soldeer migration#6
Conversation
Migrate from forge-std submodule to soldeer. Only one external dep so the migration is minimal: foundry.toml gets [dependencies] + [soldeer] blocks, lib/ submodules and .gitmodules removed, the single forge-std import in test rewritten to the versioned soldeer path. Workflows: drop inline rainix.yaml in favour of upstream rainix-sol reusable; add publish-soldeer.yaml. .soldeerignore added; .gitignore + REUSE.toml updated for the new file layout. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
WalkthroughThis PR migrates the repository from git submodules to Soldeer package management. It removes the ChangesSoldeer Dependency Migration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish-soldeer.yaml:
- Around line 7-8: The reusable workflow reference currently uses a mutable ref
("uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main") while
also inheriting secrets; replace the branch ref with an immutable commit SHA by
finding the desired commit SHA in the rainlanguage/rainix repo (e.g., the tip of
main you trust) and update the uses line to "uses:
rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@<COMMIT_SHA>" so the
workflow cannot change unexpectedly; keep the existing "secrets: inherit" line
as-is after updating the ref.
In @.github/workflows/rainix.yaml:
- Around line 5-6: The workflow currently references the reusable workflow with
a mutable ref ("uses:
rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main") while also
inheriting secrets, which is unsafe; replace the "@main" ref with the full
commit SHA of the target repo (e.g., "@<full-commit-sha>") so the "uses:
rainlanguage/rainix/.github/workflows/rainix-sol.yaml@<sha>" is pinned and keep
"secrets: inherit" as-is; obtain the SHA from the upstream repo's commit history
and update the uses line (refer to the uses string and secrets: inherit in the
diff) to the immutable commit SHA.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: d77f24a1-8b32-4d33-8693-5605c7044b50
⛔ Files ignored due to path filters (2)
foundry.lockis excluded by!**/*.locksoldeer.lockis excluded by!**/*.lock
📒 Files selected for processing (10)
.github/workflows/publish-soldeer.yaml.github/workflows/rainix.yaml.gitignore.gitmodules.soldeerignoreREUSE.tomlfoundry.tomllib/forge-stdremappings.txttest/src/concrete/VerifyAlwaysApproved.accountStatusAtTime.t.sol
💤 Files with no reviewable changes (2)
- lib/forge-std
- .gitmodules
| uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main | ||
| secrets: inherit |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Find reusable workflow/action references that are not pinned to immutable SHAs.
rg -nP '^\s*uses:\s*.+@(?:main|master|v?\d+(?:\.\d+){0,2})\s*$' .github/workflowsRepository: rainlanguage/rain.verify.interface
Length of output: 294
Pin reusable workflow to an immutable commit SHA.
Line 7 currently references @main. With secrets: inherit on line 8, upstream changes can alter privileged execution unexpectedly. Pin to a specific commit SHA instead.
Suggested change
- uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main
+ uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@<commit-sha>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish-soldeer.yaml around lines 7 - 8, The reusable
workflow reference currently uses a mutable ref ("uses:
rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main") while also
inheriting secrets; replace the branch ref with an immutable commit SHA by
finding the desired commit SHA in the rainlanguage/rainix repo (e.g., the tip of
main you trust) and update the uses line to "uses:
rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@<COMMIT_SHA>" so the
workflow cannot change unexpectedly; keep the existing "secrets: inherit" line
as-is after updating the ref.
| uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main | ||
| secrets: inherit |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, check if the file exists and read the relevant lines
if [ -f ".github/workflows/rainix.yaml" ]; then
echo "=== File content (lines 1-20) ==="
head -20 .github/workflows/rainix.yaml | cat -n
echo ""
echo "=== Lines 5-6 specifically ==="
sed -n '5,6p' .github/workflows/rainix.yaml | cat -n
else
echo "File not found"
fiRepository: rainlanguage/rain.verify.interface
Length of output: 428
🏁 Script executed:
# Search for all reusable workflow references in the repo to understand the pattern
echo "=== All uses: references in workflows ==="
fd -e yaml -e yml . .github/workflows 2>/dev/null | xargs grep -n "uses:" | head -20Repository: rainlanguage/rain.verify.interface
Length of output: 336
🌐 Web query:
GitHub Actions reusable workflows security @main commit SHA inherit secrets
💡 Result:
In GitHub Actions reusable workflows, the recommended/secure approach is: 1) Pin the reusable workflow reference (the {ref} after uses: owner/repo/.../.github/workflows/<file>@{ref}) to a full commit SHA instead of @main (or tags), because using a commit SHA is described as the safest option for stability and security [1][2]. 2) Secrets are not automatically passed to reusable workflows. To pass secrets from the caller to the directly-called reusable workflow, the caller must use either secrets: inherit (pass all caller secrets) or explicitly pass named secrets via secrets.<NAME>: ${{ secrets.<NAME> }} in the calling job [1]. 3) If you use secrets: inherit, the caller’s secrets are available to the directly called workflow (and not automatically farther down the chain unless you keep passing them along). GitHub notes that in a chain A > B > C, workflow C only receives secrets from A if they were passed from A to B and then from B to C [1]. 4) Security impact of secrets: inherit: it can be broader than you need. Least-privilege guidance applies to secrets usage and GitHub documents secrets: inherit as a way to implicitly pass all caller secrets, so you should prefer explicitly passing only the secrets a reusable workflow declares/needs when possible [1][3]. Key snippets Calling workflow (pin to SHA + inherit secrets): jobs: call-workflow: uses: octo-org/example-repo/.github/workflows/reusable-workflow.yml@ secrets: inherit This is the documented pattern for passing secrets using secrets: inherit, combined with the documented guidance to use a commit SHA as the safest reference [1][2].
Citations:
- 1: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
- 2: https://docs.github.com/en/actions/using-workflows/reusing-workflows?wt.mc_id=DT-MVP-5000590
- 3: https://docs.github.com/actions/reference/security/secure-use
Pin the reusable workflow to a specific commit SHA instead of @main.
Using a mutable reference (@main) with secrets: inherit is a security risk. When inheriting secrets, always pin to a full commit SHA to prevent unintended upstream changes from accessing your secrets. This is GitHub's documented best practice for stability and security.
Suggested change
- uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main
+ uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@<commit-sha>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/rainix.yaml around lines 5 - 6, The workflow currently
references the reusable workflow with a mutable ref ("uses:
rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main") while also
inheriting secrets, which is unsafe; replace the "@main" ref with the full
commit SHA of the target repo (e.g., "@<full-commit-sha>") so the "uses:
rainlanguage/rainix/.github/workflows/rainix-sol.yaml@<sha>" is pinned and keep
"secrets: inherit" as-is; obtain the SHA from the upstream repo's commit history
and update the uses line (refer to the uses string and secrets: inherit in the
diff) to the immutable commit SHA.
1 participant
Summary
Migrate the only external dep (forge-std) from git submodule to soldeer.
[dependencies]block,[soldeer] recursive_deps = false,libs = ['dependencies'].lib/submodule +.gitmodules+foundry.lockremoved.rainix.yamlreplaced with upstreamrainix-solreusable.publish-soldeer.yaml..soldeerignore+.gitignore+ REUSE.toml updated.Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit