[gvladika]

Which Linear task belongs to this PR?

Fixes EXSC-1307

Why did I implement it this way?

foundry-toolchain (pinned at 908c540) always downloads foundryup from GitHub releases and runs foundryup --install, even when the pinned binaries are already restored from our toolchain cache. On 8 Nov a GitHub releases outage made 8 scheduled Timelock Auto Execution runs fail in that step despite a cache hit. A new step in setup-foundry now runs verify-foundry-version.sh against ~/.foundry/bin after the cache restore; on a match it adds that directory to PATH and the install step is skipped. On a miss or wrong version, it installs as before. The check uses the binary rather than cache-hit, because cache-hit is false on a restore-keys match (e.g. after a foundry.toml edit) even when the restored binary is the pinned version. Before skipping, the step checks the four cached binaries (forge, cast, anvil, chisel) against the release-attested linux_amd64 SHA-256 values in the new .foundry-sha256, the same check foundryup runs before reusing an installed version. It hashes them before running any of them. A mismatch, a hash file whose version line differs from .foundry-version, or a non-Linux/X64 runner falls back to the install. The hashes are the subjects reported by gh attestation verify for foundry_v1.9.0_linux_amd64.tar.gz. A Foundry bump must update .foundry-sha256 in the same PR (documented in docs/Setup.md and rule 500); until it does, CI reinstalls on every run. The final "Verify foundry version" step runs on both paths. The PR also corrects the cache comment that said foundry-toolchain skips the download on a matching install.

The ticket's retry-on-failure criterion is not implemented; the reason is in the Linear comment. The GITHUB_PATH write carries a zizmor: ignore[github-env] because the value is the fixed ~/.foundry/bin.

Skip path on this PR's CI: run-unit-tests (libraries) logged "Using cached foundry; skipping install" and passed. The same outage class recurred on 9 Nov: Timelock Auto Execution on main failed at 07:25, 07:34 and 07:43 UTC with a 504 in the foundryup download (e.g. run 42581105464).

Checklist before requesting a review

• I have performed a self-review of my code
• This pull request is as small as possible and only tackles one problem
• I have added tests that cover the functionality / test the bug
• For new facets: I have checked all points from this list: https://www.notion.so/lifi/New-Facet-Contract-Checklist-157f0ff14ac78095a2b8f999d655622e
• I have updated any required documentation

Checklist for reviewer (DO NOT DEPLOY and contracts BEFORE CHECKING THIS!!!)

• I have checked that any arbitrary calls to external contracts are validated and or restricted
• I have checked that any privileged calls (i.e. storage modifications) are validated and or restricted
• I have ensured that any new contracts have had AT A MINIMUM 1 preliminary audit conducted on by <company/auditor>

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The setup action checks the executability and version of cached Foundry tools. If the tools match the pinned version, the action adds their directory to GITHUB_PATH and skips installation. Otherwise, it installs Foundry and runs final version verification.

Changes

Foundry setup

Layer / File(s)	Summary
Cached binary check and installation .github/actions/setup-foundry/action.yml	The action checks that cached forge, cast, anvil, and chisel executables run and match the pinned version. On a match, it adds ~/.foundry/bin to GITHUB_PATH and skips installation and final verification. Otherwise, installation and final verification run.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: Minimal · up to f7fbc

Matching cached Foundry installations are reused. No merge-blocking risk was established.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title names the main change: the CI setup now reuses the cached Foundry binaries instead of downloading foundryup. The raw summary confirms a cache-match check that skips the install step. The tit…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description includes the Linear task, implementation rationale, detailed behavior, and both checklist sections. The test and documentation checklist items remain unchecked, but the description is …

Full details: Title check

Explanation

The title names the main change: the CI setup now reuses the cached Foundry binaries instead of downloading foundryup. The raw summary confirms a cache-match check that skips the install step. The title also gives the ticket ID, which fits the team's convention.

Full details: Description check

Explanation

The description includes the Linear task, implementation rationale, detailed behavior, and both checklist sections. The test and documentation checklist items remain unchecked, but the description is otherwise complete.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 656fc8e9-034a-4291-9c89-c0b0e1847c6d

Commits

Reviewing files that changed from the base of the PR and between ba36eed and f7fbc5d.

Files selected for processing: 1

• .github/actions/setup-foundry/action.yml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

[lifi-qa-agent]

🔍 QA Review — EXSC-1307 · PR #2631 — ✅ Approve

🔗 Pull Request #2631 · head 0137a6b6ac18 · 🆕 First review · Critical 0 · High 0 · Medium 0 · Low 0 · Awaiting response: 0

Summary

setup-foundry now checks the toolchain cache after restore: when ~/.foundry/bin holds binaries that pass verify-foundry-version.sh for the pinned version, it adds that directory to PATH and skips the foundry-toolchain install (which always downloads foundryup). On a miss or wrong version it installs as before, and the final "Verify foundry version" step is unchanged. It also corrects the misleading cache comment.

Acceptance Criteria

• ✅ Matching cache hit makes no foundryup download; install step skipped (PR links a CI run logging "Using cached foundry; skipping install")
• ✅ Cache miss or restore-keys partial match with wrong version installs as today (the check uses the binary, not cache-hit)
• ⚠️ Retry-once on a failed install is not implemented. The PR author (the assignee) recorded a reasoned scope decision on the ticket and in the PR body: the 70-minute outage makes a retry seconds later pointless, and foundry-toolchain already retries the installer download 3 times. Treated as a documented scope decision, not a defect. See Notes.
• ✅ forge/cast/anvil on PATH in both paths; cache paths and keys untouched

Findings

None.

Notes (not gating)

• 🔵 Ticket criterion 3 (retry once) is deliberately left out. The ticket description still lists it, so the ticket or its criteria should be updated, or the retry added later if blips on cold-cache runs matter.
• 🔵 The skip step version-checks forge only. cast/anvil/chisel are checked as runnable and come from the same cache entry, so a mismatch is not realistic.

Verified

• Cache key and restore key include the pinned version; skip never leaves a different forge on PATH (verify-foundry-version.sh --quiet runs with $bin first).
• No inputs/github.* interpolation into the new script; GITHUB_PATH value is a fixed path (the zizmor ignore is justified). The toolchain action stays SHA-pinned.
• Roughly 20 workflows call the action; its interface is unchanged.

Test Coverage

CI-only change; proven by the PR's own runs. Not executed by this review.

Audit

No src/ change, so no audit entry is required.

[lifi-qa-agent]

🤖 [Automated QA Review] Approved — PR #2631: setup-foundry skips the foundryup download on a verified pinned cache hit; retry AC is a documented author scope decision; 0 findings