Fix CI: install stellar-cli from pinned release binary#6
Merged
Conversation
stellar-cli 26.1.0 declares rust-version 1.93.0, so 'cargo install' fails under the repo's pinned rustc 1.91.1 — every CI run died at the install step. Bumping rustc instead would risk changing contract codegen and invalidating the fixture WASM hash in docker/toolchain-manifest.json. Install the official v26.1.0 release tarball (SHA-256 verified) in both CI and the reproducible-build Docker image. The compiler that built the CLI binary has no effect on the contract WASM; 'stellar contract build' shells out to the pinned cargo/rustc on PATH. Verified locally: cargo test passes and the rebuilt WASM hash matches the on-chain fixture (6fe7bd58e5a33dc27daefc74acfae6eb70f101fdbde860475cf18fde87288e4b).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Every CI run fails at the Install stellar-cli (pinned) step of the contract job:
The repo pins rustc 1.91.1 (
.tool-versions, CI, Docker image) and stellar-cli 26.1.0, but that pair cannot coexist undercargo install: the stellar-cli 26.1.0 crate declaresrust-version = 1.93.0, so the pinned compiler refuses to build it.Why not bump Rust?
The rustc version is the codegen-relevant pin: the on-chain fixture hash in
docker/toolchain-manifest.json(6fe7bd58…e4b) was derived with 1.91.1, and the whole reproducible-build story depends on rebuilding with exactly that toolchain. Bumping to 1.93 could change the emitted WASM and break source↔WASM matching against the deployed fixture.The compiler needed to build the CLI itself is a separate concern — the CLI binary's own compiler has no effect on contract codegen, since
stellar contract buildshells out to the cargo/rustc on PATH.Fix
Install stellar-cli 26.1.0 from the official prebuilt release tarball, pinned by version and SHA-256, instead of compiling it from crates.io:
.github/workflows/ci.yml): download + checksum-verify the x86_64 linux tarball. Side benefit: seconds instead of a multi-minute compile.docker/Dockerfile): same latent bug —FROM rust:1.91.1-bookworm+cargo installwould fail identically atdocker build. Now arch-aware (amd64/arm64) with per-arch pinned digests.Verification
Locally with the pinned rustc 1.91.1:
cargo test --locked→ 3/3 passstellar contract build --locked→ WASM SHA-2566fe7bd58e5a33dc27daefc74acfae6eb70f101fdbde860475cf18fde87288e4b, exactly matching the on-chain fixture hash intoolchain-manifest.json— confirming 1.91.1 is the correct pin to preserve.