Skip to content

CI: cache Foundry build to skip recompiling unchanged contracts#203

Merged
thedavidmeister merged 2 commits into
mainfrom
2026-05-27-cache-forge
May 27, 2026
Merged

CI: cache Foundry build to skip recompiling unchanged contracts#203
thedavidmeister merged 2 commits into
mainfrom
2026-05-27-cache-forge

Conversation

@thedavidmeister
Copy link
Copy Markdown
Contributor

@thedavidmeister thedavidmeister commented May 27, 2026

forge build is the dominant cost in the sol workflows (~105s of the ~163s copy-artifacts run). Cache Foundry's incremental compilation cache (cache/) + artifacts (out/), keyed on the sol sources + foundry.toml + soldeer.lock, with a restore-keys prefix fallback so forge recompiles only changed files.

Split by workflow purpose (per review):

  • copy-artifacts — caches cache/ only, not out/. It's a clean-build determinism check, so out/ is regenerated fresh each run (the committed-artifact assert stays honest); cache/ still speeds recompilation.
  • sol-test, sol-static, build-pointers, manual-sol-artifacts, rainix test.yml — cache both cache/ + out/ for the full incremental speedup.

sol-legal has no forge build, so it's untouched. This is the Solidity analog of the Swatinem/rust-cache already in the rust jobs, and complements the Cachix/nix-store caching (which can't shortcut the consumer's own forge compile).

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

  • Chores
    • Improved continuous integration performance by implementing build artifact caching across multiple workflows. This reduces compilation time and accelerates pipeline execution, enabling faster feedback on code changes and deployments.

Review Change Stack

… contracts

forge build is the dominant cost in the sol workflows (~105s in copy-artifacts).
Cache Foundry's incremental compilation cache + artifacts keyed on the sol
sources + foundry.toml + soldeer.lock, with a restore-keys prefix fallback so
forge only recompiles changed files.

copy-artifacts caches cache/ but NOT out/: it is a clean-build determinism
check, so out/ is regenerated fresh each run while cache/ still speeds
recompilation. The other sol workflows (sol-test, sol-static, build-pointers,
manual-sol-artifacts, rainix test.yml) cache both for the full speedup.
@thedavidmeister thedavidmeister self-assigned this May 27, 2026
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 27, 2026

📝 Walkthrough

Walkthrough

This PR adds consistent Foundry build caching to six CI workflows using actions/cache@v4. Each workflow now caches the Foundry cache/ and out/ directories with deterministic keys derived from Solidity sources and configuration files, reducing recompilation time across builds.

Changes

Foundry Build Caching

Layer / File(s) Summary
Cache Foundry build outputs
.github/workflows/rainix-build-pointers.yaml, .github/workflows/rainix-copy-artifacts.yaml, .github/workflows/rainix-manual-sol-artifacts.yaml, .github/workflows/rainix-sol-static.yaml, .github/workflows/rainix-sol-test.yaml, .github/workflows/test.yml
Added actions/cache@v4 step to cache Foundry's cache/ and out/ directories across workflow runs. Cache keys are derived from runner OS and hashes of Solidity sources, foundry.toml, soldeer.lock, and remappings.txt. Each workflow preserves existing step order with the new cache step positioned before dependency installation.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

🐰 Six workflows now cache with glee,
Foundry's output runs swiftly, you see!
No recompile when inputs align,
Configuration hash keys divine,
Speeding CI to the finish line! ✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: adding Foundry build caching across multiple CI workflows to skip recompiling unchanged contracts.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch 2026-05-27-cache-forge

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Like copy-artifacts, build-pointers asserts committed artifacts match a fresh
build, so out/ must be regenerated each run; cache/ alone still speeds
recompilation.
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 7

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/rainix-build-pointers.yaml:
- Line 38: Replace the mutable reference "uses: actions/cache@v4" with an
immutable pinned reference to the actions/cache repository at a full commit SHA
(e.g., "uses: actions/cache@<full-commit-sha>") so the workflow uses a specific
commit; update the same pattern wherever "actions/cache@v4" appears in other
workflows to the corresponding full commit SHA for that repo.

In @.github/workflows/rainix-copy-artifacts.yaml:
- Line 36: The workflow step using the moving tag "actions/cache@v4" should be
pinned to an immutable commit SHA: locate the cache step that references
"actions/cache@v4" (the "Cache Foundry build" step) and replace the tag suffix
"`@v4`" with the full commit SHA for actions/cache (e.g., "@<FULL_COMMIT_SHA>"),
then commit that change so the workflow uses the fixed action version.

In @.github/workflows/rainix-manual-sol-artifacts.yaml:
- Line 43: The workflow currently references the mutable tag "actions/cache@v4";
replace this with the repository's immutable commit SHA (e.g.,
"actions/cache@<full-commit-sha>") so the action is pinned. Locate the uses line
that mentions actions/cache@v4 in the workflow, fetch the full commit SHA from
the actions/cache GitHub repo (or the release you trust), and update the uses
value to that full SHA commit reference to ensure immutability.

In @.github/workflows/rainix-sol-static.yaml:
- Line 36: The workflow currently references the mutable tag "actions/cache@v4";
replace that with the repository pinned to an immutable commit SHA (e.g.,
"actions/cache@<full-commit-sha>"). Locate the step containing the "uses:
actions/cache@v4" line in the workflow and update it to the specific full commit
SHA of the actions/cache repo (obtain the SHA from the official actions/cache
repo commit history on GitHub), then run the workflow lint/check to ensure no
syntax changes are needed.

In @.github/workflows/rainix-sol-test.yaml:
- Line 65: Replace the floating tag uses: actions/cache@v4 with the
corresponding full immutable commit SHA for the intended v4 release (e.g., uses:
actions/cache@<full-sha>) wherever the workflow references actions/cache@v4;
update the single line "uses: actions/cache@v4" in this workflow (and any other
workflows that use actions/cache@v4) so they point to the specific commit SHA to
ensure immutability and reproducible runs.

In @.github/workflows/test.yml:
- Around line 62-66: The cache configuration is using root-level paths and
hashes (the path entries "cache" and "out" and the cache key expression
foundry-${{ runner.os }}-${{ hashFiles('src/**/*.sol', 'test/**/*.sol',
'script/**/*.sol', 'foundry.toml', 'soldeer.lock', 'remappings.txt') }}) but the
Forge job runs in test/fixture; update the cache paths and the hashFiles globs
to target the job's working directory (e.g., test/fixture/cache,
test/fixture/out and test/fixture/**/*.sol plus test/fixture/foundry.toml,
remappings, lock files) so the key and restore target the actual build artifacts
and source files used by the job.
- Line 60: Replace the mutable GitHub Actions tag "actions/cache@v4" with a
specific immutable commit SHA for supply-chain safety; locate each occurrence of
"actions/cache@v4" in your workflow files (e.g., the entry shown in the test
workflow) and update the ref to the full commit SHA for the actions/cache
repository instead of the version tag, then commit the updated workflow(s).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 29097be3-177e-4773-bfb4-aea4ed9e5301

📥 Commits

Reviewing files that changed from the base of the PR and between 0161c87 and 90043bb.

📒 Files selected for processing (6)
  • .github/workflows/rainix-build-pointers.yaml
  • .github/workflows/rainix-copy-artifacts.yaml
  • .github/workflows/rainix-manual-sol-artifacts.yaml
  • .github/workflows/rainix-sol-static.yaml
  • .github/workflows/rainix-sol-test.yaml
  • .github/workflows/test.yml

# BuildPointers run), so out/ is regenerated fresh each run while cache/
# still speeds recompilation.
- name: Cache Foundry build
uses: actions/cache@v4
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the workflow section around the referenced line(s)
sed -n '1,120p' .github/workflows/rainix-build-pointers.yaml | nl -ba | sed -n '25,80p'

# Search for all occurrences of actions/cache in the repo workflows
rg -n "uses:\s*actions/cache@" .github/workflows -S || true

# Also check if the workflow already pins to a SHA via actions/cache@<40+>
rg -n "uses:\s*actions/cache@[0-9a-f]{40,}" .github/workflows -S || true

Repository: rainlanguage/rainix

Length of output: 106


🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Print workflow with line numbers around the target section (avoid `nl`)
sed -n '1,140p' .github/workflows/rainix-build-pointers.yaml | cat -n | sed -n '25,90p'

# Find all occurrences of actions/cache usage in workflows
rg -n --fixed-string "uses: actions/cache@" .github/workflows -S || true

# Check for any pinned SHA form (40+ hex)
rg -n "uses:\s*actions/cache@[0-9a-f]{40,}" .github/workflows -S || true

Repository: rainlanguage/rainix

Length of output: 2503


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Target section =="
sed -n '20,60p' .github/workflows/rainix-build-pointers.yaml | cat -n

echo "== All actions/cache usages (v4/any tag) in workflows =="
rg -n "uses:\s*actions/cache@" .github/workflows -S || true

echo "== All actions/cache usages pinned to a SHA (40+ hex) =="
rg -n "uses:\s*actions/cache@[0-9a-f]{40,}" .github/workflows -S || true

Repository: rainlanguage/rainix

Length of output: 2894


Pin actions/cache to a full commit SHA.

actions/cache@v4 is mutable; pin this uses reference to an immutable full commit SHA in .github/workflows/rainix-build-pointers.yaml (it’s also currently unpinned in multiple other workflows).

Suggested change
-      - name: Cache Foundry build
-        uses: actions/cache@v4
+      - name: Cache Foundry build
+        uses: actions/cache@<FULL_LENGTH_COMMIT_SHA_FOR_V4>
🧰 Tools
🪛 zizmor (1.25.2)

[error] 38-38: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/rainix-build-pointers.yaml at line 38, Replace the mutable
reference "uses: actions/cache@v4" with an immutable pinned reference to the
actions/cache repository at a full commit SHA (e.g., "uses:
actions/cache@<full-commit-sha>") so the workflow uses a specific commit; update
the same pattern wherever "actions/cache@v4" appears in other workflows to the
corresponding full commit SHA for that repo.

# regenerated fresh each run so the committed-artifact assert stays a true
# clean-build check, while cache/ still speeds recompilation.
- name: Cache Foundry build
uses: actions/cache@v4
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/rainix-copy-artifacts.yaml"
echo "== File =="
ls -l "$FILE" || true

echo
echo "== Lines around 20-60 =="
nl -ba "$FILE" | sed -n '1,120p'

Repository: rainlanguage/rainix

Length of output: 256


🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/rainix-copy-artifacts.yaml"
echo "== Snippet around line 36 =="
# Print a small window around the referenced line
cat -n "$FILE" | sed -n '25,50p'

Repository: rainlanguage/rainix

Length of output: 1731


🌐 Web query:

actions/cache v4 commit SHA

💡 Result:

For actions/cache v4, the recommended pinned commit SHAs are: - v4.2.0: 0c2c1d8… (full SHA) — not found in the sources I retrieved. - v3.4.0: (full SHA) — not found in the sources I retrieved. What I can state with high confidence from authoritative sources: - The actions/cache repository explicitly says that if you are using pinned SHAs, you should use the SHAs of versions v4.2.0 or v3.4.0. [1] - The GitHub UI “actions/cache at v4” page and the releases/changelog in the repo confirm that v4 exists and show subsequent release bumps (e.g., v4.0.5 and up), but the retrieved snippets do not include the actual full commit SHA values for v4.2.0. [1][2] If you want, tell me whether you need (a) the full 40-character commit SHA for v4.2.0, (b) the SHA(s) for a specific v4.x.y tag, or (c) the SHA corresponding to “actions/cache@v4.2.0” specifically, and I’ll do one more targeted lookup to extract the exact pinned SHA(s).

Citations:


Pin actions/cache to a commit SHA (immutable) instead of actions/cache@v4.

.github/workflows/rainix-copy-artifacts.yaml currently uses the moving v4 tag for the “Cache Foundry build” step, which can change without notice. Pin actions/cache to the exact full commit SHA you want (e.g., replace @v4 with @<FULL_LENGTH_COMMIT_SHA>).

🧰 Tools
🪛 zizmor (1.25.2)

[error] 36-36: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/rainix-copy-artifacts.yaml at line 36, The workflow step
using the moving tag "actions/cache@v4" should be pinned to an immutable commit
SHA: locate the cache step that references "actions/cache@v4" (the "Cache
Foundry build" step) and replace the tag suffix "`@v4`" with the full commit SHA
for actions/cache (e.g., "@<FULL_COMMIT_SHA>"), then commit that change so the
workflow uses the fixed action version.

# Cache Foundry's incremental compilation cache + artifacts so unchanged
# contracts aren't recompiled (forge build is the dominant CI cost).
- name: Cache Foundry build
uses: actions/cache@v4
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/rainix-manual-sol-artifacts.yaml"
echo "== exists? =="
ls -l "$FILE" || true

echo "== relevant lines (35-60) =="
nl -ba "$FILE" | sed -n '35,60p'

echo "== all actions/cache@ occurrences =="
rg -n "actions/cache@"
"$FILE" || true

Repository: rainlanguage/rainix

Length of output: 267


🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/rainix-manual-sol-artifacts.yaml"
echo "== relevant lines (35-60) =="
cat -n "$FILE" | sed -n '35,60p'

echo "== all actions/cache@ occurrences =="
( command -v rg >/dev/null 2>&1 && rg -n "actions/cache@" "$FILE" ) || grep -n "actions/cache@" "$FILE" || true

Repository: rainlanguage/rainix

Length of output: 1811


Pin actions/cache to a full commit SHA (avoid @v4).
The workflow references actions/cache@v4 at line 43, which isn’t immutable.

Suggested change
-      - name: Cache Foundry build
-        uses: actions/cache@v4
+      - name: Cache Foundry build
+        uses: actions/cache@<FULL_LENGTH_COMMIT_SHA_FOR_V4>
🧰 Tools
🪛 zizmor (1.25.2)

[error] 43-43: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/rainix-manual-sol-artifacts.yaml at line 43, The workflow
currently references the mutable tag "actions/cache@v4"; replace this with the
repository's immutable commit SHA (e.g., "actions/cache@<full-commit-sha>") so
the action is pinned. Locate the uses line that mentions actions/cache@v4 in the
workflow, fetch the full commit SHA from the actions/cache GitHub repo (or the
release you trust), and update the uses value to that full SHA commit reference
to ensure immutability.

# Cache Foundry's incremental compilation cache + artifacts so unchanged
# contracts aren't recompiled (forge build is the dominant CI cost).
- name: Cache Foundry build
uses: actions/cache@v4
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

ls -la .github/workflows || true
sed -n '1,140p' .github/workflows/rainix-sol-static.yaml | nl -ba | sed -n '1,120p'
echo "----"
# show just the relevant line range around 36
sed -n '25,60p' .github/workflows/rainix-sol-static.yaml | nl -ba | sed -n '1,80p'

Repository: rainlanguage/rainix

Length of output: 1448


🏁 Script executed:

#!/bin/bash
set -euo pipefail

if [ -f .github/workflows/rainix-sol-static.yaml ]; then
  echo "FOUND: .github/workflows/rainix-sol-static.yaml"
else
  echo "MISSING: .github/workflows/rainix-sol-static.yaml"
  exit 1
fi

nl -ba .github/workflows/rainix-sol-static.yaml | sed -n '1,120p'
echo "---- around lines 30-45 ----"
nl -ba .github/workflows/rainix-sol-static.yaml | sed -n '25,50p'

Repository: rainlanguage/rainix

Length of output: 173


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "---- File: .github/workflows/rainix-sol-static.yaml (lines 20-60) ----"
awk 'NR>=20 && NR<=60 {print NR ":" $0}' .github/workflows/rainix-sol-static.yaml

echo "---- All occurrences of actions/cache in the file ----"
rg -n "actions/cache@" .github/workflows/rainix-sol-static.yaml || true

Repository: rainlanguage/rainix

Length of output: 1780


Pin actions/cache to an immutable commit SHA

.github/workflows/rainix-sol-static.yaml uses actions/cache@v4 (mutable tag); pin to a full commit SHA.

Suggested change
-      - name: Cache Foundry build
-        uses: actions/cache@v4
+      - name: Cache Foundry build
+        uses: actions/cache@<FULL_LENGTH_COMMIT_SHA_FOR_V4>
🧰 Tools
🪛 zizmor (1.25.2)

[error] 36-36: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/rainix-sol-static.yaml at line 36, The workflow currently
references the mutable tag "actions/cache@v4"; replace that with the repository
pinned to an immutable commit SHA (e.g., "actions/cache@<full-commit-sha>").
Locate the step containing the "uses: actions/cache@v4" line in the workflow and
update it to the specific full commit SHA of the actions/cache repo (obtain the
SHA from the official actions/cache repo commit history on GitHub), then run the
workflow lint/check to ensure no syntax changes are needed.

# Cache Foundry's incremental compilation cache + artifacts so unchanged
# contracts aren't recompiled (forge build is the dominant CI cost).
- name: Cache Foundry build
uses: actions/cache@v4
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Show the relevant section around line 65
echo "=== rainix-sol-test.yaml (lines 50-90) ==="
nl -ba .github/workflows/rainix-sol-test.yaml | sed -n '50,90p'

# Find all usages of actions/cache in the repo
echo "=== All uses of actions/cache ==="
rg -n --hidden "uses:\s*actions/cache@" .github/workflows || true

Repository: rainlanguage/rainix

Length of output: 167


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== rainix-sol-test.yaml (lines 50-90) ==="
cat -n .github/workflows/rainix-sol-test.yaml | sed -n '50,90p'

echo "=== All uses of actions/cache ==="
rg -n --hidden "uses:\s*actions/cache@" .github/workflows . || true

Repository: rainlanguage/rainix

Length of output: 2624


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== rainix-sol-test.yaml (lines 50-90) ==="
cat -n .github/workflows/rainix-sol-test.yaml | sed -n '50,90p'

echo "=== All uses of actions/cache ==="
rg -n --hidden "uses:\s*actions/cache@" .github/workflows . || true

Repository: rainlanguage/rainix

Length of output: 2624


Pin actions/cache to an immutable SHA (no @v4 tags).

.github/workflows/rainix-sol-test.yaml uses actions/cache@v4 (and the same @v4 tag appears in several other workflows). Pin actions/cache to the full commit SHA for the intended version.

Suggested change
-      - name: Cache Foundry build
-        uses: actions/cache@v4
+      - name: Cache Foundry build
+        uses: actions/cache@<FULL_LENGTH_COMMIT_SHA_FOR_V4>
🧰 Tools
🪛 zizmor (1.25.2)

[error] 65-65: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/rainix-sol-test.yaml at line 65, Replace the floating tag
uses: actions/cache@v4 with the corresponding full immutable commit SHA for the
intended v4 release (e.g., uses: actions/cache@<full-sha>) wherever the workflow
references actions/cache@v4; update the single line "uses: actions/cache@v4" in
this workflow (and any other workflows that use actions/cache@v4) so they point
to the specific commit SHA to ensure immutability and reproducible runs.

# Cache Foundry's incremental compilation cache + artifacts so unchanged
# contracts aren't recompiled (forge build is the dominant CI cost).
- name: Cache Foundry build
uses: actions/cache@v4
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Locate cache action usage
rg -n "actions/cache@" .github/workflows || true

# Show workflow around the referenced line(s)
nl -ba .github/workflows/test.yml | sed -n '1,140p' | sed -n '40,95p'

Repository: rainlanguage/rainix

Length of output: 576


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== test.yml context around uses: actions/cache@v4 =="
sed -n '50,75p' .github/workflows/test.yml | cat -n

echo
echo "== Check for any commit-pinned actions/cache in repo =="
rg -n "actions/cache@([0-9a-f]{40}|\$\\{\\{.*\\}\\})|actions/cache@v" .github/workflows

Repository: rainlanguage/rainix

Length of output: 1962


Pin actions/cache to an immutable commit SHA (replace actions/cache@v4).

.github/workflows/test.yml uses the mutable tag actions/cache@v4 (also used in several other workflows), so it should be pinned to a full commit SHA for CI supply-chain safety.

Suggested change
-      - name: Cache Foundry build
-        uses: actions/cache@v4
+      - name: Cache Foundry build
+        uses: actions/cache@<FULL_LENGTH_COMMIT_SHA_FOR_V4>
🧰 Tools
🪛 zizmor (1.25.2)

[error] 60-60: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml at line 60, Replace the mutable GitHub Actions
tag "actions/cache@v4" with a specific immutable commit SHA for supply-chain
safety; locate each occurrence of "actions/cache@v4" in your workflow files
(e.g., the entry shown in the test workflow) and update the ref to the full
commit SHA for the actions/cache repository instead of the version tag, then
commit the updated workflow(s).

Comment on lines +62 to +66
path: |
cache
out
key: foundry-${{ runner.os }}-${{ hashFiles('src/**/*.sol', 'test/**/*.sol', 'script/**/*.sol', 'foundry.toml', 'soldeer.lock', 'remappings.txt') }}
restore-keys: |
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Cache path/key scope doesn’t match this job’s Foundry working directory.

This job runs Forge from test/fixture, but the cache targets root-level cache/out and root-level Solidity globs. That can prevent cache hits or cache the wrong directories.

Suggested change
       - name: Cache Foundry build
         uses: actions/cache@v4
         with:
           path: |
-            cache
-            out
-          key: foundry-${{ runner.os }}-${{ hashFiles('src/**/*.sol', 'test/**/*.sol', 'script/**/*.sol', 'foundry.toml', 'soldeer.lock', 'remappings.txt') }}
+            test/fixture/cache
+            test/fixture/out
+          key: foundry-${{ runner.os }}-${{ hashFiles('test/fixture/src/**/*.sol', 'test/fixture/test/**/*.sol', 'test/fixture/script/**/*.sol', 'test/fixture/foundry.toml', 'test/fixture/soldeer.lock', 'test/fixture/remappings.txt') }}
           restore-keys: |
             foundry-${{ runner.os }}-
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
path: |
cache
out
key: foundry-${{ runner.os }}-${{ hashFiles('src/**/*.sol', 'test/**/*.sol', 'script/**/*.sol', 'foundry.toml', 'soldeer.lock', 'remappings.txt') }}
restore-keys: |
path: |
test/fixture/cache
test/fixture/out
key: foundry-${{ runner.os }}-${{ hashFiles('test/fixture/src/**/*.sol', 'test/fixture/test/**/*.sol', 'test/fixture/script/**/*.sol', 'test/fixture/foundry.toml', 'test/fixture/soldeer.lock', 'test/fixture/remappings.txt') }}
restore-keys: |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml around lines 62 - 66, The cache configuration is
using root-level paths and hashes (the path entries "cache" and "out" and the
cache key expression foundry-${{ runner.os }}-${{ hashFiles('src/**/*.sol',
'test/**/*.sol', 'script/**/*.sol', 'foundry.toml', 'soldeer.lock',
'remappings.txt') }}) but the Forge job runs in test/fixture; update the cache
paths and the hashFiles globs to target the job's working directory (e.g.,
test/fixture/cache, test/fixture/out and test/fixture/**/*.sol plus
test/fixture/foundry.toml, remappings, lock files) so the key and restore target
the actual build artifacts and source files used by the job.

@thedavidmeister thedavidmeister merged commit 4648a61 into main May 27, 2026
13 checks passed
@github-actions
Copy link
Copy Markdown

@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment:

S/M/L PR Classification Guidelines:

This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed.

Small (S)

Characteristics:

  • Simple bug fixes, typos, or minor refactoring
  • Single-purpose changes affecting 1-2 files
  • Documentation updates
  • Configuration tweaks
  • Changes that require minimal context to review

Review Effort: Would have taken 5-10 minutes

Examples:

  • Fix typo in variable name
  • Update README with new instructions
  • Adjust configuration values
  • Simple one-line bug fixes
  • Import statement cleanup

Medium (M)

Characteristics:

  • Feature additions or enhancements
  • Refactoring that touches multiple files but maintains existing behavior
  • Breaking changes with backward compatibility
  • Changes requiring some domain knowledge to review

Review Effort: Would have taken 15-30 minutes

Examples:

  • Add new feature or component
  • Refactor common utility functions
  • Update dependencies with minor breaking changes
  • Add new component with tests
  • Performance optimizations
  • More complex bug fixes

Large (L)

Characteristics:

  • Major feature implementations
  • Breaking changes or API redesigns
  • Complex refactoring across multiple modules
  • New architectural patterns or significant design changes
  • Changes requiring deep context and multiple review rounds

Review Effort: Would have taken 45+ minutes

Examples:

  • Complete new feature with frontend/backend changes
  • Protocol upgrades or breaking changes
  • Major architectural refactoring
  • Framework or technology upgrades

Additional Factors to Consider

When deciding between sizes, also consider:

  • Test coverage impact: More comprehensive test changes lean toward larger classification
  • Risk level: Changes to critical systems bump up a size category
  • Team familiarity: Novel patterns or technologies increase complexity

Notes:

  • the assessment must be for the totality of the PR, that means comparing the base branch to the last commit of the PR
  • the assessment output must be exactly one of: S, M or L (single-line comment) in format of: SIZE={S/M/L}
  • do not include any additional text, only the size classification
  • your assessment comment must not include tips or additional sections
  • do NOT tag me or anyone else on your comment

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 27, 2026

Tip

For best results, initiate chat on the files or code changes.

SIZE=M

thedavidmeister added a commit that referenced this pull request May 27, 2026
#203 modified rainix-build-pointers.yaml on main while this branch deletes it
(delete/modify) — keep the deletion.
thedavidmeister added a commit that referenced this pull request May 27, 2026
…aces

CI: namespace Foundry cache keys by mode (fix #203 cross-restore)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant