From 2b17e4845554873480204bc2f0436c7a82719caa Mon Sep 17 00:00:00 2001 From: baku-ccron Date: Tue, 25 Aug 2026 10:05:54 +0000 Subject: [PATCH] Add the Manual sol verify caller workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every one of the five `sol-v0.1.9` deploys ran with `verify: false` — the verification retry loop was outlasting the deploy — so all five contracts are live on all seven networks with no source on any explorer. Re-dispatching `Manual sol artifacts` cannot repair that. The deploy is deterministic and therefore idempotent: a rerun against networks that already hold the code broadcasts nothing, `--verify` gets nothing to submit, and the run goes green having verified nothing. The `manual-sol-artifacts.yaml` `verify` input already points at `Manual sol verify` as the repair path; this is that workflow. Thin caller over `rainix-manual-sol-verify.yaml`, matching the one in rain.deploy. `forge verify-contract` only talks to the explorer API, so it never broadcasts, never reads `DEPLOYMENT_KEY`, and is a no-op against an explorer that already has the source. The `networks` default spells FOUNDRY's chain names, which are not this repo's `[rpc_endpoints]` aliases on three of the seven — `base-sepolia`, `mainnet` and `hyperliquid` against `base_sepolia`, `ethereum` and `hyperevm`. The alias spellings are rejected outright, and they are exactly what the deploy's own `manual verification command:` line prints, so the input description says not to copy `--chain` from there. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/manual-sol-verify.yaml | 59 ++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 .github/workflows/manual-sol-verify.yaml diff --git a/.github/workflows/manual-sol-verify.yaml b/.github/workflows/manual-sol-verify.yaml new file mode 100644 index 000000000..6b0a1fc5c --- /dev/null +++ b/.github/workflows/manual-sol-verify.yaml @@ -0,0 +1,59 @@ +name: Manual sol verify +# Explorer source verification for a suite that is ALREADY on chain, run by +# hand. +# +# `manual-sol-artifacts.yaml` submits source only for what its own run +# broadcast, and the broadcast is idempotent: a rerun against networks that +# already hold the code broadcasts nothing, so there is nothing for `--verify` +# to submit and the run is green having verified nothing. A deploy that landed +# and then went unverified — a bad explorer key, a rate limit, an explorer that +# was down, or `verify: false` because the retry loop would have outlasted the +# deploy — is repaired here rather than by re-dispatching the deploy. +# +# Deliberately `workflow_dispatch` only, like the deploy. Unlike the deploy this +# never broadcasts and never reads `DEPLOYMENT_KEY`: `forge verify-contract` +# talks to the explorer API and nothing else, so it is safe to re-run and is +# already a no-op ("already verified") against an explorer that has the source. +on: + workflow_dispatch: + inputs: + contract: + type: string + required: true + description: | + Artifact path of the contract to submit, `path:Contract`. Paired with + `address` on the `manual verification command:` line + `script/Deploy.sol` prints for every network, whether it deployed + there or skipped it, so a run of the deploy is where both values come + from. They are also the `artifactPath` and the generated + `DEPLOYED_ADDRESS` of the five suites in + `src/abstract/RainlangDeploySuites.sol`. + address: + type: string + required: true + description: | + The deployed address. One value for every network, because the Zoltu + factory derives one address from the creation code. + networks: + type: string + required: true + default: arbitrum base base-sepolia mainnet flare hyperliquid polygon + description: | + Which explorers to submit to. FOUNDRY's chain names, not the + `[rpc_endpoints]` aliases, and the two differ on three of the seven: + the aliases `base_sepolia`, `ethereum` and `hyperevm` are rejected + outright, and the chain names are `base-sepolia`, `mainnet` and + `hyperliquid`. The `manual verification command:` line is NOT a source + for this field — it prints `--chain` with the alias it broadcast + under, which is the spelling that gets rejected here. The default is + `LibRainDeploy.supportedNetworks()` spelled the working way, i.e. + every network `script/Deploy.sol` broadcasts to, so it has to move + when that does. +jobs: + verify: + uses: rainlanguage/rainix/.github/workflows/rainix-manual-sol-verify.yaml@main + with: + contract: ${{ inputs.contract }} + address: ${{ inputs.address }} + networks: ${{ inputs.networks }} + secrets: inherit