feat: migrate to soldeer + bump rainix to rainlanguage/rainix main#56
Conversation
Replace the lib/rain.interpreter.interface submodule with a Soldeer dependency. Also pulls rain-math-float in as a Soldeer dep since the imports reference it directly. Forge build passes on the result. Adds publish-soldeer.yaml workflow so v* tags publish to Soldeer.
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (5)
WalkthroughDependency management is migrated from git submodules to a Soldeer-style ChangesSoldeer Dependency Migration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish-soldeer.yaml:
- Line 9: The workflow currently uses "secrets: inherit" which exposes all repo
secrets to the external workflow; replace this by either pinning the referenced
external workflow (use a commit SHA in the uses: reference) and then explicitly
listing only the needed secrets (e.g., with "secrets: { MY_SECRET: ${{
secrets.MY_SECRET }}, OTHER_SECRET: ${{ secrets.OTHER_SECRET }} }") instead of
"secrets: inherit", or if you cannot pin yet, remove inherit and explicitly pass
only the required secret names; update the step that contains "secrets: inherit"
to the explicit secrets mapping and pin the external workflow reference in the
uses: field.
- Line 8: Update the reusable workflow reference that currently reads "uses:
rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main" to pin to a
specific commit SHA instead of `@main`: locate the uses entry in
.github/workflows/publish-soldeer.yaml and replace the branch suffix (`@main`)
with the full commit hash from the rainlanguage/rainix repo (e.g.,
@<commit-sha>) so the workflow uses an immutable, reviewable version.
In `@src/interface/deprecated/v4/IOrderBookV4.sol`:
- Line 14: You've modified a deprecated interface file (IOrderBookV4.sol) by
changing the import to IInterpreterCallerV3; revert that edit and do not change
any files under src/interface/deprecated/v4 (or any **/interface/deprecated/**)
in this migration. Instead, if you need the new import/behavior, add a new
non-deprecated interface or migration file (e.g., create a new interface named
IOrderBookV4New or place changes under a non-deprecated path) and update callers
to use that new symbol; ensure the original IOrderBookV4 and its import
reference to IInterpreterCallerV2 remain untouched to preserve deprecation
immutability.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: c6583498-d0cf-4784-bf41-7082c920d15c
⛔ Files ignored due to path filters (1)
soldeer.lockis excluded by!**/*.lock
📒 Files selected for processing (9)
.github/workflows/publish-soldeer.yaml.gitignore.gitmodulesfoundry.tomllib/rain.interpreter.interfaceremappings.txtsrc/interface/IRaindexV6.solsrc/interface/deprecated/v4/IOrderBookV4.solsrc/interface/deprecated/v5/IOrderBookV5.sol
💤 Files with no reviewable changes (2)
- lib/rain.interpreter.interface
- .gitmodules
| - "v*" | ||
| jobs: | ||
| publish: | ||
| uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main |
There was a problem hiding this comment.
Pin the reusable workflow to a specific commit hash.
The workflow reference uses @main instead of a commit SHA. Static analysis flags this as violating a blanket policy and enabling supply chain attacks. If the external workflow is modified (maliciously or accidentally), this workflow will automatically use the new version without review.
🔒 Recommended fix
- uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main
+ uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@<commit-sha>Replace <commit-sha> with the full commit hash of the desired version from rainlanguage/rainix. You can find this by visiting the repository and copying the commit SHA of the workflow file you want to use.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 8-8: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 8-8: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish-soldeer.yaml at line 8, Update the reusable
workflow reference that currently reads "uses:
rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main" to pin to a
specific commit SHA instead of `@main`: locate the uses entry in
.github/workflows/publish-soldeer.yaml and replace the branch suffix (`@main`)
with the full commit hash from the rainlanguage/rainix repo (e.g.,
@<commit-sha>) so the workflow uses an immutable, reviewable version.
| jobs: | ||
| publish: | ||
| uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main | ||
| secrets: inherit |
There was a problem hiding this comment.
Consider restricting inherited secrets.
secrets: inherit passes all repository secrets to the external workflow. Combined with the unpinned workflow reference on line 8, this increases the risk surface—any change to the external workflow immediately gains access to all secrets.
Once the workflow is pinned to a commit hash, this pattern may be acceptable depending on organizational standards. Alternatively, explicitly pass only required secrets.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish-soldeer.yaml at line 9, The workflow currently
uses "secrets: inherit" which exposes all repo secrets to the external workflow;
replace this by either pinning the referenced external workflow (use a commit
SHA in the uses: reference) and then explicitly listing only the needed secrets
(e.g., with "secrets: { MY_SECRET: ${{ secrets.MY_SECRET }}, OTHER_SECRET: ${{
secrets.OTHER_SECRET }} }") instead of "secrets: inherit", or if you cannot pin
yet, remove inherit and explicitly pass only the required secret names; update
the step that contains "secrets: inherit" to the explicit secrets mapping and
pin the external workflow reference in the uses: field.
| //forge-lint: disable-next-line(unused-import) | ||
| IInterpreterStoreV2 | ||
| } from "../../../../lib/rain.interpreter.interface/src/interface/deprecated/v2/IInterpreterCallerV3.sol"; | ||
| } from "rain.interpreter.interface/interface/deprecated/v2/IInterpreterCallerV3.sol"; |
There was a problem hiding this comment.
Do not edit deprecated v1-v5 interfaces in-place.
Line 14 modifies a file under src/interface/deprecated/v4/, which breaks the repository deprecation immutability policy. This migration should avoid touching deprecated interfaces unless this PR is explicitly undeprecating them.
As per coding guidelines **/interface/deprecated/**/*.sol: Do not modify deprecated interfaces (v1-v5) in src/interface/deprecated/ unless undeprecating.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/interface/deprecated/v4/IOrderBookV4.sol` at line 14, You've modified a
deprecated interface file (IOrderBookV4.sol) by changing the import to
IInterpreterCallerV3; revert that edit and do not change any files under
src/interface/deprecated/v4 (or any **/interface/deprecated/**) in this
migration. Instead, if you need the new import/behavior, add a new
non-deprecated interface or migration file (e.g., create a new interface named
IOrderBookV4New or place changes under a non-deprecated path) and update callers
to use that new symbol; ensure the original IOrderBookV4 and its import
reference to IInterpreterCallerV2 remain untouched to preserve deprecation
immutability.
thedavidmeister
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/rainix.yaml:
- Line 5: Replace the mutable reusable workflow reference that uses
"rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main" with an immutable
commit SHA; locate the "uses:
rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main" entry in
.github/workflows/rainix.yaml (and the analogous "uses: ...@main" entry in
.github/workflows/publish-soldeer.yaml), get the correct full commit SHA from
the rainlanguage/rainix repository, and update the "uses:" value to
"rainlanguage/rainix/.github/workflows/rainix-sol.yaml@<COMMIT_SHA>" (and
similarly replace the other `@main`) so the workflow is pinned to that exact
commit.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: e8a81b36-3dbe-4205-8244-05a9ef54a99a
⛔ Files ignored due to path filters (1)
flake.lockis excluded by!**/*.lock
📒 Files selected for processing (4)
.github/workflows/rainix.yamlREUSE.tomlflake.nixslither.config.json
| DEPLOY_VERIFIER: '' | ||
| run: nix develop -c ${{ matrix.task }} No newline at end of file | ||
| rainix: | ||
| uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ls -la .github/workflows || true
sed -n '1,120p' .github/workflows/rainix.yaml
echo "----"
rg -n --hidden --no-ignore -S "uses:\s*rainlanguage/rainix/\.github/workflows/.*@[^[:space:]]+" .github/workflows/rainix.yaml || true
rg -n --hidden --no-ignore -S "uses:\s*rainlanguage/rainix/\.github/workflows/.*@[^[:space:]]+" .github/workflows || trueRepository: rainlanguage/rain.raindex.interface
Length of output: 807
Pin the reusable workflow reference(s) to an immutable commit SHA
.github/workflows/rainix.yaml references rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main, making CI behavior mutable. Pin it to a full commit SHA instead of @main (same @main pattern exists in .github/workflows/publish-soldeer.yaml).
Suggested fix
- uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main
+ uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@<full_commit_sha>🧰 Tools
🪛 zizmor (1.25.2)
[error] 5-5: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 5-5: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/rainix.yaml at line 5, Replace the mutable reusable
workflow reference that uses
"rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main" with an immutable
commit SHA; locate the "uses:
rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main" entry in
.github/workflows/rainix.yaml (and the analogous "uses: ...@main" entry in
.github/workflows/publish-soldeer.yaml), get the correct full commit SHA from
the rainlanguage/rainix repository, and update the "uses:" value to
"rainlanguage/rainix/.github/workflows/rainix-sol.yaml@<COMMIT_SHA>" (and
similarly replace the other `@main`) so the workflow is pinned to that exact
commit.
The relative-path -> remapped-path import rewrites in the soldeer migration commit left a few lines unformatted by forges default style. Re-running forge fmt cleans 5 files.
|
@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment: S/M/L PR Classification Guidelines:This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed. Small (S)Characteristics:
Review Effort: Would have taken 5-10 minutes Examples:
Medium (M)Characteristics:
Review Effort: Would have taken 15-30 minutes Examples:
Large (L)Characteristics:
Review Effort: Would have taken 45+ minutes Examples:
Additional Factors to ConsiderWhen deciding between sizes, also consider:
Notes:
|
|
Tip For best results, initiate chat on the files or code changes. SIZE=M |
1 participant
Two related changes bundled together:
1. Submodules → Soldeer (a6c3cf7)
Replaces the `lib/rain.interpreter.interface` submodule with Soldeer deps. `rain-math-float` is also declared since the imports reference it directly.
2. rainix bump + CI restructure (bff6a97)
Why combined
The soldeer migration unblocks the parent raindex soldeer migration, and the rainix bump unblocks raindex's own rainix bump (raindex#2579). Doing them in one PR avoids the interim "soldeer but old rainix" state.
`forge build` passes locally on the resulting tree.
🤖 Generated with Claude Code
Summary by CodeRabbit