Skip to content

fix: harden weighted-average rounding and support custody #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gorgos merged 2 commits into from
Aug 3, 2026
Merged

fix: harden weighted-average rounding and support custody #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
032cccd
feat: add Code 67 and Code 1962 migration paths
jbernal87 Jul 31, 2026
f3d5bcf
fix: prevent weighted-average rounding from spending support
jbernal87 Aug 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 9 additions & 14 deletions .github/workflows/rust.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,11 @@ jobs:
- name: Checkout sources
uses: actions/checkout@v2

- name: Install nightly toolchain
- name: Install Rust toolchain
uses: actions-rs/toolchain@v1
with:
profile: minimal
toolchain: 1.78.0
toolchain: 1.86.0
Comment on lines +32 to +36

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

if rg -n 'actions-rs/(toolchain|cargo)`@v1`' .github/workflows; then
  echo "Archived actions remain" >&2
  exit 1
fi

Repository: InjectiveLabs/swap-contract

Length of output: 157

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*'

printf '%s\n' '--- actions-rs references ---'
rg -n -C 3 'actions-rs/(toolchain|cargo)`@v1`' .github/workflows || true

printf '%s\n' '--- workflow sections ---'
sed -n '1,145p' .github/workflows/rust.yaml

Repository: InjectiveLabs/swap-contract

Length of output: 157

🌐 Web query:

actions-rs/toolchain GitHub archived actions-rs/cargo maintenance status

💡 Result:

The entire actions-rs organization, including the actions-rs/toolchain and actions-rs/cargo repositories, has been archived by the owner [1][2][3][4]. As of October 13, 2023, these repositories are in a read-only state and are no longer maintained [5][6]. The organization was archived due to the primary maintainer stepping back, and the community has widely recognized these actions as unmaintained [3][4][7][8]. Users are advised to migrate to alternative, actively maintained solutions [3]. For example, dtolnay/rust-toolchain is a common replacement for actions-rs/toolchain, while standard cargo commands are often used in place of actions-rs/cargo [3].

Citations:

🏁 Script executed:

#!/usr/bin/env bash
set -u

printf '%s\n' '--- file metadata ---'
stat .github/workflows/rust.yaml 2>&1 || true

printf '%s\n' '--- requested workflow ranges ---'
for range in '1,75' '90,135'; do
  printf '%s\n' "--- lines $range ---"
  sed -n "${range}p" .github/workflows/rust.yaml 2>&1 || true
done

printf '%s\n' '--- exact action references ---'
grep -nE 'actions-rs/(toolchain|cargo)`@v1`' .github/workflows/rust.yaml 2>&1 || true

Repository: InjectiveLabs/swap-contract

Length of output: 157

🌐 Web query:

GitHub Actions archived action still runs actions-rs toolchain Node runtime actionlint too old to run

💡 Result:

The actions-rs organization, including actions-rs/toolchain, was archived by its owner in October 2023 and is unmaintained [1][2][3]. Because these actions were authored using older Node.js runtimes (such as Node 12) that have long been deprecated by GitHub Actions, they trigger deprecation warnings in CI workflows [1][4][5]. While these archived actions may still execute in some environments, they are technically unsupported and incompatible with the current GitHub Actions runtime requirements [6][4]. As of mid-2026, GitHub Actions has largely transitioned to Node.js 24 [7][8]. Using unmaintained actions that rely on obsolete Node.js versions poses significant risks of pipeline failure as GitHub continues to remove support for older runtimes [7][8]. To resolve these issues and remove deprecation warnings, you should replace the deprecated actions with maintained alternatives [1][6]: 1. Replace actions-rs/toolchain with dtolnay/rust-toolchain, which is the industry-standard, maintained alternative [1][4][9]. 2. Replace other actions like actions-rs/cargo, actions-rs/clippy-check, and actions-rs/audit-check with direct shell commands (e.g., cargo build, cargo clippy) or community-supported forks [1][6]. The error mentioning actionlint being "too old" likely refers to the fact that your local or CI-based linter (actionlint) is flagging the use of these deprecated, archived actions or the underlying obsolete Node.js runtime configuration in your workflow files [1][4]. Updating your workflow syntax to use the recommended modern replacements will resolve these linting errors and ensure your pipelines remain compatible with current and future GitHub Actions environments [1][9].

Citations:

Replace the archived actions-rs actions. The actions-rs organization has been archived since October 2023. Replace actions-rs/toolchain@v1 with dtolnay/rust-toolchain and replace actions-rs/cargo@v1 with direct cargo commands to avoid unsupported CI dependencies.

🧰 Tools
🪛 actionlint (1.7.12)

[error] 33-33: the runner of "actions-rs/toolchain@v1" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🪛 zizmor (1.28.0)

[warning] 33-33: action or reusable workflow from archived repository (archived-uses): repository is archived

(archived-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/rust.yaml around lines 32 - 36, Update the Rust CI
workflow by replacing the archived actions-rs/toolchain@v1 step with
dtolnay/rust-toolchain, preserving the minimal profile and Rust 1.86.0 toolchain
settings. Replace every actions-rs/cargo@v1 usage in the workflow with
equivalent direct cargo commands while retaining the existing CI operations and
arguments.

Source: Linters/SAST tools

target: wasm32-unknown-unknown
override: true
components: llvm-tools-preview
Expand All @@ -50,20 +50,15 @@ jobs:
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
restore-keys: ${{ runner.os }}-cargo-

- name: Compile WASM contracts
uses: actions-rs/cargo@v1
with:
command: build
args: --release --target wasm32-unknown-unknown --locked --package swap-contract
env:
RUSTFLAGS: "-C link-arg=-s"
- name: Build optimized WASM contract
run: ./build_release.sh

- name: Run tests
uses: actions-rs/cargo@v1
with:
command: test
toolchain: 1.78.0
args: --locked --tests
toolchain: 1.86.0
args: --locked --tests --features integration
env:
LLVM_PROFILE_FILE: "swap-contract-%p-%m.profraw"
RUSTFLAGS: "-Cinstrument-coverage"
Expand Down Expand Up @@ -98,7 +93,7 @@ jobs:
uses: actions-rs/toolchain@v1
with:
profile: minimal
toolchain: 1.78.0
toolchain: 1.86.0
override: true
components: rustfmt, clippy

Expand All @@ -123,13 +118,13 @@ jobs:
- name: Run cargo fmt
uses: actions-rs/cargo@v1
with:
toolchain: 1.78.0
toolchain: 1.86.0
command: fmt
args: --all -- --check

- name: Run cargo clippy
uses: actions-rs/cargo@v1
with:
toolchain: 1.78.0
toolchain: 1.86.0
command: clippy
args: --tests -- -D warnings
Loading
Loading