[GabrielePicco]

Adds an optional ref input to Propose Program Upgrade so a release tag, commit SHA or branch of the program can be proposed without first switching the ref the workflow runs from. Same change as magicblock-labs/ephemeral-spl-token#159.

Default (input empty): unchanged. actions/checkout treats an empty ref as unset and checks out the commit the run was dispatched on, exactly as today.

With ref set: the checkout uses it. The shared Squads action builds that worktree and records git rev-parse HEAD, so the buffer, the otter-verify PDA and the job summary all reflect the chosen ref. SHAs must be the full 40 characters; actions/checkout rejects short ones.

Run it from the Actions UI, or:

gh workflow run propose-program-upgrade.yml -f cluster=devnet -f dry_run=true -f ref=<sha|tag|branch>

Notes

• The environment's deployment-branch rule still gates the ref the run is dispatched on, not ref. Approvers keep checking the commit shown in the job summary.
• The shared action needs no change at the pinned commit: it never resolves a ref itself, and its only use of github.sha is the proposal-name default, which this workflow overrides.

Summary by CodeRabbit

• New Features

  • Manual program upgrade runs can now use a chosen commit SHA, release tag, or branch as the build source. The input is optional; when left blank, the workflow uses its default source.

• Documentation

  • Updated upgrade instructions to explain how to select a source reference.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T08:58:47.149552Z	b5792ca	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The upgrade workflow adds an optional ref input for a commit SHA, release tag, or branch. The checkout step uses the selected ref. The README describes these supported source types.

Suggested reviewers: snawaz

Merge Risk: Minimal · up to b5792

No actionable merge-blocking issue is identified. The optional source selection and its documentation are consistent; normal checks should complete before merging.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: magicblock-labs/delegation-program
• Branch: dlp-v2
• File: .coderabbit.yaml
• Commit: 41e3d1d
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e20ff7fd-4efd-4a9c-bddc-111cc461dacf

Commits

Reviewing files that changed from the base of the PR and between 41e3d1d and b5792ca.

Files selected for processing: 2

• .github/workflows/propose-program-upgrade.yml
• README.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[chatgpt-codex-connector]

💡 Codex Review

delegation-program/program/src/processor/fraud_proofs/challenger_reveal.rs

Lines 178 to 180 in b5792ca

	if reopen_pending {
	pending.active_challenge_mut()?.set(None)?;
	pending.resolved_state_source_mut()?.set(None)?;

Preserve an approval opportunity after reopening a commitment

If a challenger raises a challenge before the selected verifier approves, then reveals matching state after the original challenge window ends but before the reveal deadline, this reopens a commitment that can never finalize. ApproveCommitment rejects non-active commitments during the challenge and rejects approvals after challenge_window_end_slot afterward; FinalizeCommitment still requires approval. Thus a challenger can permanently block further commits for the account even by completing a matching reveal and paying only the matching-state penalty. Preserve an approval opportunity when reopening, or allow approvals while the challenge is pending.

---

delegation-program/program/src/processor/fraud_proofs/finalize_commitment.rs

Line 231 in b5792ca

delegated_account.resize(raw_state.len())?;

Handle account growth beyond the per-instruction resize limit

When the committed payload exceeds the delegated account's current data length by more than 10,240 bytes, this single resize fails under Solana's account-growth limit. WriteStateBuffer explicitly supports larger uploads through incremental growth, and ProposeCommitment accepts those finalized buffers, but finalization has no corresponding staged-growth path. Consequently, an otherwise valid approved commitment can become impossible to finalize and block subsequent commit IDs. Provide a staged allocation path or reject unsupported growth before accepting the commitment.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".