make rainix-sol-artifacts hermetic: own anvil when no ETH_RPC_URL (fixes main red) - #284
Conversation
The artifacts job read ETH_RPC_URL from CI_DEPLOY_SEPOLIA_RPC_URL, a legacy org secret removed in the RPC-secret consolidation to the canonical RPC_URL_*_FORK scheme. With it empty, forge treated the empty --rpc-url as a local path and "connection refused" against the cwd (test/fixture/) — main went red with a misleading error (see #283). The job only SIMULATES script/Deploy.sol, so any eth fork RPC works; use the surviving RPC_URL_ETHEREUM_FORK. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 44 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughArtifact deployments now use an environment-provided deployment key and start a local Anvil when no RPC URL is configured. CI no longer supplies RPC, Etherscan, or deployment-key secrets for the hermetic artifact task. ChangesHermetic artifact deployment
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant CI as Rainix CI
participant Task as rainix-sol-artifacts
participant Anvil
participant Deploy as Deploy.sol
CI->>Task: Run artifact task without RPC/key secrets
Task->>Anvil: Start local node on port 18545
Task->>Deploy: Set ETH_RPC_URL and DEPLOYMENT_KEY
Deploy->>Anvil: Broadcast Counter deployment
Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The CI artifacts job depended on a live external RPC via secrets that have been deleted (empty ETH_RPC_URL, connection refused on main) and no surviving secret can satisfy it (the retry --resume needs the recorded chain, and a mainnet fork URL yields 'Deployment not found for chain 1'). Instead of repointing at another external RPC, the task now runs against its own ephemeral anvil when no ETH_RPC_URL is provided: no secrets, no external network, no rate limits. An explicit ETH_RPC_URL (a real deploy) always wins. The fixture Deploy.sol now reads DEPLOYMENT_KEY like consumer deploy scripts do, so the fixture exercises the task exactly as consumers run it (broadcast included); the skip-simulation bats test supplies the key via env accordingly. CI drops the PRIVATE_KEY / RPC / etherscan secret plumbing from the job. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
thedavidmeister
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@flake.nix`:
- Around line 246-254: Bound the Anvil readiness loop in the startup flow by
adding a retry deadline and checking that anvil_pid remains alive before each
retry. If the deadline expires or Anvil exits before cast chain-id succeeds,
fail the artifact job with a nonzero status instead of continuing to wait
indefinitely.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: ea83b41f-52f4-453c-bcf3-f607bc82b3a9
📒 Files selected for processing (4)
.github/workflows/test.ymlflake.nixtest/bats/task/skip-simulation.test.batstest/fixture/script/Deploy.sol
The readiness wait was unbounded, so an anvil that exited during startup (or never bound the port) hung the task until the surrounding job timed out. Bound the wait to 20s and check the anvil process is still alive each iteration, so both cases exit non-zero with a clear message. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Reviewed 5d8a665: approve Makes Verification:
Merging with --admin (branch protection; sole maintainer cannot self-approve). |
|
@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment: S/M/L PR Classification Guidelines:This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed. Small (S)Characteristics:
Review Effort: Would have taken 5-10 minutes Examples:
Medium (M)Characteristics:
Review Effort: Would have taken 15-30 minutes Examples:
Large (L)Characteristics:
Review Effort: Would have taken 45+ minutes Examples:
Additional Factors to ConsiderWhen deciding between sizes, also consider:
Notes:
|
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the complete PR delta against its merge base: changed files and diff statistics.
base="$(git merge-base HEAD origin/HEAD 2>/dev/null || true)"
if [ -z "$base" ]; then
base="$(git merge-base HEAD main 2>/dev/null || true)"
fi
git diff --stat "$base"...HEAD
git diff --name-status "$base"...HEAD
git diff --numstat "$base"...HEADLength of output: 509 SIZE=M |
1 participant
Problem
The
rainix-sol-artifactsCI job (runs intest/fixture/) depended on a live external RPC:CI_DEPLOY_SEPOLIA_RPC_URLsecret was deleted, soETH_RPC_URLis empty →Connection refused.RPC_URL_ETHEREUM_FORK(this PR's first commit) cannot work: the RPC connects, but the first attempt fails (drpc free-plan 408s / unfunded key), and the retry's--resumethen looks for a recorded broadcast for chain 1 that doesn't exist →Error: Deployment not found for chain 1. Any external RPC keeps the job hostage to secrets, key rotation, and rate limits.Fix: hermetic by default
rainix-sol-artifactsnow starts its own ephemeral anvil when noETH_RPC_URLis provided (port 18545, killed on exit), with anvil's first funded dev account asDEPLOYMENT_KEY. An explicitETH_RPC_URL— a real deploy — always wins and leavesDEPLOYMENT_KEYuntouched. This mirrors the existing precedent intest/bats/task/skip-simulation.test.bats, which already spins anvil with the same dev key.test/fixture/script/Deploy.solnow readsDEPLOYMENT_KEYexactly like consumer deploy scripts, so the fixture exercises the task as consumers run it (barevm.broadcast()hits foundry's default-sender refusal under broadcast).test.ymldrops all secret plumbing from the job (PRIVATE_KEY, RPC URL, etherscan key): the artifacts job now needs no secrets and no external network.Verification (local, repo's own nix shells)
rainix-sol-artifactsexit 0,SIMULATION COMPLETE, anvil reaped by trap.DEPLOY_BROADCAST=1): exit 0,ONCHAIN EXECUTION COMPLETE & SUCCESSFUL.ETH_RPC_URL/DEPLOYMENT_KEYset): task exit 0 — explicit config wins as before. The retry loop (where--resumelives) is untouched by this diff; with a healthy local chain the first attempt succeeds so the retry path never fires in CI.bats test/bats/task/skip-simulation.test.bats: 2/2 ok.--all-filesrustfmt failure is pre-existing on an untouched main clone (no repo-rootCargo.toml) and untriggered by this diff (no.rschanges).🤖 Generated with Claude Code
Summary by CodeRabbit
ETH_RPC_URLis provided.DEPLOYMENT_KEYenvironment variable, ensuring consistent broadcasting behavior.