Gate autopublish on the pushed commit's own CI (rainix-static ci-gate)

.github/workflows/rainix-autopublish.yaml

@@ -50,7 +50,7 @@ on:
       SOLDEER_API_TOKEN:
         required: false
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   release:
     if: ${{ !startsWith(github.event.head_commit.message, 'Package Release') }}
@@ -72,6 +72,13 @@ jobs:
     permissions:
       id-token: write
       contents: write
+      # The commit-CI gate below reads this repository's workflow runs. A
+      # caller job with no `permissions:` block of its own needs nothing —
+      # this block narrows the token the caller hands over. A caller job that
+      # DOES set an explicit block on the job that `uses:` this workflow must
+      # include `actions: read` in it, because a called workflow can only
+      # narrow the caller's grant, never widen it.
+      actions: read
     steps:
       # This job needs a deploy-key (ssh-key) checkout, so it runs the shared
       # `checkout` composite itself with the key, then calls the nix+cachix
@@ -221,6 +228,30 @@ jobs:
             rainix-static soldeer-gate \
             --package "$SOLDEER_PACKAGE" \
             --github-output "$GITHUB_OUTPUT"
+      # Publish gate on this commit's own CI (rainlanguage/rainix#326). The
+      # caller's test workflows trigger on the same push as this one and race
+      # it — nothing else orders publish after green — so before anything
+      # bumps, tags, or publishes, wait for every OTHER workflow run on
+      # github.sha (all trigger events, excluding every run of the caller's
+      # own release workflow, which would deadlock against itself) and require
+      # them all to have completed green, re-checking any all-green set seen
+      # before the discovery grace elapses (run registration lags the push, so
+      # an early snapshot could miss a late-registering run). This inherits
+      # whatever the repo runs
+      # on push — the full rainix-sol/rs matrix, not a re-run subset — at zero
+      # extra compute. A failed/cancelled run, a timeout, or a commit with NO
+      # other CI at all (fail-closed: nothing tested it) each fail the gate
+      # loudly, nothing publishes, and the next push — or a re-run of this job
+      # once the commit's CI is green — retries for free. Gated on the change
+      # outputs so a no-op push short-circuits without waiting. Runs via `nix
+      # run` (no dev shell): the wrapped binary carries its own curl + CA
+      # bundle, so soldeer/npm/cargo callers all pay only the small
+      # rainix-static closure.
+      - name: Gate on commit CI
+        if: ${{ steps.cargo.outputs.changed == 'true' || steps.npm.outputs.changed == 'true' || steps.soldeer.outputs.changed == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: nix run github:rainlanguage/rainix/${{ env.RAINIX_SHA }}#rainix-static -- ci-gate
       # Run the test suite only when something is actually going to publish. The
       # change gates above are cheap (cargo package --no-verify + a hash compare,
       # an npm/soldeer version lookup); the full workspace test is the expensive

.github/workflows/rainix-copy-artifacts.yaml

@@ -2,7 +2,7 @@ name: rainix-copy-artifacts
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   copy-artifacts:
     runs-on: ubuntu-latest

.github/workflows/rainix-manual-sol-artifacts.yaml

@@ -85,7 +85,7 @@ on:
       CI_DEPLOY_FLARE_ETHERSCAN_API_KEY:
         required: false
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   deploy:
     runs-on: ubuntu-latest

.github/workflows/rainix-manual-sol-verify.yaml

@@ -65,7 +65,7 @@ on:
       CI_DEPLOY_FLARE_ETHERSCAN_API_KEY:
         required: false
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   verify:
     runs-on: ubuntu-latest

.github/workflows/rainix-rs-static.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-static
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   rs-static:
     runs-on: ubuntu-latest

.github/workflows/rainix-rs-test.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-test
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   rs-test:
     strategy:

.github/workflows/rainix-rs-wasm-test.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-wasm-test
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   rs-wasm-test:
     runs-on: ubuntu-latest

.github/workflows/rainix-rs-wasm.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-wasm
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   rs-wasm:
     runs-on: ubuntu-latest

.github/workflows/rainix-sol-legal.yaml

@@ -2,7 +2,7 @@ name: rainix-sol-legal
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   legal:
     runs-on: ubuntu-latest

.github/workflows/rainix-sol-static.yaml

@@ -2,7 +2,7 @@ name: rainix-sol-static
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   static:
     runs-on: ubuntu-latest

.github/workflows/rainix-sol-test.yaml

@@ -25,7 +25,7 @@ on:
       RPC_URL_SEPOLIA_FORK:
         required: false
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/rainix-subgraph-test.yaml

@@ -2,7 +2,7 @@ name: rainix-subgraph-test
 on:
   workflow_call:
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   subgraph-test:
     runs-on: ubuntu-latest

.github/workflows/rainix-tag-release.yaml

@@ -124,7 +124,7 @@ on:
       RPC_URL_SEPOLIA_FORK:
         required: false
 env:
-  RAINIX_SHA: c4cf22d9b76600a4ad33b5552f4083f80d9b83de
+  RAINIX_SHA: 022c32c614baa2925c1a715aee8b94ae74abbb97
 jobs:
   # The release tag must point at a commit already merged to the release branch.
   # `on: push: tags` fires for ANY tag, including one cut from an unmerged branch;

flake.nix

@@ -521,14 +521,22 @@
             # (instead of nix-store interpolation) keeps rust-toolchain out
             # of the hook's nix closure, so consumers of sol-shell — which
             # have no rust to format — do not pull the rust toolchain in.
+            # Each manifest (repo root or one level down, e.g. this repo's
+            # rainix-static/Cargo.toml) is formatted via --manifest-path, so
+            # a crate nested below the repo root is formatted rather than
+            # cargo erroring on the manifest-less root.
             rustfmt-conditional = {
               enable = true;
               name = "rustfmt";
               entry = "${pkgs.writeShellScript "rustfmt-conditional" ''
                 command -v cargo-fmt >/dev/null 2>&1 || exit 0
-                if [ -f Cargo.toml ] || [ -f */Cargo.toml ]; then
-                  exec cargo-fmt fmt
-                fi
+                status=0
+                for manifest in Cargo.toml */Cargo.toml; do
+                  if [ -f "$manifest" ]; then
+                    cargo-fmt fmt --manifest-path "$manifest" || status=1
+                  fi
+                done
+                exit "$status"
               ''}";
               files = "\\.rs$";
               pass_filenames = false;