the parallel-cache-save collision (push + PR firing for same SHA).
Spec file stays so Copilot Agent can read the bootstrap steps when opening a workspace, but the per-PR validation run is dropped — saves ~5.5min of CI per PR for a feature that doesn't need per-PR proof.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 12
🧹 Nitpick comments (5)
.github/workflows/vercel-prod.yaml (1)
43-50: ⚡ Quick winAdd the standard npm cache before this workspace install.
This new
npm install --no-checkpath will repopulate~/.npmfrom scratch on every run. Please add the repo-standardactions/cachestep keyed by**/package-lock.jsonbefore Line 43 so the split workflow doesn't pay the full dependency download cost each time.Based on learnings: "Use
Swatinem/rust-cachev2after the nix-store cache step for any cargo work; useactions/cachev4over~/.npmkeyed by**/package-lock.jsonfor anynpm installwork".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/vercel-prod.yaml around lines 43 - 50, Add the standard npm cache step before the workspace npm install block that runs the bash command (the block containing "npm install --no-check" and the three "npm run build -w ..." lines): create an actions/cache (actions/cache@v4) step keyed by "**/package-lock.json" that caches/restores the ~/.npm directory so the subsequent npm install --no-check does not re-download all dependencies each run; place this cache step immediately prior to the run step in the workflow and ensure the cache path targets the repository npm cache (~/.npm) per repo standard..github/workflows/test-webapp.yaml (1)
44-50: ⚡ Quick winAdd the standard npm cache before this install/build block.
The new workspace-root
npm install --no-checkwill repopulate~/.npmfrom scratch on every run. Adding the repo-standard cache step before Line 44 keeps this split workflow aligned with the faster shape used elsewhere in the PR.Based on learnings: "Use
Swatinem/rust-cachev2after the nix-store cache step for any cargo work; useactions/cachev4over~/.npmkeyed by**/package-lock.jsonfor anynpm installwork".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/test-webapp.yaml around lines 44 - 50, Add the repo-standard npm cache step before the existing npm install/build block: insert an actions/cachev4 step (targeting ~/.npm) keyed by **/package-lock.json and place it after the nix-store cache step but before the run that invokes "npm install --no-check" and the builds for `@rainlanguage/raindex`, `@rainlanguage/ui-components`, and `@rainlanguage/webapp`; ensure the cache action uses Swatinem/rust-cachev2 practices (i.e., cache restore before installs) so subsequent runs reuse ~/.npm rather than repopulating it each time..github/workflows/manual-rs-release.yml (1)
22-33: ⚡ Quick winAdd the standard Rust cache before the release build.
cargo release --workspaceis the heaviest Rust path in this job, but the workflow still restores only the Nix store. Adding the repo-standardSwatinem/rust-cachestep after the Nix cache will avoid cold rebuilds on every manual release run.Based on learnings: "Use
Swatinem/rust-cachev2after the nix-store cache step for any cargo work; useactions/cachev4over~/.npmkeyed by**/package-lock.jsonfor anynpm installwork".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/manual-rs-release.yml around lines 22 - 33, Add the standard Rust cache step (Swatinem/rust-cachev2) immediately after the existing nix cache step (nix-community/cache-nix-action@v6) and before the cargo release invocation (the run: nix develop .#rust-shell --command cargo release --workspace line) so that cargo artifacts are restored for the heavy release run; insert a step using uses: Swatinem/rust-cachev2 with the repo-standard inputs (keeping it after the Nix restore/save block) to avoid cold rebuilds on manual release runs..github/workflows/test-ui-components.yaml (1)
44-51: ⚡ Quick winAdd the standard npm cache before this install/build block.
This new workspace-root
npm install --no-checkwill redownload the npm cache on every run. Please add the usualactions/cachestep keyed by**/package-lock.jsonbefore Line 44 to keep the split workflow fast.Based on learnings: "Use
Swatinem/rust-cachev2after the nix-store cache step for any cargo work; useactions/cachev4over~/.npmkeyed by**/package-lock.jsonfor anynpm installwork".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/test-ui-components.yaml around lines 44 - 51, Add an actions/cache step immediately before the run step that executes "npm install --no-check" to cache the npm artifacts; use actions/cache v4, cache the npm directory (e.g. ~/.npm) and key it by the repo package-lock pattern "**/package-lock.json" (restore-keys optional) so the "npm install --no-check" in the run block reuses the cache; also ensure the recommended Swatinem/rust-cachev2 step remains after the nix-store cache step for any cargo work as per the workflow guidance.AGENTS.md (1)
65-66: ⚡ Quick winThe
copilot-setup-stepsexample is already stale.That workflow now uses
nix develop .#wasm-shell, so keeping it here as the example for when the heavy default devshell is required will mislead the next workflow change. Please drop the example or replace it with one that still exists.Based on learnings
Use slim shells (\nix develop .#wasm-shell` for rust+node work, `.#subgraph-shell` for graph CLI work) over default devshell; default shells should only be used when legitimately needing the full toolchain`.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@AGENTS.md` around lines 65 - 66, The README line references a stale example "copilot-setup-steps" when advising use of the heavy default devshell via "nix develop -c"; remove or replace that example with a current, accurate one (e.g., mention using slim shells like "nix develop .#wasm-shell" for Rust+Node or ".#subgraph-shell" for graph CLI) and update the sentence to recommend slim shells by name and reserve the default devshell only for true full-toolchain needs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/copilot-setup-steps.yml:
- Around line 51-59: Remove the package-local install and run lint from the
workspace root: delete the subshell "(cd packages/ui-components && npm i && npm
run lint)" and instead, after running "npm install --no-check" at the root
inside the bash -c block, invoke the workspace lint from the root (e.g., "npm
run lint -w `@rainlanguage/ui-components`" or the root "npm run lint" that covers
that package); ensure "npm install --no-check" remains the first command inside
the bash -c to preserve proper npm workspace resolution.
- Around line 20-36: The workflow uses mutable tags for several actions
(cachix/cachix-action@v15, nix-community/cache-nix-action@v7,
Swatinem/rust-cache@v2, actions/cache@v4); replace each `uses:` reference with
the corresponding immutable commit SHA (e.g. `owner/repo@<full-commit-sha>`) to
pin versions, keeping existing `with:` inputs and step names unchanged; fetch
the latest trusted commit SHAs from each action's GitHub repo/releases, update
the four `uses:` lines accordingly, and commit the updated workflow.
In @.github/workflows/deploy-subgraph.yaml:
- Around line 22-27: Locate the GitHub Actions step that currently uses
"cachix/cachix-action@v15" in the deploy workflow and replace the floating tag
with the upstream action's exact commit SHA (e.g.,
"cachix/cachix-action@<full-commit-sha>"); keep the existing inputs (name,
authToken, useDaemon, continue-on-error) unchanged, and ensure you use the
full-length commit SHA from the cachix/cachix-action repository to prevent tag
retargeting.
In @.github/workflows/manual-rs-release.yml:
- Around line 16-21: Replace the floating action ref cachix/cachix-action@v15 in
the workflow with a specific commit SHA to pin the dependency; update the line
that currently references cachix/cachix-action@v15 in
.github/workflows/manual-rs-release.yml to use cachix/cachix-action@<COMMIT_SHA>
(the exact commit SHA you choose), verify the SHA points to a release/commit you
trust, and keep the other keys (continue-on-error, with.name, with.authToken,
with.useDaemon) unchanged.
In @.github/workflows/npm-package-release.yml:
- Around line 40-64: The workflow currently references third-party actions with
mutable tags (nixbuild/nix-quick-install-action@v30, cachix/cachix-action@v15,
nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2, actions/cache@v4);
replace each `uses:` reference with the corresponding immutable commit SHA
(e.g., nixbuild/nix-quick-install-action@<sha>, cachix/cachix-action@<sha>,
nix-community/cache-nix-action@<sha>, Swatinem/rust-cache@<sha>,
actions/cache@<sha>) by looking up the latest vetted commit on each action’s
GitHub repo and pinning that SHA so the release job uses fixed versions.
In @.github/workflows/test-ui-components.yaml:
- Around line 27-32: Replace the floating tag cachix/cachix-action@v15 with a
specific commit SHA to pin the action (e.g., change "cachix/cachix-action@v15"
to "cachix/cachix-action@<commit-sha>"); edit the workflow step that currently
contains name: rainlanguage, authToken: ${{ secrets.CACHIX_AUTH_TOKEN }},
useDaemon: false and continue-on-error: true to reference the chosen commit SHA
instead of the tag so the CI uses an immutable release; do not add or change npm
caching steps since this workflow follows the repo convention of using npm
install --no-check alongside the nix cache action.
In @.github/workflows/test-webapp.yaml:
- Around line 27-32: Replace the floating ref "uses: cachix/cachix-action@v15"
with a pinned commit SHA for cachix/cachix-action (use the specific commit SHA
for the release you want) while preserving the inputs (continue-on-error, name,
authToken, useDaemon) so the step still behaves the same; additionally, add an
npm cache step using actions/cache@v4 before the "npm install --no-check" step
that caches path ~/.npm with a key derived from package-lock.json (or
package.json) and a restore-keys fallback so the "npm install --no-check" run
benefits from npm caching.
In @.github/workflows/vercel-docs-preview.yaml:
- Around line 24-45: The workflow uses mutable version tags for third-party
actions which should be pinned to immutable commit SHAs; update each `uses:`
reference—nixbuild/nix-quick-install-action@v30, cachix/cachix-action@v15,
nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2, and
actions/cache@v4—to the corresponding repository commit SHA (replace the tag
with owner/repo@<full-commit-sha>) so the workflow references a specific commit;
locate these `uses:` lines in the vercel-docs-preview.yaml and swap the tag
versions for verified commit SHAs (and optionally add a comment with the
tag-to-sha mapping for future maintenance).
In @.github/workflows/vercel-docs-prod.yaml:
- Around line 19-42: Replace floating version tags with pinned commit SHAs for
each third-party GitHub Action used: jlumbroso/free-disk-space@v1.3.1,
nixbuild/nix-quick-install-action@v30, cachix/cachix-action@v15,
nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2, and actions/cache@v4;
locate the `uses:` entries for those exact strings and update them to the
corresponding full commit SHA (e.g., jlumbroso/free-disk-space@<commit-sha>) so
each action is fixed to a specific commit instead of a floating tag. Ensure you
verify the correct SHA on the action's GitHub repo and replace the tag only,
leaving surrounding step configuration unchanged.
In @.github/workflows/vercel-preview.yaml:
- Around line 60-69: The bootstrap workflow step is inheriting the secret
PUBLIC_WALLETCONNECT_PROJECT_ID while running repo-controlled npm install and
builds; remove the webapp build from this step so secrets aren't exposed. Edit
the nix develop step that runs "npm install --no-check" and the three "npm run
build -w ..." commands (targets `@rainlanguage/raindex`,
`@rainlanguage/ui-components`, `@rainlanguage/webapp`) and either delete those
commands or move them into the later dedicated webapp/Vercel job, and stop
exporting PUBLIC_WALLETCONNECT_PROJECT_ID in this step's env block so the secret
is only present in the webapp/Vercel deployment job.
- Around line 43-48: The workflow step using the unpinned action
"cachix/cachix-action@v15" should be replaced with an immutable commit SHA:
locate the GitHub Actions step that contains uses: cachix/cachix-action@v15 and
change it to uses: cachix/cachix-action@<commit-sha> (the full 40-char commit
SHA from the cachix/cachix-action repo) so the action is pinned; update all
other occurrences of cachix/cachix-action@v15 to the same commit SHA for
consistency.
In @.github/workflows/vercel-prod.yaml:
- Around line 26-31: Replace the floating action ref "cachix/cachix-action@v15"
with a specific commit SHA to hard-pin the dependency: locate the step that
references cachix/cachix-action (the block with name: rainlanguage, authToken,
useDaemon) and change the action reference to the form
cachix/cachix-action@<commit-sha> using the action's latest stable commit SHA
from its GitHub repo; keep the existing inputs (name, authToken, useDaemon)
unchanged.
---
Nitpick comments:
In @.github/workflows/manual-rs-release.yml:
- Around line 22-33: Add the standard Rust cache step (Swatinem/rust-cachev2)
immediately after the existing nix cache step
(nix-community/cache-nix-action@v6) and before the cargo release invocation (the
run: nix develop .#rust-shell --command cargo release --workspace line) so that
cargo artifacts are restored for the heavy release run; insert a step using
uses: Swatinem/rust-cachev2 with the repo-standard inputs (keeping it after the
Nix restore/save block) to avoid cold rebuilds on manual release runs.
In @.github/workflows/test-ui-components.yaml:
- Around line 44-51: Add an actions/cache step immediately before the run step
that executes "npm install --no-check" to cache the npm artifacts; use
actions/cache v4, cache the npm directory (e.g. ~/.npm) and key it by the repo
package-lock pattern "**/package-lock.json" (restore-keys optional) so the "npm
install --no-check" in the run block reuses the cache; also ensure the
recommended Swatinem/rust-cachev2 step remains after the nix-store cache step
for any cargo work as per the workflow guidance.
In @.github/workflows/test-webapp.yaml:
- Around line 44-50: Add the repo-standard npm cache step before the existing
npm install/build block: insert an actions/cachev4 step (targeting ~/.npm) keyed
by **/package-lock.json and place it after the nix-store cache step but before
the run that invokes "npm install --no-check" and the builds for
`@rainlanguage/raindex`, `@rainlanguage/ui-components`, and `@rainlanguage/webapp`;
ensure the cache action uses Swatinem/rust-cachev2 practices (i.e., cache
restore before installs) so subsequent runs reuse ~/.npm rather than
repopulating it each time.
In @.github/workflows/vercel-prod.yaml:
- Around line 43-50: Add the standard npm cache step before the workspace npm
install block that runs the bash command (the block containing "npm install
--no-check" and the three "npm run build -w ..." lines): create an actions/cache
(actions/cache@v4) step keyed by "**/package-lock.json" that caches/restores the
~/.npm directory so the subsequent npm install --no-check does not re-download
all dependencies each run; place this cache step immediately prior to the run
step in the workflow and ensure the cache path targets the repository npm cache
(~/.npm) per repo standard.
In `@AGENTS.md`:
- Around line 65-66: The README line references a stale example
"copilot-setup-steps" when advising use of the heavy default devshell via "nix
develop -c"; remove or replace that example with a current, accurate one (e.g.,
mention using slim shells like "nix develop .#wasm-shell" for Rust+Node or
".#subgraph-shell" for graph CLI) and update the sentence to recommend slim
shells by name and reserve the default devshell only for true full-toolchain
needs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 22507987-c580-4076-b76e-a1aa9a15018b
📒 Files selected for processing (24)
.github/workflows/copilot-setup-steps.yml.github/workflows/deploy-subgraph.yaml.github/workflows/manual-rs-release.yml.github/workflows/npm-package-release.yml.github/workflows/test-js-bindings.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/vercel-docs-preview.yaml.github/workflows/vercel-docs-prod.yaml.github/workflows/vercel-preview.yaml.github/workflows/vercel-prod.yaml.github/workflows/wasm-artifacts.yaml.github/workflows/wasm-browser-test.yaml.github/workflows/wasm-test.yamlAGENTS.mdREADME.mdREUSE.tomlcrates/test_fixtures/abis/RaindexV6.jsoncrates/test_fixtures/abis/RaindexV6SubParser.jsonflake.nixpointers.shprep-all.shprep-webapp.shscript/build.sh
💤 Files with no reviewable changes (5)
- pointers.sh
- REUSE.toml
- crates/test_fixtures/abis/RaindexV6SubParser.json
- prep-webapp.sh
- prep-all.sh
✅ Files skipped from review due to trivial changes (1)
- README.md
🚧 Files skipped from review as they are similar to previous changes (4)
- .github/workflows/wasm-test.yaml
- .github/workflows/wasm-browser-test.yaml
- .github/workflows/wasm-artifacts.yaml
- script/build.sh
Comment on lines
+20
to
+36
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false | ||
| - name: Restore and save Nix store | ||
| uses: nix-community/cache-nix-action@v6 | ||
| uses: nix-community/cache-nix-action@v7 | ||
| with: | ||
| primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }} | ||
| restore-prefixes-first-match: nix-${{ runner.os }}- | ||
| gc-max-store-size-linux: 1G | ||
| - uses: Swatinem/rust-cache@v2 | ||
| with: | ||
| prefix-key: rust-${{ github.workflow }} | ||
| - name: Cache npm | ||
| uses: actions/cache@v4 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant section from the target workflow
target=".github/workflows/copilot-setup-steps.yml"
if [ -f "$target" ]; then
echo "=== $target (lines 1-120) ==="
nl -ba "$target" | sed -n '1,120p'
else
echo "Missing file: $target" >&2
fi
# Find other workflows' uses patterns (pinning vs version tags)
echo
echo "=== Scan other workflows for uses:@<sha> vs uses:`@v`* ==="
# List all workflow files
wf_files=$(git ls-files ".github/workflows/**/*.{yml,yaml}" 2>/dev/null || true)
echo "Workflows found: $(echo "$wf_files" | wc -l)"
# Count uses lines with @<40-hex> and with `@v`
echo "Counts across workflows:"
printf "%s\n" "$wf_files" | while read -r f; do
[ -n "$f" ] || continue
# sha-like (at least 40 hex chars)
sha_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@[0-9a-f]{40,}" "$f" -S --count || true)
# common version tags
ver_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@v[0-9]+(\.[0-9]+)*" "$f" -S --count || true)
# actions without pin (heuristic: uses: ...@v or uses: ...@* but not sha)
unpinned_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@(?![0-9a-f]{40,})[^ ]+" "$f" -S --count || true)
printf "%-70s sha=%s ver=%s unpinned=%s\n" "$f" "${sha_cnt:-0}" "${ver_cnt:-0}" "${unpinned_cnt:-0}"
doneRepository: rainlanguage/raindex
Length of output: 189
🏁 Script executed:
#!/bin/bash
set -euo pipefail
target=".github/workflows/copilot-setup-steps.yml"
if [ -f "$target" ]; then
echo "=== $target (first 160 lines) ==="
awk '{printf "%4d\t%s\n", NR, $0}' "$target" | sed -n '1,160p'
else
echo "Missing file: $target" >&2
exit 1
fi
echo
echo "=== Scan other workflows for uses:@<sha> vs uses:`@v`* ==="
wf_files=$(git ls-files ".github/workflows/**/*.{yml,yaml}" 2>/dev/null || true)
echo "Workflows found: $(echo "$wf_files" | wc -l)"
printf "%-70s %12s %12s %12s\n" "workflow" "sha_pins" "version_uses" "unpinned"
printf "%-70s %12s %12s %12s\n" "--------" "---------" "-------------" "--------"
while read -r f; do
[ -n "$f" ] || continue
sha_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@[0-9a-f]{40,}" "$f" -S --count || true)
ver_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@v[0-9]+(\.[0-9]+)*" "$f" -S --count || true)
# "unpinned" heuristic: uses something that's not a full SHA (>=40 hex), including `@v`* tags.
unpinned_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@(?:(?![0-9a-f]{40,})[^ ]+)" "$f" -S --count || true)
printf "%-70s %12s %12s %12s\n" "$f" "${sha_cnt:-0}" "${ver_cnt:-0}" "${unpinned_cnt:-0}"
done <<< "$wf_files"Repository: rainlanguage/raindex
Length of output: 3353
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== List .github/workflows tree ==="
ls -R .github/workflows || true
echo
echo "=== List workflow files tracked by git ==="
git ls-files ".github/workflows/**/*.{yml,yaml}" || true
echo
echo "=== Scan all workflow files (uses pinning patterns) ==="
wf_files=$(git ls-files ".github/workflows/**/*.{yml,yaml}" 2>/dev/null || true)
echo "Workflows found: $(echo "$wf_files" | wc -l)"
printf "%-70s %12s %12s %12s\n" "workflow" "sha_pins" "version_uses" "unpinned"
printf "%-70s %12s %12s %12s\n" "--------" "---------" "-------------" "--------"
while read -r f; do
[ -n "$f" ] || continue
sha_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@[0-9a-f]{40,}" "$f" -S --count || true)
ver_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@v[0-9]+(\.[0-9]+)*" "$f" -S --count || true)
unpinned_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@(?:(?![0-9a-f]{40,})[^ ]+)" "$f" -S --count || true)
printf "%-70s %12s %12s %12s\n" "$f" "${sha_cnt:-0}" "${ver_cnt:-0}" "${unpinned_cnt:-0}"
done <<< "$wf_files"Repository: rainlanguage/raindex
Length of output: 883
🏁 Script executed:
#!/bin/bash
set -euo pipefail
shopt -s nullglob
files=(.github/workflows/*.{yml,yaml} .github/workflows/*/*.yml .github/workflows/*/*.yaml)
# filter existing
existing=()
for f in "${files[@]}"; do
[ -f "$f" ] && existing+=("$f")
done
echo "Found workflow files:"
printf ' - %s\n' "${existing[@]}"
echo
echo "=== Any uses pinned to SHAs (40+ hex) in workflows? ==="
rg -n --no-heading "uses:\s+[^ ]+@[0-9a-f]{40,}" "${existing[@]}" -S || true
echo
echo "=== Count uses by pin type ==="
for f in "${existing[@]}"; do
sha_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@[0-9a-f]{40,}" "$f" -S --count || true)
ver_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@v[0-9]+(\.[0-9]+)*" "$f" -S --count || true)
branch_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@main|uses:\s+[^ ]+@master|uses:\s+[^ ]+@refs/heads/" "$f" -S --count || true)
other_cnt=$(rg -n --no-heading "uses:\s+[^ ]+@(?:(?![0-9a-f]{40,}).[^ \n]+)" "$f" -S --count || true)
printf "%-35s sha=%-3s ver=%-3s branch=%-3s other=%s\n" "$f" "$sha_cnt" "$ver_cnt" "$branch_cnt" "$other_cnt"
done
echo
echo "=== Unique unpinned uses in copilot-setup-steps.yml ==="
rg -n --no-heading "uses:\s+[^ ]+@(?:(?![0-9a-f]{40,}).[^ \n]+)" ".github/workflows/copilot-setup-steps.yml" -S || trueRepository: rainlanguage/raindex
Length of output: 8452
Pin newly added workflow actions to commit SHAs
In .github/workflows/copilot-setup-steps.yml (lines 20-36), these actions are referenced only via mutable version tags (cachix/cachix-action@v15, nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2, actions/cache@v4). Pin each uses: to an immutable full commit SHA (...@<40+hex>) instead.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 36-36: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/copilot-setup-steps.yml around lines 20 - 36, The workflow
uses mutable tags for several actions (cachix/cachix-action@v15,
nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2, actions/cache@v4);
replace each `uses:` reference with the corresponding immutable commit SHA (e.g.
`owner/repo@<full-commit-sha>`) to pin versions, keeping existing `with:` inputs
and step names unchanged; fetch the latest trusted commit SHAs from each
action's GitHub repo/releases, update the four `uses:` lines accordingly, and
commit the updated workflow.
Comment on lines
+51
to
+59
| - run: | | ||
| nix develop .#wasm-shell -c bash -c ' | ||
| set -euxo pipefail | ||
| npm install --no-check | ||
| (cd packages/ui-components && npm i && npm run lint) | ||
| npm run build -w @rainlanguage/raindex | ||
| npm run build -w @rainlanguage/ui-components | ||
| npm run build -w @rainlanguage/webapp | ||
| ' |
Contributor
There was a problem hiding this comment.
Drop the package-local npm i here.
After the root npm install --no-check, doing another install inside packages/ui-components reintroduces the exact workspace-resolution problem this shell wrapper is avoiding. Run the lint script from the root workspace instead.
Suggested change
nix develop .#wasm-shell -c bash -c '
set -euxo pipefail
npm install --no-check
- (cd packages/ui-components && npm i && npm run lint)
+ npm run lint -w `@rainlanguage/ui-components`
npm run build -w `@rainlanguage/raindex`
npm run build -w `@rainlanguage/ui-components`
npm run build -w `@rainlanguage/webapp`
'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - run: | | |
| nix develop .#wasm-shell -c bash -c ' | |
| set -euxo pipefail | |
| npm install --no-check | |
| (cd packages/ui-components && npm i && npm run lint) | |
| npm run build -w @rainlanguage/raindex | |
| npm run build -w @rainlanguage/ui-components | |
| npm run build -w @rainlanguage/webapp | |
| ' | |
| - run: | | |
| nix develop .#wasm-shell -c bash -c ' | |
| set -euxo pipefail | |
| npm install --no-check | |
| npm run lint -w `@rainlanguage/ui-components` | |
| npm run build -w `@rainlanguage/raindex` | |
| npm run build -w `@rainlanguage/ui-components` | |
| npm run build -w `@rainlanguage/webapp` | |
| ' |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/copilot-setup-steps.yml around lines 51 - 59, Remove the
package-local install and run lint from the workspace root: delete the subshell
"(cd packages/ui-components && npm i && npm run lint)" and instead, after
running "npm install --no-check" at the root inside the bash -c block, invoke
the workspace lint from the root (e.g., "npm run lint -w
`@rainlanguage/ui-components`" or the root "npm run lint" that covers that
package); ensure "npm install --no-check" remains the first command inside the
bash -c to preserve proper npm workspace resolution.
Comment on lines
+22
to
+27
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ls -la .github/workflows || true
sed -n '1,140p' .github/workflows/deploy-subgraph.yaml | nl -ba | sed -n '1,160p'
echo "---- other workflows (action pinning conventions) ----"
fd -t f -g '*.yml' .github/workflows -x echo {} >/dev/null 2>&1 || true
# List some uses lines containing cachix/cachix-action and also any unpinned uses occurrences
rg -n "uses:\s*[^@]+@v\d+(\.\d+)*\s*$" .github/workflows --glob '*.yml' --glob '*.yaml' || true
rg -n "uses:\s*cachix/cachix-action@" .github/workflows --glob '*.yml' --glob '*.yaml' || true
# Collect a few uses lines with SHA pinning patterns
rg -n "uses:\s*[^@]+@[0-9a-f]{7,40}\s*$" .github/workflows --glob '*.yml' --glob '*.yaml' | head -n 50 || trueRepository: rainlanguage/raindex
Length of output: 1713
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant workflow section around lines ~10-40 with line numbers
if [ -f ".github/workflows/deploy-subgraph.yaml" ]; then
sed -n '1,160p' .github/workflows/deploy-subgraph.yaml | nl -ba | sed -n '1,200p'
fi
echo "---- Find uses: lines in deploy-subgraph.yaml ----"
rg -n "uses:" .github/workflows/deploy-subgraph.yaml || true
echo "---- Repo-wide workflow conventions: find unpinned uses refs ----"
# Heuristic: floating tags like `@v1`, `@v2`, `@v15` etc (not SHA-like)
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@v[0-9]+(\.[0-9]+)*\s*$" .github/workflows || true
echo "---- Repo-wide: find cachix/cachix-action occurrences ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*cachix/cachix-action@" .github/workflows || true
echo "---- Repo-wide: find uses pinned to commit SHA ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@[0-9a-f]{7,40}\s*$" .github/workflows | head -n 80 || trueRepository: rainlanguage/raindex
Length of output: 107
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the workflow section with line numbers
if [ -f ".github/workflows/deploy-subgraph.yaml" ]; then
sed -n '1,160p' .github/workflows/deploy-subgraph.yaml | nl -ba | sed -n '1,220p'
fi
echo "---- Find uses: lines in deploy-subgraph.yaml ----"
rg -n "uses:" .github/workflows/deploy-subgraph.yaml || true
echo "---- Repo-wide workflow conventions: unpinned uses refs (heuristic) ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@v[0-9]+(\.[0-9]+)*\s*$" .github/workflows || true
echo "---- Repo-wide: cachix/cachix-action occurrences ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*cachix/cachix-action@" .github/workflows || true
echo "---- Repo-wide: uses pinned to commit SHA (heuristic) ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@[0-9a-f]{7,40}\s*$" .github/workflows | head -n 80 || trueRepository: rainlanguage/raindex
Length of output: 107
🏁 Script executed:
#!/bin/bash
set -euo pipefail
wf=".github/workflows/deploy-subgraph.yaml"
if [ -f "$wf" ]; then
echo "---- $wf (lines 1-120) ----"
sed -n '1,120p' "$wf" | awk '{printf "%4d\t%s\n", NR, $0}'
fi
echo "---- uses: lines in deploy-subgraph.yaml ----"
rg -n "uses:" "$wf" || true
echo "---- cachix/cachix-action occurrences ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*cachix/cachix-action@" .github/workflows || true
echo "---- repo-wide unpinned uses refs (heuristic: `@v`*) ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@v[0-9]+(\.[0-9]+)*\s*$" .github/workflows || true
echo "---- repo-wide uses pinned to commit SHA (heuristic) ----"
rg -n --glob '*.yml' --glob '*.yaml' "uses:\s*[^@]+@[0-9a-f]{7,40}\s*$" .github/workflows | head -n 80 || trueRepository: rainlanguage/raindex
Length of output: 10509
Pin cachix/cachix-action to a commit SHA (avoid floating tags).
.github/workflows/deploy-subgraph.yaml uses cachix/cachix-action@v15; pin it to the exact commit SHA to prevent upstream tag retargeting in this privileged deploy workflow.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-subgraph.yaml around lines 22 - 27, Locate the
GitHub Actions step that currently uses "cachix/cachix-action@v15" in the deploy
workflow and replace the floating tag with the upstream action's exact commit
SHA (e.g., "cachix/cachix-action@<full-commit-sha>"); keep the existing inputs
(name, authToken, useDaemon, continue-on-error) unchanged, and ensure you use
the full-length commit SHA from the cachix/cachix-action repository to prevent
tag retargeting.
Comment on lines
+16
to
+21
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Show the full workflow for manual-rs-release.yml (small file likely)
echo "=== manual-rs-release.yml ==="
if [ -f ".github/workflows/manual-rs-release.yml" ]; then
sed -n '1,220p' .github/workflows/manual-rs-release.yml | cat -n
else
echo "Missing: .github/workflows/manual-rs-release.yml"
fi
# 2) Find other workflows that mention Cachix and/or Rust caching conventions
echo
echo "=== Workflows using cachix/cachix-action ==="
rg -n "cachix/cachix-action@" .github/workflows --hidden || true
echo
echo "=== Workflows using Rust cache actions (common patterns) ==="
rg -n "rust-cache|Swatinem/rust-cache|actions/cache.*cargo|cache.*cargo|cache.*rust" .github/workflows --hidden || true
echo
echo "=== List all workflows files (for convention comparison) ==="
ls -1 .github/workflows || trueRepository: rainlanguage/raindex
Length of output: 4487
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Manual rs release: rust cache references ==="
rg -n "rust-cache|Swatinem/rust-cache|actions/cache|cache.*cargo|cache.*rust" .github/workflows/manual-rs-release.yml || trueRepository: rainlanguage/raindex
Length of output: 113
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Manual rs release: rust cache references ==="
rg -n "rust-cache|Swatinem/rust-cache|actions/cache|cache.*cargo|cache.*rust" .github/workflows/manual-rs-release.yml || trueRepository: rainlanguage/raindex
Length of output: 113
Pin cachix/cachix-action to a commit SHA instead of @v15 in .github/workflows/manual-rs-release.yml. Floating uses: refs weaken the trust boundary on a release workflow.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/manual-rs-release.yml around lines 16 - 21, Replace the
floating action ref cachix/cachix-action@v15 in the workflow with a specific
commit SHA to pin the dependency; update the line that currently references
cachix/cachix-action@v15 in .github/workflows/manual-rs-release.yml to use
cachix/cachix-action@<COMMIT_SHA> (the exact commit SHA you choose), verify the
SHA points to a release/commit you trust, and keep the other keys
(continue-on-error, with.name, with.authToken, with.useDaemon) unchanged.
Comment on lines
+40
to
+64
| - uses: nixbuild/nix-quick-install-action@v30 | ||
| with: | ||
| determinate: true | ||
| # cache nix store to speed up subsequent builds | ||
| - uses: DeterminateSystems/flakehub-cache-action@main | ||
| nix_conf: | | ||
| keep-env-derivations = true | ||
| keep-outputs = true | ||
| # pull rainix derivations from shared Cachix; push new ones if the | ||
| # token is set. continue-on-error so a token miss / Cachix outage | ||
| # degrades gracefully. | ||
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false | ||
| - name: Restore and save Nix store | ||
| uses: nix-community/cache-nix-action@v7 | ||
| with: | ||
| primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }} | ||
| restore-prefixes-first-match: nix-${{ runner.os }}- | ||
| gc-max-store-size-linux: 8G | ||
| - uses: Swatinem/rust-cache@v2 | ||
| with: | ||
| prefix-key: rust-${{ github.workflow }} | ||
| - name: Cache npm | ||
| uses: actions/cache@v4 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# List the workflow file
ls -la .github/workflows/npm-package-release.yml 2>/dev/null || true
# Show the relevant portion (lines with numbers) around 1-120
sed -n '1,200p' .github/workflows/npm-package-release.yml
# Collect all uses lines in this workflow
echo "---- uses lines in npm-package-release.yml ----"
rg -n "^\s*- uses:" .github/workflows/npm-package-release.yml
# Search other workflows for pinned vs `@v`* patterns
echo "---- uses lines across workflows (sample) ----"
rg -n "^\s*- uses:" .github/workflows --glob '**/*.{yml,yaml}' | head -n 50
echo "---- count uses with `@v`* vs @<sha> (heuristic) ----"
python3 - <<'PY'
import re, subprocess, os, sys, pathlib, json
from collections import Counter
workflows_dir = pathlib.Path(".github/workflows")
paths = [str(p) for p in workflows_dir.rglob("*.yml")] + [str(p) for p in workflows_dir.rglob("*.yaml")]
pattern = re.compile(r'^\s*-\s+uses:\s*([^\s]+)@(.+?)\s*(#.*)?$')
counts = Counter()
bad = []
all_entries=[]
for path in paths:
txt = pathlib.Path(path).read_text(errors='ignore').splitlines()
for i,line in enumerate(txt,1):
m = re.match(r'^\s*-\s+uses:\s*(.+?)@(.+?)\s*$', line)
if m:
repo, ref = m.group(1), m.group(2)
if re.fullmatch(r'[0-9a-fA-F]{7,40}', ref):
counts['pinned_sha'] += 1
elif re.fullmatch(r'v\d+(\.\d+)*', ref) or ref.startswith('v'):
counts['major_semver_tag'] += 1
else:
counts['other_ref'] += 1
all_entries.append((path,i,repo,ref))
for k,v in counts.items():
print(k, v)
# Show examples of semver tags
semver_examples=[e for e in all_entries if re.fullmatch(r'v\d+(\.\d+)*', e[3]) or e[3].startswith('v')]
print("---- semver-like ref examples (up to 25) ----")
for path,i,repo,ref in semver_examples[:25]:
print(f"{path}:{i}: {repo}@{ref}")
# Show examples of sha pins (up to 10)
sha_examples=[e for e in all_entries if re.fullmatch(r'[0-9a-fA-F]{7,40}', e[3])]
print("---- sha pin examples (up to 10) ----")
for path,i,repo,ref in sha_examples[:10]:
print(f"{path}:{i}: {repo}@{ref}")
PYRepository: rainlanguage/raindex
Length of output: 17292
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ls -la .github/workflows/npm-package-release.yml
sed -n '1,220p' .github/workflows/npm-package-release.yml
echo "---- uses lines in npm-package-release.yml ----"
rg -n "^\s*-\s+uses:" .github/workflows/npm-package-release.yml
echo "---- count uses with `@v`* vs @<sha> across workflows (heuristic) ----"
python3 - <<'PY'
import re, pathlib
from collections import Counter
paths = list(pathlib.Path(".github/workflows").rglob("*.yml")) + list(pathlib.Path(".github/workflows").rglob("*.yaml"))
counts=Counter()
semver=[]
sha=[]
other=[]
pattern = re.compile(r'^\s*-\s+uses:\s*(.+?)@(.+?)\s*$')
for p in paths:
lines=p.read_text(errors='ignore').splitlines()
for i,line in enumerate(lines,1):
m=pattern.match(line)
if not m:
continue
ref=m.group(2).strip()
if re.fullmatch(r'[0-9a-fA-F]{7,40}', ref):
counts['pinned_sha']+=1; sha.append((str(p),i,m.group(1),ref))
elif ref.startswith('v') and re.fullmatch(r'v\d+(\.\d+)*', ref):
counts['major_semver_tag']+=1; semver.append((str(p),i,m.group(1),ref))
else:
counts['other_ref']+=1; other.append((str(p),i,m.group(1),ref))
print(counts)
print("sha examples:")
for e in sha[:10]:
print(e)
print("semver examples:")
for e in semver[:10]:
print(e)
PYRepository: rainlanguage/raindex
Length of output: 12746
Pin external uses: actions in the release job to immutable SHAs
.github/workflows/npm-package-release.yml references third-party actions via mutable major-version tags in the release/publish path (nixbuild/nix-quick-install-action@v30, cachix/cachix-action@v15, nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2, actions/cache@v4); pin these uses: refs to commit SHAs to reduce supply-chain risk.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 40-40: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 48-48: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 55-55: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 60-60: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 64-64: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 55-55: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): always restores from cache
(cache-poisoning)
[error] 60-60: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
[error] 64-64: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/npm-package-release.yml around lines 40 - 64, The workflow
currently references third-party actions with mutable tags
(nixbuild/nix-quick-install-action@v30, cachix/cachix-action@v15,
nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2, actions/cache@v4);
replace each `uses:` reference with the corresponding immutable commit SHA
(e.g., nixbuild/nix-quick-install-action@<sha>, cachix/cachix-action@<sha>,
nix-community/cache-nix-action@<sha>, Swatinem/rust-cache@<sha>,
actions/cache@<sha>) by looking up the latest vetted commit on each action’s
GitHub repo and pinning that SHA so the release job uses fixed versions.
Comment on lines
+24
to
+45
| - uses: nixbuild/nix-quick-install-action@v30 | ||
| with: | ||
| determinate: true | ||
| - uses: DeterminateSystems/flakehub-cache-action@main | ||
| - run: ./prep-all.sh | ||
| env: | ||
| PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID }} | ||
| - run: nix develop .#webapp-shell -c npm run docs | ||
| working-directory: packages/raindex | ||
| nix_conf: | | ||
| keep-env-derivations = true | ||
| keep-outputs = true | ||
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false | ||
| - name: Restore and save Nix store | ||
| uses: nix-community/cache-nix-action@v7 | ||
| with: | ||
| primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }} | ||
| restore-prefixes-first-match: nix-${{ runner.os }}- | ||
| gc-max-store-size-linux: 8G | ||
| - uses: Swatinem/rust-cache@v2 | ||
| with: | ||
| prefix-key: rust-${{ github.workflow }} | ||
| - name: Cache npm | ||
| uses: actions/cache@v4 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant workflow section with line numbers
sed -n '1,120p' .github/workflows/vercel-docs-preview.yaml | nl -ba
# Extract all `uses:` lines in the workflow (to check pinning style)
rg -n "^\s*- uses: " .github/workflows/vercel-docs-preview.yaml
# Check other workflow files for action pinning convention (SHA vs major tag)
# Limit output to just `uses:` lines for quick pattern comparison
fd ".github/workflows" -t f | head -n 1 >/dev/null 2>&1 || true
for f in $(ls .github/workflows/*.yml .github/workflows/*.yaml 2>/dev/null); do
echo "---- $f ----"
rg -n "^\s*- uses: " "$f" | head -n 30
doneRepository: rainlanguage/raindex
Length of output: 107
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/vercel-docs-preview.yaml"
echo "---- $FILE (lines 1-120) ----"
sed -n '1,120p' "$FILE" | cat -n
echo
echo "---- uses: lines in $FILE ----"
rg -n "^\s*- uses:\s" "$FILE" || true
echo
echo "---- uses: pinning style in other workflows ----"
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -e "$f" ] || continue
echo "---- $f ----"
# show only top few uses lines for context
rg -n "^\s*- uses:\s" "$f" | head -n 30 || true
done
echo
echo "---- action references that look like tags (vN / vN.N / master) in $FILE ----"
rg -n "^\s*- uses:\s*[^@]+@((v[0-9]+(\.[0-9]+)*)|master|main|master|latest)\b" "$FILE" || true
echo
echo "---- action references with commit SHAs in $FILE ----"
rg -n "^\s*- uses:\s*[^@]+@([0-9a-f]{40})\b" "$FILE" || trueRepository: rainlanguage/raindex
Length of output: 8937
Pin the added third-party uses: action refs to commit SHAs.
Lines 24-45 reference mutable version tags instead of immutable SHAs:
nixbuild/nix-quick-install-action@v30cachix/cachix-action@v15nix-community/cache-nix-action@v7Swatinem/rust-cache@v2actions/cache@v4
🧰 Tools
🪛 zizmor (1.25.2)
[error] 24-24: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 29-29: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 36-36: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 41-41: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 45-45: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/vercel-docs-preview.yaml around lines 24 - 45, The
workflow uses mutable version tags for third-party actions which should be
pinned to immutable commit SHAs; update each `uses:`
reference—nixbuild/nix-quick-install-action@v30, cachix/cachix-action@v15,
nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2, and
actions/cache@v4—to the corresponding repository commit SHA (replace the tag
with owner/repo@<full-commit-sha>) so the workflow references a specific commit;
locate these `uses:` lines in the vercel-docs-preview.yaml and swap the tag
versions for verified commit SHAs (and optionally add a comment with the
tag-to-sha mapping for future maintenance).
Comment on lines
+19
to
+42
| - name: Free disk space | ||
| uses: jlumbroso/free-disk-space@v1.3.1 | ||
| - uses: nixbuild/nix-quick-install-action@v30 | ||
| with: | ||
| determinate: true | ||
| - uses: DeterminateSystems/flakehub-cache-action@main | ||
| - run: ./prep-all.sh | ||
| env: | ||
| PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID }} | ||
| - run: nix develop .#webapp-shell -c npm run docs | ||
| working-directory: packages/raindex | ||
| nix_conf: | | ||
| keep-env-derivations = true | ||
| keep-outputs = true | ||
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false | ||
| - name: Restore and save Nix store | ||
| uses: nix-community/cache-nix-action@v7 | ||
| with: | ||
| primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }} | ||
| restore-prefixes-first-match: nix-${{ runner.os }}- | ||
| gc-max-store-size-linux: 8G | ||
| - uses: Swatinem/rust-cache@v2 | ||
| with: | ||
| prefix-key: rust-${{ github.workflow }} | ||
| - name: Cache npm | ||
| uses: actions/cache@v4 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/vercel-docs-prod.yaml"
echo "=== File: $FILE (relevant section) ==="
if [ -f "$FILE" ]; then
nl -ba "$FILE" | sed -n '1,140p'
else
echo "Missing: $FILE"
fi
echo
echo "=== Search for other workflows pinning uses to SHAs (quick heuristic) ==="
# Look for common pattern "uses: owner/repo@<40hex>" in workflow files
rg -n --glob ".github/workflows/**/*.{yml,yaml}" "uses:\s*[^@]+@[0-9a-fA-F]{40}\b" .github/workflows || true
echo
echo "=== Find uses lines in this workflow for pinning status ==="
if [ -f "$FILE" ]; then
rg -n "uses:\s*" "$FILE"
echo
echo "=== Extract uses lines with any @ tag/version ==="
rg -n "uses:\s*([^@]+)@(.+)$" "$FILE" || true
fiRepository: rainlanguage/raindex
Length of output: 198
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/vercel-docs-prod.yaml"
echo "=== File: $FILE (relevant section) ==="
if [ -f "$FILE" ]; then
cat -n "$FILE" | sed -n '1,180p'
else
echo "Missing: $FILE"
fi
echo
echo "=== Search for other workflows pinning uses to SHAs (pattern uses: owner/repo@40hex) ==="
rg -n --glob ".github/workflows/**/*.{yml,yaml}" "uses:\s*[^@]+@[0-9a-fA-F]{40}\b" .github/workflows || true
echo
echo "=== Uses lines in this workflow (with any `@tag`) ==="
if [ -f "$FILE" ]; then
rg -n "uses:\s*" "$FILE" || true
echo
echo "=== Extract uses refs in this workflow (owner/repo@ref) ==="
rg -n "uses:\s*([^@]+)@(.+)$" "$FILE" || true
fi
echo
echo "=== Check whether this workflow already uses commit-SHA pins anywhere ==="
if [ -f "$FILE" ]; then
rg -n "uses:\s*[^@]+@[0-9a-fA-F]{40}\b" "$FILE" || true
fiRepository: rainlanguage/raindex
Length of output: 4487
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== List workflow files ==="
find .github/workflows -maxdepth 2 -type f \( -name "*.yml" -o -name "*.yaml" \) | sort
echo
echo "=== Any uses: pinned to 40-hex commit SHAs across workflows? ==="
rg -n --glob ".github/workflows/**/*.{yml,yaml}" "uses:\s*[^@]+@[0-9a-fA-F]{40}\b" .github/workflows || true
echo
echo "=== Any uses: using floating branches/tags like `@main/`@master/@v? (sample) ==="
# Show a small sample to see conventions
rg -n --glob ".github/workflows/**/*.{yml,yaml}" "uses:\s*[^@]+@(main|master|master|v[0-9]+|v[0-9]+\.[0-9]+|latest)\b" .github/workflows | head -n 60 || true
echo
echo "=== Search for policy references to 'pin'/'zizmor'/'sha' in repo ==="
rg -n "zizmor|pin(ning)?|commit sha|commit-sha|supply chain|unpinned-uses" -S .github/workflows .github || trueRepository: rainlanguage/raindex
Length of output: 6786
Pin third-party GitHub Actions uses: refs to commit SHAs in .github/workflows/vercel-docs-prod.yaml.
In .github/workflows/vercel-docs-prod.yaml (lines 20-21, 26, 33, 38, 42), these uses: refs use floating tags: jlumbroso/free-disk-space@v1.3.1, nixbuild/nix-quick-install-action@v30, cachix/cachix-action@v15, nix-community/cache-nix-action@v7, Swatinem/rust-cache@v2, and actions/cache@v4; pin each to a specific commit SHA.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 33-33: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 38-38: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 42-42: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/vercel-docs-prod.yaml around lines 19 - 42, Replace
floating version tags with pinned commit SHAs for each third-party GitHub Action
used: jlumbroso/free-disk-space@v1.3.1, nixbuild/nix-quick-install-action@v30,
cachix/cachix-action@v15, nix-community/cache-nix-action@v7,
Swatinem/rust-cache@v2, and actions/cache@v4; locate the `uses:` entries for
those exact strings and update them to the corresponding full commit SHA (e.g.,
jlumbroso/free-disk-space@<commit-sha>) so each action is fixed to a specific
commit instead of a floating tag. Ensure you verify the correct SHA on the
action's GitHub repo and replace the tag only, leaving surrounding step
configuration unchanged.
Comment on lines
+43
to
+48
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Show the cited section of the workflow
echo "=== vercel-preview.yaml (lines ~35-60) ==="
nl -ba .github/workflows/vercel-preview.yaml | sed -n '35,70p'
# 2) Find all usages of cachix/cachix-action in workflows
echo
echo "=== All cachix/cachix-action usages ==="
rg -n "cachix/cachix-action@|cachix/cachix-action" .github/workflows || true
# 3) Check whether other actions are pinned to SHAs in the repo's workflows
echo
echo "=== Sample pinned/unpinned uses in .github/workflows ==="
# Count actions using `@v`* vs @<sha> (best-effort)
rg -n "uses:\s*([^@]+)@([^ \n]+)" .github/workflows -S || true
# Create quick stats: actions refs
python3 - <<'PY'
import re, os, glob, json
refs=[]
for path in glob.glob(".github/workflows/**/*.yml", recursive=True)+glob.glob(".github/workflows/**/*.yaml", recursive=True):
with open(path,'r',encoding='utf-8') as f:
for line in f:
m=re.search(r'uses:\s*([^\s@]+)@([^\s]+)', line)
if m:
refs.append((path,m.group(1),m.group(2)))
sha_like=sum(1 for p,a,r in refs if re.fullmatch(r'[0-9a-fA-F]{40}', r))
tag_like=sum(1 for p,a,r in refs if re.fullmatch(r'v\d+(\.\d+)*', r) or r.startswith('v'))
other=sum(1 for p,a,r in refs if not (re.fullmatch(r'[0-9a-fA-F]{40}', r) or re.fullmatch(r'v\d+(\.\d+)*', r) or r.startswith('v')))
print("Total uses:", len(refs))
print("SHA-like:", sha_like)
print("Tag-like (heuristic):", tag_like)
print("Other (heuristic):", other)
# List the cachix-action refs specifically
for p,a,r in refs:
if a=="cachix/cachix-action":
print("cachix action ref:", p, "->", r)
PY
# 4) Look for repo-wide policy (zizmor) config about pinning, if present
echo
echo "=== Search for zizmor/pinning policy hints ==="
rg -n "zizmor|unpinned-uses|pin.*(sha|commit)|GITHUB_ACTIONS" .github || trueRepository: rainlanguage/raindex
Length of output: 168
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Show the cited section of the workflow (use cat -n instead of nl)
echo "=== vercel-preview.yaml (lines ~35-70) ==="
cat -n .github/workflows/vercel-preview.yaml | sed -n '35,70p'
# 2) Find all usages of cachix/cachix-action in workflows
echo
echo "=== All cachix/cachix-action usages ==="
rg -n "cachix/cachix-action@|cachix/cachix-action" .github/workflows || true
# 3) Heuristic stats: how many uses: refs look pinned vs version-tag vs other
echo
echo "=== Uses: ref pinning heuristic stats (.github/workflows) ==="
python3 - <<'PY'
import re, glob
refs=[]
pat=re.compile(r'^\s*uses:\s*([^\s@]+)@([^\s]+)\s*$')
sha_re=re.compile(r'^[0-9a-fA-F]{40}$')
tag_re=re.compile(r'^v\d+(\.\d+)*$')
for path in glob.glob(".github/workflows/**/*.yml", recursive=True)+glob.glob(".github/workflows/**/*.yaml", recursive=True):
with open(path,'r',encoding='utf-8') as f:
for line in f:
m=pat.search(line)
if m:
refs.append((path,m.group(1),m.group(2)))
sha_like=sum(1 for p,a,r in refs if sha_re.fullmatch(r))
tag_like=sum(1 for p,a,r in refs if tag_re.fullmatch(r) or r.startswith('v'))
other=len(refs)-sha_like-tag_like
print("Total uses:", len(refs))
print("SHA-like:", sha_like)
print("Tag-like (heuristic):", tag_like)
print("Other (heuristic):", other)
print("\nAll cachix/cachix-action refs:")
for p,a,r in refs:
if a=="cachix/cachix-action":
print(f"- {p}: {r}")
PY
# 4) Search for zizmor/pinning policy hints (unpinned-uses etc.)
echo
echo "=== Search for zizmor/pinning policy hints ==="
rg -n "zizmor|unpinned-uses|pin.*(sha|commit)|GITHUB_ACTIONS" .github || trueRepository: rainlanguage/raindex
Length of output: 3245
Pin cachix/cachix-action to an immutable commit SHA.
cachix/cachix-action@v15 is an unpinned tag (also used in multiple other workflows here), so pin uses: to the exact commit SHA to avoid unexpected changes in the preview deploy path.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 43-43: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/vercel-preview.yaml around lines 43 - 48, The workflow
step using the unpinned action "cachix/cachix-action@v15" should be replaced
with an immutable commit SHA: locate the GitHub Actions step that contains uses:
cachix/cachix-action@v15 and change it to uses:
cachix/cachix-action@<commit-sha> (the full 40-char commit SHA from the
cachix/cachix-action repo) so the action is pinned; update all other occurrences
of cachix/cachix-action@v15 to the same commit SHA for consistency.
Comment on lines
+60
to
69
| - run: | | ||
| nix develop .#wasm-shell -c bash -c ' | ||
| set -euxo pipefail | ||
| npm install --no-check | ||
| npm run build -w @rainlanguage/raindex | ||
| npm run build -w @rainlanguage/ui-components | ||
| npm run build -w @rainlanguage/webapp | ||
| ' | ||
| env: | ||
| PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID }} |
Contributor
There was a problem hiding this comment.
Keep the new bootstrap step out of the secret-bearing path.
This step now runs npm install plus repo-controlled build scripts while inheriting PUBLIC_WALLETCONNECT_PROJECT_ID, which contradicts the security model documented at the top of the file. The simplest fix is to stop building the webapp here and keep the secret scoped to the later dedicated webapp/Vercel steps.
Suggested change
- run: |
nix develop .#wasm-shell -c bash -c '
set -euxo pipefail
npm install --no-check
npm run build -w `@rainlanguage/raindex`
npm run build -w `@rainlanguage/ui-components`
- npm run build -w `@rainlanguage/webapp`
'
- env:
- PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - run: | | |
| nix develop .#wasm-shell -c bash -c ' | |
| set -euxo pipefail | |
| npm install --no-check | |
| npm run build -w @rainlanguage/raindex | |
| npm run build -w @rainlanguage/ui-components | |
| npm run build -w @rainlanguage/webapp | |
| ' | |
| env: | |
| PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID }} | |
| - run: | | |
| nix develop .#wasm-shell -c bash -c ' | |
| set -euxo pipefail | |
| npm install --no-check | |
| npm run build -w `@rainlanguage/raindex` | |
| npm run build -w `@rainlanguage/ui-components` | |
| ' |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/vercel-preview.yaml around lines 60 - 69, The bootstrap
workflow step is inheriting the secret PUBLIC_WALLETCONNECT_PROJECT_ID while
running repo-controlled npm install and builds; remove the webapp build from
this step so secrets aren't exposed. Edit the nix develop step that runs "npm
install --no-check" and the three "npm run build -w ..." commands (targets
`@rainlanguage/raindex`, `@rainlanguage/ui-components`, `@rainlanguage/webapp`) and
either delete those commands or move them into the later dedicated webapp/Vercel
job, and stop exporting PUBLIC_WALLETCONNECT_PROJECT_ID in this step's env block
so the secret is only present in the webapp/Vercel deployment job.
Comment on lines
+26
to
+31
| - uses: cachix/cachix-action@v15 | ||
| continue-on-error: true | ||
| with: | ||
| name: rainlanguage | ||
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | ||
| useDaemon: false |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/vercel-prod.yaml"
echo "== File exists =="
ls -la "$FILE"
echo
echo "== Relevant lines from $FILE =="
nl -ba "$FILE" | sed -n '1,120p'
echo
echo "== Find cachix usage(s) in workflows =="
rg -n "cachix/cachix-action@" .github/workflows || true
echo
echo "== Find unpinned uses: any uses: owner/action@<tag> without sha (best-effort) =="
rg -n --glob ".github/workflows/*.{yml,yaml}" "uses:\s*[^#\s]+@v[0-9A-Za-z\.\-_]+" .github/workflows || true
echo
echo "== Search for standard npm cache step or patterns in workflows =="
rg -n --glob ".github/workflows/*.{yml,yaml}" "setup-node|cache:.*npm|npm cache|~\/\.npm|cache-npm|actions/cache" .github/workflows || true
echo
echo "== Search for the specific install path mention (no-check / npm install) =="
rg -n --glob ".github/workflows/*.{yml,yaml}" "npm install.*no-check|nix develop .*wasm-shell|workspace-root" .github/workflows || trueRepository: rainlanguage/raindex
Length of output: 290
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/vercel-prod.yaml"
echo "== Relevant lines from $FILE (with line numbers) =="
cat -n "$FILE" | sed -n '1,140p'
echo
echo "== cachix usage(s) in workflows =="
rg -n "cachix/cachix-action@" .github/workflows || true
echo
echo "== unpinned uses: any uses: owner/action@<tag> without sha (best-effort) =="
rg -n --glob ".github/workflows/*.{yml,yaml}" "uses:\s*[^#\s]+@v[0-9A-Za-z\.\-_]+" .github/workflows || true
echo
echo "== standard npm cache step/patterns across workflows =="
rg -n --glob ".github/workflows/*.{yml,yaml}" "setup-node|cache:.*npm|npm cache|~\/\.npm|cache-npm|actions/cache" .github/workflows || true
echo
echo "== Search for npm install/no-check or nix develop wasm-shell conventions =="
rg -n --glob ".github/workflows/*.{yml,yaml}" "npm install.*no-check|nix develop .*wasm-shell|workspace-root" .github/workflows || trueRepository: rainlanguage/raindex
Length of output: 15743
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== actions/setup-node with npm caching (cache: npm) =="
rg -n --glob ".github/workflows/*.{yml,yaml}" "actions/setup-node|cache:\s*'npm'|cache:\s*\"npm\"|cache:\s*npm" .github/workflows || true
echo
echo "== actions/cache for npm / npm cache dirs =="
rg -n --glob ".github/workflows/*.{yml,yaml}" "uses:\s*actions/cache@|~\/\.npm|\.npm\/|npm-cache|cache-npm|node_modules" .github/workflows || true
echo
echo "== any npm-cache / npm install caching scripts =="
rg -n --glob ".github/workflows/*.{yml,yaml}" "npm.*cache|cache.*npm" .github/workflows || trueRepository: rainlanguage/raindex
Length of output: 478
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== cachix/cachix-action@ usage (including if any are pinned) =="
rg -n "cachix/cachix-action@" .github/workflows || true
echo
echo "== actions/setup-node usage with npm cache config =="
rg -n "uses:\s*actions/setup-node@" .github/workflows || true
rg -n "cache:\s*['\"]npm['\"]" .github/workflows || true
rg -n "cache-dependency-path" .github/workflows || true
echo
echo "== actions/cache usage (any) =="
rg -n "uses:\s*actions/cache@" .github/workflows || true
echo
echo "== npm cache / directories (literal searches) =="
rg -n -F "~/.npm" .github/workflows || true
rg -n -F "node_modules" .github/workflows || true
rg -n "npm cache" .github/workflows || true
echo
echo "== Inspect npm-package-release.yml around the setup-node step =="
FILE=".github/workflows/npm-package-release.yml"
grep -n "uses: actions/setup-node@v4" "$FILE" || true
START=$(grep -n "uses: actions/setup-node@v4" "$FILE" | head -n1 | cut -d: -f1)
if [ -n "${START:-}" ]; then
from=$((START-10))
to=$((START+25))
sed -n "${from},${to}p" "$FILE" | nl -ba -w2 -s': ' || sed -n "${from},${to}p" "$FILE"
fiRepository: rainlanguage/raindex
Length of output: 4039
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in .github/workflows/vercel-prod.yaml .github/workflows/vercel-preview.yaml .github/workflows/vercel-docs-prod.yaml .github/workflows/test-webapp.yaml; do
echo
echo "==== $f (show 1-140 lines) ===="
cat -n "$f" | sed -n '1,160p'
doneRepository: rainlanguage/raindex
Length of output: 16773
Pin cachix/cachix-action to a commit SHA.
.github/workflows/vercel-prod.yaml (production deploy on main) uses the floating ref cachix/cachix-action@v15, which weakens supply-chain guarantees; pin this action to a specific commit SHA.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/vercel-prod.yaml around lines 26 - 31, Replace the
floating action ref "cachix/cachix-action@v15" with a specific commit SHA to
hard-pin the dependency: locate the step that references cachix/cachix-action
(the block with name: rainlanguage, authToken, useDaemon) and change the action
reference to the form cachix/cachix-action@<commit-sha> using the action's
latest stable commit SHA from its GitHub repo; keep the existing inputs (name,
authToken, useDaemon) unchanged.
Contributor
Author
CI timing comparison (this PR vs main last week)PR head
Total wall clock (bounded by slowest single job, excluding the now-deleted cargo build --release matrix):
About a 2.5× total PR wall-clock speedup, plus the entire cargo-build-release matrix (~46m of compute) is gone. The one regression is copy-artifacts (303 → 402s, 1.3× slower). The new |
Contributor
|
@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment: S/M/L PR Classification Guidelines:This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed. Small (S)Characteristics:
Review Effort: Would have taken 5-10 minutes Examples:
Medium (M)Characteristics:
Review Effort: Would have taken 15-30 minutes Examples:
Large (L)Characteristics:
Review Effort: Would have taken 45+ minutes Examples:
Additional Factors to ConsiderWhen deciding between sizes, also consider:
Notes:
|
Contributor
|
Tip For best results, initiate chat on the files or code changes. SIZE=L |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replace the single
rainix.yamlmatrix (full default devshell + dead./pointers.shforge build) with one workflow per task on the slim#wasm-shell(or rainix reusables). Closes raindex#2601's Rainix CI track, depends on (merged) rainlanguage/rainix#212.rs-test.yamlrainix-rs-test.yaml@main(ubuntu+macos, cargo test in #rust-shell)rs-static.yamlrainix-rs-static.yaml@mainwasm-artifacts.yamlcargo build --profile release-wasmin #wasm-shellwasm-test.yamlcargo test --target wasm32withwasm-bindgen-test-runnerin #wasm-shellwasm-browser-test.yamltest-js-bindings.yamlRemoved:
rainix.yaml(matrix → split).cargo-build-release.yamlwas never added; the original matrix entry is dropped — release-mode build sanity isn't in the rainlang/rainix pattern and no observed release-only breakage has shown up../pointers.shfrom the test path: no raindex rust crate reads forgeout/at compile or runtime, nosol!macros, no shell-outs to forge/cast/anvil. It was dead weight.Bumps
rainixtoc465734(rainlanguage/rainix#212:pkgs.sqlitein rust-build-inputs for rusqlite +subgraph-testtasknpm ci).Test plan
Tracked in raindex#2607. Each new workflow's first run is the baseline against the ~25m
Rainix CImatrix it replaces.🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
Chores