Skip to content

Moving env vars to org #233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Moving env vars to org #233

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
38aa8d5
Moving env vars to org
blockiosaurus Jun 10, 2025
bc7b20e
Removing from .env
blockiosaurus Jun 10, 2025
87b2198
Fixing missing export
blockiosaurus Jun 10, 2025
0f6adf4
Adding more env vars
blockiosaurus Jun 11, 2025
1f379df
Always run tests on Dependabot PRs
blockiosaurus Jun 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions .github/.env
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,4 @@
CARGO_TERM_COLOR=always
NODE_VERSION=20.x
PROGRAMS=["mpl-core"]
RUST_VERSION=1.79.0
SOLANA_VERSION=1.18.19
COMMIT_USER_NAME=github-actions
[email protected]
DEPLOY_SOLANA_VERSION=1.18.19
5 changes: 5 additions & 0 deletions .github/workflows/benchmark-summary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,11 @@ jobs:
with:
ref: ${{ inputs.git_ref }}

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down
5 changes: 5 additions & 0 deletions .github/workflows/benchmark.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,11 @@ jobs:
- name: Git checkout
uses: actions/checkout@v4

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

Comment on lines +25 to +29
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Standardize exporting repository-level vars
The new “Export GitHub vars to GITHUB_ENV” step correctly surfaces NODE_VERSION and SOLANA_VERSION for downstream steps. As this pattern is repeated across multiple workflows, consider extracting it into a reusable composite action or workflow call to reduce duplication and ease future updates.

🤖 Prompt for AI Agents 
In .github/workflows/benchmark.yml around lines 25 to 29, the step exporting
NODE_VERSION and SOLANA_VERSION to GITHUB_ENV is duplicated in multiple
workflows. Refactor by extracting this export logic into a reusable composite
action or a separate workflow that can be called from other workflows. Replace
the inline export commands with a call to this reusable component to reduce
duplication and simplify future maintenance.

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down
8 changes: 7 additions & 1 deletion .github/workflows/build-programs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,12 @@ jobs:
with:
ref: ${{ inputs.git_ref }}

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "RUST_VERSION=${{ vars.RUST_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

Comment on lines +38 to +43
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Validate exports order and avoid duplicates.

You’ve correctly added a step to source repo-level vars into GITHUB_ENV. Please confirm that .github/.env no longer defines NODE_VERSION, RUST_VERSION, or SOLANA_VERSION, otherwise the subsequent cat .env will override these exports. Optionally, fail fast if any of these vars.* are unset to catch missing org variables early.

🏁 Script executed:

#!/bin/bash
# Check if .github/.env exists and whether it defines the versions in question
if [ -f .github/.env ]; then
  echo "Scanning .github/.env for version definitions..."
  rg -n '^(NODE_VERSION|RUST_VERSION|SOLANA_VERSION)=' .github/.env || echo "✔ No matching definitions found in .github/.env"
else
  echo "✔ .github/.env does not exist"
fi

# Verify if any workflow step later re-cats .env into GITHUB_ENV
echo "Searching workflows for any 'cat .env' usage..."
rg -n 'cat .*\.env' .github/workflows || echo "✔ No 'cat .env' steps found in workflows"

Length of output: 1583

Validate exports order and avoid duplicates

The .github/.env file still defines RUST_VERSION and SOLANA_VERSION, and the cat .github/.env >> $GITHUB_ENV step at line 45 of build-programs.yml will override the repo-level vars.* exports. To fix:

  • Remove RUST_VERSION and SOLANA_VERSION from .github/.env.

  • In .github/workflows/build-programs.yml (line 45), either remove the cat .github/.env >> $GITHUB_ENV step or move it before the echo "…vars.*" exports.

  • Optionally add a fail-fast check for unset variables, e.g.:

    run: |
  set -u
  : "${{ vars.NODE_VERSION:?NODE_VERSION is not set}}"
  : "${{ vars.RUST_VERSION:?RUST_VERSION is not set}}"
  : "${{ vars.SOLANA_VERSION:?SOLANA_VERSION is not set}}"
  echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
  …
🤖 Prompt for AI Agents 
In .github/workflows/build-programs.yml around lines 38 to 43, the environment
variables RUST_VERSION and SOLANA_VERSION are still defined in .github/.env,
causing the later step at line 45 that cats .github/.env into GITHUB_ENV to
override the repo-level vars exports. To fix this, remove RUST_VERSION and
SOLANA_VERSION definitions from .github/.env, then either delete the cat
.github/.env >> $GITHUB_ENV step at line 45 or move it before the echo commands
that export vars.*. Additionally, add a fail-fast check before exporting to
ensure NODE_VERSION, RUST_VERSION, and SOLANA_VERSION are set in vars, using
shell parameter expansion with set -u to catch missing variables early.

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down Expand Up @@ -70,7 +76,7 @@ jobs:
fi
SANITIZED=${REF//\//-}
echo "sanitized=$SANITIZED" >> "$GITHUB_OUTPUT"

- name: Upload program builds
uses: actions/upload-artifact@v4
with:
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/build-rust-client.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,12 @@ jobs:
with:
ref: ${{ inputs.git_ref }}

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "RUST_VERSION=${{ vars.RUST_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down
43 changes: 24 additions & 19 deletions .github/workflows/deploy-program.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,22 +39,22 @@

jobs:
check_tag:
name: 'Check tag'
name: "Check tag"
runs-on: ubuntu-latest
outputs:
program: ${{ steps.set_program.outputs.program }}
type: ${{ steps.set_program.outputs.type }}
steps:
- name: Check tag
id: set_program
run: |
echo program="core" >> $GITHUB_OUTPUT
if [[ "${{ inputs.git_ref }}" =~ ^release/core@* ]]; then
echo type="release" >> $GITHUB_OUTPUT
else
echo type="ref" >> $GITHUB_OUTPUT
fi
- name: Check tag
id: set_program
run: |
echo program="core" >> $GITHUB_OUTPUT
if [[ "${{ inputs.git_ref }}" =~ ^release/core@* ]]; then
echo type="release" >> $GITHUB_OUTPUT
else
echo type="ref" >> $GITHUB_OUTPUT
fi
build_programs:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
name: Programs
uses: ./.github/workflows/build-programs.yml
secrets: inherit
Expand Down Expand Up @@ -109,6 +109,12 @@
token: ${{ secrets.SVC_TOKEN }}
ref: ${{ inputs.git_ref }}

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "RUST_VERSION=${{ vars.RUST_VERSION }}" >> $GITHUB_ENV
echo "DEPLOY_SOLANA_VERSION=${{ vars.DEPLOY_SOLANA_VERSION }}" >> $GITHUB_ENV

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down Expand Up @@ -152,7 +158,7 @@
run: |
echo PROGRAM_NAME="mpl_core" >> $GITHUB_ENV
echo ${{ secrets.CORE_ID }} > ./program-id.json

if [[ "${{ inputs.cluster }}" == "sonic"* ]]; then
echo ${{ secrets.CORE_SONIC_DEPLOY_KEY }} > ./deployer-key.json
echo DEPLOY_TYPE="direct" >> $GITHUB_ENV
Expand All @@ -172,7 +178,7 @@
else
echo "Invalid cluster: ${{ inputs.cluster }}"
exit 1
fi
fi

- name: Sanitize Ref
id: sanitize
Expand All @@ -190,7 +196,7 @@
if: needs.check_tag.outputs.type == 'ref'
with:
name: program-builds-${{ steps.sanitize.outputs.sanitized }}

- name: Download release asset
uses: actions/github-script@v5
id: get_release
Expand All @@ -206,11 +212,11 @@
repo: context.repo.repo,
tag: tag
});

if (release.status !== 200) {
throw new Error(`Failed to fetch release for tag ${tag}`);
}

const asset = release.data.assets.find(asset => asset.name === assetName);
if (!asset) {
throw new Error(`Asset ${assetName} not found in release tagged ${tag}`);
Expand Down Expand Up @@ -259,20 +265,19 @@
rm ./submitter-key.json

echo "BUFFER=$BUFFER" >> $GITHUB_ENV


- name: Create Squads proposal
if: github.event.inputs.dry_run == 'false' && env.DEPLOY_TYPE == 'squads'
uses: metaplex-foundation/squads-program-upgrade@main
with:
network-url: ${{ env.RPC }}
program-multisig: ${{ env.SQUADS_MULTISIG }}
program-id: 'CoREENxT6tW1HoK8ypY1SxRMZTcVPm7R94rH4PZNhX7d'
program-id: "CoREENxT6tW1HoK8ypY1SxRMZTcVPm7R94rH4PZNhX7d"
program-index: ${{ env.SQUADS_PROGRAM_INDEX }}
buffer: ${{ env.BUFFER }}
spill-address: 'botTxAkJhuCtNNn9xsH8fHJjzTkcN6XD4dR3R5hkzV2'
spill-address: "botTxAkJhuCtNNn9xsH8fHJjzTkcN6XD4dR3R5hkzV2"
authority: ${{ env.SQUADS_VAULT }}
Comment on lines +275 to 279
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Parameterize static values; consider centralizing addresses.

Using env.SQUADS_MULTISIG, env.BUFFER, and a hardcoded spill-address is fine, but extracting the static spill address into a repo variable or secret could simplify updates if it ever changes.

🤖 Prompt for AI Agents 
In .github/workflows/deploy-program.yml around lines 275 to 279, the hardcoded
spill-address value should be parameterized by moving it to a centralized
repository variable or secret. Replace the static spill-address string with a
reference to this new environment variable to make future updates easier and
maintain consistency across the codebase.

name: 'Deploy ${{ inputs.git_ref }}'
name: "Deploy ${{ inputs.git_ref }}"
keypair: ${{ secrets.SQUADS_BOT_KEY }}

- name: Create env tag
Expand Down
17 changes: 13 additions & 4 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,21 @@ jobs:
name: Detect changes
runs-on: ubuntu-latest
outputs:
any: ${{ steps.changes.outputs.any }}
programs: ${{ steps.changes.outputs.programs }}
any: ${{ steps.changes.outputs.any || github.actor == 'dependabot[bot]' }}
programs: ${{ steps.changes.outputs.programs || github.actor == 'dependabot[bot]' }}
program_matrix: ${{ steps.program_matrix.outputs.matrix }}
js_client: ${{ steps.changes.outputs.js_client }}
rust_client: ${{ steps.changes.outputs.rust_client }}
js_client: ${{ steps.changes.outputs.js_client || github.actor == 'dependabot[bot]' }}
rust_client: ${{ steps.changes.outputs.rust_client || github.actor == 'dependabot[bot]' }}
Comment on lines +17 to +21
Copy link

@coderabbitai coderabbitai bot Jun 11, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Logical error: Dependabot override never applied due to string truthiness
Using steps.changes.outputs.any || github.actor == 'dependabot[bot]' always returns the non-empty string output (even when it’s "false"), so Dependabot runs won’t be forced to true.

Consider switching to a boolean comparison, for example:

any: ${{ steps.changes.outputs.any == 'true' || github.actor == 'dependabot[bot]' }}
programs: ${{ steps.changes.outputs.programs == 'true' || github.actor == 'dependabot[bot]' }}
js_client: ${{ steps.changes.outputs.js_client == 'true' || github.actor == 'dependabot[bot]' }}
rust_client: ${{ steps.changes.outputs.rust_client == 'true' || github.actor == 'dependabot[bot]' }}

Ensure your downstream if: needs.changes.outputs.* == 'true' checks still align with this boolean logic.

🤖 Prompt for AI Agents 
In .github/workflows/main.yml around lines 17 to 21, the current use of logical
OR with string outputs like steps.changes.outputs.any || github.actor ==
'dependabot[bot]' always evaluates to the string value, causing Dependabot
overrides to never apply correctly. Fix this by explicitly comparing the output
strings to 'true' using equality checks (e.g., steps.changes.outputs.any ==
'true' || github.actor == 'dependabot[bot]') to ensure proper boolean logic.
Also verify that any downstream conditional checks using these outputs remain
consistent with this boolean comparison approach.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pinging on this @blockiosaurus if you had looked into this or can be resolved

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!

steps:
- name: Git checkout
uses: actions/checkout@v4

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "RUST_VERSION=${{ vars.RUST_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

Comment on lines +26 to +31
Copy link

@coderabbitai coderabbitai bot Jun 11, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Ensure .env won’t override your exports.

You’ve exported NODE_VERSION, RUST_VERSION, and SOLANA_VERSION from repo vars. Verify that .github/.env no longer redeclares these keys—otherwise your values will be shadowed. Consider erroring out if any vars.* is empty to avoid silent misconfigurations.

🏁 Script executed:

#!/bin/bash
echo "Checking for .github/.env file..."
if [ -f .github/.env ]; then
  echo "Found .github/.env; checking for redeclaration of vars:"
  grep -E '^(NODE_VERSION|RUST_VERSION|SOLANA_VERSION)=' .github/.env || echo "No NODE_VERSION, RUST_VERSION or SOLANA_VERSION lines found."
else
  echo ".github/.env file not found."
fi

Length of output: 336

Remove conflicting .github/.env entries

I noticed that .github/.env still redeclares two of your workflow vars, which will override the values you export in main.yml:

  • File: .github/.env
    • Lines containing RUST_VERSION=1.79.0 and SOLANA_VERSION=1.18.19

To fix this:

• Remove or rename these entries in .github/.env, so your workflow’s
echo "…${{ vars.* }}" >> $GITHUB_ENV lines take effect.
• (Optional) Add a validation step in your workflow to fail early if any of the repo vars is empty:

- name: Validate required vars
  run: |
    for var in NODE_VERSION RUST_VERSION SOLANA_VERSION; do
      if [ -z "${{ vars[$var] }}" ]; then
        echo "Error: $var is not set" >&2
        exit 1
      fi
    done

This prevents silent misconfiguration and ensures your exports aren’t inadvertently shadowed.

🤖 Prompt for AI Agents 
In .github/workflows/main.yml around lines 26 to 31, the environment variables
NODE_VERSION, RUST_VERSION, and SOLANA_VERSION are exported from repo vars, but
the .github/.env file still redeclares RUST_VERSION and SOLANA_VERSION, causing
conflicts and shadowing. To fix this, remove or rename the RUST_VERSION and
SOLANA_VERSION entries in .github/.env so the exported values from the workflow
take effect. Additionally, add a validation step in the workflow to check if any
of these vars are empty and fail early with an error message to prevent silent
misconfigurations.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shadowing by setting an overriding value in the repo .env file is the intended behavior

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@blockiosaurus Got it—thanks for clarifying. I’ll keep in mind that the values in .github/.env are meant to take precedence over the repository-level variables, so no changes are needed here. Let me know if you’d like any further tweaks.

✏️ Learnings added 
Learnt from: blockiosaurus
PR: metaplex-foundation/mpl-core#233
File: .github/workflows/main.yml:26-31
Timestamp: 2025-06-11T15:08:45.869Z
Learning: In this repository, the `.github/.env` file is intentionally allowed to override environment variables that are first exported from GitHub repository-level variables in workflows.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down Expand Up @@ -65,6 +71,9 @@ jobs:
- name: Git checkout
uses: actions/checkout@v4

- name: Export GitHub vars to GITHUB_ENV
run: echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV

Comment on lines +74 to +76
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Missing Rust/Solana version exports in Generate clients job
The generate_clients job only echoes NODE_VERSION but later installs Rust and Solana using env.RUST_VERSION and env.SOLANA_VERSION. Add those exports here:

-      - name: Export GitHub vars to GITHUB_ENV
-        run: echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
+      - name: Export GitHub vars to GITHUB_ENV
+        run: |
+          echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
+          echo "RUST_VERSION=${{ vars.RUST_VERSION }}" >> $GITHUB_ENV
+          echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Export GitHub vars to GITHUB_ENV
run: echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "RUST_VERSION=${{ vars.RUST_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV
🤖 Prompt for AI Agents 
In .github/workflows/main.yml around lines 74 to 76, the generate_clients job
exports only NODE_VERSION to GITHUB_ENV but uses RUST_VERSION and SOLANA_VERSION
later. Add echo commands to export RUST_VERSION and SOLANA_VERSION to GITHUB_ENV
alongside NODE_VERSION to ensure these environment variables are available
during the job execution.

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/publish-js-client.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,9 @@ jobs:
- name: Git checkout
uses: actions/checkout@v4

- name: Export GitHub vars to GITHUB_ENV
run: echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down Expand Up @@ -117,6 +120,9 @@ jobs:
with:
ref: ${{ github.ref }}

- name: Export GitHub vars to GITHUB_ENV
run: echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down
9 changes: 7 additions & 2 deletions .github/workflows/publish-rust-client.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,11 @@ jobs:
- name: Git checkout
uses: actions/checkout@v4

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "RUST_VERSION=${{ vars.RUST_VERSION }}" >> $GITHUB_ENV

Comment on lines +60 to +64
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Validate exports order and avoid overrides.

This step correctly pulls NODE_VERSION and RUST_VERSION from repo vars. Confirm .github/.env no longer includes these keys so your exports persist. Optionally, add a guard to fail if any vars.* is missing.

#!/bin/bash
# Check for existence of .github/.env and search for NODE_VERSION and RUST_VERSION
if [ -f .github/.env ]; then
  echo "Found .github/.env"
  grep -n "NODE_VERSION" .github/.env || echo "NODE_VERSION not found in .github/.env"
  grep -n "RUST_VERSION" .github/.env || echo "RUST_VERSION not found in .github/.env"
else
  echo ".github/.env not found"
fi
#!/bin/bash
# List top-level files in .github/
echo "=== .github directory contents ==="
find .github -maxdepth 1 -type f -print

# Search for any .env files in .github and project root
echo -e "\n=== .env files found ==="
find .github . -type f \( -name ".env" -o -name "*.env" \) -print

# Inspect each .env file for NODE_VERSION and RUST_VERSION
echo -e "\n=== Checking for NODE_VERSION and RUST_VERSION in .env files ==="
while IFS= read -r file; do
  echo "---- $file ----"
  grep -nE "NODE_VERSION|RUST_VERSION" "$file" && echo || echo "No matches in $file"
done < <(find .github . -type f \( -name ".env" -o -name "*.env" \))

🏁 Script executed:

#!/bin/bash
set -e

# Check for .github/.env overrides
echo "==> Checking .github/.env"
if [[ -f .github/.env ]]; then
  echo ".github/.env found"
  grep -En "^(NODE_VERSION|RUST_VERSION)=" .github/.env || echo "No NODE_VERSION or RUST_VERSION entries in .github/.env"
else
  echo ".github/.env not found"
fi

# Search for other .env files in repo
echo -e "\n==> Searching for other .env files"
find . -maxdepth 2 -type f \( -name ".env" -o -name "*.env" \) | while read -r file; do
  echo "Inspecting $file"
  grep -En "^(NODE_VERSION|RUST_VERSION)=" "$file" || echo "  No NODE_VERSION or RUST_VERSION in $file"
done

Length of output: 539

Remove version overrides from .github/.env to prevent conflicts

The .github/.env file still contains an entry for RUST_VERSION (line 2), which will override the value you’re exporting. Please:

  • Delete any NODE_VERSION= and RUST_VERSION= lines from .github/.env
  • Optionally, add a guard in your workflow to fail early if either var is unset:
- name: Export GitHub vars to GITHUB_ENV
  run: |
    for v in NODE_VERSION RUST_VERSION; do
      if [ -z "${{ vars[$v] }}" ]; then
        echo "ERROR: $v is undefined" >&2
        exit 1
      fi
    done
    echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
    echo "RUST_VERSION=${{ vars.RUST_VERSION }}" >> $GITHUB_ENV
🤖 Prompt for AI Agents 
In .github/workflows/publish-rust-client.yml around lines 60 to 64, the
.github/.env file still contains NODE_VERSION and RUST_VERSION entries that
override the exported GitHub vars. Remove any lines defining NODE_VERSION= or
RUST_VERSION= from .github/.env to prevent conflicts. Additionally, update the
workflow step to include a guard that checks if these vars are set and fails
early with an error message if either is missing before exporting them to
GITHUB_ENV.

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand All @@ -81,8 +86,8 @@ jobs:

if [ "${{ inputs.dry_run }}" == "false" ]; then
OPTIONS="--no-push --no-tag --no-confirm --execute"
git config user.name ${{ env.COMMIT_USER_NAME }}
git config user.email ${{ env.COMMIT_USER_EMAIL }}
git config user.name ${{ vars.COMMIT_USER_NAME }}
git config user.email ${{ vars.COMMIT_USER_EMAIL }}
fi
Comment on lines +89 to 91
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Quote Git config values to handle spaces.

Wrap the user name/email expansions in quotes to avoid splitting on spaces:

- git config user.name ${{ vars.COMMIT_USER_NAME }}
+ git config user.name "${{ vars.COMMIT_USER_NAME }}"
- git config user.email ${{ vars.COMMIT_USER_EMAIL }}
+ git config user.email "${{ vars.COMMIT_USER_EMAIL }}"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
git config user.name ${{ vars.COMMIT_USER_NAME }}
git config user.email ${{ vars.COMMIT_USER_EMAIL }}
fi
git config user.name "${{ vars.COMMIT_USER_NAME }}"
git config user.email "${{ vars.COMMIT_USER_EMAIL }}"
fi
🤖 Prompt for AI Agents 
In .github/workflows/publish-rust-client.yml around lines 89 to 91, the git
config commands for user.name and user.email do not quote the variable
expansions, which can cause issues if the values contain spaces. Fix this by
wrapping the variable expansions ${{ vars.COMMIT_USER_NAME }} and ${{
vars.COMMIT_USER_EMAIL }} in double quotes to ensure the entire value is treated
as a single argument.


echo "Cargo logging in"
Expand Down
12 changes: 11 additions & 1 deletion .github/workflows/test-js-client.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,18 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
node: ["20.x", "22.x"]
node: ["${{ vars.NEXT_VERSION }}", "${{ vars.NEXT_VERSION_NEXT }}"]
steps:
- name: Git checkout
uses: actions/checkout@v4
with:
ref: ${{ inputs.git_ref }}

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

Comment on lines +25 to +29
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Avoid .env shadowing of Solana.

You export SOLANA_VERSION here before loading .env. Confirm that .env no longer defines SOLANA_VERSION (or else this export will be overridden). Consider failing on an unset vars.SOLANA_VERSION.

🏁 Script executed:

#!/bin/bash
# Search for explicit .env usage in the workflow
rg -n ".env" -A3 .github/workflows/test-js-client.yml || echo "No .env references in test-js-client.yml"

# List any .env files in the repo root
find . -maxdepth 2 -type f -name ".env*" -print

# Check for SOLANA_VERSION in any .env files
grep -H "SOLANA_VERSION" .env* || echo "No SOLANA_VERSION definitions found in .env files"

Length of output: 1255

🏁 Script executed:

#!/bin/bash
# Check for SOLANA_VERSION definition in the GitHub Actions .env file
grep -n "SOLANA_VERSION" .github/.env || echo "No SOLANA_VERSION definitions found in .github/.env"

Length of output: 94

Prevent .env from overriding SOLANA_VERSION

The .github/.env file still defines SOLANA_VERSION, which will override the earlier export. You’ll need to either remove that entry or adjust the workflow so that your vars.SOLANA_VERSION export takes precedence (and fail fast if it’s unset).

• In .github/.env – remove or rename the SOLANA_VERSION=… line.
• In .github/workflows/test-js-client.yml – move the “Export GitHub vars” step to after you load .env, or vice versa:

  - name: Export GitHub vars to GITHUB_ENV
    run: |
      echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
-       echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

  - name: Load environment variables
    run: cat .github/.env >> $GITHUB_ENV

+   - name: Export Solana version
+     run: |
+       : "${{ vars.SOLANA_VERSION }:?vars.SOLANA_VERSION is required}"
+       echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

This ensures your declared vars.SOLANA_VERSION isn’t silently overridden and the workflow fails if it’s missing.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV
- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
- name: Load environment variables
run: |
cat .github/.env >> $GITHUB_ENV
- name: Export Solana version
run: |
: "${{ vars.SOLANA_VERSION }:?vars.SOLANA_VERSION is required}"
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV
🤖 Prompt for AI Agents 
In .github/workflows/test-js-client.yml around lines 25 to 29, the workflow
exports SOLANA_VERSION from vars before loading the .env file, but .github/.env
still defines SOLANA_VERSION which overrides this export. To fix this, either
remove or rename the SOLANA_VERSION entry in .github/.env, or adjust the
workflow to export SOLANA_VERSION after loading .env, and add a check to fail
the workflow if vars.SOLANA_VERSION is unset to prevent silent overrides.

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down Expand Up @@ -66,6 +71,11 @@ jobs:
- name: Git checkout
uses: actions/checkout@v4

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

Comment on lines +74 to +78
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Avoid .env shadowing in lint job.

Same as above: you export SOLANA_VERSION then cat .env. Verify .env doesn’t accidentally redefine it.

🏁 Script executed:

#!/bin/bash
# Locate any usage of .env in the test-js-client workflow
grep -R "cat .*\.env" -n .github/workflows/test-js-client.yml

# Confirm where SOLANA_VERSION is exported
grep -R "SOLANA_VERSION" -n .github/workflows/test-js-client.yml

Length of output: 425

🏁 Script executed:

#!/bin/bash
# Verify if .github/.env redefines NODE_VERSION or SOLANA_VERSION
grep -En '^(NODE_VERSION|SOLANA_VERSION)=' .github/.env || echo "No redefinitions found in .env"

Length of output: 82

Prevent .env from overriding exported vars
The .github/.env file defines SOLANA_VERSION (and may define NODE_VERSION in future), which will shadow the values you explicitly export above. To avoid this, you should either import .env before exporting these vars or filter out those keys from .env.

• File: .github/workflows/test-js-client.yml
– Line 31 & Line 80: run: cat .github/.env >> $GITHUB_ENV
– Line 74–78: exporting NODE_VERSION and SOLANA_VERSION

Suggested fixes:

  • Move the cat .github/.env >> $GITHUB_ENV step so it runs before the export block.
  • Or change the .env import to exclude NODE_VERSION/SOLANA_VERSION.
  • Or re-export the correct versions after sourcing .env.
🤖 Prompt for AI Agents 
In .github/workflows/test-js-client.yml around lines 74 to 78, the exported
environment variables NODE_VERSION and SOLANA_VERSION are being overridden by
values from the .github/.env file imported later at line 80. To fix this, either
move the step that imports .github/.env to run before exporting these variables,
or modify the import command to exclude NODE_VERSION and SOLANA_VERSION from
being overwritten, or re-export NODE_VERSION and SOLANA_VERSION after importing
.env to ensure the correct values persist.

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/test-programs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,12 @@ jobs:
with:
ref: ${{ inputs.git_ref }}

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "RUST_VERSION=${{ vars.RUST_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down
8 changes: 7 additions & 1 deletion .github/workflows/test-rust-client.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,12 @@ jobs:
with:
ref: ${{ inputs.git_ref }}

- name: Export GitHub vars to GITHUB_ENV
run: |
echo "NODE_VERSION=${{ vars.NODE_VERSION }}" >> $GITHUB_ENV
echo "RUST_VERSION=${{ vars.RUST_VERSION }}" >> $GITHUB_ENV
echo "SOLANA_VERSION=${{ vars.SOLANA_VERSION }}" >> $GITHUB_ENV

- name: Load environment variables
run: cat .github/.env >> $GITHUB_ENV

Expand Down Expand Up @@ -59,4 +65,4 @@ jobs:
- name: Run tests
shell: bash
working-directory: configs/scripts/client
run: RUST_LOG=error ./test-rust.sh
run: RUST_LOG=error ./test-rust.sh