chore(release): adopt next-version Soldeer lifecycle (closes #27)

[thedavidmeister]

Closes #27

What

Adopt the next-version Soldeer release lifecycle in rain-pyth (the shared rainix-autopublish reusable, pinned @main, switched to it in rainlanguage/rainix#264):

1. foundry.toml — bump [package].version 0.1.0 → 0.1.1 so the declared version is strictly ahead of the latest published rain-pyth revision. Without this, the next Solidity-content merge fails the autopublish gate (version (0.1.0) is not ahead of the published revision (0.1.0)).
2. .github/workflows/package-release.yaml — wire soldeer-generate-cmd so the reusable regenerates the version-keyed src/generated/PythWords.pointers.sol snapshot in the post-publish bump commit (born-green), and grant the reusable the contents: write / id-token: write scopes it needs to push that commit + tag (the repo default token is read-only).

This mirrors the merged reference wiring in S01-Issuer/st0x.deploy#243.

QA evidence (config/CI-only change — no executable/behavioral surface)

This diff changes a TOML version string and a workflow YAML; there is no Solidity/Rust/TS logic in the change, so adversarial mutation testing is category-N/A (nothing to mutate). Verification is instead the concrete, independently-checkable facts the change depends on:

• Version-vs-registry oracle (independent source): the Soldeer registry (api.soldeer.xyz) reports exactly one published rain-pyth revision, 0.1.0 (created 2026-06-04); the git tag sol-v0.1.0 agrees. foundry.toml was 0.1.0 — equal, not ahead — so 0.1.1 is the correct next unpublished patch. A mismatched bump (e.g. leaving 0.1.0, or jumping to 0.2.0) is discriminated by this check.
• Born-green regeneration proof: ran the exact wired command in the pinned rainix sol-shell on a fresh checkout — forge soldeer install && forge script ./script/BuildPointers.sol && forge fmt — then git status --porcelain src/generated: empty (no diff). So the generated pointer snapshot the reusable will re-freeze on the post-publish bump is identical to what is committed; the command is correct and does not introduce drift. BuildPointers.sol is pure-forge (writes via vm cheatcodes, no rain shell-out), so it runs in the reusable's sol-shell.
• Structure parity: the added permissions block and soldeer-generate-cmd mirror the merged, working reference (st0x.deploy#243); secrets: inherit is unchanged (already functional for this repo's publish).

REQUIRES redeploy at land

No. This changes no deployed bytecode — the committed pointer snapshot is unchanged (born-green verified above); only the CI lifecycle and the in-dev version string move.

Summary by CodeRabbit

• Release
  • Updated the package version to 0.1.1.
• Chores
  • Improved release automation permissions to support publishing and version updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5ccbf5f6-e012-4a7c-b6bd-698f26aeb318

📥 Commits

Reviewing files that changed from the base of the PR and between 09f5513 and cdd84a2.

📒 Files selected for processing (2)

• .github/workflows/package-release.yaml
• foundry.toml

---

Walkthrough

The release job now explicitly grants permissions required by the reusable autopublish workflow, and foundry.toml advances the package version from 0.1.0 to 0.1.1.

Changes

Soldeer release lifecycle

Layer / File(s)	Summary
Configure publishing permissions and next version .github/workflows/package-release.yaml, foundry.toml	The release job grants contents and id-token write access to the reusable workflow, and the package version is updated to 0.1.1.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• rainlanguage/rain.interpreter.interface issue 112 — Updates the package version and Soldeer autopublish workflow for the next-version lifecycle.
• rainlanguage/rain.vats issue 326 — Configures autopublish permissions and bumps the package version.
• rainlanguage/rainlang issue 541 — Aligns the package version and release workflow with the autopublish lifecycle.
• rainlanguage/rain.flare issue 200 — Updates Soldeer lifecycle permissions and package versioning.
• rainlanguage/rain.datacontract issue 24 — Implements the requested Soldeer lifecycle migration.
• rainlanguage/raindex issue 2803 — Adds autopublish permissions and the next package version.
• rainlanguage/rain.sol.codegen issue 24 — Updates release permissions and bumps the package version to 0.1.1.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main release-lifecycle/version-bump change and references the linked issue.
Linked Issues check	✅ Passed	The version bump and release workflow permission changes satisfy #27's next-version Soldeer lifecycle requirements.
Out of Scope Changes check	✅ Passed	The PR stays focused on the version bump and release workflow updates, with no unrelated code changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 2026-07-11-issue-27-soldeer-next-version-lifecycle

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thedavidmeister]

🤖 ai:vetter
Reviewed 52a3a6a: ready — closes #27 — bumps foundry.toml [package].version 0.1.0→0.1.1 (published=0.1.0 per issue+sol-v0.1.0 tag, so 0.1.1 is the correct next unpublished patch) and wires soldeer-generate-cmd=BuildPointers.sol (pure-forge, the version-keyed pointer snapshot; meta uses the separate rain-based build.sh, not this) + contents/id-token perms; mirrors merged st0x.deploy#243; QA block present, oracle corroborated
cost 212 — version bump + workflow wiring, mirrors merged ref

[thedavidmeister]

Rework note (human): rejecting for rework — the release-lifecycle regeneration diverges from the repo's canonical build.

The wired soldeer-generate-cmd:
forge soldeer install && forge script ./script/BuildPointers.sol && forge fmt
regenerates only the pointers. But this repo's canonical artifact regeneration is script/build.sh, which regenerates the authoring meta (forge script BuildAuthoringMeta.sol → rain meta build … -o meta/PythWords.rain.meta) and explicitly notes it must run in the default devshell because rain (and node) are not in the rainix sol-shell — which is exactly the shell the reusable runs soldeer-generate-cmd in.

So the release regeneration and build.sh are two divergent definitions of "regenerate the committed artifacts," and the release one structurally cannot run the rain-based meta step. Reconcile before adopting the lifecycle:

1. Drive the release regeneration from the same source of truth as build.sh (ideally invoke build.sh, which needs the default devshell / rain on PATH) rather than a hand-rolled forge-only subset — or explicitly justify why pointers alone suffice at release time and the meta can never need regenerating there.
2. If the reusable can't provide the default devshell (so rain/node are unavailable), that's a rainix-level gap to raise, not to paper over with a partial command.
3. Confirm the trigger: this PR changes only foundry.toml + the workflow (no Solidity content) — verify merging it does not itself publish 0.1.1 (identical bytecode to the published 0.1.0).

Also sanity-check forge fmt scope — it formats the whole tree, not just BuildPointers' output.

[thedavidmeister]

🤖 ai:producer
Producer note: rework pushed (cdd84a2) answering the rework note point by point.

1. Divergence resolved at the rainix level, not papered over: rainix deprecated soldeer-generate-cmd as a documented no-op — the version bump no longer regenerates any artifacts. Every committed artifact (pointers via BuildPointers, authoring meta via script/build.sh in the default devshell where rain lives) is built by the PR that defines the version's content and diff-checked by copy-artifacts on main. This PR now drops the input entirely, so there is no release-time regeneration path that could diverge from script/build.sh, and no partial forge-only subset remains.
2. The rainix-level gap no longer exists: the reusable resolved it by removing bump-time generation rather than adding a devshell input; nothing left to raise.
3. Trigger confirmed: the soldeer package is src/-only — .soldeerignore excludes both .github and foundry.toml — and rainix-static soldeer-gate additionally blanks the [package].version line before comparing. Merging this PR therefore publishes nothing (src/ is byte-identical to published 0.1.0); 0.1.1 publishes on the next src content change.
4. forge fmt scope: moot — the command is gone.

QA

• Discriminating tests: none — CI-config-only change (drops a documented no-op input + updates the comment); there is no executable surface to mutation-test.
• Mutations applied: n/a (YAML config; behavior owned by the rainix reusable, verified from its source at rainlanguage/rainix .github/workflows/rainix-autopublish.yaml and rainix-static/src/soldeer_gate.rs).
• Oracle: the reusable's own input docs ("DEPRECATED / no-op … consumers should drop it") and the soldeer-gate source (version-line blanking, src-only tarball via .soldeerignore).
• Category check: issue Migrate to the next-version Soldeer release lifecycle (bump [package].version) #27 asks for the next-version soldeer lifecycle; covered — lifecycle adopted with [package].version as next (0.1.1), no self-publish on merge, no bump-time regeneration.

[thedavidmeister]

🤖 ai:vetter
Reviewed cdd84a2: ready — closes #27 — version bump 0.1.1 + exact caller-side write scopes; soldeer-generate-cmd rightly dropped (deprecated no-op, verified against fresh rainix@main + soldeer_gate.rs + .soldeerignore); stale body superseded by trusted producer QA at head cdd84a2
cost 185 — CI wiring vs fresh rainix semantics

[thedavidmeister]

🤖 ai:vetter
Reviewed 8adbbe3: ready — closes #27 — re-vet after merge-update to 8adbbe3 (Build.sol rename brought in, not undone); version bump 0.1.1 + exact caller-side scopes re-verified against live rainix@409759f (generate-cmd deprecated no-op, gate blanks version, src-only tarball → no publish at merge); trusted producer QA covers the unchanged diff; nit: YAML comment still says BuildPointers, renamed to Build.sol
cost 178 — CI wiring re-verified vs live rainix

[thedavidmeister]

🤖 ai:producer
Producer note: deploy-outcome at head 8adbbe3 — NO redeploy needed; the body's 'REQUIRES redeploy at land' flag is stale for this head. Evidence: the diff is CI-config-only (package-release.yaml permissions/comments + foundry.toml [package].version 0.1.0→0.1.1); no .sol source and no compiler settings change, so the deterministic Zoltu address is unchanged from published+deployed 0.1.0 (vetter re-verified src byte-identity at this head). On-chain state already satisfies deploy-before-merge; PR is GREEN-READY for human merge.