From f96d904d2d413aa255e404c94704334f16c8588c Mon Sep 17 00:00:00 2001 From: Giovanny Amador <219895655+Eras256@users.noreply.github.com> Date: Mon, 9 Nov 2026 12:50:02 -0600 Subject: [PATCH] fix(ci): verified vault build needs stellar-cli 25.2.0+ The first nirium-vault-v0.1.0 run failed: soroban-sdk 29 refuses to build with stellar-cli 25.1.0, which the pinned v25.1.0 workflow uses. Pin the workflow main commit 6b16426 instead (stellar-cli 28.1.0). The only other change upstream since v25.1.0 is actions/checkout v4 to v6. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release-nirium-vault.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release-nirium-vault.yml b/.github/workflows/release-nirium-vault.yml index d2b8348..7b6acca 100644 --- a/.github/workflows/release-nirium-vault.yml +++ b/.github/workflows/release-nirium-vault.yml @@ -11,11 +11,14 @@ # Tag prefix is `nirium-vault-v`, not `v`: release.yml (desktop app) already # runs on every `v*` tag, and "vault-v1" would match it too. # -# Pinned to the commit of release v25.1.0 (published 2026-03-09), reviewed on -# 2026-11-08: it checks out the tagged commit, builds from source with +# Pinned to commit 6b16426 of the workflow main branch (2026-10-04, stellar-cli +# 28.1.0), reviewed on 2026-11-09. The v25.1.0 release (2026-03-09) cannot build +# this package: soroban-sdk 29 requires stellar-cli 25.2.0 or newer, and the first +# tag run failed on exactly that. The only changes since v25.1.0 are the CLI +# version and actions/checkout v4 to v6. It checks out the tagged commit, builds from source with # `stellar contract build --optimize`, and attests the same file it uploads. -# The pin freezes release.yml only. The actions it calls (actions/checkout@v4, -# stellar/stellar-cli@v25.1.0, actions/attest-build-provenance@v1) resolve their +# The pin freezes release.yml only. The actions it calls (actions/checkout@v6, +# stellar/stellar-cli@v28.1.0, actions/attest-build-provenance@v1) resolve their # own tags at run time; fork the workflow if that residual risk is unacceptable. name: Build and Release NiriumVault @@ -30,7 +33,7 @@ permissions: # inherited by the called workflow, which cannot elevate jobs: release: - uses: stellar-expert/soroban-build-workflow/.github/workflows/release.yml@e43b241f114bcf02151c30d61088506c6ad3ae0b # v25.1.0 + uses: stellar-expert/soroban-build-workflow/.github/workflows/release.yml@6b16426dd3a61715ddddf83a2df322a6371fe071 # main, stellar-cli 28.1.0 with: release_name: ${{ github.ref_name }} package: nirium-contracts