Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Summary by CodeRabbit
WalkthroughThis PR integrates solana-verify across CI and tooling: pins the verifier, rewrites program build scripts/workflows to use solana-verify with library-name resolution, adds verify-from-repo tooling and a verify workflow, runs verification during mainnet direct deployments, and updates docs and build profiles. ChangesSolana Verify Integration
🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers:
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy-program.yml:
- Around line 265-291: The verification/upload steps ("Upload verified-build
PDA" and "Submit remote verification job") are unreachable because their if
conditions require inputs.cluster == 'mainnet-beta' while mainnet sets
DEPLOY_TYPE="squads"; update those step conditions to remove the mainnet-beta
cluster check and instead gate only on github.event.inputs.dry_run == 'false' &&
env.DEPLOY_TYPE == 'direct' (and do the same for the earlier "Install" step that
currently uses the mismatched cluster check) so direct deployments
(DEPLOY_TYPE="direct") can reach the verification commands; keep existing
environment variables PROGRAM_ID/UPLOADER/COMMIT_HASH logic intact.
In @.github/workflows/verify-program.yml:
- Around line 69-92: The workflow sets PROGRAM_NAME (mpl_${{ inputs.program }})
but never uses it and hardcodes the library name as mpl_core_program; update the
Upload step to derive the library name from the input instead of the hardcoded
string—either remove the unused PROGRAM_NAME assignment or reuse it to build the
library name, and replace the literal "--library-name mpl_core_program" with a
reference that composes the library name from the input (e.g., using
PROGRAM_NAME or inputs.program to form the expected mpl_<program>[_program]
token) so the workflow works for programs beyond core and no dead environment
vars remain.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: f9fd14f6-e6df-4e7c-ba14-587a17836282
📒 Files selected for processing (13)
.github/.env.github/file-filters.yml.github/workflows/build-programs.yml.github/workflows/deploy-program.yml.github/workflows/verify-program.ymlCargo.tomlREADME.mdconfigs/scripts/program/build.shconfigs/scripts/program/verify-from-repo.shconfigs/shank.cjspackage.jsonprograms/mpl-core/Cargo.tomlprograms/mpl-core/README.md
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/verify-program.yml:
- Around line 74-94: The workflow's "Upload verified-build PDA" step uses the
direct keypair upload (--keypair ./deployer-key.json) and only supports
mainnet-beta, which conflicts with the earlier note that core mainnet must
publish via Squads; update this job to either (A) implement the Squads
publication flow instead of using the direct --keypair path (replace the direct
solana-verify invocation with the Squads-specific submission logic for program
publish), or (B) gate the existing solana-verify --keypair invocation behind a
conditional that skips it when deploying to core mainnet (check the cluster
variable/RPC or CORE_ID context) so PROGRAM_ID, COMMIT_HASH and the direct
upload are only used for non-core-mainnet clusters.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 36a34e1a-795f-4b2b-9048-354c5128be5e
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.github/workflows/deploy-program.yml.github/workflows/verify-program.yml
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Benchmark
Details
| Benchmark suite | Current: 6259d49 | Previous: 2398d72 | Ratio |
|---|---|---|---|
CU: create a new, empty asset |
8178 Compute Units |
8022 Compute Units |
1.02 |
Space: create a new, empty asset |
91 Bytes |
91 Bytes |
1 |
CU: create a new, empty asset with empty collection |
16974 Compute Units |
16839 Compute Units |
1.01 |
Space: create a new, empty asset with empty collection |
91 Bytes |
91 Bytes |
1 |
CU: create a new asset with plugins |
27797 Compute Units |
26608 Compute Units |
1.04 |
Space: create a new asset with plugins |
194 Bytes |
194 Bytes |
1 |
CU: create a new asset with plugins and empty collection |
33147 Compute Units |
31936 Compute Units |
1.04 |
Space: create a new asset with plugins and empty collection |
194 Bytes |
194 Bytes |
1 |
CU: list an asset |
20774 Compute Units |
20043 Compute Units |
1.04 |
CU: sell an asset |
26152 Compute Units |
25233 Compute Units |
1.04 |
CU: list an asset with empty collection |
25718 Compute Units |
24993 Compute Units |
1.03 |
CU: sell an asset with empty collection |
34279 Compute Units |
33304 Compute Units |
1.03 |
CU: list an asset with collection royalties |
24895 Compute Units |
24276 Compute Units |
1.03 |
CU: sell an asset with collection royalties |
37316 Compute Units |
36089 Compute Units |
1.03 |
CU: transfer an empty asset |
3865 Compute Units |
3785 Compute Units |
1.02 |
CU: transfer an empty asset with empty collection |
5588 Compute Units |
5498 Compute Units |
1.02 |
CU: transfer an asset with plugins |
7454 Compute Units |
7213 Compute Units |
1.03 |
CU: transfer an asset with plugins and empty collection |
9177 Compute Units |
8926 Compute Units |
1.03 |
This comment was automatically generated by workflow using github-action-benchmark.
This reverts commit a5ffea6.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/verify-program.yml (1)
75-94:⚠️ Potential issue | 🟠 Major | ⚡ Quick winCore mainnet publish path still uses direct keypair upload.
Line 75-Line 77 says core mainnet PDA publishing must go through Squads, but Line 85-Line 94 still executes direct
--keypairupload for the only allowed input combination (core+mainnet-beta). This path is not compatible with the current authority model. Please add a Squads publish path or explicitly fail/skip direct PDA publishing until that path exists.Suggested minimal guard (fail-fast until Squads path is added)
- name: Upload verified-build PDA run: | + if [ "${{ inputs.program }}" = "core" ] && [ "${{ inputs.cluster }}" = "mainnet-beta" ]; then + echo "Core mainnet verified-build PDA publishing must run via Squads; direct keypair upload is unsupported." + exit 1 + fi + PROGRAM_ID="$(solana-keygen pubkey ./program-id.json)" COMMIT_HASH="$(git rev-parse HEAD)"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/verify-program.yml around lines 75 - 94, The current "Upload verified-build PDA" step runs solana-verify with --keypair which is incompatible for the Core mainnet-authority model; update that step to detect the forbidden combination (when LIBRARY_NAME == "core" and RPC indicates mainnet-beta, using the existing PROGRAM_ID and COMMIT_HASH variables) and fail fast or skip publishing instead of running solana-verify --keypair; implement a bash guard at the start of the step that prints a clear error and exits non-zero (or explicitly skips) when those conditions are met so direct keypair upload is never attempted for Core on mainnet-beta.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Line 74: The README line wrongly implies a direct mainnet-beta deploy path;
update the sentence that references the Verify Program and Deploy Program
workflows so it clarifies that mainnet-beta deploys in this repo use Squads (not
direct deploys) and that verification is only automated for DEPLOY_TYPE ==
direct, and that publishing the verified-build PDA for the Squads upgrade
authority must be routed through the Squads transaction flow described in the
Solana verified-builds guide; mention the workflows by name (Verify Program,
Deploy Program), the DEPLOY_TYPE variable, and "mainnet-beta" and "Squads" so
readers know the exact behavior.
---
Duplicate comments:
In @.github/workflows/verify-program.yml:
- Around line 75-94: The current "Upload verified-build PDA" step runs
solana-verify with --keypair which is incompatible for the Core
mainnet-authority model; update that step to detect the forbidden combination
(when LIBRARY_NAME == "core" and RPC indicates mainnet-beta, using the existing
PROGRAM_ID and COMMIT_HASH variables) and fail fast or skip publishing instead
of running solana-verify --keypair; implement a bash guard at the start of the
step that prints a clear error and exits non-zero (or explicitly skips) when
those conditions are met so direct keypair upload is never attempted for Core on
mainnet-beta.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 23339fa0-bfac-46ec-91cd-e581ddbc4731
📒 Files selected for processing (3)
.github/workflows/deploy-program.yml.github/workflows/verify-program.ymlREADME.md
blockiosaurus
approved these changes
May 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
solana-verifyverified-build path and pin the verify CLI version in CI.pnpm programs:verifywrapper for public-repo verification.Test plan
bash -n configs/scripts/program/build.sh configs/scripts/program/verify-from-repo.sh.github/file-filters.ymlcargo metadata --no-deps --format-version 1node -e 'JSON.parse(require("fs").readFileSync("package.json", "utf8"))'pnpm programs:buildbecause it requiressolana-verifyand Docker