ci: fix 4 workflow issues pre-testnet

[iap]

Summary

Four workflow issues found during pre-testnet review.

Changes

1. Sync _reusable-contracts-slither.yml with Makefile
Delegates to make slither-core — single source of truth. Previously the workflow hardcoded 4 contracts with global exclusions; the Makefile now covers 8 contracts with per-contract exclusions (PR #105). CI was running the old narrower scan.

2. Enable pool execute smoke
KI-8 is resolved (PR #104): via_ir inlines PoseidonT3, MARKPool is 24,298 bytes and deployable. Removed stale blocker comment and added the broadcast step.

3. Fix integration readiness port
The job waited on port 8420 (supersim admin) but the integration tests use 9545/9546 (RPC). Changed to wait on the actual ports the tests connect to.

4. Pin foundry-rs/foundry-toolchain to v1.8.0
Floating @v1 could silently break on Foundry breaking changes. Pinned to commit SHA c7450ba (v1.8.0) across all 4 workflows that use it.

Scope

.github/workflows/

Summary by CodeRabbit

• Chores

  • Upgraded and pinned Foundry toolchain to v1.8.0 across CI for deterministic runs
  • Streamlined static-analysis and verification steps in contract CI

• Tests / Reliability

  • Improved integration test readiness checks with more robust port-wait logic

• Documentation

  • Clarified CI validation and contract-size behavior in known-issues (KI-8)

[coderabbitai]

Walkthrough

Pin Foundry toolchain to a specific v1.8.0 commit across CI workflows, bump the reusable Slither workflow default to 1.8.0 and run make slither-core, replace integration supersim readiness with a port-polling loop, and clarify KI-8 in docs.

Changes

Foundry toolchain upgrade and Slither workflow refactoring

Layer / File(s)	Summary
Reusable Slither workflow update and Foundry pinning .github/workflows/_reusable-contracts-slither.yml	The foundry_version input default is bumped from 1.5.0 to 1.8.0; Slither job now uses foundry-rs/foundry-toolchain at v${{ inputs.foundry_version }} and runs make slither-core in contracts instead of an inline slither loop.
Foundry pinning across CI job workflows .github/workflows/contracts-ci.yml, .github/workflows/contracts-mainnet-readiness.yml, .github/workflows/contracts-production-lock-verify.yml, .github/workflows/contracts-staging-rehearsal.yml	Pin foundry-rs/foundry-toolchain to a specific commit (annotated v1.8.0) across unit/invariant, release-check, production-mode-smoke, mainnet-readiness, production-lock-verify, and staging-rehearsal jobs.
Integration job Foundry pinning and supersim readiness polling .github/workflows/contracts-ci.yml	Integration RPC job now pins Foundry and replaces pnpm wait-port 8420 with an inline shell loop that polls ports 9545 and 9546 until reachable, with logging and timeout.
Release-check comment update .github/workflows/contracts-ci.yml	Update the release-check explanatory comment to reference the PoseidonT3 artifact/broadcast contract-size-check (KI-8) rather than the previous size-limit rationale.
KI-8 documentation clarification contracts/KNOWN_ISSUES.md	Extend KI-8 Impact text to explain CI dry-run validation and the contract-size-check mismatch with PoseidonT3 despite via_ir inlining into MARKPool.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• trade/mark#105: Refactors the contracts/Makefile slither-core target that this workflow now invokes.
• trade/mark#23: Earlier changes to the reusable Slither workflow; both PRs touch _reusable-contracts-slither.yml wiring.
• trade/mark#33: Related changes to supersim/RPC readiness checks and integration job port-wait logic.

Poem

🐰 I hopped through CI lines tonight,
Foundry pinned and shining bright,
Slither hums with one make command,
Ports now polled by steady hand,
Rabbit cheers—pipelines take flight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: fixing four workflow issues pre-testnet, which matches the four specific fixes in the PR description and raw summary.
Description check	✅ Passed	The PR description covers all critical aspects: a clear summary of four workflow issues, detailed changes section explaining each fix, and scope identification. The template's verification and risk review sections are not filled, but the core content is comprehensive.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/fix-workflow-issues

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/foundry-rs/foundry-toolchain	c7450ba673e133f5ee30098b3b54f444d3a2ca2d	🟢 8	Details Check Score Reason Code-Review 🟢 8 Found 17/19 approved changesets -- score normalized to 8 Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 8 9 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 10 all dependencies are pinned Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches Security-Policy 🟢 9 security policy file detected SAST 🟢 9 SAST tool detected but not run on all commits

Scanned Files

• .github/workflows/contracts-staging-rehearsal.yml

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 757e3e9213

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/contracts-ci.yml:
- Line 33: Four workflow steps reference the action "uses:
foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d" but do
not pin the installed Foundry binary version; for each occurrence of that "uses:
foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d" entry
(the ones annotated with "# v1.8.0"), add an explicit configuration block adding
with: version: "1.8.0" so the action installs the same Foundry release rather
than the default "stable" channel.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c5a20e45-e275-41e9-88e0-a502e36ad026

📥 Commits

Reviewing files that changed from the base of the PR and between 86aa621 and 757e3e9.

📒 Files selected for processing (5)

• .github/workflows/_reusable-contracts-slither.yml
• .github/workflows/contracts-ci.yml
• .github/workflows/contracts-mainnet-readiness.yml
• .github/workflows/contracts-production-lock-verify.yml
• .github/workflows/contracts-staging-rehearsal.yml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/_reusable-contracts-slither.yml:
- Around line 25-26: The "Setup Foundry" workflow step uses
foundry-rs/foundry-toolchain@c7450ba... but doesn't pin the installed Foundry
binary version, so add the explicit version input (e.g., version: "1.8.0") to
the same step to force installing Foundry v1.8.0; update the step that
references the action (the "Setup Foundry" step) to include the version field so
the binary and action are both pinned.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6a90fe8c-6b84-4b71-9067-597a8cfff8b1

📥 Commits

Reviewing files that changed from the base of the PR and between 757e3e9 and 275fdee.

📒 Files selected for processing (1)

• .github/workflows/_reusable-contracts-slither.yml

[coderabbitai]

♻️ Duplicate comments (1)

.github/workflows/contracts-ci.yml (1)

33-33: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Explicitly pin the Foundry binary version, not only the action revision.

These steps still rely on the action’s default Foundry channel (stable) unless with.version is set, so binary drift can still occur despite commit-pinning the action itself.

Suggested minimal fix

      - name: Setup Foundry
        uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d  # v1.8.0
+       with:
+         version: v1.8.0

Apply to all four Setup Foundry steps in this file.

#!/bin/bash
set -euo pipefail

echo "Check callsites missing explicit Foundry version:"
python - <<'PY'
import pathlib, re
p = pathlib.Path(".github/workflows/contracts-ci.yml")
lines = p.read_text().splitlines()
for i, line in enumerate(lines, start=1):
    if "uses: foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d" in line:
        window = lines[i:i+8]
        has_with = any(re.match(r'^\s*with:\s*$', w) for w in window)
        has_version = any(re.match(r'^\s*version:\s*\S+', w) for w in window)
        if not (has_with and has_version):
            print(f"missing with.version near Line {i}")
PY

echo
echo "Confirm action default for 'version' input at pinned commit:"
curl -fsSL https://raw.githubusercontent.com/foundry-rs/foundry-toolchain/c7450ba673e133f5ee30098b3b54f444d3a2ca2d/action.yml \
  | tr '\n' ' ' | sed 's/inputs:/\ninputs:/' | sed 's/runs:/\nruns:/'

Also applies to: 69-69, 165-165, 209-209

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/contracts-ci.yml at line 33, The workflow pins the action
commit ("uses:
foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d") but does
not pin the Foundry binary itself; update each "Setup Foundry" step (the four
occurrences of that exact uses string) to include a with.version input (i.e.,
add a with: block that sets version to the concrete Foundry binary tag you want,
using the same semantic value across all occurrences) so the action will install
the pinned Foundry binary rather than using the action default channel.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In @.github/workflows/contracts-ci.yml:
- Line 33: The workflow pins the action commit ("uses:
foundry-rs/foundry-toolchain@c7450ba673e133f5ee30098b3b54f444d3a2ca2d") but does
not pin the Foundry binary itself; update each "Setup Foundry" step (the four
occurrences of that exact uses string) to include a with.version input (i.e.,
add a with: block that sets version to the concrete Foundry binary tag you want,
using the same semantic value across all occurrences) so the action will install
the pinned Foundry binary rather than using the action default channel.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0302daf8-6314-4254-b5da-d32152671899

📥 Commits

Reviewing files that changed from the base of the PR and between 275fdee and 064f38e.

📒 Files selected for processing (2)

• .github/workflows/contracts-ci.yml
• contracts/KNOWN_ISSUES.md

Pool execute smoke step was reverted — this comment is stale