chore(ci): replace Cargo cooldown with Socket by decofe · Pull Request #16765 · foundry-rs/foundry

decofe · 2026-09-09T14:38:51Z

Replace the standalone Cargo cooldown workflow and configuration with Socket Firewall in CI jobs, so supported package downloads are checked during installation rather than by a separate gate. Use the shared secure-runner action on Linux, macOS, and Windows across tests, linting, docs, benchmarks, and release workflows, with temporary macOS/Windows Clippy coverage. Verify Cargo resolves through the Socket shim and use Git CLI fetching for certificate compatibility.

Preserve existing build caches, start sccache outside the Socket-wrapped Cargo process, and configure the Node connection-timeout workaround and SFW_UNKNOWN_HOST_ACTION=ignore. Use host-only bypass rules for binaries.soliditylang.org and raw.githubusercontent.com to avoid compiler-download TLS trust failures, while keeping wrap exceptions for test endpoints. Disable Cargo's Windows certificate revocation check for Socket-enabled Clippy, tests, and release builds; certificate validation remains enabled. Make generated binding tests use committed lockfiles with --locked. Pin pnpm for external fixtures, use frozen lockfiles for Snekmate and the standalone Sablier fixture, and fail external tests if all dependency installation commands fail.

This is install-time protection, not a guarantee that every CI dependency is inspected: cached packages are not rechecked, host interception does not cover container-internal installs or direct binary downloads, and unknown hosts are allowed without package inspection. The raw GitHub bypass covers the entire host, not just the compiler repository paths; crates.io remains intercepted. StepSecurity egress policy remains in audit mode where its agent is supported; the pinned action skips agent installation on detected Depot Windows runners.

Code and PR description were written with AI assistance.

Prompted by: @grandizzy

github-actions · 2026-09-09T14:39:05Z

✅ Changelog exempt

A maintainer marked this pull request as not requiring a changelog entry.

mablr · 2026-09-10T08:26:19Z

-      contents: read
-    uses: ./.github/workflows/cargo-cooldown.yml
-
  test:


The pinned action falls back to Socket Free on fork PRs, so removing cooldown drops their pre-merge age gate and org policies. Could we retain cooldown for fork PRs until Socket supports equivalent enforcement? That preserves the age gate, though exceptions would still need separate maintenance.

mablr · 2026-09-10T08:26:19Z

+        if [[ "$RUNNER_OS" == Windows ]]; then
+          shim_dir="$(cygpath -u "$shim_dir")"
+        fi
+        test "$(command -v cargo)" = "$shim_dir/cargo"


Rollout follow-up: this checks interception, not policy enforcement. Could we add a harmless policy-denied dependency canary and assert installation fails, covering both same-repo and fork PR behavior?

mablr · 2026-09-10T08:26:19Z

+          egress-policy: audit
+      - name: Install Socket on macOS and Windows
+        if: runner.os != 'Linux'
+        uses: tempoxyz/gh-actions/actions/socket-firewall@5338a3746a2ac2ddd88cbede733c79f907aca3a0


Rollout follow-up: PR tests currently select only Linux x86, so green PR CI doesn't exercise this setup. Please track macOS/Windows smoke runs, plus the musl offline build and Docker host dependency check, before replicating this across repos.

yep, had macOS/Windows in a previous run and reverted

mablr · 2026-09-10T08:26:19Z

+          egress-policy: audit
+      - name: Verify Socket Cargo interception
+        uses: ./.github/actions/check-socket-shim
+      # BuildKit does not inherit the host's package-manager shims.


Rollout follow-up: could we put the coverage limits from the PR body into the shared action docs? Cached packages aren't rechecked, unknown hosts are allowed, and container tool installs/direct binary downloads bypass the host shim. Future consumers need those boundaries too.

mablr

As far as the prior comments are acknowledged, this is fine to go as-is and handle them as follow-ups.

Protect dependency downloads with Socket across CI while preserving build caches. Lock generated binding fixtures and validate Cargo interception and Docker lockfile inputs. Allow unknown hosts and add scoped wrapper rules for compiler metadata, test RPCs, signature lookup and Soldeer downloads. Correct the devnet hostname, pin the standalone Sablier fixture with its frozen Bun lockfile, and retain the provider-hostname assertion without a brittle blank line. Install the external fixture package manager through Socket, honor frozen lockfiles, and fail when dependency installation fails. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Exercise the Socket setup on all three platforms without cancelling the other matrix jobs on failure. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Preserve the designated Socket JSON after every protected job, including failures, with seven-day retention and matrix-specific artifact names. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Reject Socket unexpected errors even when the shim returns success, while preserving Clippy exit failures on all three platforms. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Add the Solidity binary host rule to doctest, no-default-features, and forge-fmt to address certificate failures in the compiler build script. Keep Cargo registry checks and other platform jobs unchanged. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Use the same secure-runner action and audit input on Linux, macOS, and Windows to test whether the security setup contributes to platform-specific failures. Preserve the shared Socket environment and error checks. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Switch existing Solidity compiler host rules from wrap to bypass to test native certificate validation for compiler metadata downloads. Keep registry package checks, unrelated host rules, and Socket error guards unchanged. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Revert eabc19d to compare CI behavior after Linux Clippy began failing with UnknownIssuer. Restore the previous compiler routing without changing the unified runner setup. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Merge master while retaining the removal of cooldown.toml and the restored Socket workflow configuration. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Remove report uploads, container dependency prefetch checks, inline Clippy error detection, and external installer unit tests. Restore musl network fetching after removing its prefetch step. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Replace OS-specific Socket setup with the existing pinned secure-runner action. Preserve audit policy, host rules, and Cargo interception verification. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Bypass compiler download hosts without path prefixes to avoid macOS keychain trust failures. Disable Cargo's Windows revocation check for proxy certificates without revocation endpoints. Preserve other host exceptions and Git CLI fetching. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Declare Git CLI fetching alongside the other Clippy Socket settings. Leave the shared shim and all other jobs unchanged. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

decofe added the L-ignore Log: ignore PR in changelog label Sep 9, 2026

decofe assigned grandizzy Sep 9, 2026

github-project-automation Bot added this to Foundry Sep 9, 2026

decofe changed the title ~~chore(ci): gate locked dependencies with Socket~~ chore(ci): replace Cargo cooldown with Socket Sep 9, 2026

decofe force-pushed the centaur/simple-socket-gate-1788964800 branch 4 times, most recently from a7a1f3d to 2ecbe81 Compare September 10, 2026 07:32

grandizzy marked this pull request as ready for review September 10, 2026 08:07

grandizzy requested review from 0xrusowsky, DaniPopes, figtracer, grandizzy, mablr, mattsse and stevencartavia as code owners September 10, 2026 08:07

decofe force-pushed the centaur/simple-socket-gate-1788964800 branch from 2ecbe81 to 6377783 Compare September 10, 2026 08:08

decofe mentioned this pull request Sep 10, 2026

chore(ci): replace Cargo cooldown with Socket foundry-rs/foundry-core#192

Open

mablr reviewed Sep 10, 2026

View reviewed changes

mablr previously approved these changes Sep 10, 2026

View reviewed changes

decofe dismissed mablr’s stale review via 066b03c September 10, 2026 09:23

grandizzy and others added 3 commits September 10, 2026 09:40

chore(ci): check Clippy on macOS and Windows

e3e417c

Exercise the Socket setup on all three platforms without cancelling the other matrix jobs on failure. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

chore(ci): restore Socket report artifacts

bffe901

Preserve the designated Socket JSON after every protected job, including failures, with seven-day retention and matrix-specific artifact names. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

decofe force-pushed the centaur/simple-socket-gate-1788964800 branch from 066b03c to bffe901 Compare September 10, 2026 09:40

grandizzy and others added 4 commits September 10, 2026 09:46

fix(ci): fail Clippy on Socket errors

eeeca42

Reject Socket unexpected errors even when the shim returns success, while preserving Clippy exit failures on all three platforms. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

grandizzy marked this pull request as draft September 10, 2026 16:17

decofe force-pushed the centaur/simple-socket-gate-1788964800 branch from 4b54a8a to 9ed8493 Compare September 10, 2026 16:18

grandizzy and others added 6 commits September 10, 2026 16:19

chore(ci): resolve Socket rollout merge conflict

acc6cb3

Merge master while retaining the removal of cooldown.toml and the restored Socket workflow configuration. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

chore(ci): use secure-runner on all platforms

7d78d7e

Replace OS-specific Socket setup with the existing pinned secure-runner action. Preserve audit policy, host rules, and Cargo interception verification. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

fix(ci): restore Bash for Clippy

29207bb

Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

chore(ci): make Clippy Git fetching explicit

21d256a

Declare Git CLI fetching alongside the other Clippy Socket settings. Leave the shared shim and all other jobs unchanged. Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

Navigation Menu

Uh oh!

chore(ci): replace Cargo cooldown with Socket - #16765

chore(ci): replace Cargo cooldown with Socket#16765
decofe wants to merge 14 commits into
masterfrom
centaur/simple-socket-gate-1788964800

decofe commented Sep 9, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 9, 2026

Uh oh!

mablr Sep 10, 2026

Uh oh!

mablr Sep 10, 2026

Uh oh!

mablr Sep 10, 2026

Uh oh!

grandizzy Sep 10, 2026

Uh oh!

mablr Sep 10, 2026

Uh oh!

mablr left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

decofe commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 9, 2026

✅ Changelog exempt

Uh oh!

mablr Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

mablr Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

mablr Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

grandizzy Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

mablr Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

mablr left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

decofe commented Sep 9, 2026 •

edited

Loading