Merge pull request #246 from rainlanguage/2026-06-20-versioned-deploy-constants

Pin versioned deploy constants per soldeer tag (dex pattern)

Author: thedavidmeister

script/check-published-deploy-constants.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: LicenseRef-DCL-1.0
+# SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
+#
+# Prints "OK" iff every version published to the soldeer registry for
+# `rain-math-float` has a full suite of pinned deploy constants in
+# LibDecimalFloatDeploy.sol: a log-tables address + codehash and a DecimalFloat
+# address + codehash, each suffixed with the version.
+#
+# Consumed by LibDecimalFloatDeployTaggedConstants.t.sol via FFI. Output is one
+# of:
+#   OK                   - every published version has its full constant suite
+#   MISSING: <names...>  - one or more expected constants are absent
+#   SKIP: <reason>       - the registry could not be reached (nothing verified)
+#
+# Always exits 0 so the test sees the message rather than an ffi failure.
+
+lib="src/lib/deploy/LibDecimalFloatDeploy.sol"
+
+versions=$(
+  curl -fsS --connect-timeout 5 --max-time 20 --retry 2 --retry-delay 1 \
+    "https://api.soldeer.xyz/api/v1/revision?project_name=rain-math-float" 2>/dev/null \
+    | grep -oE '"version":"[0-9][0-9.]*"' | cut -d'"' -f4 | sort -u
+)
+
+if [ -z "$versions" ]; then
+  printf 'SKIP: could not fetch published soldeer versions'
+  exit 0
+fi
+
+# The deploy constants that must be pinned for every published version, suffixed
+# with the version (dots replaced by underscores).
+bases="ZOLTU_DEPLOYED_LOG_TABLES_ADDRESS \
+LOG_TABLES_DATA_CONTRACT_HASH \
+ZOLTU_DEPLOYED_DECIMAL_FLOAT_ADDRESS \
+DECIMAL_FLOAT_CONTRACT_HASH"
+
+missing=""
+for v in $versions; do
+  suffix=$(printf '%s' "$v" | tr . _)
+  for b in $bases; do
+    name="${b}_${suffix}"
+    grep -qE "constant ${name} =" "$lib" || missing="${missing} ${name}"
+  done
+done
+
+if [ -n "$missing" ]; then
+  printf 'MISSING:%s' "$missing"
+else
+  printf 'OK'
+fi

src/lib/deploy/LibDecimalFloatDeploy.sol

@@ -31,6 +31,29 @@ library LibDecimalFloatDeploy {
     /// Zoltu's deterministic deployment proxy.
     bytes32 constant DECIMAL_FLOAT_CONTRACT_HASH = 0xdc468883c345d41c0abd98ef2fd933c370bd1682522d37e6f6b729793301f55e;
 
+    /// @dev Deploy constants pinned to each version published to the soldeer
+    /// registry. These are frozen literals — not aliases of the "current"
+    /// constants above — so each keeps referencing its own release's deployment
+    /// after the current constants advance to a newer version.
+    /// `script/check-published-deploy-constants.sh` (run by
+    /// `LibDecimalFloatDeployTaggedConstantsTest`) queries the registry and
+    /// fails if any published version is missing its suite, so publishing a new
+    /// tag forces pinning that tag's deploy constants here.
+
+    /// @dev Log tables address at the published `0.1.1` soldeer tag.
+    address constant ZOLTU_DEPLOYED_LOG_TABLES_ADDRESS_0_1_1 = address(0xc51a14251b0dcF0ae24A96b7153991378938f5F5);
+
+    /// @dev Log tables codehash at the published `0.1.1` soldeer tag.
+    bytes32 constant LOG_TABLES_DATA_CONTRACT_HASH_0_1_1 =
+        0x2573004ac3a9ee7fc8d73654d76386f1b6b99e34cdf86a689c4691e47143420f;
+
+    /// @dev DecimalFloat address at the published `0.1.1` soldeer tag.
+    address constant ZOLTU_DEPLOYED_DECIMAL_FLOAT_ADDRESS_0_1_1 = address(0xBee0eEFaffD046c9602109eB30A858Be301CC926);
+
+    /// @dev DecimalFloat codehash at the published `0.1.1` soldeer tag.
+    bytes32 constant DECIMAL_FLOAT_CONTRACT_HASH_0_1_1 =
+        0x7a93d0311f7782b44157ba40e94ec936085ebe001c7893bdd74911c8351d3def;
+
     /// Combines all log and anti-log tables into a single bytes array for
     /// deployment. These are using packed encoding to minimize size and remove
     /// the complexity of full ABI encoding.

test/src/lib/deploy/LibDecimalFloatDeployTaggedConstants.t.sol

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: LicenseRef-DCL-1.0
+// SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd
+pragma solidity =0.8.25;
+
+import {Test} from "forge-std-1.16.1/src/Test.sol";
+
+/// @title LibDecimalFloatDeployTaggedConstantsTest
+/// @notice Every version published to the soldeer registry for `rain-math-float`
+/// must have a full suite of pinned deploy constants in `LibDecimalFloatDeploy`:
+/// a log-tables address + codehash and a DecimalFloat address + codehash for
+/// each published version. `script/check-published-deploy-constants.sh` queries
+/// the live registry (via FFI) and lists any missing constants, so publishing a
+/// new tag without pinning its constants fails this test. Skips if the registry
+/// is unreachable rather than failing on network flakiness.
+contract LibDecimalFloatDeployTaggedConstantsTest is Test {
+    function testAllPublishedSoldeerTagsHaveAFullConstantSuite() external {
+        string[] memory cmd = new string[](2);
+        cmd[0] = "bash";
+        cmd[1] = "script/check-published-deploy-constants.sh";
+        bytes memory out = vm.ffi(cmd);
+
+        // The registry could not be reached; there is nothing to verify.
+        if (_startsWith(out, bytes("SKIP"))) {
+            vm.skip(true);
+            return;
+        }
+
+        // On failure the actual value lists the missing `*_<version>` constants.
+        assertEq(string(out), "OK", "a published soldeer tag is missing pinned deploy constants");
+    }
+
+    function _startsWith(bytes memory s, bytes memory prefix) private pure returns (bool) {
+        if (s.length < prefix.length) {
+            return false;
+        }
+        for (uint256 i = 0; i < prefix.length; i++) {
+            if (s[i] != prefix[i]) {
+                return false;
+            }
+        }
+        return true;
+    }
+}