Gate autopublish on the pushed commit's own CI (rainix-static ci-gate)

.github/workflows/rainix-autopublish.yaml

@@ -50,7 +50,7 @@ on:
       SOLDEER_API_TOKEN:
         required: false
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   release:
     if: ${{ !startsWith(github.event.head_commit.message, 'Package Release') }}
@@ -72,6 +72,10 @@ jobs:
     permissions:
       id-token: write
       contents: write
+      # The commit-CI gate reads this repository's workflow runs. A caller
+      # job with an explicit `permissions:` block on its `uses:` job must
+      # include `actions: read` there; a caller with no block needs nothing.
+      actions: read
     steps:
       # This job needs a deploy-key (ssh-key) checkout, so it runs the shared
       # `checkout` composite itself with the key, then calls the nix+cachix
@@ -221,6 +225,18 @@ jobs:
             rainix-static soldeer-gate \
             --package "$SOLDEER_PACKAGE" \
             --github-output "$GITHUB_OUTPUT"
+      # Publish gate on this commit's own CI (rainlanguage/rainix#326): the
+      # caller's test workflows race this run on the same push, so nothing
+      # bumps, tags, or publishes until every other workflow run on
+      # github.sha is green (semantics: rainix-static/src/ci_gate.rs). Gated
+      # on the change outputs so a no-op push skips the wait. `nix run`, no
+      # dev shell: the wrapped binary carries its own curl + CA bundle, so
+      # all callers pay only the small rainix-static closure.
+      - name: Gate on commit CI
+        if: ${{ steps.cargo.outputs.changed == 'true' || steps.npm.outputs.changed == 'true' || steps.soldeer.outputs.changed == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: nix run github:rainlanguage/rainix/${{ env.RAINIX_SHA }}#rainix-static -- ci-gate
       # Run the test suite only when something is actually going to publish. The
       # change gates above are cheap (cargo package --no-verify + a hash compare,
       # an npm/soldeer version lookup); the full workspace test is the expensive

.github/workflows/rainix-copy-artifacts.yaml

@@ -2,7 +2,7 @@ name: rainix-copy-artifacts
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   copy-artifacts:
     runs-on: ubuntu-latest

.github/workflows/rainix-manual-sol-artifacts.yaml

@@ -85,7 +85,7 @@ on:
       CI_DEPLOY_FLARE_ETHERSCAN_API_KEY:
         required: false
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   deploy:
     runs-on: ubuntu-latest

.github/workflows/rainix-manual-sol-verify.yaml

@@ -65,7 +65,7 @@ on:
       CI_DEPLOY_FLARE_ETHERSCAN_API_KEY:
         required: false
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   verify:
     runs-on: ubuntu-latest

.github/workflows/rainix-rs-static.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-static
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   rs-static:
     runs-on: ubuntu-latest

.github/workflows/rainix-rs-test.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-test
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   rs-test:
     strategy:

.github/workflows/rainix-rs-wasm-test.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-wasm-test
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   rs-wasm-test:
     runs-on: ubuntu-latest

.github/workflows/rainix-rs-wasm.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-wasm
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   rs-wasm:
     runs-on: ubuntu-latest

.github/workflows/rainix-sol-legal.yaml

@@ -2,7 +2,7 @@ name: rainix-sol-legal
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   legal:
     runs-on: ubuntu-latest

.github/workflows/rainix-sol-static.yaml

@@ -2,7 +2,7 @@ name: rainix-sol-static
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   static:
     runs-on: ubuntu-latest

.github/workflows/rainix-sol-test.yaml

@@ -25,7 +25,7 @@ on:
       RPC_URL_SEPOLIA_FORK:
         required: false
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/rainix-subgraph-test.yaml

@@ -2,7 +2,7 @@ name: rainix-subgraph-test
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   subgraph-test:
     runs-on: ubuntu-latest

.github/workflows/rainix-tag-release.yaml

@@ -124,7 +124,7 @@ on:
       RPC_URL_SEPOLIA_FORK:
         required: false
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 64c884b9215f1391549926125de18c3a1b6330b6
 jobs:
   # The release tag must point at a commit already merged to the release branch.
   # `on: push: tags` fires for ANY tag, including one cut from an unmerged branch;

flake.nix

@@ -521,14 +521,22 @@
             # (instead of nix-store interpolation) keeps rust-toolchain out
             # of the hook's nix closure, so consumers of sol-shell — which
             # have no rust to format — do not pull the rust toolchain in.
+            # Each manifest (repo root or one level down, e.g. this repo's
+            # rainix-static/Cargo.toml) is formatted via --manifest-path, so
+            # a crate nested below the repo root is formatted rather than
+            # cargo erroring on the manifest-less root.
             rustfmt-conditional = {
               enable = true;
               name = "rustfmt";
               entry = "${pkgs.writeShellScript "rustfmt-conditional" ''
                 command -v cargo-fmt >/dev/null 2>&1 || exit 0
-                if [ -f Cargo.toml ] || [ -f */Cargo.toml ]; then
-                  exec cargo-fmt fmt
-                fi
+                status=0
+                for manifest in Cargo.toml */Cargo.toml; do
+                  if [ -f "$manifest" ]; then
+                    cargo-fmt fmt --manifest-path "$manifest" || status=1
+                  fi
+                done
+                exit "$status"
               ''}";
               files = "\\.rs$";
               pass_filenames = false;