Skip to content

ci: pin the verified Foundry toolchain - #91

Merged
0xMuang merged 1 commit into
mainfrom
fix/pin-foundry-ci-v1.7.1
Sep 3, 2026
Merged

ci: pin the verified Foundry toolchain#91
0xMuang merged 1 commit into
mainfrom
fix/pin-foundry-ci-v1.7.1

Conversation

@0xMuang

@0xMuang 0xMuang commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • pin GitHub CI to the verified Foundry v1.7.1 release instead of the floating stable channel
  • document the CI/E2E baseline and require explicit review for future Foundry upgrades
  • preserve the fail-closed high-severity lint gate

Reason

The #89 merge used the same reviewed code as the green PR build, but main CI downloaded newly released Foundry v1.8.1. Its new arbitrary-send-erc20 lint warnings changed the gate after review. The adapter transfers are intentional signed/router-authorized settlement paths; this PR restores deterministic CI rather than silently weakening lint policy.

Verification

  • official Foundry v1.7.1 release confirmed
  • git diff --check passed
  • prior clean CI and full 870-test suite passed on the v1.7.1 baseline
  • GitHub Actions clean-runner result required before merge

Local gap

The exact v1.7.1 binary is not installed locally, so the local floating/nightly formatter still reports its known formatting difference. No product source was changed.

Constraint: The repository's verified formatter, lint, build and E2E baseline is Foundry v1.7.1, while the floating stable channel advanced to v1.8.1 after PR review.

Rejected: Silently weakening the high-severity lint gate | the failure came from toolchain drift, not an accepted change to the repository warning policy.

Confidence: high

Scope-risk: narrow

Directive: Upgrade Foundry only through an explicit PR that reviews formatter and lint-rule changes and reruns the full repository gate.

Tested: Official v1.7.1 release exists; git diff check passed; prior PR CI and full Foundry 870/870 verification used the v1.7.1 baseline.

Not-tested: Local full check could not use v1.7.1 because the pinned binary is not installed locally; GitHub CI is the authoritative clean-runner verification.
@0xMuang
0xMuang merged commit 0421850 into main Sep 3, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant