Skip to content

fix(ci): simplify CLI workflow to fix fork PR permissions#787

Merged
DBosley merged 6 commits intomainfrom
fix/simplify-cli-workflow
Jan 9, 2026
Merged

fix(ci): simplify CLI workflow to fix fork PR permissions#787
DBosley merged 6 commits intomainfrom
fix/simplify-cli-workflow

Conversation

@DBosley
Copy link
Copy Markdown
Contributor

@DBosley DBosley commented Jan 9, 2026

Summary

Simplify the CLI workflow to fix fork PR permission errors and improve maintainability.

Before: 5 jobs with complex dependencies, ghcr.io writes required
After: 4 jobs (test-evm + 2 parallel builds + test-solana), no registry writes

Problem

Fork PR #756 failed with:

denied: installation not allowed to Write organization package

This was introduced in PR #773 (Dec 19) which added ghcr.io push to share images between jobs. Fork PRs don't have write access to the org's package registry.

Solution

Remove ghcr.io dependency entirely. Use GHA layer cache for Docker builds and actions/cache for Solana artifacts.

New Architecture

test-evm ──────────────────────────────────────> ✅
build-solana (v1.0.0) ─┬─> test-solana ────────> ✅
build-solana (v2.0.0) ─┘
  • test-evm: Builds cli-local-test target with GHA layer cache
  • build-solana: Matrix job builds v1.0.0 and v2.0.0 artifacts in parallel
    • Cached by version + build script hash
    • Fork PRs can read cache from main branch
  • test-solana: Downloads pre-built artifacts, runs tests (no compilation needed)

Fork PR Support

Component How it works for forks
Docker layers GHA cache readable by forks ✅
Solana artifacts actions/cache readable from main ✅
Registry writes None required ✅

Cache Key

solana-v${version}-${hashFiles('cli/test/build-solana.sh', 'Dockerfile.cli', 'Dockerfile.anchor-base', 'solana/Anchor.toml')}

Cache invalidates when build infrastructure changes. Since v1.0.0/v2.0.0 are immutable tags, this is sufficient.

Changes

  • Simplify cli.yml workflow (removed ghcr.io push complexity)
  • Delete unused Dockerfile.cli-test-evm and Dockerfile.cli-test-solana
  • Add fork detection to anchor-base.yml with clear error message
  • All jobs run on ubuntu-latest (no tilt runner dependency)

Test plan

  • Verify test-evm passes
  • Verify build-solana matrix jobs complete
  • Verify test-solana passes with pre-built artifacts
  • Test from a fork PR to confirm no permission errors

Remove ghcr.io push for cli-local image that was breaking fork PRs with
"installation not allowed to Write organization package" error.

Changes:
- Simplify cli.yml from 5 jobs to 2 parallel jobs (test-evm, test-solana)
- Remove ghcr.io push entirely for cli-local
- Use GHA layer caching (cache-from: type=gha) instead of registry
- Each job builds its own target directly with BuildKit
- Delete unused Dockerfile.cli-test-{evm,solana} files
- Add fork detection to anchor-base.yml with clear error message

Fork PRs now work because no registry writes are required. The anchor-base
image uses a default ARG in Dockerfile.cli pointing to a pre-built version
that fork PRs can pull (read-only access is allowed).

GHA layer cache provides sufficient performance by caching base layers
(apt, bun, foundry, anchor) and only rebuilding from source changes.

Fixes fork PR #756 permission error.
Use jlumbroso/free-disk-space to remove ~25GB of unused software
(Android SDK, .NET, Haskell, large packages) before building Solana.
This avoids dependence on limited tilt-kube-public runners.
- Build v1.0.0 and v2.0.0 artifacts in parallel matrix jobs
- Cache artifacts by version + build script hash
- Test job downloads pre-built artifacts (no compilation needed)
- All jobs use ubuntu-latest with GHA layer cache (no tilt runners)
- No ghcr.io writes (fork PRs work)
Copy link
Copy Markdown
Contributor

@dvgui dvgui left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@dvgui dvgui requested a review from nvsriram January 9, 2026 20:37
@DBosley DBosley merged commit 86d351f into main Jan 9, 2026
17 checks passed
@DBosley DBosley deleted the fix/simplify-cli-workflow branch January 9, 2026 20:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants