ci: unify toolchain setup into one composite action

[dev-jodee]

One .github/actions/setup action with install-* toggles and version
inputs (pnpm/Node, Solana, Anchor, just, sbpf) plus built-in caching,
called by every build workflow. Replaces the vendored setup-anchor
action and all remote heyAyushh/setup-solana references — that action
checks out its own default branch at runtime for its scripts, so even
a SHA pin executed unpinned code. Solana installs straight from
release.anza.xyz; "stable"/"beta" resolve through the vendored
channel-info.sh.

Also fixes an upstream bug inherited by the old action: when a channel
has no tag, its empty field shifted the other tag into the wrong slot
on read, so "stable" could resolve to nothing and 404 (true today —
beta currently has no tag). The script now emits "none" placeholders
and the action errors explicitly on a tagless channel.

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[dev-jodee]

Superseded by a single combined PR.

[greptile-apps]

Greptile Summary

The PR centralizes CI toolchain installation and caching in one repository-local composite action.

• Replaces the vendored Anchor setup and remote Solana setup calls across five build workflows.
• Adds Solana channel resolution, explicit version verification, and reusable pnpm, Cargo, Anchor, just, and sbpf setup toggles.
• Pins the ASM workflow to a compatible Solana and sbpf toolchain while retaining a non-blocking scheduled beta leg.

Confidence Score: 4/5

The PR is safe to merge, with non-blocking improvements available for cache-order documentation and action-reference pinning.

The Solana cache is restored after cleanup and uncached runs install the requested toolchain; the remaining concerns are maintainability of that ordering and the mutable setup-node tag.

.github/actions/setup/action.yml

Security Review

The composite action introduces mutable actions/setup-node@v5 references across the migrated workflows; pinning these references to full commit SHAs would preserve action integrity.

Important Files Changed

Filename	Overview
.github/actions/setup/action.yml	Defines the consolidated toolchain setup and caching flow, with non-blocking concerns around cache-order clarity and mutable setup-node references.
.github/actions/setup/scripts/channel-info.sh	Resolves stable and beta Agave tags while preserving empty channel fields with explicit placeholders.
.github/actions/setup/scripts/semver.sh	Supplies semantic-version comparison helpers used by channel resolution.
.github/workflows/solana-asm.yml	Migrates ASM builds to the composite action and pins compatible stable Solana and sbpf versions.
.github/workflows/solana-native.yml	Migrates stable and scheduled beta native builds to the shared setup action.
.github/workflows/solana-pinocchio.yml	Migrates stable and scheduled beta Pinocchio builds to the shared setup action.
.github/workflows/anchor.yml	Replaces the vendored Anchor setup action with the consolidated setup action.
.github/workflows/just.yml	Consolidates per-project Node, Cargo, Solana, and just setup configuration.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  W[Build workflows] --> S[Local setup action]
  S --> N[pnpm and Node]
  S --> C[Cargo cache]
  S --> R[Resolve Solana release]
  R --> X[Clean existing installation]
  X --> K[Restore Solana cache]
  K --> I{Cache hit?}
  I -->|No| D[Install from release.anza.xyz]
  I -->|Yes| V[Verify version]
  D --> V
  S --> A[Optional Anchor]
  S --> J[Optional just]
  S --> B[Optional sbpf]

Loading

_{Reviews (1): Last reviewed commit: "ci: unify toolchain setup into one compo..." | Re-trigger Greptile}

[greptile-apps]

Clarify cache cleanup ordering

The cleanup intentionally runs before cache restoration, so cached installations remain available and installation is skipped safely on hits. Documenting this ordering next to the cleanup prevents future refactors from moving it after restoration and deleting the toolchain.

Knowledge Base Used: Repo Tooling: Building, Testing, and CI'ing the Program Examples Monorepo

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Mutable setup action reference

The consolidated action invokes actions/setup-node@v5 through a mutable tag, allowing a moved tag to change the code executed across every migrated build workflow. Pin both setup-node invocations to a full commit SHA, consistent with the other external actions in this file.