verify build + new CODEOWNERS

.github/.env

@@ -3,3 +3,5 @@ NODE_VERSION=20.x
 PROGRAMS=["program"]
 RUST_VERSION=1.78.0
 SOLANA_VERSION=1.17.34
+VERIFY_BUILD_VERSION=0.2.11
+

.github/CODEOWNERS

@@ -1 +1 @@
-* @richardwu @samuelvanderwaal
+* @richardwu @nftechie @leantOnSol

.github/file-filters.yml

@@ -5,7 +5,7 @@
 # Programs.
 
 program_common: &program_common
-  - ".github/workflows/build-programs.yml"
+  - ".github/workflows/build-verify-programs.yml"
   - ".github/workflows/test-programs.yml"
   - ".github/workflows/main.yml"
   - ".github/file-filters.yml"

.github/workflows/build-programs.yml → .github/workflows/build-verify-programs.yml

@@ -1,4 +1,4 @@
-name: Build Programs
+name: Build Verify Programs
 
 on:
   workflow_call:
@@ -13,41 +13,46 @@ on:
     inputs:
       rust:
         description: Rust version
-        default: 1.78.0
+        default: 1.75.0
         required: true
         type: string
       solana:
         description: Solana version
-        default: 1.17.34
+        default: 1.17.22
         required: true
         type: string
       node:
         description: Node version
         default: 20.x
         required: true
         type: string
+      verify:
+        description: Verify build version
+        default: 0.2.11
+        required: true
+        type: string
 
 env:
   CACHE: true
   CARGO_NET_GIT_FETCH_WITH_CLI: "true"
-  ARTIFACTS_TOKEN: ${{ secrets.ARTIFACTS_TOKEN }}
   RPC: ${{ secrets.SOLANA_MAINNET_RPC_URL }}
+  ARTIFACTS_TOKEN: ${{ secrets.ARTIFACTS_TOKEN }}
 
 jobs:
-  build_programs:
+  build_verify_programs:
     name: Build
     runs-on: ubuntu-latest
     steps:
       - name: Git checkout
         uses: actions/checkout@v4
 
       - name: Setup SSH agent
-        uses: tensor-foundation/actions/ssh-agent@v1
+        uses: tensor-foundation/actions/ssh-agent@v2
         with:
           key: |
+            ${{ secrets.ESCROW_KEY }}
             ${{ secrets.TOOLBOX_KEY }}
             ${{ secrets.WHITELIST_KEY }}
-            ${{ secrets.ESCROW_KEY }}
 
       - name: Load environment variables
         run: cat .github/.env >> $GITHUB_ENV
@@ -58,7 +63,7 @@ jobs:
           toolchain: ${{ inputs.rust || env.RUST_VERSION }}
 
       - name: Install Solana
-        uses: tensor-foundation/actions/install-solana@v2.1
+        uses: tensor-foundation/actions/install-solana@v3
         with:
           version: ${{ inputs.solana || env.SOLANA_VERSION }}
           cache: ${{ env.CACHE }}
@@ -76,10 +81,25 @@ jobs:
         with:
           folder: "."
           key: programs
+
+      - name: Dump mainnet binaries
+        run: pnpm programs:dump_binaries:mainnet
+
+      - name: Cache solana-verify
+        uses: actions/cache@v4
+        id: cache-verify
+        with:
+          path: /home/runner/.cargo-install/solana-verify
+          key: solana-verify-${{ inputs.verify || env.VERIFY_BUILD_VERSION }}-${{ runner.os }}
+
+      - name: Install verify build
+        if: steps.cache-verify.outputs.cache-hit != 'true'
+        run: cargo install solana-verify --force --root /home/runner/.cargo-install/solana-verify --version ${{ inputs.verify || env.VERIFY_BUILD_VERSION }} --locked
 
-      - name: Build programs
+      - name: Verify build program
         shell: bash
-        run: pnpm programs:build
+        run: |
+          /home/runner/.cargo-install/solana-verify/bin/solana-verify build --library-name amm_program | tee >(tail -n 1 > build_hash.txt)
 
       - name: Upload programs build
         uses: actions/upload-artifact@v4
@@ -88,5 +108,7 @@ jobs:
           # First wildcard ensures exported paths are consistently under the programs folder.
           path: |
             ./targe*/deploy/*.so
+            build_hash.txt
             ./targe*/deploy/*.json
-          if-no-files-found: error
+            !./targe*/deploy/*keypair*.json
+          if-no-files-found: error

.github/workflows/main.yml

@@ -137,11 +137,11 @@ jobs:
           command: clippy
           args: --all-targets --all-features --no-deps -- -D warnings
 
-  build_programs:
+  build_verify_programs:
     name: Programs
     if: ${{ needs.changes.outputs.any == 'true' }}
     needs: [changes, lint_js, lint_rust]
-    uses: ./.github/workflows/build-programs.yml
+    uses: ./.github/workflows/build-verify-programs.yml
     secrets: inherit
 
   test_programs:
@@ -156,7 +156,7 @@ jobs:
   generate_clients:
     name: Generate Clients
     if: ${{ needs.changes.outputs.any == 'true' }}
-    needs: [changes, build_programs]
+    needs: [changes, build_verify_programs]
     runs-on: ubuntu-latest
     steps:
       - name: Git checkout

.github/workflows/publish-js-client.yml

@@ -3,26 +3,13 @@ name: Publish JS Client
 on:
   workflow_dispatch:
     inputs:
-      bump:
-        description: Version bump
-        required: true
-        default: patch
-        type: choice
-        options:
-          - patch
-          - minor
-          - major
-          - prerelease
-          - prepatch
-          - preminor
-          - premajor
       tag:
-        description: NPM Tag (and preid for pre-releases)
+        description: NPM Tag
         required: true
         type: string
         default: latest
-      create_release:
-        description: Create a GitHub release
+      dry_run:
+        description: Dry run
         required: true
         type: boolean
         default: true
@@ -31,19 +18,22 @@ env:
   CACHE: true
 
 jobs:
-  build_programs:
+  build_verify_programs:
     name: Programs
-    uses: ./.github/workflows/build-programs.yml
+    if: github.ref == 'refs/heads/main' || inputs.dry_run == true
+    uses: ./.github/workflows/build-verify-programs.yml
     secrets: inherit
 
   test_js:
     name: JS client
-    needs: build_programs
+    if: github.ref == 'refs/heads/main' || inputs.dry_run == true
+    needs: build_verify_programs
     uses: ./.github/workflows/test-js-client.yml
     secrets: inherit
 
   publish_js:
     name: JS client / Publish
+    if: github.ref == 'refs/heads/main' || inputs.dry_run == true
     runs-on: ubuntu-latest
     needs: test_js
     permissions:
@@ -71,17 +61,11 @@ jobs:
       - name: Build
         working-directory: ./clients/js
         run: pnpm build
-
-      - name: Bump
-        id: bump
+        
+      - name: Get version
+        id: get_version
         working-directory: ./clients/js
-        run: |
-          if [ "${{ startsWith(inputs.bump, 'pre') }}" == "true" ]; then
-            pnpm version ${{ inputs.bump }} --preid ${{ inputs.tag }} --no-git-tag-version
-          else
-            pnpm version ${{ inputs.bump }} --no-git-tag-version
-          fi
-          echo "new_version=$(pnpm pkg get version | sed 's/"//g')" >> $GITHUB_OUTPUT
+        run: echo "version=$(pnpm pkg get version | sed 's/"//g')" >> $GITHUB_OUTPUT
 
       - name: Set publishing config
         run: pnpm config set '//registry.npmjs.org/:_authToken' "${NODE_AUTH_TOKEN}"
@@ -90,40 +74,4 @@ jobs:
 
       - name: Publish
         working-directory: ./clients/js
-        run: pnpm publish --no-git-checks --tag ${{ inputs.tag }}
-
-      - name: Commit and tag new version
-        uses: stefanzweifel/git-auto-commit-action@v4
-        with:
-          commit_message: Deploy JS client v${{ steps.bump.outputs.new_version }}
-          tagging_message: js@v${{ steps.bump.outputs.new_version }}
-
-      - name: Create GitHub release
-        if: github.event.inputs.create_release == 'true'
-        uses: ncipollo/release-action@v1
-        with:
-          tag: js@v${{ steps.bump.outputs.new_version }}
-
-  deploy_js_docs:
-    name: JS client / Deploy docs
-    runs-on: ubuntu-latest
-    needs: publish_js
-    environment:
-      name: js-client-documentation
-      url: ${{ steps.deploy.outputs.url }}
-    steps:
-      - name: Git checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.ref }}
-
-      - name: Load environment variables
-        run: cat .github/.env >> $GITHUB_ENV
-
-      - name: Deploy to Vercel
-        id: deploy
-        env:
-          VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
-          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
-        working-directory: ./clients/js
-        run: echo "url=$(vercel deploy --prod --token=${{ secrets.VERCEL_TOKEN }})" | tee $GITHUB_OUTPUT
+        run: pnpm publish --no-git-checks --tag ${{ inputs.tag }} ${{ inputs.dry_run && '--dry-run' || '' }}

.github/workflows/publish-rust-client.yml

@@ -31,9 +31,9 @@ env:
   CACHE: true
 
 jobs:
-  build_programs:
+  build_verify_programs:
     name: Programs
-    uses: ./.github/workflows/build-programs.yml
+    uses: ./.github/workflows/build-verify-programs.yml
     secrets: inherit
 
   build_rust_client:
@@ -43,7 +43,7 @@ jobs:
 
   test_rust_client:
     name: Rust Client
-    needs: [build_programs, build_rust_client]
+    needs: [build_verify_programs, build_rust_client]
     uses: ./.github/workflows/test-rust-client.yml
     secrets: inherit