Skip to content

feat: migrate to soldeer #29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thedavidmeister merged 3 commits into from
May 12, 2026
Merged

feat: migrate to soldeer #29

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4b8c93d
feat: migrate to soldeer
thedavidmeister May 11, 2026
7cd9d26
fix(ci): point slither filter_paths at soldeer dirs
thedavidmeister May 11, 2026
52fd82e
fix(ci): cover .soldeerignore and soldeer.lock in REUSE.toml
thedavidmeister May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/publish-soldeer.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
name: Publish to Soldeer
on:
push:
tags: ["v*"]
jobs:
publish:
uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main
secrets: inherit
Comment on lines +7 to +8
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify mutable reusable-workflow refs that should be pinned.
rg -nP '^\s*uses:\s*rainlanguage/rainix/.+@main\b' .github/workflows -C2

Repository: rainlanguage/rain.factory

Length of output: 602

🏁 Script executed:

#!/bin/bash
# Check for security policies, guidelines, or documentation about GitHub Actions pinning
find . -maxdepth 2 -type f \( -name "SECURITY.md" -o -name "CONTRIBUTING.md" -o -name ".github/GOVERNANCE.md" -o -name "README.md" \) | head -10

Repository: rainlanguage/rain.factory

Length of output: 81

🏁 Script executed:

#!/bin/bash
# Look for any comments or documentation in workflow files about pinning strategy
rg -l 'pin|immutable|sha|security|commit' .github/workflows/ | head -20

Repository: rainlanguage/rain.factory

Length of output: 51

🏁 Script executed:

#!/bin/bash
# Check README for any mentions of Actions, security practices, or pinning
rg -i 'action|workflow|pin|security|sha' README.md

Repository: rainlanguage/rain.factory

Length of output: 98

🏁 Script executed:

#!/bin/bash
# Check all workflow files to see what pinning strategy is used elsewhere
rg -h 'uses:.*@' .github/workflows/ | head -20

Repository: rainlanguage/rain.factory

Length of output: 689

🏁 Script executed:

#!/bin/bash
# Check all workflow files to see what pinning strategy is used elsewhere
rg 'uses:.*@' .github/workflows/ | head -30

Repository: rainlanguage/rain.factory

Length of output: 567

🏁 Script executed:

#!/bin/bash
# Verify the exact state of the file at lines 7-8
cat -n .github/workflows/publish-soldeer.yaml | head -10

Repository: rainlanguage/rain.factory

Length of output: 291

Pin reusable workflow to an immutable commit SHA.

Using @main for a reusable workflow while inheriting secrets creates a mutable trust boundary. Pin to a commit SHA (or an immutable, verified release ref) to prevent upstream ref drift from changing privileged CI behavior.

Suggested change 
-    uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main
+    uses: rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@<commit-sha>
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-soldeer.yaml around lines 7 - 8, Replace the
mutable ref in the reusable workflow invocation (the line using
"rainlanguage/rainix/.github/workflows/publish-soldeer.yaml@main") with an
immutable ref such as a commit SHA or a verified release tag (e.g., change the
"@main" suffix to a specific commit SHA or release ref) so the "uses" entry is
pinned; keep "secrets: inherit" as needed but do not rely on branch names for
trust boundaries and update any documentation or PR notes to indicate the pinned
ref used.

6 changes: 6 additions & 0 deletions .github/workflows/rainix-sol.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
name: rainix-sol
on: [push]
jobs:
rainix-sol:
uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main
secrets: inherit
Comment on lines +5 to +6
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

find . -name "rainix-sol.yaml" -type f

Repository: rainlanguage/rain.factory

Length of output: 105

🏁 Script executed:

git ls-files | grep -E "\.github/workflows"

Repository: rainlanguage/rain.factory

Length of output: 186

🏁 Script executed:

cat -n .github/workflows/rainix-sol.yaml 2>/dev/null || echo "File not found in standard location"

Repository: rainlanguage/rain.factory

Length of output: 249

🏁 Script executed:

grep -r "uses:.*@main\|uses:.*@v[0-9]" .github/workflows/ --include="*.yaml" --include="*.yml"

Repository: rainlanguage/rain.factory

Length of output: 567

🏁 Script executed:

grep -l "secrets: inherit" .github/workflows/*.yaml 2>/dev/null

Repository: rainlanguage/rain.factory

Length of output: 142

Pin the reusable workflow to a specific commit SHA instead of using @main.

Line 5 uses @main, a mutable branch reference. Combined with secrets: inherit on line 6, this allows unreviewed upstream changes to execute with privileged access. Pin to a specific commit SHA to prevent unauthorized modifications.

-    uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main
+    uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@<commit-sha>
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/rainix-sol.yaml around lines 5 - 6, Replace the mutable
reference "uses: rainlanguage/rainix/.github/workflows/rainix-sol.yaml@main"
with a specific commit SHA to pin the reusable workflow; locate the "uses" line
in the file (the line that currently ends with "@main"), determine the commit
SHA you trust (e.g., from the upstream repo's commit history or GitHub UI), and
update the "uses" value to "…@<commit-sha>" so the workflow runs a fixed
revision while leaving "secrets: inherit" as-is.

37 changes: 0 additions & 37 deletions .github/workflows/rainix.yaml
View file
Open in desktop

This file was deleted.

5 changes: 4 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,7 @@ out
cache
result
.env
.fixes
.fixes
dependencies
remappings.txt
.pre-commit-config.yaml
12 changes: 0 additions & 12 deletions .gitmodules
View file
Open in desktop

This file was deleted.

24 changes: 24 additions & 0 deletions .soldeerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
.DS_Store
.coderabbitai.yaml
.gas-snapshot
.git
.github
.gitignore
.gitmodules
.pre-commit-config.yaml
.soldeerignore
.vscode
CLAUDE.md
/audit
/cache
/dependencies
/flake.lock
/flake.nix
/foundry.lock
/foundry.toml
/meta
/out
/remappings.txt
/slither.config.json
/soldeer.lock
/REUSE.toml
2 changes: 2 additions & 0 deletions REUSE.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ path = [
"slither.config.json",
"REUSE.toml",
"foundry.lock",
"soldeer.lock",
".soldeerignore",
]
SPDX-FileCopyrightText = "Copyright (c) 2020 Rain Open Source Software Ltd"
SPDX-License-Identifier = "LicenseRef-DCL-1.0"
14 changes: 0 additions & 14 deletions foundry.lock
View file
Open in desktop

This file was deleted.

31 changes: 17 additions & 14 deletions foundry.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@
src = 'src'
test = 'test'
out = 'out'
libs = ['lib']

# See more config options https://github.com/foundry-rs/foundry/tree/master/config

Expand All @@ -17,27 +16,31 @@ cbor_metadata = false

# Build metadata used for testing rain meta aware contracts in this folder rather
# than expose ffi to forge.
fs_permissions = [{ access = "read", path = "./meta"}]

remappings = [
"rain.deploy/=lib/rain.deploy/src/"
]

no_match_path = "lib/**/test/**"
fs_permissions = [{ access = "read", path = "./meta" }]
libs = ["dependencies"]

[fuzz]
runs = 2048

[dependencies]
forge-std = "1.16.1"
"@openzeppelin-contracts" = "5.6.1"
"rain-extrospection" = "0.1.0"
"rain-deploy" = "0.1.2"

[soldeer]
recursive_deps = false

[rpc_endpoints]
arbitrum = "${CI_DEPLOY_ARBITRUM_RPC_URL}"
base = "${CI_DEPLOY_BASE_RPC_URL}"
base_sepolia = "${CI_DEPLOY_BASE_SEPOLIA_RPC_URL}"
flare = "${CI_DEPLOY_FLARE_RPC_URL}"
polygon = "${CI_DEPLOY_POLYGON_RPC_URL}"
arbitrum = "${ARBITRUM_RPC_URL}"
base = "${BASE_RPC_URL}"
base_sepolia = "${BASE_SEPOLIA_RPC_URL}"
flare = "${FLARE_RPC_URL}"
polygon = "${POLYGON_RPC_URL}"

[etherscan]
arbitrum = { key = "${CI_DEPLOY_ARBITRUM_ETHERSCAN_API_KEY}" }
base = { key = "${CI_DEPLOY_BASE_ETHERSCAN_API_KEY}" }
base_sepolia = { key = "${CI_DEPLOY_BASE_SEPOLIA_ETHERSCAN_API_KEY}" }
flare = { key = "${CI_DEPLOY_FLARE_ETHERSCAN_API_KEY}" }
polygon = { key = "${CI_DEPLOY_POLYGON_ETHERSCAN_API_KEY}" }
polygon = { key = "${CI_DEPLOY_POLYGON_ETHERSCAN_API_KEY}" }
1 change: 0 additions & 1 deletion lib/forge-std
Open in desktop
Submodule forge-std deleted from 1801b0
1 change: 0 additions & 1 deletion lib/openzeppelin-contracts
Open in desktop
Submodule openzeppelin-contracts deleted from fcbae5
1 change: 0 additions & 1 deletion lib/rain.deploy
Open in desktop
Submodule rain.deploy deleted from 43a6ed
1 change: 0 additions & 1 deletion lib/rain.extrospection
Open in desktop
Submodule rain.extrospection deleted from 6445db
4 changes: 2 additions & 2 deletions script/Deploy.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@
// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
pragma solidity =0.8.25;

import {Script} from "forge-std/Script.sol";
import {Script} from "forge-std-1.16.1/src/Script.sol";
import {CloneFactory} from "../src/concrete/CloneFactory.sol";
import {LibRainDeploy} from "rain.deploy/lib/LibRainDeploy.sol";
import {LibRainDeploy} from "rain-deploy-0.1.2/src/lib/LibRainDeploy.sol";
import {LibCloneFactoryDeploy} from "../src/lib/LibCloneFactoryDeploy.sol";

/// @title Deploy
Expand Down
2 changes: 1 addition & 1 deletion slither.config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{
"detectors_to_exclude": "assembly-usage,solc-version,pragma,unindexed-event-address",
"filter_paths": "lib/forge-std,test,lib/openzeppelin-contracts"
"filter_paths": "dependencies/forge-std-1.16.1,dependencies/@openzeppelin-contracts-5.6.1"
}
27 changes: 27 additions & 0 deletions soldeer.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
[[dependencies]]
name = "@openzeppelin-contracts"
version = "5.6.1"
url = "https://soldeer-revisions.s3.amazonaws.com/@openzeppelin-contracts/5_6_1_15-03-2026_09:19:50_contracts.zip"
checksum = "a3b6bc661be858c7c27f60a1708cbebe8c71034b4cc1e9fe270d0a05b069352f"
integrity = "bce03af7ada1eee21a7fff393f238bcd7cd75a022a4db55ffb6b0dbb32433d35"

[[dependencies]]
name = "forge-std"
version = "1.16.1"
url = "https://soldeer-revisions.s3.amazonaws.com/forge-std/1_16_1_08-05-2026_08:51:16_forge-std-1.16.zip"
checksum = "839b61832925c7152c7b6dffbfa4998d9e606211179bd8f604733124e8a7cb57"
integrity = "60e55d10150354ca4a1e2985c5456c834b92b82ef85ab0e1d92a7786cddbd219"

[[dependencies]]
name = "rain-deploy"
version = "0.1.2"
url = "https://soldeer-revisions.s3.amazonaws.com/rain-deploy/0_1_2_09-05-2026_19:49:20_rain.zip"
checksum = "94d3daf2f9f90062d2e676077c2b4ccd2bdd66201665a2209e98016e155f619a"
integrity = "10bff708d9e5d8b77655b8a8fc0c755cef8e3fc876cc3ff100425d27b08294a0"

[[dependencies]]
name = "rain-extrospection"
version = "0.1.0"
url = "https://soldeer-revisions.s3.amazonaws.com/rain-extrospection/0_1_0_11-05-2026_12:26:12_rain.zip"
checksum = "97297c3f1d623c63f5996b4266a4c26f895a1ca17ab271a619af601f8950521d"
integrity = "30f7e23c71b24267d2db46085049aec5baaa693825ff8bc8fd72bd685da479ad"
2 changes: 1 addition & 1 deletion src/concrete/CloneFactory.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ pragma solidity =0.8.25;

import {ICloneableV2, ICLONEABLE_V2_SUCCESS} from "../interface/ICloneableV2.sol";
import {ICloneableFactoryV2} from "../interface/ICloneableFactoryV2.sol";
import {Clones} from "openzeppelin-contracts/contracts/proxy/Clones.sol";
import {Clones} from "@openzeppelin-contracts-5.6.1/proxy/Clones.sol";

/// Thrown when an implementation has zero code size which is always a mistake.
error ZeroImplementationCodeSize();
Expand Down
4 changes: 2 additions & 2 deletions test/src/concrete/CloneFactory.t.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@
// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
pragma solidity =0.8.25;

import {Test, Vm} from "forge-std/Test.sol";
import {Test, Vm} from "forge-std-1.16.1/src/Test.sol";

import {LibExtrospectERC1167Proxy} from "rain.extrospection/lib/LibExtrospectERC1167Proxy.sol";
import {LibExtrospectERC1167Proxy} from "rain-extrospection-0.1.0/src/lib/LibExtrospectERC1167Proxy.sol";
import {ICloneableV2, ICLONEABLE_V2_SUCCESS} from "../../../src/interface/ICloneableV2.sol";
import {CloneFactory, ZeroImplementationCodeSize, InitializationFailed} from "../../../src/concrete/CloneFactory.sol";

Expand Down
4 changes: 2 additions & 2 deletions test/src/lib/LibCloneFactoryDeploy.t.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@
// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
pragma solidity =0.8.25;

import {Test} from "forge-std/Test.sol";
import {LibRainDeploy} from "rain.deploy/lib/LibRainDeploy.sol";
import {Test} from "forge-std-1.16.1/src/Test.sol";
import {LibRainDeploy} from "rain-deploy-0.1.2/src/lib/LibRainDeploy.sol";
import {LibCloneFactoryDeploy} from "../../../src/lib/LibCloneFactoryDeploy.sol";
import {CloneFactory} from "../../../src/concrete/CloneFactory.sol";

Expand Down
4 changes: 2 additions & 2 deletions test/src/lib/LibCloneFactoryDeployProd.t.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@
// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
pragma solidity =0.8.25;

import {Test} from "forge-std/Test.sol";
import {LibRainDeploy} from "rain.deploy/lib/LibRainDeploy.sol";
import {Test} from "forge-std-1.16.1/src/Test.sol";
import {LibRainDeploy} from "rain-deploy-0.1.2/src/lib/LibRainDeploy.sol";
import {LibCloneFactoryDeploy} from "../../../src/lib/LibCloneFactoryDeploy.sol";

/// @title LibCloneFactoryDeployProdTest
Expand Down
Loading