From 689284a7a35f452eb167d77576ba29ae0d71d9bb Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Fri, 30 Oct 2026 10:07:09 -0400 Subject: [PATCH 01/12] ci: call the shared reusable workflows from metaplex-foundation/actions Replaces the repository's copies of build, test, benchmark and client workflows with calls into metaplex-foundation/actions, pinned by commit. Program facts move to .github/programs.json; toolchain pins stay in .github/.env. The publish workflows now open a release pull request and the new release-* workflows tag on merge, matching mpl-core and bubblegum. Co-Authored-By: Claude Fable 5.1 --- .github/dependabot.yml | 11 +- .github/file-filters.yml | 13 +- .github/programs.json | 125 ++++++++ .github/workflows/benchmark-summary.yml | 92 ------ .github/workflows/benchmark.yml | 84 ------ .github/workflows/build-programs.yml | 83 ------ .github/workflows/build-rust-client.yml | 79 ----- .github/workflows/create-release.yml | 140 ++------- .github/workflows/deploy-program.yml | 346 +++++----------------- .github/workflows/main.yml | 154 +++------- .github/workflows/publish-js-client.yml | 170 ++++------- .github/workflows/publish-rust-client.yml | 117 +++----- .github/workflows/release-js-client.yml | 24 ++ .github/workflows/release-rust-client.yml | 25 ++ .github/workflows/test-js-client.yml | 91 ------ .github/workflows/test-programs.yml | 68 ----- .github/workflows/test-rust-client.yml | 65 ---- 17 files changed, 441 insertions(+), 1246 deletions(-) create mode 100644 .github/programs.json delete mode 100644 .github/workflows/benchmark-summary.yml delete mode 100644 .github/workflows/benchmark.yml delete mode 100644 .github/workflows/build-programs.yml delete mode 100644 .github/workflows/build-rust-client.yml create mode 100644 .github/workflows/release-js-client.yml create mode 100644 .github/workflows/release-rust-client.yml delete mode 100644 .github/workflows/test-js-client.yml delete mode 100644 .github/workflows/test-programs.yml delete mode 100644 .github/workflows/test-rust-client.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7bbb32f..bb19e99 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,4 +9,13 @@ updates: interval: 'weekly' allow: # Starting slow by only checking our own packages for updates. - - dependency-name: '@metaplex-foundation/*' \ No newline at end of file + - dependency-name: '@metaplex-foundation/*' + + # Shared CI workflows and third-party actions are SHA-pinned; keep them current. + - package-ecosystem: 'github-actions' + directory: '/' + schedule: + interval: 'weekly' + groups: + actions: + patterns: ['*'] diff --git a/.github/file-filters.yml b/.github/file-filters.yml index a75ddb0..df26128 100644 --- a/.github/file-filters.yml +++ b/.github/file-filters.yml @@ -5,11 +5,11 @@ # Programs. program_common: &program_common - - ".github/workflows/build-programs.yml" - - ".github/workflows/test-programs.yml" - ".github/workflows/main.yml" - ".github/file-filters.yml" + - ".github/programs.json" - ".github/.env" + - "configs/scripts/program/**" mpl_agent_identity_program: &mpl_agent_identity_program - *program_common @@ -39,21 +39,18 @@ client_common: &client_common - *programs - ".github/workflows/main.yml" - ".github/file-filters.yml" + - ".github/programs.json" - ".github/.env" + - "configs/scripts/client/**" - "configs/shank.cjs" - - "configs/kinobi.cjs" + - "configs/kinobi-*.cjs" js_client: &js_client - *client_common - - ".github/workflows/test-js-client.yml" - - ".github/workflows/publish-js-client.yml" - "clients/js/**" rust_client: &rust_client - *client_common - - ".github/workflows/test-rust-client.yml" - - ".github/workflows/build-rust-client.yml" - - ".github/workflows/publish-rust-client.yml" - "clients/rust-identity/**" - "clients/rust-reputation/**" - "clients/rust-tools/**" diff --git a/.github/programs.json b/.github/programs.json new file mode 100644 index 0000000..98e8c53 --- /dev/null +++ b/.github/programs.json @@ -0,0 +1,125 @@ +{ + "$comment": "Program descriptors for the shared CI in metaplex-foundation/actions. Toolchain pins live in .github/.env.", + "programs": [ + { + "name": "mpl-agent-identity", + "build": "sbf", + "deploy": { + "program_id": "1DREGFgysWYxLnRnKQnwrxnJQeSMk2HmGaC6whw2B2p", + "clusters": { + "devnet": { + "type": "direct" + }, + "mainnet-beta": { + "type": "direct" + }, + "sonic-devnet": { + "type": "direct" + }, + "sonic-testnet": { + "type": "direct" + }, + "eclipse-devnet": { + "type": "direct" + }, + "eclipse-testnet": { + "type": "direct" + }, + "eclipse-mainnet": { + "type": "direct" + } + } + } + }, + { + "name": "mpl-agent-reputation", + "build": "sbf", + "deploy": { + "program_id": "REPREG5c1gPHuHukEyANpksLdHFaJCiTrm6zJgNhRZR", + "clusters": { + "devnet": { + "type": "direct" + }, + "mainnet-beta": { + "type": "direct" + }, + "sonic-devnet": { + "type": "direct" + }, + "sonic-testnet": { + "type": "direct" + }, + "eclipse-devnet": { + "type": "direct" + }, + "eclipse-testnet": { + "type": "direct" + }, + "eclipse-mainnet": { + "type": "direct" + } + } + } + }, + { + "name": "mpl-agent-validation", + "build": "sbf", + "deploy": { + "program_id": "VALREGY66A9ieJfFUNs5GrxFTy498KUoSU7TbmSePQi", + "clusters": { + "devnet": { + "type": "direct" + }, + "mainnet-beta": { + "type": "direct" + }, + "sonic-devnet": { + "type": "direct" + }, + "sonic-testnet": { + "type": "direct" + }, + "eclipse-devnet": { + "type": "direct" + }, + "eclipse-testnet": { + "type": "direct" + }, + "eclipse-mainnet": { + "type": "direct" + } + } + } + }, + { + "name": "mpl-agent-tools", + "build": "sbf", + "deploy": { + "program_id": "TLREGni9ZEyGC3vnPZtqUh95xQ8oPqJSvNjvB7FGK8S", + "clusters": { + "devnet": { + "type": "direct" + }, + "mainnet-beta": { + "type": "direct" + }, + "sonic-devnet": { + "type": "direct" + }, + "sonic-testnet": { + "type": "direct" + }, + "eclipse-devnet": { + "type": "direct" + }, + "eclipse-testnet": { + "type": "direct" + }, + "eclipse-mainnet": { + "type": "direct" + } + } + } + } + ] +} diff --git a/.github/workflows/benchmark-summary.yml b/.github/workflows/benchmark-summary.yml deleted file mode 100644 index bde1bd9..0000000 --- a/.github/workflows/benchmark-summary.yml +++ /dev/null @@ -1,92 +0,0 @@ -name: Benchmark -on: - workflow_call: - inputs: - git_ref: - type: string - -permissions: - # deployments permission to deploy GitHub pages website - deployments: write - # contents permission to update benchmark contents in gh-pages branch - contents: write - # allow posting comments to pull request - pull-requests: write - -env: - CACHE: true - -jobs: - benchmark_summary: - name: Performance regression summary - runs-on: ubuntu-latest - steps: - - name: Git checkout - uses: actions/checkout@v4 - with: - ref: ${{ inputs.git_ref }} - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Sanitize Ref - id: sanitize - shell: bash - run: | - REF="${{ inputs.git_ref }}" - if [ -z "$REF" ]; then - REF="default" - fi - SANITIZED=${REF//\//-} - echo "sanitized=$SANITIZED" >> "$GITHUB_OUTPUT" - - - name: Start validator - uses: metaplex-foundation/actions/start-validator@v1 - with: - node: 18.x - solana: ${{ env.SOLANA_VERSION }} - cache: ${{ env.CACHE }} - artifacts: program-builds-${{ steps.sanitize.outputs.sanitized }} - - - name: Install dependencies - uses: metaplex-foundation/actions/install-node-dependencies@v1 - with: - folder: ./clients/js - cache: ${{ env.CACHE }} - key: clients-js - - - name: Build - working-directory: ./clients/js - run: pnpm build - - - name: Test - working-directory: ./clients/js - run: pnpm bench - - # Download previous benchmark result from cache (if exists) - - name: Download previous benchmark data - uses: actions/cache@v4 - with: - path: ./cache - key: ${{ runner.os }}-benchmark - - # Run `github-action-benchmark` action - - name: Store benchmark result - uses: benchmark-action/github-action-benchmark@v1 - with: - # What benchmark tool the output.json came from - tool: "customSmallerIsBetter" - # Where the output from the benchmark tool is stored - output-file-path: ./clients/js/output.json - # Where the previous data file is stored - # external-data-json-path: ./cache/benchmark-data.json - # Enable Job Summary for PRs - summary-always: true - # Always comment on the PR - comment-always: true - # Don't save the benchmark data to the cache - save-data-file: false - # Workflow will fail when an alert happens - fail-on-alert: true - # Access token to deploy GitHub Pages branch - github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml deleted file mode 100644 index 91361e0..0000000 --- a/.github/workflows/benchmark.yml +++ /dev/null @@ -1,84 +0,0 @@ -name: Benchmark -on: - workflow_call: - inputs: - git_ref: - type: string - -permissions: - # deployments permission to deploy GitHub pages website - deployments: write - # contents permission to update benchmark contents in gh-pages branch - contents: write - -env: - CACHE: true - -jobs: - benchmark: - name: Performance regression check - runs-on: ubuntu-latest - steps: - - name: Git checkout - uses: actions/checkout@v4 - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Sanitize Ref - id: sanitize - shell: bash - run: | - REF="${{ inputs.git_ref }}" - if [ -z "$REF" ]; then - REF="default" - fi - SANITIZED=${REF//\//-} - echo "sanitized=$SANITIZED" >> "$GITHUB_OUTPUT" - - - name: Start validator - uses: metaplex-foundation/actions/start-validator@v1 - with: - node: 18.x - solana: ${{ env.SOLANA_VERSION }} - cache: ${{ env.CACHE }} - artifacts: program-builds-${{ steps.sanitize.outputs.sanitized }} - - - name: Install dependencies - uses: metaplex-foundation/actions/install-node-dependencies@v1 - with: - folder: ./clients/js - cache: ${{ env.CACHE }} - key: clients-js - - - name: Build - working-directory: ./clients/js - run: pnpm build - - - name: Test - working-directory: ./clients/js - run: pnpm bench - - # Download previous benchmark result from cache (if exists) - - name: Download previous benchmark data - uses: actions/cache@v4 - with: - path: ./cache - key: ${{ runner.os }}-benchmark - - # Run `github-action-benchmark` action - - name: Store benchmark result - uses: benchmark-action/github-action-benchmark@v1 - with: - # What benchmark tool the output.json came from - tool: "customSmallerIsBetter" - # Where the output from the benchmark tool is stored - output-file-path: ./clients/js/output.json - # Where the previous data file is stored - # external-data-json-path: ./cache/benchmark-data.json - # Workflow will fail when an alert happens - fail-on-alert: true - # Access token to deploy GitHub Pages branch - github-token: ${{ secrets.GITHUB_TOKEN }} - # Push and deploy GitHub pages branch automatically - auto-push: true diff --git a/.github/workflows/build-programs.yml b/.github/workflows/build-programs.yml deleted file mode 100644 index 5a7e379..0000000 --- a/.github/workflows/build-programs.yml +++ /dev/null @@ -1,83 +0,0 @@ -name: Build Programs - -on: - workflow_call: - inputs: - rust: - type: string - solana: - type: string - git_ref: - type: string - workflow_dispatch: - inputs: - rust: - description: Rust version - default: 1.83.0 - required: true - type: string - solana: - description: Solana version - default: 2.2.1 - required: true - type: string - -env: - CACHE: true - -jobs: - build_programs: - name: Build - runs-on: ubuntu-latest - steps: - - name: Git checkout - uses: actions/checkout@v4 - with: - ref: ${{ inputs.git_ref }} - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Install Rust - uses: metaplex-foundation/actions/install-rust@v1 - with: - toolchain: ${{ inputs.rust || env.RUST_VERSION }} - - - name: Install Solana - uses: metaplex-foundation/actions/install-solana@v1 - with: - version: ${{ inputs.solana || env.SOLANA_VERSION }} - cache: ${{ env.CACHE }} - - - name: Install Protobuf Compiler - run: sudo apt-get update && sudo apt-get install -y protobuf-compiler - - name: Cache program dependencies - if: env.CACHE == 'true' - uses: metaplex-foundation/actions/cache-programs@v1 - - - name: Build programs - shell: bash - working-directory: configs/scripts/program - run: ./build.sh - env: - PROGRAMS: ${{ env.PROGRAMS }} - - - name: Sanitize Ref - id: sanitize - shell: bash - run: | - REF="${{ inputs.git_ref }}" - if [ -z "$REF" ]; then - REF="default" - fi - SANITIZED=${REF//\//-} - echo "sanitized=$SANITIZED" >> "$GITHUB_OUTPUT" - - - name: Upload program builds - uses: actions/upload-artifact@v4 - with: - name: program-builds-${{ steps.sanitize.outputs.sanitized }} - # First wildcard ensures exported paths are consistently under the programs folder. - path: ./program*/.bin/*.so - include-hidden-files: true - if-no-files-found: error diff --git a/.github/workflows/build-rust-client.yml b/.github/workflows/build-rust-client.yml deleted file mode 100644 index ac014ab..0000000 --- a/.github/workflows/build-rust-client.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: Build Rust Client - -on: - workflow_call: - inputs: - rust: - type: string - solana: - type: string - git_ref: - type: string - workflow_dispatch: - inputs: - rust: - description: Rust version - default: 1.83.0 - required: true - type: string - solana: - description: Solana version - default: 2.2.1 - required: true - type: string - -env: - CACHE: true - -jobs: - build_sdk: - name: Build - runs-on: ubuntu-latest - strategy: - matrix: - client: [rust-identity, rust-reputation, rust-validation, rust-tools] - steps: - - name: Git checkout - uses: actions/checkout@v4 - with: - ref: ${{ inputs.git_ref }} - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Install Rust - uses: metaplex-foundation/actions/install-rust@v1 - with: - toolchain: ${{ inputs.rust || env.RUST_VERSION }} - - - name: Install Solana - uses: metaplex-foundation/actions/install-solana@v1 - with: - version: ${{ inputs.solana || env.SOLANA_VERSION }} - cache: ${{ env.CACHE }} - - - name: Install Protobuf Compiler - run: sudo apt-get update && sudo apt-get install -y protobuf-compiler - - name: Cache Rust client test dependencies - uses: metaplex-foundation/actions/cache-crate@v1 - with: - folder: ./clients/${{ matrix.client }} - key: ${{ matrix.client }}-test - - - name: Run cargo clippy - uses: actions-rs/cargo@v1 - with: - command: clippy - args: --all-targets --all-features --no-deps --manifest-path ./clients/${{ matrix.client }}/Cargo.toml - - - name: Build Rust client - shell: bash - working-directory: clients/${{ matrix.client }} - run: cargo build --all-features --release - - - name: Upload Rust client builds - uses: actions/upload-artifact@v4 - with: - name: rust-client-builds-${{ matrix.client }} - path: ./targe*/release/*mpl_agent* - if-no-files-found: error diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index b1c869e..b80c9f9 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -8,151 +8,69 @@ on: required: true default: mpl-agent-identity type: choice - options: - - mpl-agent-identity - - mpl-agent-reputation - - mpl-agent-validation - - mpl-agent-tools + options: [mpl-agent-identity, mpl-agent-reputation, mpl-agent-validation, mpl-agent-tools] bump: description: Version bump required: true default: patch type: choice - options: - - patch - - minor - - major + options: [patch, minor, major] git_ref: - description: Commit hash or branch to create release + description: Commit hash or branch to create the release from required: false type: string default: main - -env: - CACHE: true +permissions: {} jobs: build_programs: name: Programs - uses: ./.github/workflows/build-programs.yml - secrets: inherit + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read with: git_ref: ${{ inputs.git_ref }} + apt_packages: protobuf-compiler test_programs: name: Programs - uses: ./.github/workflows/test-programs.yml - secrets: inherit + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read with: program_matrix: '["${{ inputs.program }}"]' git_ref: ${{ inputs.git_ref }} + apt_packages: protobuf-compiler test_js: name: JS client needs: build_programs - uses: ./.github/workflows/test-js-client.yml - secrets: inherit + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read with: git_ref: ${{ inputs.git_ref }} - + node_matrix: '["22.x", "24.x"]' + test_rust: name: Rust client needs: build_programs - uses: ./.github/workflows/test-rust-client.yml - secrets: inherit + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read with: git_ref: ${{ inputs.git_ref }} - + apt_packages: protobuf-compiler + client_dir: clients + create_release: - name: Create program release - runs-on: ubuntu-latest + name: Program needs: [test_js, test_rust, test_programs] + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 permissions: contents: write - steps: - - name: Git checkout - uses: actions/checkout@v4 - with: - ref: ${{ inputs.git_ref }} - - name: Bump Program Version - run: | - git fetch --tags --all - VERSION=`git tag -l --sort -version:refname "release/${{ inputs.program }}@*" | head -n 1 | sed 's|release/${{ inputs.program }}@||'` - # First release for this program: start from 0.0.0 so the bump below produces a valid semver. - if [ -z "${VERSION}" ]; then - VERSION="0.0.0" - fi - MAJOR=`echo ${VERSION} | cut -d. -f1` - MINOR=`echo ${VERSION} | cut -d. -f2` - PATCH=`echo ${VERSION} | cut -d. -f3` - - if [ "${{ inputs.bump }}" == "major" ]; then - MAJOR=$((MAJOR + 1)) - MINOR=0 - PATCH=0 - elif [ "${{ inputs.bump }}" == "minor" ]; then - MINOR=$((MINOR + 1)) - PATCH=0 - else - PATCH=$((PATCH + 1)) - fi - - PROGRAM_VERSION="${MAJOR}.${MINOR}.${PATCH}" - - echo PROGRAM_VERSION="${PROGRAM_VERSION}" >> $GITHUB_ENV - - - name: Sanitize Ref - id: sanitize - shell: bash - run: | - REF="${{ inputs.git_ref }}" - if [ -z "$REF" ]; then - REF="default" - fi - SANITIZED=${REF//\//-} - echo "sanitized=$SANITIZED" >> "$GITHUB_OUTPUT" - - - name: Download Program Builds - uses: actions/download-artifact@v4 - with: - name: program-builds-${{ steps.sanitize.outputs.sanitized }} - - - name: Identify Program - run: | - PROGRAM_NAME=$(echo "${{ inputs.program }}" | tr - _) - echo PROGRAM_NAME="${PROGRAM_NAME}" >> $GITHUB_ENV - - - name: Create Release - id: create_release - uses: actions/create-release@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag_name: release/${{ inputs.program }}@${{ env.PROGRAM_VERSION }} - release_name: ${{ inputs.program }} v${{ env.PROGRAM_VERSION }} - body: | - Release ${{ inputs.program }} v${{ env.PROGRAM_VERSION }} - draft: false - prerelease: false - - - name: Upload Release Asset - uses: actions/upload-release-asset@v1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} - asset_path: ./programs/.bin/${{ env.PROGRAM_NAME }}_program.so - asset_name: ${{ env.PROGRAM_NAME }}_program.so - asset_content_type: application/octet-stream - - # - name: Update latest tag - # uses: actions/github-script@v5 - # with: - # script: | - # github.rest.git.createRef({ - # owner: context.repo.owner, - # repo: context.repo.repo, - # ref: 'refs/tags/release/${{ inputs.program }}@latest', - # sha: '${{ github.sha }}' - # }); \ No newline at end of file + with: + program: ${{ inputs.program }} + bump: ${{ inputs.bump }} + git_ref: ${{ inputs.git_ref }} diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index b214b98..c70e6bb 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -4,7 +4,7 @@ on: workflow_dispatch: inputs: git_ref: - description: Release tag (release/@) or commit to deploy + description: Release tag (release/mpl-agent-identity@0.1.0) or commit to deploy required: true type: string default: main @@ -13,11 +13,7 @@ on: required: true default: mpl-agent-identity type: choice - options: - - mpl-agent-identity - - mpl-agent-reputation - - mpl-agent-validation - - mpl-agent-tools + options: [mpl-agent-identity, mpl-agent-reputation, mpl-agent-validation, mpl-agent-tools] cluster: description: Cluster environment required: true @@ -37,304 +33,114 @@ on: type: boolean default: false -env: - CACHE: true +permissions: {} jobs: check_tag: - name: 'Check tag' + name: Check tag runs-on: ubuntu-latest + permissions: {} outputs: - program: ${{ steps.set_program.outputs.program }} - type: ${{ steps.set_program.outputs.type }} + type: ${{ steps.set_type.outputs.type }} steps: - - name: Check tag - id: set_program - env: - GIT_REF: ${{ inputs.git_ref }} - PROGRAM: ${{ inputs.program }} - run: | - echo "program=${PROGRAM}" >> $GITHUB_OUTPUT - # Require literal `release/@<...>` — `@*` regex would match `release/` with no version. - if [[ "${GIT_REF}" == "release/${PROGRAM}@"* ]]; then - echo "type=release" >> $GITHUB_OUTPUT - else - echo "type=ref" >> $GITHUB_OUTPUT - fi + - name: Check tag + id: set_type + env: + GIT_REF: ${{ inputs.git_ref }} + run: | + # A release tag deploys the asset attached to the GitHub release; any + # other ref is built and tested first. + if [[ "$GIT_REF" == release/*@* ]]; then + echo "type=release" >> "$GITHUB_OUTPUT" + else + echo "type=ref" >> "$GITHUB_OUTPUT" + fi + build_programs: name: Programs - uses: ./.github/workflows/build-programs.yml - secrets: inherit - needs: check_tag if: needs.check_tag.outputs.type == 'ref' + needs: check_tag + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read with: git_ref: ${{ inputs.git_ref }} + apt_packages: protobuf-compiler test_programs: - name: Test Programs - uses: ./.github/workflows/test-programs.yml - secrets: inherit - needs: [build_programs, check_tag] + name: Programs if: needs.check_tag.outputs.type == 'ref' + needs: [check_tag, build_programs] + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read with: program_matrix: '["${{ inputs.program }}"]' git_ref: ${{ inputs.git_ref }} + apt_packages: protobuf-compiler test_js: name: JS client - needs: [build_programs, check_tag] - uses: ./.github/workflows/test-js-client.yml - secrets: inherit if: needs.check_tag.outputs.type == 'ref' + needs: [check_tag, build_programs] + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read with: git_ref: ${{ inputs.git_ref }} + node_matrix: '["22.x", "24.x"]' test_rust: name: Rust client - needs: [build_programs, check_tag] - uses: ./.github/workflows/test-rust-client.yml - secrets: inherit if: needs.check_tag.outputs.type == 'ref' + needs: [check_tag, build_programs] + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read with: git_ref: ${{ inputs.git_ref }} + apt_packages: protobuf-compiler + client_dir: clients - deploy_program: - name: Program / Deploy - runs-on: ubuntu-latest-16-cores - needs: [check_tag, test_js, test_programs, test_rust] + deploy: + name: Program if: | always() && (needs.test_js.result == 'success' || needs.test_js.result == 'skipped') && (needs.test_programs.result == 'success' || needs.test_programs.result == 'skipped') && (needs.test_rust.result == 'success' || needs.test_rust.result == 'skipped') + needs: [check_tag, test_js, test_programs, test_rust] + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 permissions: contents: write - steps: - - name: Git checkout - uses: actions/checkout@v4 - with: - token: ${{ secrets.SVC_TOKEN }} - ref: ${{ inputs.git_ref }} - - - name: Resolve checked-out commit - id: resolved - run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Install Rust - uses: metaplex-foundation/actions/install-rust@v1 - with: - toolchain: ${{ env.RUST_VERSION }} - - - name: Install Solana - uses: metaplex-foundation/actions/install-solana@v1 - with: - version: ${{ env.DEPLOY_SOLANA_VERSION }} - cache: ${{ env.CACHE }} - - - name: Install cargo-release - uses: metaplex-foundation/actions/install-cargo-release@v1 - if: github.event.inputs.publish_crate == 'true' - with: - cache: ${{ env.CACHE }} - - - name: Set RPC - run: | - # We do this if waterfall because github actions does not allow dynamic access to secrets - if [ "${{ inputs.cluster }}" == "devnet" ]; then - echo RPC=${{ secrets.DEVNET_RPC }} >> $GITHUB_ENV - elif [ "${{ inputs.cluster }}" == "mainnet-beta" ]; then - echo RPC=${{ secrets.MAINNET_RPC }} >> $GITHUB_ENV - elif [ "${{ inputs.cluster }}" == "sonic-devnet" ]; then - echo RPC=${{ secrets.SONIC_DEVNET_RPC }} >> $GITHUB_ENV - elif [ "${{ inputs.cluster }}" == "sonic-testnet" ]; then - echo RPC=${{ secrets.SONIC_TESTNET_RPC }} >> $GITHUB_ENV - elif [ "${{ inputs.cluster }}" == "eclipse-devnet" ]; then - echo RPC=${{ secrets.ECLIPSE_DEVNET_RPC }} >> $GITHUB_ENV - elif [ "${{ inputs.cluster }}" == "eclipse-testnet" ]; then - echo RPC=${{ secrets.ECLIPSE_TESTNET_RPC }} >> $GITHUB_ENV - elif [ "${{ inputs.cluster }}" == "eclipse-mainnet" ]; then - echo RPC=${{ secrets.ECLIPSE_MAINNET_RPC }} >> $GITHUB_ENV - fi - - - name: Identify Program - env: - PROGRAM: ${{ inputs.program }} - CLUSTER: ${{ inputs.cluster }} - IDENTITY_PROGRAM_ID: ${{ secrets.IDENTITY_PROGRAM_ID }} - REPUTATION_PROGRAM_ID: ${{ secrets.REPUTATION_PROGRAM_ID }} - VALIDATION_PROGRAM_ID: ${{ secrets.VALIDATION_PROGRAM_ID }} - TOOLS_PROGRAM_ID: ${{ secrets.TOOLS_PROGRAM_ID }} - PROGRAM_SOLANA_DEPLOY_KEY: ${{ secrets.PROGRAM_SOLANA_DEPLOY_KEY }} - PROGRAM_SONIC_DEPLOY_KEY: ${{ secrets.PROGRAM_SONIC_DEPLOY_KEY }} - PROGRAM_ECLIPSE_DEPLOY_KEY: ${{ secrets.PROGRAM_ECLIPSE_DEPLOY_KEY }} - run: | - PROGRAM_NAME=$(echo "${PROGRAM}" | tr - _) - echo PROGRAM_NAME="${PROGRAM_NAME}" >> $GITHUB_ENV - - # Per-program program-id keypair secret (waterfall — github actions does not allow dynamic access to secrets) - case "${PROGRAM}" in - mpl-agent-identity) PROGRAM_ID_KEYPAIR="${IDENTITY_PROGRAM_ID}" ;; - mpl-agent-reputation) PROGRAM_ID_KEYPAIR="${REPUTATION_PROGRAM_ID}" ;; - mpl-agent-validation) PROGRAM_ID_KEYPAIR="${VALIDATION_PROGRAM_ID}" ;; - mpl-agent-tools) PROGRAM_ID_KEYPAIR="${TOOLS_PROGRAM_ID}" ;; - *) echo "Invalid program: ${PROGRAM}"; exit 1 ;; - esac - - if [ -z "${PROGRAM_ID_KEYPAIR}" ]; then - echo "Missing program-id secret for ${PROGRAM} (set IDENTITY_PROGRAM_ID / REPUTATION_PROGRAM_ID / VALIDATION_PROGRAM_ID / TOOLS_PROGRAM_ID)." - exit 1 - fi - echo "${PROGRAM_ID_KEYPAIR}" > ./program-id.json - - case "${CLUSTER}" in - sonic*) DEPLOYER_KEY="${PROGRAM_SONIC_DEPLOY_KEY}" ;; - eclipse*) DEPLOYER_KEY="${PROGRAM_ECLIPSE_DEPLOY_KEY}" ;; - devnet) DEPLOYER_KEY="${PROGRAM_SOLANA_DEPLOY_KEY}" ;; - mainnet-beta) DEPLOYER_KEY="${PROGRAM_SOLANA_DEPLOY_KEY}" ;; - *) echo "Invalid cluster: ${CLUSTER}"; exit 1 ;; - esac - - if [ -z "${DEPLOYER_KEY}" ]; then - echo "Missing deployer-key secret for cluster ${CLUSTER}." - exit 1 - fi - echo "${DEPLOYER_KEY}" > ./deployer-key.json - echo DEPLOY_TYPE="direct" >> $GITHUB_ENV - - - name: Sanitize Ref - id: sanitize - shell: bash - run: | - REF="${{ inputs.git_ref }}" - if [ -z "$REF" ]; then - REF="default" - fi - SANITIZED=${REF//\//-} - echo "sanitized=$SANITIZED" >> "$GITHUB_OUTPUT" - - - name: Download program builds - uses: actions/download-artifact@v4 - if: needs.check_tag.outputs.type == 'ref' - with: - name: program-builds-${{ steps.sanitize.outputs.sanitized }} - - - name: Download release asset - uses: actions/github-script@v5 - id: get_release - if: needs.check_tag.outputs.type == 'release' - with: - script: | - const tag = "${{ inputs.git_ref }}"; - const assetName = "${{ env.PROGRAM_NAME }}_program.so"; - - // Fetch the release associated with the tag - const release = await github.rest.repos.getReleaseByTag({ - owner: context.repo.owner, - repo: context.repo.repo, - tag: tag - }); - - if (release.status !== 200) { - throw new Error(`Failed to fetch release for tag ${tag}`); - } - - const asset = release.data.assets.find(asset => asset.name === assetName); - if (!asset) { - throw new Error(`Asset ${assetName} not found in release tagged ${tag}`); - } - - core.setOutput("url", asset.url); - - - name: Download the Selected Asset - if: needs.check_tag.outputs.type == 'release' - run: | - mkdir -p ${{ github.workspace }}/programs/.bin - curl -L -o ${{ github.workspace }}/programs/.bin/${{ env.PROGRAM_NAME }}_program.so \ - -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ - -H "Accept: application/octet-stream" \ - "${{ steps.get_release.outputs.url }}" - - - name: Deploy Program - if: github.event.inputs.dry_run == 'false' && env.DEPLOY_TYPE == 'direct' - run: | - echo "Deploying ${{ needs.check_tag.outputs.program }} to ${{ inputs.cluster }}" - - solana -v program deploy ./programs/.bin/${{ env.PROGRAM_NAME }}_program.so \ - -u ${{ env.RPC }} \ - --program-id ./program-id.json \ - -k ./deployer-key.json \ - --max-sign-attempts 100 \ - --use-rpc - - rm ./deployer-key.json - rm ./program-id.json - - - name: Deploy squads buffer - if: github.event.inputs.dry_run == 'false' && env.DEPLOY_TYPE == 'squads' - run: | - echo "Deploying buffer for ${{ inputs.program }} on ${{ inputs.cluster }}" - echo ${{ secrets.SQUADS_BOT_KEY }} > ./submitter-key.json - - BUFFER=$(solana program write-buffer -u ${{ env.RPC }} -k ./submitter-key.json --max-sign-attempts 100 --use-rpc ./programs/.bin/${{ env.PROGRAM_NAME }}_program.so | awk '{print $2}') - echo "Buffer: $BUFFER" - - solana program set-buffer-authority $BUFFER \ - --new-buffer-authority ${{ env.SQUADS_VAULT }} \ - -k ./submitter-key.json \ - -u ${{ env.RPC }} - - rm ./submitter-key.json - - echo "BUFFER=$BUFFER" >> $GITHUB_ENV - - - - name: Create env tag - uses: actions/github-script@v7 - if: github.event.inputs.dry_run == 'false' - env: - REF_TYPE: ${{ needs.check_tag.outputs.type }} - GIT_REF: ${{ inputs.git_ref }} - PROGRAM: ${{ needs.check_tag.outputs.program }} - CLUSTER: ${{ inputs.cluster }} - RESOLVED_SHA: ${{ steps.resolved.outputs.sha }} - with: - github-token: ${{ secrets.GH_TAGGER_TOKEN }} - script: | - // For release tags we can dereference via the GitHub API. For ref inputs - // (branch names, SHAs) getRef won't accept a bare value, so use the SHA - // we resolved from the checked-out workspace instead. - let sha; - if (process.env.REF_TYPE === 'release') { - const refData = await github.rest.git.getRef({ - owner: context.repo.owner, - repo: context.repo.repo, - ref: `tags/${process.env.GIT_REF}`, - }); - sha = refData.data.object.sha; - } else { - sha = process.env.RESOLVED_SHA; - if (!sha) { - throw new Error('Resolved checkout SHA is empty'); - } - } - - const envRef = `${process.env.PROGRAM}-${process.env.CLUSTER}`; - try { - await github.rest.git.createRef({ - owner: context.repo.owner, - repo: context.repo.repo, - ref: `refs/tags/${envRef}`, - sha, - }); - } catch (err) { - if (err.status !== 422) throw err; - await github.rest.git.updateRef({ - owner: context.repo.owner, - repo: context.repo.repo, - ref: `tags/${envRef}`, - sha, - }); - } + # GitHub Actions cannot look secrets up by a computed name, so the + # per-cluster secrets are mapped onto the shared workflow's fixed names here. + secrets: + RPC_URL: >- + ${{ inputs.cluster == 'devnet' && secrets.DEVNET_RPC + || inputs.cluster == 'mainnet-beta' && secrets.MAINNET_RPC + || inputs.cluster == 'sonic-devnet' && secrets.SONIC_DEVNET_RPC + || inputs.cluster == 'sonic-testnet' && secrets.SONIC_TESTNET_RPC + || inputs.cluster == 'eclipse-devnet' && secrets.ECLIPSE_DEVNET_RPC + || inputs.cluster == 'eclipse-testnet' && secrets.ECLIPSE_TESTNET_RPC + || inputs.cluster == 'eclipse-mainnet' && secrets.ECLIPSE_MAINNET_RPC + || '' }} + PROGRAM_ID_KEYPAIR: >- + ${{ inputs.program == 'mpl-agent-identity' && secrets.IDENTITY_PROGRAM_ID + || inputs.program == 'mpl-agent-reputation' && secrets.REPUTATION_PROGRAM_ID + || inputs.program == 'mpl-agent-validation' && secrets.VALIDATION_PROGRAM_ID + || inputs.program == 'mpl-agent-tools' && secrets.TOOLS_PROGRAM_ID + || '' }} + DEPLOYER_KEYPAIR: >- + ${{ inputs.cluster == 'devnet' && secrets.PROGRAM_SOLANA_DEPLOY_KEY + || inputs.cluster == 'mainnet-beta' && secrets.PROGRAM_SOLANA_DEPLOY_KEY + || startsWith(inputs.cluster, 'sonic') && secrets.PROGRAM_SONIC_DEPLOY_KEY + || startsWith(inputs.cluster, 'eclipse') && secrets.PROGRAM_ECLIPSE_DEPLOY_KEY + || '' }} + SQUADS_BOT_KEY: ${{ secrets.SQUADS_BOT_KEY }} + with: + program: ${{ inputs.program }} + cluster: ${{ inputs.cluster }} + git_ref: ${{ inputs.git_ref }} + dry_run: ${{ inputs.dry_run }} + runner: ubuntu-latest-16-cores diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index f7a7c25..761f402 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,139 +1,83 @@ name: Main +# Thin orchestrator over the shared workflows in metaplex-foundation/actions. +# Repository facts live in .github/.env (toolchain pins), .github/programs.json +# (program descriptors) and .github/file-filters.yml (change detection). + on: push: branches: [main] pull_request: branches: [main] -env: - CACHE: true +permissions: {} jobs: changes: name: Detect changes - runs-on: ubuntu-latest - outputs: - any: ${{ steps.changes.outputs.any }} - programs: ${{ steps.changes.outputs.programs }} - program_matrix: ${{ steps.program_matrix.outputs.matrix }} - js_client: ${{ steps.changes.outputs.js_client }} - rust_client: ${{ steps.changes.outputs.rust_client }} - steps: - - name: Git checkout - uses: actions/checkout@v4 - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Detect changes - uses: dorny/paths-filter@v2 - id: changes - with: - filters: .github/file-filters.yml - - - name: Filter program matrix - id: program_matrix - uses: metaplex-foundation/actions/filter-matrix@v1 - with: - matrix: ${{ env.PROGRAMS }} - changes: ${{ steps.changes.outputs.changes }} - suffix: _program + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read + pull-requests: read build_programs: name: Programs - if: ${{ needs.changes.outputs.any == 'true' }} + if: needs.changes.outputs.any == 'true' needs: changes - uses: ./.github/workflows/build-programs.yml - secrets: inherit + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read + with: + apt_packages: protobuf-compiler test_programs: name: Programs - if: ${{ needs.changes.outputs.programs == 'true' }} + if: needs.changes.outputs.programs == 'true' needs: changes - uses: ./.github/workflows/test-programs.yml - secrets: inherit + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read with: program_matrix: ${{ needs.changes.outputs.program_matrix }} + apt_packages: protobuf-compiler generate_clients: name: Generate clients - if: ${{ needs.changes.outputs.any == 'true' }} - needs: build_programs - runs-on: ubuntu-latest - steps: - - name: Git checkout - uses: actions/checkout@v4 - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Install Linux Build Deps - run: sudo apt-get update && sudo apt-get install -y pkg-config build-essential libudev-dev - - - name: Install Rust - uses: metaplex-foundation/actions/install-rust@v1 - with: - toolchain: ${{ env.RUST_VERSION }} - - - name: Install Solana - uses: metaplex-foundation/actions/install-solana@v1 - with: - version: ${{ env.SOLANA_VERSION }} - cache: ${{ env.CACHE }} - - - name: Cache program dependencies - if: env.CACHE == 'true' - uses: metaplex-foundation/actions/cache-programs@v1 - - - name: Install Node.js - uses: metaplex-foundation/actions/install-node-with-pnpm@v1 - with: - version: ${{ env.NODE_VERSION }} - cache: ${{ env.CACHE }} - dependencies: true - - - name: Cache IDL generators - if: env.CACHE == 'true' - uses: metaplex-foundation/actions/cache-idl-generators@v1 - - - name: Generate IDLs and clients - run: pnpm generate - - - name: Ensure working directory is clean - run: test -z "$(git status --porcelain)" + if: needs.changes.outputs.any == 'true' + needs: [changes, build_programs] + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read test_js: - if: needs.changes.outputs.js_client == 'true' name: JS Client - needs: generate_clients - uses: ./.github/workflows/test-js-client.yml - secrets: inherit - - # benchmark: - # if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} - # name: Benchmark - # needs: generate_clients - # uses: ./.github/workflows/benchmark.yml - # secrets: inherit - - # benchmark_summary: - # if: ${{ github.event_name == 'pull_request' }} - # name: Benchmark Summary - # needs: generate_clients - # uses: ./.github/workflows/benchmark-summary.yml - # secrets: inherit + if: needs.changes.outputs.js_client == 'true' + needs: [changes, generate_clients] + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read + with: + node_matrix: '["22.x", "24.x"]' build_rust_client: - if: needs.changes.outputs.rust_client == 'true' name: Rust Client - needs: generate_clients - uses: ./.github/workflows/build-rust-client.yml - secrets: inherit + if: needs.changes.outputs.rust_client == 'true' + needs: [changes, generate_clients] + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read + with: + apt_packages: protobuf-compiler + client_matrix: '["clients/rust-identity", "clients/rust-reputation", "clients/rust-validation", "clients/rust-tools"]' + features: --all-features test_rust_client: - if: needs.changes.outputs.rust_client == 'true' name: Rust Client - needs: generate_clients - uses: ./.github/workflows/test-rust-client.yml - secrets: inherit + if: needs.changes.outputs.rust_client == 'true' + needs: [changes, generate_clients] + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read + with: + apt_packages: protobuf-compiler + client_dir: clients diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index 4b4c7b1..6110524 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -3,138 +3,90 @@ name: Publish JS Client on: workflow_dispatch: inputs: + git_ref: + description: Release tag (release/mpl-agent-identity@0.1.0) or commit to publish from + required: false + type: string + default: '' bump: description: Version bump required: true default: patch type: choice - options: - - patch - - minor - - major - - prerelease - - prepatch - - preminor - - premajor + options: [patch, minor, major, prerelease, prepatch, preminor, premajor] tag: - description: NPM Tag (and preid for pre-releases) + description: NPM tag (and preid for pre-releases) required: true type: string default: latest create_release: - description: Create a GitHub release + description: Open the release pull request and deploy docs required: true type: boolean default: true -env: - CACHE: true +permissions: {} jobs: + check_tag: + name: Check tag + runs-on: ubuntu-latest + permissions: {} + outputs: + type: ${{ steps.set_type.outputs.type }} + steps: + - name: Check tag + id: set_type + env: + GIT_REF: ${{ inputs.git_ref }} + run: | + # A program release tag was already built and tested when it was cut. + if [[ "$GIT_REF" == release/*@* ]]; then + echo "type=release" >> "$GITHUB_OUTPUT" + else + echo "type=ref" >> "$GITHUB_OUTPUT" + fi + build_programs: name: Programs - uses: ./.github/workflows/build-programs.yml - secrets: inherit + if: needs.check_tag.outputs.type == 'ref' + needs: check_tag + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read + with: + git_ref: ${{ inputs.git_ref }} + apt_packages: protobuf-compiler test_js: name: JS client - needs: build_programs - uses: ./.github/workflows/test-js-client.yml - secrets: inherit + if: needs.check_tag.outputs.type == 'ref' + needs: [check_tag, build_programs] + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read + with: + git_ref: ${{ inputs.git_ref }} + node_matrix: '["22.x", "24.x"]' - publish_js: - name: JS client / Publish - runs-on: ubuntu-latest - needs: test_js + publish: + name: JS client + if: | + always() + && (needs.test_js.result == 'success' || needs.test_js.result == 'skipped') + needs: [check_tag, test_js] + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 permissions: contents: write - packages: write pull-requests: write id-token: write - steps: - - name: Git checkout - uses: actions/checkout@v4 - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Install pnpm - uses: pnpm/action-setup@v4 - with: - version: 8.9.0 - - - name: Install Node.js - uses: actions/setup-node@v4 - with: - node-version: 24.x - registry-url: 'https://registry.npmjs.org' - cache: 'pnpm' - - - name: Install dependencies - uses: metaplex-foundation/actions/install-node-dependencies@v1 - with: - folder: ./clients/js - cache: ${{ env.CACHE }} - key: clients-js - - - name: Build - working-directory: ./clients/js - run: pnpm build - - - name: Bump - id: bump - working-directory: ./clients/js - run: | - if [ "${{ startsWith(inputs.bump, 'pre') }}" == "true" ]; then - pnpm version ${{ inputs.bump }} --preid ${{ inputs.tag }} --no-git-tag-version - else - pnpm version ${{ inputs.bump }} --no-git-tag-version - fi - echo "new_version=$(pnpm pkg get version | sed 's/"//g')" >> $GITHUB_OUTPUT - - - name: Publish - working-directory: ./clients/js - run: npm publish --access public --tag ${{ inputs.tag }} --provenance - - - name: Create release pull request - if: ${{ github.event.inputs.create_release == 'true' }} - uses: peter-evans/create-pull-request@v6 - with: - commit-message: 'chore: release JS client v${{ steps.bump.outputs.new_version }}' - branch: release/js-client-v${{ steps.bump.outputs.new_version }} - title: 'chore: release JS client v${{ steps.bump.outputs.new_version }}' - body: | - ## Summary - - publish-js-client workflow bumped the package to `${{ steps.bump.outputs.new_version }}` - - once merged, run the release workflow to tag `js@v${{ steps.bump.outputs.new_version }}` - labels: release - - - name: Create GitHub release - if: github.event.inputs.create_release == 'true' - uses: ncipollo/release-action@v1 - with: - tag: js@v${{ steps.bump.outputs.new_version }} - - deploy_js_docs: - name: JS client / Deploy docs - runs-on: ubuntu-latest - needs: publish_js - environment: - name: js-client-documentation - url: ${{ steps.deploy.outputs.url }} - steps: - - name: Git checkout - uses: actions/checkout@v4 - with: - ref: ${{ github.ref }} - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Deploy to Vercel - id: deploy - env: - VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} - VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} - working-directory: ./clients/js - run: echo "url=$(vercel deploy --prod --token=${{ secrets.VERCEL_TOKEN }})" | tee $GITHUB_OUTPUT + secrets: + VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }} + VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} + VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} + with: + git_ref: ${{ inputs.git_ref }} + bump: ${{ inputs.bump }} + tag: ${{ inputs.tag }} + create_release: ${{ inputs.create_release }} + deploy_docs: true diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index 5673301..5a9b93d 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -1,5 +1,7 @@ name: Publish Rust Client +run-name: Publish Rust Client (${{ inputs.level }}${{ inputs.dry_run && ', dry run' || '' }}) + on: workflow_dispatch: inputs: @@ -7,27 +9,15 @@ on: description: Client to publish required: true type: choice - options: - - rust-identity - - rust-reputation - - rust-validation - - rust-tools + options: [rust-identity, rust-reputation, rust-validation, rust-tools] level: description: Level required: true default: patch type: choice - options: - - patch - - minor - - major - - rc - - beta - - alpha - - release - - version + options: [patch, minor, major, rc, beta, alpha, release, version] version: - description: Version + description: Version (when level is `version`) required: false type: string dry_run: @@ -36,81 +26,48 @@ on: default: true type: boolean -env: - CACHE: true +permissions: {} jobs: build_programs: name: Programs - uses: ./.github/workflows/build-programs.yml - secrets: inherit + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read + with: + apt_packages: protobuf-compiler build_rust_client: - name: Rust Client - uses: ./.github/workflows/build-rust-client.yml - secrets: inherit + name: Rust client + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read + with: + apt_packages: protobuf-compiler + client_matrix: '["clients/rust-identity", "clients/rust-reputation", "clients/rust-validation", "clients/rust-tools"]' + features: --all-features test_rust_client: - name: Rust Client + name: Rust client needs: [build_programs, build_rust_client] - uses: ./.github/workflows/test-rust-client.yml - secrets: inherit + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: read + with: + apt_packages: protobuf-compiler + client_dir: clients - publish_crate: - name: Rust Client / Publish Crate - runs-on: ubuntu-latest + publish: + name: Rust client needs: test_rust_client + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 permissions: contents: write - steps: - - name: Git checkout - uses: actions/checkout@v4 - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Install Rust - uses: metaplex-foundation/actions/install-rust@v1 - with: - toolchain: ${{ env.RUST_VERSION }} - - - name: Install cargo-release - uses: metaplex-foundation/actions/install-cargo-release@v1 - with: - cache: ${{ env.CACHE }} - - - name: Publish crate - working-directory: ./clients/${{ inputs.client }} - run: | - if [ "${{ inputs.level }}" == "version" ]; then - BUMP=${{ inputs.version }} - else - BUMP=${{ inputs.level }} - fi - - if [ "${{ inputs.dry_run }}" == "false" ]; then - OPTIONS="--no-push --no-tag --no-confirm --execute" - git config user.name ${{ env.COMMIT_USER_NAME }} - git config user.email ${{ env.COMMIT_USER_EMAIL }} - fi - - echo "Cargo logging in" - cargo login ${{ secrets.CRATES_TOKEN }} - echo "Cargo release" - cargo release $BUMP $OPTIONS - - if [ "${{ inputs.dry_run }}" == "false" ]; then - git reset --soft HEAD~1 - fi - - CLIENT_NAME=`grep -E '^name\s*=' Cargo.toml | awk -F '"' '{print $2}'` - CLIENT_VERSION=`grep -E '^version\s*=' Cargo.toml | awk -F '"' '{print $2}'` - echo CLIENT_NAME="${CLIENT_NAME}" >> $GITHUB_ENV - echo CLIENT_VERSION="${CLIENT_VERSION}" >> $GITHUB_ENV - - - name: Commit and tag new version - uses: stefanzweifel/git-auto-commit-action@v4 - if: github.event.inputs.dry_run == 'false' - with: - commit_message: "chore: Release ${{ env.CLIENT_NAME }} version ${{ env.CLIENT_VERSION }}" - tagging_message: ${{ env.CLIENT_NAME }}@v${{ env.CLIENT_VERSION }} + pull-requests: write + secrets: + CRATES_TOKEN: ${{ secrets.CRATES_TOKEN }} + with: + level: ${{ inputs.level }} + version: ${{ inputs.version }} + dry_run: ${{ inputs.dry_run }} + client_dir: ${{ inputs.client == 'rust-identity' && 'clients/rust-identity' || inputs.client == 'rust-reputation' && 'clients/rust-reputation' || inputs.client == 'rust-validation' && 'clients/rust-validation' || inputs.client == 'rust-tools' && 'clients/rust-tools' || '' }} diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml new file mode 100644 index 0000000..1f63c72 --- /dev/null +++ b/.github/workflows/release-js-client.yml @@ -0,0 +1,24 @@ +name: Release JS Client + +# Tags and releases the JS client once the pull request opened by +# publish-js-client is merged. + +on: + pull_request: + types: [closed] + branches: [main] + +permissions: {} + +jobs: + release: + name: JS client + if: | + github.event.pull_request.merged == true + && startsWith(github.event.pull_request.head.ref, 'release/js-client-') + && github.event.pull_request.head.repo.full_name == github.repository + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: write + with: + merge_commit_sha: ${{ github.event.pull_request.merge_commit_sha }} diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml new file mode 100644 index 0000000..54028d3 --- /dev/null +++ b/.github/workflows/release-rust-client.yml @@ -0,0 +1,25 @@ +name: Release Rust Client + +# Tags and releases the Rust client once the pull request opened by +# publish-rust-client is merged. + +on: + pull_request: + types: [closed] + branches: [main] + +permissions: {} + +jobs: + release: + name: Rust client + if: | + github.event.pull_request.merged == true + && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') + && github.event.pull_request.head.repo.full_name == github.repository + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + permissions: + contents: write + with: + merge_commit_sha: ${{ github.event.pull_request.merge_commit_sha }} + client_matrix: '["clients/rust-identity", "clients/rust-reputation", "clients/rust-validation", "clients/rust-tools"]' diff --git a/.github/workflows/test-js-client.yml b/.github/workflows/test-js-client.yml deleted file mode 100644 index 0efda83..0000000 --- a/.github/workflows/test-js-client.yml +++ /dev/null @@ -1,91 +0,0 @@ -name: Test JS client - -on: - workflow_call: - inputs: - git_ref: - type: string - -env: - CACHE: true - -jobs: - test: - name: Test - runs-on: ubuntu-latest - strategy: - matrix: - node: ["22.x", "24.x"] - steps: - - name: Git checkout - uses: actions/checkout@v4 - with: - ref: ${{ inputs.git_ref }} - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Sanitize Ref - id: sanitize - shell: bash - run: | - REF="${{ inputs.git_ref }}" - if [ -z "$REF" ]; then - REF="default" - fi - SANITIZED=${REF//\//-} - echo "sanitized=$SANITIZED" >> "$GITHUB_OUTPUT" - - - name: Start validator - uses: metaplex-foundation/actions/start-validator@v1 - with: - node: ${{ matrix.node }} - solana: ${{ env.SOLANA_VERSION }} - cache: ${{ env.CACHE }} - artifacts: program-builds-${{ steps.sanitize.outputs.sanitized }} - - - name: Install dependencies - uses: metaplex-foundation/actions/install-node-dependencies@v1 - with: - folder: ./clients/js - cache: ${{ env.CACHE }} - key: clients-js - - - name: Build - working-directory: ./clients/js - run: pnpm build - - - name: Test - working-directory: ./clients/js - run: pnpm test - - lint: - name: Lint - runs-on: ubuntu-latest - steps: - - name: Git checkout - uses: actions/checkout@v4 - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Install Node.js - uses: metaplex-foundation/actions/install-node-with-pnpm@v1 - with: - version: ${{ env.NODE_VERSION }} - cache: ${{ env.CACHE }} - - - name: Install dependencies - uses: metaplex-foundation/actions/install-node-dependencies@v1 - with: - folder: ./clients/js - cache: ${{ env.CACHE }} - key: clients-js - - - name: Format - working-directory: ./clients/js - run: pnpm format - - - name: Lint - working-directory: ./clients/js - run: pnpm lint diff --git a/.github/workflows/test-programs.yml b/.github/workflows/test-programs.yml deleted file mode 100644 index fadccac..0000000 --- a/.github/workflows/test-programs.yml +++ /dev/null @@ -1,68 +0,0 @@ -name: Test Programs - -on: - workflow_call: - inputs: - program_matrix: - type: string - git_ref: - type: string - -env: - CACHE: true - -jobs: - test_programs: - name: Test - runs-on: ubuntu-latest - strategy: - matrix: - program: ${{ fromJson(inputs.program_matrix) }} - steps: - - name: Git checkout - uses: actions/checkout@v4 - with: - ref: ${{ inputs.git_ref }} - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Install Rust - uses: metaplex-foundation/actions/install-rust@v1 - with: - toolchain: ${{ env.RUST_VERSION }} - - - name: Install Solana - uses: metaplex-foundation/actions/install-solana@v1 - with: - version: ${{ env.SOLANA_VERSION }} - cache: ${{ env.CACHE }} - - - name: Install Protobuf Compiler - run: sudo apt-get update && sudo apt-get install -y protobuf-compiler - - - name: Cache program dependencies - if: env.CACHE == 'true' - uses: metaplex-foundation/actions/cache-program@v1 - with: - folder: ./programs/${{ matrix.program }} - key: program-${{ matrix.program }} - - - name: Run cargo fmt - uses: actions-rs/cargo@v1 - with: - command: fmt - args: --all --manifest-path ./programs/${{ matrix.program }}/Cargo.toml -- --check - - - name: Run cargo clippy - uses: actions-rs/cargo@v1 - with: - command: clippy - args: --all-targets --all-features --no-deps --manifest-path ./programs/${{ matrix.program }}/Cargo.toml - - - name: Run tests - shell: bash - working-directory: configs/scripts/program - run: RUST_LOG=error ./test.sh - env: - PROGRAM: ${{ matrix.program }} diff --git a/.github/workflows/test-rust-client.yml b/.github/workflows/test-rust-client.yml deleted file mode 100644 index 5fd341c..0000000 --- a/.github/workflows/test-rust-client.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Test Rust Client - -on: - workflow_call: - inputs: - program_matrix: - type: string - git_ref: - type: string - -env: - CACHE: true - -jobs: - test_sdk: - name: Test - runs-on: ubuntu-latest - steps: - - name: Git checkout - uses: actions/checkout@v4 - with: - ref: ${{ inputs.git_ref }} - - - name: Load environment variables - run: cat .github/.env >> $GITHUB_ENV - - - name: Install Rust - uses: metaplex-foundation/actions/install-rust@v1 - with: - toolchain: ${{ env.RUST_VERSION }} - - - name: Install Solana - uses: metaplex-foundation/actions/install-solana@v1 - with: - version: ${{ env.SOLANA_VERSION }} - cache: ${{ env.CACHE }} - - - name: Install Protobuf Compiler - run: sudo apt-get update && sudo apt-get install -y protobuf-compiler - - - name: Cache Rust client test dependencies - uses: metaplex-foundation/actions/cache-crate@v1 - with: - folder: ./clients - key: rust-clients-test - - - name: Sanitize Ref - id: sanitize - shell: bash - run: | - REF="${{ inputs.git_ref }}" - if [ -z "$REF" ]; then - REF="default" - fi - SANITIZED=${REF//\//-} - echo "sanitized=$SANITIZED" >> "$GITHUB_OUTPUT" - - name: Download program builds - uses: actions/download-artifact@v4 - with: - name: program-builds-${{ steps.sanitize.outputs.sanitized }} - - - name: Run tests - shell: bash - working-directory: configs/scripts/client - run: RUST_LOG=error ./test-rust.sh \ No newline at end of file From 94140a9624599a718126a0713c9fd7ffda3e6678 Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Fri, 30 Oct 2026 11:07:26 -0400 Subject: [PATCH 02/12] ci: pin shared workflows to actions@7afc538992df Picks up the solana-verify version default in the shared workflows. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/create-release.yml | 10 +++++----- .github/workflows/deploy-program.yml | 10 +++++----- .github/workflows/main.yml | 14 +++++++------- .github/workflows/publish-js-client.yml | 6 +++--- .github/workflows/publish-rust-client.yml | 8 ++++---- .github/workflows/release-js-client.yml | 2 +- .github/workflows/release-rust-client.yml | 2 +- 7 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index b80c9f9..6f62db9 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -26,7 +26,7 @@ permissions: {} jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -35,7 +35,7 @@ jobs: test_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -46,7 +46,7 @@ jobs: test_js: name: JS client needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -56,7 +56,7 @@ jobs: test_rust: name: Rust client needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -67,7 +67,7 @@ jobs: create_release: name: Program needs: [test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index c70e6bb..d512ea4 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -60,7 +60,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -71,7 +71,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -83,7 +83,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -94,7 +94,7 @@ jobs: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -110,7 +110,7 @@ jobs: && (needs.test_programs.result == 'success' || needs.test_programs.result == 'skipped') && (needs.test_rust.result == 'success' || needs.test_rust.result == 'skipped') needs: [check_tag, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 761f402..eb35e6b 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index 6110524..60d3227 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -51,7 +51,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -62,7 +62,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: always() && (needs.test_js.result == 'success' || needs.test_js.result == 'skipped') needs: [check_tag, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index 5a9b93d..9a9f8e4 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -31,7 +31,7 @@ permissions: {} jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -39,7 +39,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -50,7 +50,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: read with: @@ -60,7 +60,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index 1f63c72..24d5631 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index 54028d3..dd7aff8 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@269d4cbf2dbbebda3ff5ad7cb00caca8af134fad # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 permissions: contents: write with: From be7e8520b8f5af7f1617aada122b1eaca14328be Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Fri, 30 Oct 2026 15:06:36 -0400 Subject: [PATCH 03/12] ci: pin shared workflows to actions@772e5a7cf740 and tighten the dispatch gates - deploy and publish only accept skipped build/test jobs when git_ref is a release tag; a failed build or tag check now blocks them - check_tag rejects release tags that do not belong to this repository (or, for deploy, to the selected program) - one deploy per program and cluster, one publish and one release at a time - the shared deploy workflow now emits its squads plan output and reads programs.json from the dispatched revision, so older release tags deploy Co-Authored-By: Claude Fable 5.1 --- .github/workflows/create-release.yml | 15 ++++++--- .github/workflows/deploy-program.yml | 40 +++++++++++++++++------ .github/workflows/main.yml | 14 ++++---- .github/workflows/publish-js-client.yml | 30 ++++++++++------- .github/workflows/publish-rust-client.yml | 13 +++++--- .github/workflows/release-js-client.yml | 2 +- .github/workflows/release-rust-client.yml | 2 +- 7 files changed, 77 insertions(+), 39 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 6f62db9..70da7c3 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -23,10 +23,15 @@ on: permissions: {} +concurrency: + # One release per program at a time. + group: create-release-${{ inputs.program }} + cancel-in-progress: false + jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -35,7 +40,7 @@ jobs: test_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -46,7 +51,7 @@ jobs: test_js: name: JS client needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -56,7 +61,7 @@ jobs: test_rust: name: Rust client needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -67,7 +72,7 @@ jobs: create_release: name: Program needs: [test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index d512ea4..3c34d1e 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -35,6 +35,11 @@ on: permissions: {} +concurrency: + # One deploy per program and cluster at a time; a running deploy is never cancelled. + group: deploy-${{ inputs.program }}-${{ inputs.cluster }} + cancel-in-progress: false + jobs: check_tag: name: Check tag @@ -47,10 +52,22 @@ jobs: id: set_type env: GIT_REF: ${{ inputs.git_ref }} + PROGRAM: ${{ inputs.program }} run: | # A release tag deploys the asset attached to the GitHub release; any # other ref is built and tested first. + case "$PROGRAM" in + mpl-agent-identity) TAG=mpl-agent-identity ;; + mpl-agent-reputation) TAG=mpl-agent-reputation ;; + mpl-agent-validation) TAG=mpl-agent-validation ;; + mpl-agent-tools) TAG=mpl-agent-tools ;; + *) echo "::error::unknown program '$PROGRAM'"; exit 1 ;; + esac if [[ "$GIT_REF" == release/*@* ]]; then + if [[ "$GIT_REF" != "release/${TAG}@"* ]]; then + echo "::error::'$GIT_REF' is not a release tag of $PROGRAM (expected release/${TAG}@)" + exit 1 + fi echo "type=release" >> "$GITHUB_OUTPUT" else echo "type=ref" >> "$GITHUB_OUTPUT" @@ -60,7 +77,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -71,7 +88,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -83,7 +100,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -94,7 +111,7 @@ jobs: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -105,12 +122,15 @@ jobs: deploy: name: Program if: | - always() - && (needs.test_js.result == 'success' || needs.test_js.result == 'skipped') - && (needs.test_programs.result == 'success' || needs.test_programs.result == 'skipped') - && (needs.test_rust.result == 'success' || needs.test_rust.result == 'skipped') - needs: [check_tag, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + !cancelled() && !failure() + && needs.check_tag.result == 'success' + && (needs.check_tag.outputs.type == 'release' + || (needs.build_programs.result == 'success' + && needs.test_js.result == 'success' + && needs.test_programs.result == 'success' + && needs.test_rust.result == 'success')) + needs: [check_tag, build_programs, test_js, test_programs, test_rust] + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index eb35e6b..538d902 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index 60d3227..a5e2b79 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -27,6 +27,11 @@ on: permissions: {} +concurrency: + # One JS publish at a time: each bumps the version and opens a release PR. + group: publish-js-client + cancel-in-progress: false + jobs: check_tag: name: Check tag @@ -41,17 +46,17 @@ jobs: GIT_REF: ${{ inputs.git_ref }} run: | # A program release tag was already built and tested when it was cut. - if [[ "$GIT_REF" == release/*@* ]]; then - echo "type=release" >> "$GITHUB_OUTPUT" - else - echo "type=ref" >> "$GITHUB_OUTPUT" - fi + case "$GIT_REF" in + release/mpl-agent-identity@*|release/mpl-agent-reputation@*|release/mpl-agent-validation@*|release/mpl-agent-tools@*) echo "type=release" >> "$GITHUB_OUTPUT" ;; + release/*@*) echo "::error::'$GIT_REF' is not a release tag of this repository (expected release/mpl-agent-identity@, release/mpl-agent-reputation@, release/mpl-agent-validation@, release/mpl-agent-tools@)"; exit 1 ;; + *) echo "type=ref" >> "$GITHUB_OUTPUT" ;; + esac build_programs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -62,7 +67,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -72,10 +77,13 @@ jobs: publish: name: JS client if: | - always() - && (needs.test_js.result == 'success' || needs.test_js.result == 'skipped') - needs: [check_tag, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + !cancelled() && !failure() + && needs.check_tag.result == 'success' + && (needs.check_tag.outputs.type == 'release' + || (needs.build_programs.result == 'success' + && needs.test_js.result == 'success')) + needs: [check_tag, build_programs, test_js] + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index 9a9f8e4..3a34bfb 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -28,10 +28,15 @@ on: permissions: {} +concurrency: + # One Rust publish per crate at a time. + group: publish-rust-client-${{ inputs.client }} + cancel-in-progress: false + jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -39,7 +44,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -50,7 +55,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: read with: @@ -60,7 +65,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index 24d5631..4646275 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index dd7aff8..6525f05 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@7afc538992dfe77522d372163d6afe92b10dc15b # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 permissions: contents: write with: From 2b68cfba0d5d64a97462dc167d00fff75afcd3f9 Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Fri, 30 Oct 2026 16:21:25 -0400 Subject: [PATCH 04/12] ci: pin shared workflows to actions@089e761576b6 Picks up the benchmark fix for repos without a gh-pages branch. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/create-release.yml | 10 +++++----- .github/workflows/deploy-program.yml | 10 +++++----- .github/workflows/main.yml | 14 +++++++------- .github/workflows/publish-js-client.yml | 6 +++--- .github/workflows/publish-rust-client.yml | 8 ++++---- .github/workflows/release-js-client.yml | 2 +- .github/workflows/release-rust-client.yml | 2 +- 7 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 70da7c3..235a0b4 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -31,7 +31,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -40,7 +40,7 @@ jobs: test_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -51,7 +51,7 @@ jobs: test_js: name: JS client needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -61,7 +61,7 @@ jobs: test_rust: name: Rust client needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -72,7 +72,7 @@ jobs: create_release: name: Program needs: [test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index 3c34d1e..b655c40 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -77,7 +77,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -88,7 +88,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -100,7 +100,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -111,7 +111,7 @@ jobs: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -130,7 +130,7 @@ jobs: && needs.test_programs.result == 'success' && needs.test_rust.result == 'success')) needs: [check_tag, build_programs, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 538d902..1ca8e7b 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index a5e2b79..83d5a08 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -56,7 +56,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -67,7 +67,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -83,7 +83,7 @@ jobs: || (needs.build_programs.result == 'success' && needs.test_js.result == 'success')) needs: [check_tag, build_programs, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index 3a34bfb..4694563 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -36,7 +36,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -44,7 +44,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -55,7 +55,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: read with: @@ -65,7 +65,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index 4646275..a02475e 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index 6525f05..066c910 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@772e5a7cf7408fb8346dccb5665f0502c33e9dbb # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 permissions: contents: write with: From 0a4a3a3466ae81544cf3b268b58ea95fd19b6c76 Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Fri, 30 Oct 2026 16:32:17 -0400 Subject: [PATCH 05/12] ci: pin shared workflows to actions@8f4db07ffb2a; check_tag confirms the tag exists Picks up the second CodeRabbit round on the shared workflows: programs.json and host tool pins read from the dispatched revision, publish from the tested commit, resumable releases. check_tag now rejects a branch named like a release tag, and create_release waits for the program build. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/create-release.yml | 12 +++++------ .github/workflows/deploy-program.yml | 25 +++++++++++++++-------- .github/workflows/main.yml | 14 ++++++------- .github/workflows/publish-js-client.yml | 21 +++++++++++++------ .github/workflows/publish-rust-client.yml | 8 ++++---- .github/workflows/release-js-client.yml | 2 +- .github/workflows/release-rust-client.yml | 2 +- 7 files changed, 51 insertions(+), 33 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 235a0b4..81ce339 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -31,7 +31,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -40,7 +40,7 @@ jobs: test_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -51,7 +51,7 @@ jobs: test_js: name: JS client needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -61,7 +61,7 @@ jobs: test_rust: name: Rust client needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -71,8 +71,8 @@ jobs: create_release: name: Program - needs: [test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + needs: [build_programs, test_js, test_rust, test_programs] + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index b655c40..d6b9d51 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -44,7 +44,9 @@ jobs: check_tag: name: Check tag runs-on: ubuntu-latest - permissions: {} + permissions: + # Confirms the release tag exists. + contents: read outputs: type: ${{ steps.set_type.outputs.type }} steps: @@ -52,6 +54,7 @@ jobs: id: set_type env: GIT_REF: ${{ inputs.git_ref }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} PROGRAM: ${{ inputs.program }} run: | # A release tag deploys the asset attached to the GitHub release; any @@ -68,16 +71,22 @@ jobs: echo "::error::'$GIT_REF' is not a release tag of $PROGRAM (expected release/${TAG}@)" exit 1 fi - echo "type=release" >> "$GITHUB_OUTPUT" + TYPE=release else - echo "type=ref" >> "$GITHUB_OUTPUT" + TYPE=ref + fi + if [ "$TYPE" = release ]; then + # Only an existing tag skips build and test; a branch named like one does not. + gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${GIT_REF}" --silent \ + || { echo "::error::'$GIT_REF' is not an existing tag of this repository"; exit 1; } fi + echo "type=$TYPE" >> "$GITHUB_OUTPUT" build_programs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -88,7 +97,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -100,7 +109,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -111,7 +120,7 @@ jobs: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -130,7 +139,7 @@ jobs: && needs.test_programs.result == 'success' && needs.test_rust.result == 'success')) needs: [check_tag, build_programs, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 1ca8e7b..e8024be 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index 83d5a08..9a95909 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -36,7 +36,9 @@ jobs: check_tag: name: Check tag runs-on: ubuntu-latest - permissions: {} + permissions: + # Confirms the release tag exists. + contents: read outputs: type: ${{ steps.set_type.outputs.type }} steps: @@ -44,19 +46,26 @@ jobs: id: set_type env: GIT_REF: ${{ inputs.git_ref }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | # A program release tag was already built and tested when it was cut. case "$GIT_REF" in - release/mpl-agent-identity@*|release/mpl-agent-reputation@*|release/mpl-agent-validation@*|release/mpl-agent-tools@*) echo "type=release" >> "$GITHUB_OUTPUT" ;; + release/mpl-agent-identity@*|release/mpl-agent-reputation@*|release/mpl-agent-validation@*|release/mpl-agent-tools@*) TYPE=release ;; release/*@*) echo "::error::'$GIT_REF' is not a release tag of this repository (expected release/mpl-agent-identity@, release/mpl-agent-reputation@, release/mpl-agent-validation@, release/mpl-agent-tools@)"; exit 1 ;; - *) echo "type=ref" >> "$GITHUB_OUTPUT" ;; + *) TYPE=ref ;; esac + if [ "$TYPE" = release ]; then + # Only an existing tag skips build and test; a branch named like one does not. + gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${GIT_REF}" --silent \ + || { echo "::error::'$GIT_REF' is not an existing tag of this repository"; exit 1; } + fi + echo "type=$TYPE" >> "$GITHUB_OUTPUT" build_programs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -67,7 +76,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -83,7 +92,7 @@ jobs: || (needs.build_programs.result == 'success' && needs.test_js.result == 'success')) needs: [check_tag, build_programs, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index 4694563..d593319 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -36,7 +36,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -44,7 +44,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -55,7 +55,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: read with: @@ -65,7 +65,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index a02475e..27a5dd6 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index 066c910..3babcce 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@089e761576b6d1d09db11a34771fab7b150c14fc # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 permissions: contents: write with: From 5557ab294820edc697ed9b646c05c3fc922adf49 Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Fri, 30 Oct 2026 16:33:18 -0400 Subject: [PATCH 06/12] ci: pin shared workflows to actions@da62cf9659ef Co-Authored-By: Claude Fable 5.1 --- .github/workflows/create-release.yml | 10 +++++----- .github/workflows/deploy-program.yml | 10 +++++----- .github/workflows/main.yml | 14 +++++++------- .github/workflows/publish-js-client.yml | 6 +++--- .github/workflows/publish-rust-client.yml | 8 ++++---- .github/workflows/release-js-client.yml | 2 +- .github/workflows/release-rust-client.yml | 2 +- 7 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 81ce339..acc9e1e 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -31,7 +31,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -40,7 +40,7 @@ jobs: test_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -51,7 +51,7 @@ jobs: test_js: name: JS client needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -61,7 +61,7 @@ jobs: test_rust: name: Rust client needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -72,7 +72,7 @@ jobs: create_release: name: Program needs: [build_programs, test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index d6b9d51..819de41 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -86,7 +86,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -97,7 +97,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -109,7 +109,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -120,7 +120,7 @@ jobs: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -139,7 +139,7 @@ jobs: && needs.test_programs.result == 'success' && needs.test_rust.result == 'success')) needs: [check_tag, build_programs, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index e8024be..ee71a00 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index 9a95909..9dbd497 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -65,7 +65,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -76,7 +76,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -92,7 +92,7 @@ jobs: || (needs.build_programs.result == 'success' && needs.test_js.result == 'success')) needs: [check_tag, build_programs, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index d593319..60ec948 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -36,7 +36,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -44,7 +44,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -55,7 +55,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: read with: @@ -65,7 +65,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index 27a5dd6..bae3561 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index 3babcce..fec0ead 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@8f4db07ffb2abc0ac10bbe94f5dc623eb2218641 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 permissions: contents: write with: From ced93c93ab6630e26a5265876762e73e25154101 Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Fri, 30 Oct 2026 18:01:15 -0400 Subject: [PATCH 07/12] ci: pin shared workflows to actions 6064713 (CodeRabbit round 3) Dispatch workflows resolve git_ref to one commit in check_tag and pass that commit to every build, test, publish, release and deploy job, so a moving branch or a branch named like a tag cannot split a run across different source. The release workflows get the merged branch name to pick the released version. The JS client CONTRIBUTING guide describes npm trusted publishing instead of NPM_TOKEN. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/create-release.yml | 70 ++++++++++++++++++----- .github/workflows/deploy-program.yml | 38 ++++++++---- .github/workflows/main.yml | 14 ++--- .github/workflows/publish-js-client.yml | 29 +++++++--- .github/workflows/publish-rust-client.yml | 8 +-- .github/workflows/release-js-client.yml | 3 +- .github/workflows/release-rust-client.yml | 3 +- clients/js/CONTRIBUTING.md | 10 +++- 8 files changed, 128 insertions(+), 47 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index acc9e1e..c68d609 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -29,53 +29,97 @@ concurrency: cancel-in-progress: false jobs: + check_tag: + name: Check tag + runs-on: ubuntu-latest + permissions: + # Confirms the release tag exists and resolves the ref to a commit. + contents: read + outputs: + type: ${{ steps.set_type.outputs.type }} + sha: ${{ steps.set_type.outputs.sha }} + steps: + - name: Check tag + id: set_type + env: + GIT_REF: ${{ inputs.git_ref }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + # Resolve the branch to one commit: build, test and the release tag must + # all refer to the same source, even if the branch moves meanwhile. + if [[ "$GIT_REF" == release/*@* ]]; then + echo "::error::a release is cut from a commit or branch, not from the release tag '$GIT_REF'" + exit 1 + fi + TYPE=ref + if [ "$TYPE" = release ]; then + # Only an existing tag skips build and test; a branch named like one does not. + OBJ="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${GIT_REF}" --jq '.object.type + " " + .object.sha')" \ + || { echo "::error::'$GIT_REF' is not an existing tag of this repository"; exit 1; } + read -r OBJ_TYPE SHA <<< "$OBJ" + if [ "$OBJ_TYPE" = tag ]; then + # Annotated tag: follow it to the commit. + SHA="$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${SHA}" --jq .object.sha)" + fi + elif [ -z "$GIT_REF" ]; then + SHA="$GITHUB_SHA" + else + SHA="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${GIT_REF}" --jq .sha)" \ + || { echo "::error::'$GIT_REF' is not a commit, branch or tag of this repository"; exit 1; } + fi + echo "type=$TYPE" >> "$GITHUB_OUTPUT" + echo "sha=$SHA" >> "$GITHUB_OUTPUT" + echo "$GIT_REF -> $SHA ($TYPE)" + build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + needs: check_tag + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} apt_packages: protobuf-compiler test_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + needs: [check_tag, build_programs] + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: program_matrix: '["${{ inputs.program }}"]' - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} apt_packages: protobuf-compiler test_js: name: JS client - needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + needs: [check_tag, build_programs] + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} node_matrix: '["22.x", "24.x"]' test_rust: name: Rust client - needs: build_programs - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + needs: [check_tag, build_programs] + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} apt_packages: protobuf-compiler client_dir: clients create_release: name: Program - needs: [build_programs, test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + needs: [check_tag, build_programs, test_js, test_rust, test_programs] + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: write with: program: ${{ inputs.program }} bump: ${{ inputs.bump }} - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index 819de41..933f58c 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -45,10 +45,11 @@ jobs: name: Check tag runs-on: ubuntu-latest permissions: - # Confirms the release tag exists. + # Confirms the release tag exists and resolves the ref to a commit. contents: read outputs: type: ${{ steps.set_type.outputs.type }} + sha: ${{ steps.set_type.outputs.sha }} steps: - name: Check tag id: set_type @@ -77,54 +78,66 @@ jobs: fi if [ "$TYPE" = release ]; then # Only an existing tag skips build and test; a branch named like one does not. - gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${GIT_REF}" --silent \ + OBJ="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${GIT_REF}" --jq '.object.type + " " + .object.sha')" \ || { echo "::error::'$GIT_REF' is not an existing tag of this repository"; exit 1; } + read -r OBJ_TYPE SHA <<< "$OBJ" + if [ "$OBJ_TYPE" = tag ]; then + # Annotated tag: follow it to the commit. + SHA="$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${SHA}" --jq .object.sha)" + fi + elif [ -z "$GIT_REF" ]; then + SHA="$GITHUB_SHA" + else + SHA="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${GIT_REF}" --jq .sha)" \ + || { echo "::error::'$GIT_REF' is not a commit, branch or tag of this repository"; exit 1; } fi echo "type=$TYPE" >> "$GITHUB_OUTPUT" + echo "sha=$SHA" >> "$GITHUB_OUTPUT" + echo "$GIT_REF -> $SHA ($TYPE)" build_programs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} apt_packages: protobuf-compiler test_programs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: program_matrix: '["${{ inputs.program }}"]' - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} apt_packages: protobuf-compiler test_js: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} node_matrix: '["22.x", "24.x"]' test_rust: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} apt_packages: protobuf-compiler client_dir: clients @@ -139,7 +152,7 @@ jobs: && needs.test_programs.result == 'success' && needs.test_rust.result == 'success')) needs: [check_tag, build_programs, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the @@ -170,6 +183,7 @@ jobs: with: program: ${{ inputs.program }} cluster: ${{ inputs.cluster }} - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} + release_tag: ${{ needs.check_tag.outputs.type == 'release' && inputs.git_ref || '' }} dry_run: ${{ inputs.dry_run }} runner: ubuntu-latest-16-cores diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index ee71a00..787f74a 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index 9dbd497..db6fec8 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -37,10 +37,11 @@ jobs: name: Check tag runs-on: ubuntu-latest permissions: - # Confirms the release tag exists. + # Confirms the release tag exists and resolves the ref to a commit. contents: read outputs: type: ${{ steps.set_type.outputs.type }} + sha: ${{ steps.set_type.outputs.sha }} steps: - name: Check tag id: set_type @@ -56,31 +57,43 @@ jobs: esac if [ "$TYPE" = release ]; then # Only an existing tag skips build and test; a branch named like one does not. - gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${GIT_REF}" --silent \ + OBJ="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${GIT_REF}" --jq '.object.type + " " + .object.sha')" \ || { echo "::error::'$GIT_REF' is not an existing tag of this repository"; exit 1; } + read -r OBJ_TYPE SHA <<< "$OBJ" + if [ "$OBJ_TYPE" = tag ]; then + # Annotated tag: follow it to the commit. + SHA="$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${SHA}" --jq .object.sha)" + fi + elif [ -z "$GIT_REF" ]; then + SHA="$GITHUB_SHA" + else + SHA="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${GIT_REF}" --jq .sha)" \ + || { echo "::error::'$GIT_REF' is not a commit, branch or tag of this repository"; exit 1; } fi echo "type=$TYPE" >> "$GITHUB_OUTPUT" + echo "sha=$SHA" >> "$GITHUB_OUTPUT" + echo "$GIT_REF -> $SHA ($TYPE)" build_programs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} apt_packages: protobuf-compiler test_js: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} node_matrix: '["22.x", "24.x"]' publish: @@ -92,7 +105,7 @@ jobs: || (needs.build_programs.result == 'success' && needs.test_js.result == 'success')) needs: [check_tag, build_programs, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: write pull-requests: write @@ -102,7 +115,7 @@ jobs: VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }} VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }} with: - git_ref: ${{ inputs.git_ref }} + git_ref: ${{ needs.check_tag.outputs.sha }} bump: ${{ inputs.bump }} tag: ${{ inputs.tag }} create_release: ${{ inputs.create_release }} diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index 60ec948..becc105 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -36,7 +36,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: @@ -44,7 +44,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: @@ -55,7 +55,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: read with: @@ -65,7 +65,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index bae3561..6c50156 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,8 +17,9 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: write with: merge_commit_sha: ${{ github.event.pull_request.merge_commit_sha }} + head_ref: ${{ github.event.pull_request.head.ref }} diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index fec0ead..ed1cc61 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,9 +17,10 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@da62cf9659efdd4e28daa0c777535ea5f54ab53a # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 permissions: contents: write with: merge_commit_sha: ${{ github.event.pull_request.merge_commit_sha }} client_matrix: '["clients/rust-identity", "clients/rust-reputation", "clients/rust-validation", "clients/rust-tools"]' + head_ref: ${{ github.event.pull_request.head.ref }} diff --git a/clients/js/CONTRIBUTING.md b/clients/js/CONTRIBUTING.md index 260a652..a460743 100644 --- a/clients/js/CONTRIBUTING.md +++ b/clients/js/CONTRIBUTING.md @@ -40,9 +40,17 @@ For this to work, some initial setup is required on the repository as explained ## Setting up GitHub actions +The publish workflow authenticates to NPM with [trusted publishing](https://docs.npmjs.com/trusted-publishers) +rather than a long-lived token: it requests an OIDC token from GitHub (`id-token: write`) and +publishes with `npm` 11.5.1 or newer, so no `NPM_TOKEN` secret is read or needed. + +To enable it, on npmjs.com open the `@metaplex-foundation/mpl-agent-registry` package settings, add a +trusted publisher, and point it at this repository with the workflow file +`.github/workflows/publish-js-client.yml`. The npm account performing that setup must be able to +publish the package. + To publish JavaScript clients using GitHub actions, we first need the following secret variables to be set up on the repository. -- `NPM_TOKEN` — An access token that can publish your packages to NPM. - `VERCEL_TOKEN` — An access token that can deploy to Vercel. - `VERCEL_ORG_ID` — The ID of the Vercel organization you want to deploy to. From cdd733de8173c5445858d7ec17fdda7377e62811 Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Fri, 30 Oct 2026 18:03:07 -0400 Subject: [PATCH 08/12] ci: pin shared workflows to actions 782403d detect-changes works on pushes to private repositories again and create-release continues the program's version across tag families. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/create-release.yml | 10 +++++----- .github/workflows/deploy-program.yml | 10 +++++----- .github/workflows/main.yml | 14 +++++++------- .github/workflows/publish-js-client.yml | 6 +++--- .github/workflows/publish-rust-client.yml | 8 ++++---- .github/workflows/release-js-client.yml | 2 +- .github/workflows/release-rust-client.yml | 2 +- 7 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index c68d609..45383f9 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -74,7 +74,7 @@ jobs: build_programs: name: Programs needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -84,7 +84,7 @@ jobs: test_programs: name: Programs needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -95,7 +95,7 @@ jobs: test_js: name: JS client needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -105,7 +105,7 @@ jobs: test_rust: name: Rust client needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -116,7 +116,7 @@ jobs: create_release: name: Program needs: [check_tag, build_programs, test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index 933f58c..ac223aa 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -99,7 +99,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -110,7 +110,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -122,7 +122,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -133,7 +133,7 @@ jobs: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -152,7 +152,7 @@ jobs: && needs.test_programs.result == 'success' && needs.test_rust.result == 'success')) needs: [check_tag, build_programs, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 787f74a..fd0ad1c 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index db6fec8..02406ed 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -78,7 +78,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -89,7 +89,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -105,7 +105,7 @@ jobs: || (needs.build_programs.result == 'success' && needs.test_js.result == 'success')) needs: [check_tag, build_programs, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index becc105..cd89312 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -36,7 +36,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -44,7 +44,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -55,7 +55,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: read with: @@ -65,7 +65,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index 6c50156..378e7ea 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index ed1cc61..a258692 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@6064713458c329034014d12f2f27488b592ad8a4 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 permissions: contents: write with: From 7b3ba6b9af531aeea0ceef1b2c20c3d26d7457a8 Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Fri, 30 Oct 2026 19:17:56 -0400 Subject: [PATCH 09/12] ci: pin shared workflows at 759f332, trusted-publisher setup notes - Regenerated from metaplex-foundation/actions@759f332: filter-matrix injection fix, publish reruns recover after a published-but-unreleased run, create-release's check_tag drops its unreachable release branch. - CONTRIBUTING: npm trusted publisher takes the workflow filename alone, must allow direct `npm publish`, and the release PR needs "Allow GitHub Actions to create and approve pull requests". Co-Authored-By: Claude Fable 5.1 --- .github/workflows/create-release.yml | 28 +++++++---------------- .github/workflows/deploy-program.yml | 10 ++++---- .github/workflows/main.yml | 14 ++++++------ .github/workflows/publish-js-client.yml | 6 ++--- .github/workflows/publish-rust-client.yml | 8 +++---- .github/workflows/release-js-client.yml | 2 +- .github/workflows/release-rust-client.yml | 2 +- clients/js/CONTRIBUTING.md | 12 ++++++---- 8 files changed, 37 insertions(+), 45 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 45383f9..d0294e4 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -33,10 +33,9 @@ jobs: name: Check tag runs-on: ubuntu-latest permissions: - # Confirms the release tag exists and resolves the ref to a commit. + # Resolves the ref to a commit. contents: read outputs: - type: ${{ steps.set_type.outputs.type }} sha: ${{ steps.set_type.outputs.sha }} steps: - name: Check tag @@ -51,30 +50,19 @@ jobs: echo "::error::a release is cut from a commit or branch, not from the release tag '$GIT_REF'" exit 1 fi - TYPE=ref - if [ "$TYPE" = release ]; then - # Only an existing tag skips build and test; a branch named like one does not. - OBJ="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${GIT_REF}" --jq '.object.type + " " + .object.sha')" \ - || { echo "::error::'$GIT_REF' is not an existing tag of this repository"; exit 1; } - read -r OBJ_TYPE SHA <<< "$OBJ" - if [ "$OBJ_TYPE" = tag ]; then - # Annotated tag: follow it to the commit. - SHA="$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${SHA}" --jq .object.sha)" - fi - elif [ -z "$GIT_REF" ]; then + if [ -z "$GIT_REF" ]; then SHA="$GITHUB_SHA" else SHA="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${GIT_REF}" --jq .sha)" \ || { echo "::error::'$GIT_REF' is not a commit, branch or tag of this repository"; exit 1; } fi - echo "type=$TYPE" >> "$GITHUB_OUTPUT" echo "sha=$SHA" >> "$GITHUB_OUTPUT" - echo "$GIT_REF -> $SHA ($TYPE)" + echo "$GIT_REF -> $SHA" build_programs: name: Programs needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -84,7 +72,7 @@ jobs: test_programs: name: Programs needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -95,7 +83,7 @@ jobs: test_js: name: JS client needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -105,7 +93,7 @@ jobs: test_rust: name: Rust client needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -116,7 +104,7 @@ jobs: create_release: name: Program needs: [check_tag, build_programs, test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index ac223aa..bbb0681 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -99,7 +99,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -110,7 +110,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -122,7 +122,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -133,7 +133,7 @@ jobs: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -152,7 +152,7 @@ jobs: && needs.test_programs.result == 'success' && needs.test_rust.result == 'success')) needs: [check_tag, build_programs, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index fd0ad1c..5ef442c 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index 02406ed..0376c30 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -78,7 +78,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -89,7 +89,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -105,7 +105,7 @@ jobs: || (needs.build_programs.result == 'success' && needs.test_js.result == 'success')) needs: [check_tag, build_programs, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index cd89312..fe09696 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -36,7 +36,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -44,7 +44,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -55,7 +55,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: read with: @@ -65,7 +65,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index 378e7ea..da81fe1 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index a258692..2f479bb 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@782403d54939dc66861d8d7c036d6a313d5da37d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 permissions: contents: write with: diff --git a/clients/js/CONTRIBUTING.md b/clients/js/CONTRIBUTING.md index a460743..dcd5929 100644 --- a/clients/js/CONTRIBUTING.md +++ b/clients/js/CONTRIBUTING.md @@ -44,10 +44,14 @@ The publish workflow authenticates to NPM with [trusted publishing](https://docs rather than a long-lived token: it requests an OIDC token from GitHub (`id-token: write`) and publishes with `npm` 11.5.1 or newer, so no `NPM_TOKEN` secret is read or needed. -To enable it, on npmjs.com open the `@metaplex-foundation/mpl-agent-registry` package settings, add a -trusted publisher, and point it at this repository with the workflow file -`.github/workflows/publish-js-client.yml`. The npm account performing that setup must be able to -publish the package. +To enable it, on npmjs.com open the `@metaplex-foundation/mpl-agent-registry` package settings and add a GitHub Actions +trusted publisher for this repository with the workflow filename `publish-js-client.yml` (the +filename alone, not its path). Under allowed actions, permit direct publishing with `npm publish`: +a publisher created after September 2026 allows only `npm stage publish` by default, and the +workflow runs `npm publish`. The npm account performing that setup must be able to publish the +package, and the publisher must complete its first publish within two days of being created. +The release pull request the workflow opens afterwards needs "Allow GitHub Actions to create and +approve pull requests" enabled under the repository's Actions settings. To publish JavaScript clients using GitHub actions, we first need the following secret variables to be set up on the repository. From 32c6da3081b9421e0f4ab02661322e23fa58704e Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Fri, 30 Oct 2026 19:41:27 -0400 Subject: [PATCH 10/12] ci: pin shared workflows at 7f55495 - Regenerated from metaplex-foundation/actions@7f55495: publish reruns only recover when the registry holds this commit's content, buffer-only Squads deploys export the verified-build PDA transaction, a release whose asset upload fails now fails, release workflows accept SemVer build metadata. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/create-release.yml | 10 +++++----- .github/workflows/deploy-program.yml | 10 +++++----- .github/workflows/main.yml | 14 +++++++------- .github/workflows/publish-js-client.yml | 6 +++--- .github/workflows/publish-rust-client.yml | 8 ++++---- .github/workflows/release-js-client.yml | 2 +- .github/workflows/release-rust-client.yml | 2 +- 7 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index d0294e4..e591691 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -62,7 +62,7 @@ jobs: build_programs: name: Programs needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -72,7 +72,7 @@ jobs: test_programs: name: Programs needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -83,7 +83,7 @@ jobs: test_js: name: JS client needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -93,7 +93,7 @@ jobs: test_rust: name: Rust client needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -104,7 +104,7 @@ jobs: create_release: name: Program needs: [check_tag, build_programs, test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index bbb0681..d2f8293 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -99,7 +99,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -110,7 +110,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -122,7 +122,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -133,7 +133,7 @@ jobs: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -152,7 +152,7 @@ jobs: && needs.test_programs.result == 'success' && needs.test_rust.result == 'success')) needs: [check_tag, build_programs, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 5ef442c..b54e003 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index 0376c30..0495eb6 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -78,7 +78,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -89,7 +89,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -105,7 +105,7 @@ jobs: || (needs.build_programs.result == 'success' && needs.test_js.result == 'success')) needs: [check_tag, build_programs, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index fe09696..6a6caa9 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -36,7 +36,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -44,7 +44,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -55,7 +55,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: read with: @@ -65,7 +65,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index da81fe1..982d175 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index 2f479bb..5f720c3 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@759f332a0e956a796b6823d81ede32f76f71853d # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 permissions: contents: write with: From 6bf7cbf358e580f11daba89599e0ea43ae04ee0d Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Mon, 2 Nov 2026 13:01:04 -0500 Subject: [PATCH 11/12] ci: pin shared workflows at v2.0.0 - Pin metaplex-foundation/actions at v2.0.0 (4ee4bcf), the merge of metaplex-foundation/actions#18. Also brings rerun recovery that compares unpacked crates, a non-fatal PDA export for buffer-only Squads deploys, and a node_modules cache keyed by runner image. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/create-release.yml | 10 +++++----- .github/workflows/deploy-program.yml | 10 +++++----- .github/workflows/main.yml | 14 +++++++------- .github/workflows/publish-js-client.yml | 6 +++--- .github/workflows/publish-rust-client.yml | 8 ++++---- .github/workflows/release-js-client.yml | 2 +- .github/workflows/release-rust-client.yml | 2 +- 7 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index e591691..ed85ea4 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -62,7 +62,7 @@ jobs: build_programs: name: Programs needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -72,7 +72,7 @@ jobs: test_programs: name: Programs needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -83,7 +83,7 @@ jobs: test_js: name: JS client needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -93,7 +93,7 @@ jobs: test_rust: name: Rust client needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -104,7 +104,7 @@ jobs: create_release: name: Program needs: [check_tag, build_programs, test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index d2f8293..07ff517 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -99,7 +99,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -110,7 +110,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -122,7 +122,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -133,7 +133,7 @@ jobs: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -152,7 +152,7 @@ jobs: && needs.test_programs.result == 'success' && needs.test_rust.result == 'success')) needs: [check_tag, build_programs, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index b54e003..6caa92e 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index 0495eb6..3f28abf 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -78,7 +78,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -89,7 +89,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -105,7 +105,7 @@ jobs: || (needs.build_programs.result == 'success' && needs.test_js.result == 'success')) needs: [check_tag, build_programs, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index 6a6caa9..9eaffcf 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -36,7 +36,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -44,7 +44,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -55,7 +55,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: read with: @@ -65,7 +65,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index 982d175..d3789e1 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: write with: diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index 5f720c3..37652f9 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@7f55495a7da7c3c1884845f75341dd5032a84139 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 permissions: contents: write with: From 3685e9df71beb2a027d9af977aebe4ac20b002a5 Mon Sep 17 00:00:00 2001 From: Blockiosaurus Date: Mon, 2 Nov 2026 16:21:21 -0500 Subject: [PATCH 12/12] ci: pin shared workflows at v2.0.1 - Pin metaplex-foundation/actions at v2.0.1 (8fcadb6), the merge of metaplex-foundation/actions#20: verify-from-repo fails on a hash mismatch, no remote verification job on devnet or for private repositories, npm provenance only from public repositories, and publish reruns check the requested dist-tag. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/create-release.yml | 10 +++++----- .github/workflows/deploy-program.yml | 10 +++++----- .github/workflows/main.yml | 14 +++++++------- .github/workflows/publish-js-client.yml | 6 +++--- .github/workflows/publish-rust-client.yml | 8 ++++---- .github/workflows/release-js-client.yml | 2 +- .github/workflows/release-rust-client.yml | 2 +- 7 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index ed85ea4..71dd399 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -62,7 +62,7 @@ jobs: build_programs: name: Programs needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -72,7 +72,7 @@ jobs: test_programs: name: Programs needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -83,7 +83,7 @@ jobs: test_js: name: JS client needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -93,7 +93,7 @@ jobs: test_rust: name: Rust client needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -104,7 +104,7 @@ jobs: create_release: name: Program needs: [check_tag, build_programs, test_js, test_rust, test_programs] - uses: metaplex-foundation/actions/.github/workflows/create-release.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/create-release.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: write with: diff --git a/.github/workflows/deploy-program.yml b/.github/workflows/deploy-program.yml index 07ff517..8ce35fb 100644 --- a/.github/workflows/deploy-program.yml +++ b/.github/workflows/deploy-program.yml @@ -99,7 +99,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -110,7 +110,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -122,7 +122,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -133,7 +133,7 @@ jobs: name: Rust client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -152,7 +152,7 @@ jobs: && needs.test_programs.result == 'success' && needs.test_rust.result == 'success')) needs: [check_tag, build_programs, test_js, test_programs, test_rust] - uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/deploy-program.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: write # GitHub Actions cannot look secrets up by a computed name, so the diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 6caa92e..6a5f029 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -15,7 +15,7 @@ permissions: {} jobs: changes: name: Detect changes - uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/detect-changes.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read pull-requests: read @@ -24,7 +24,7 @@ jobs: name: Programs if: needs.changes.outputs.any == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -34,7 +34,7 @@ jobs: name: Programs if: needs.changes.outputs.programs == 'true' needs: changes - uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-programs.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -45,7 +45,7 @@ jobs: name: Generate clients if: needs.changes.outputs.any == 'true' needs: [changes, build_programs] - uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/generate-clients.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read @@ -53,7 +53,7 @@ jobs: name: JS Client if: needs.changes.outputs.js_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -63,7 +63,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -75,7 +75,7 @@ jobs: name: Rust Client if: needs.changes.outputs.rust_client == 'true' needs: [changes, generate_clients] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: diff --git a/.github/workflows/publish-js-client.yml b/.github/workflows/publish-js-client.yml index 3f28abf..5804d34 100644 --- a/.github/workflows/publish-js-client.yml +++ b/.github/workflows/publish-js-client.yml @@ -78,7 +78,7 @@ jobs: name: Programs if: needs.check_tag.outputs.type == 'ref' needs: check_tag - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -89,7 +89,7 @@ jobs: name: JS client if: needs.check_tag.outputs.type == 'ref' needs: [check_tag, build_programs] - uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-js-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -105,7 +105,7 @@ jobs: || (needs.build_programs.result == 'success' && needs.test_js.result == 'success')) needs: [check_tag, build_programs, test_js] - uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-js-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: write pull-requests: write diff --git a/.github/workflows/publish-rust-client.yml b/.github/workflows/publish-rust-client.yml index 9eaffcf..a214993 100644 --- a/.github/workflows/publish-rust-client.yml +++ b/.github/workflows/publish-rust-client.yml @@ -36,7 +36,7 @@ concurrency: jobs: build_programs: name: Programs - uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-programs.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -44,7 +44,7 @@ jobs: build_rust_client: name: Rust client - uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/build-rust-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -55,7 +55,7 @@ jobs: test_rust_client: name: Rust client needs: [build_programs, build_rust_client] - uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/test-rust-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: read with: @@ -65,7 +65,7 @@ jobs: publish: name: Rust client needs: test_rust_client - uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/publish-rust-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: write pull-requests: write diff --git a/.github/workflows/release-js-client.yml b/.github/workflows/release-js-client.yml index d3789e1..8da0ce1 100644 --- a/.github/workflows/release-js-client.yml +++ b/.github/workflows/release-js-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/js-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-js-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: write with: diff --git a/.github/workflows/release-rust-client.yml b/.github/workflows/release-rust-client.yml index 37652f9..64fed83 100644 --- a/.github/workflows/release-rust-client.yml +++ b/.github/workflows/release-rust-client.yml @@ -17,7 +17,7 @@ jobs: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/rust-client-') && github.event.pull_request.head.repo.full_name == github.repository - uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@4ee4bcfc012e96d54917820d1d65018275c40603 # v2.0.0 + uses: metaplex-foundation/actions/.github/workflows/release-rust-client.yml@8fcadb6df757cba34aa8475373886eca9b6ce8cf # v2.0.1 permissions: contents: write with: