Lock rainix at the SHA CI runs

[thedavidmeister]

flake.lock locked the rainix input at f22d4dcaca61717e33eac65e7b09b9a82f604c1f (2026-06-01). Every CI gate this repo has — rainix-sol-static, rainix-sol-test, rainix-sol-legal, rainix-autopublish — sets RAINIX_SHA: 8657b83b68f41957ab85da91132c3f652c1f32c0 and runs nix develop github:rainlanguage/rainix/$RAINIX_SHA#sol-shell -c <cmd>. forge fmt --check, forge lint -D warnings, pre-commit run --all-files and slither . are all gates whose verdict is a function of the build running them, so local green and CI green were unrelated facts. The lock now names the same rev CI runs.

flake.nix stays unpinned: all six sibling repos leave rainix.url = "github:rainlanguage/rainix", and the lock is what reconciles it. Pinning the URL as well would make nix flake update a no-op and move the pin to a second place.

rainix's own flake.lock is byte-identical at f22d4dc and 8657b83, so no transitive input moves — this is a three-line change to one node.

The durable half of the fix is rainix-side (a static step asserting the caller's flake.lock rainix rev equals RAINIX_SHA), since rainix owns shared CI. Not in this PR.

Closes #145

QA

• Discriminating tests: n/a — no Solidity or Rust changed; the artifact under test is the toolchain itself. Verified directly: nix develop -c forge --version under the new lock resolves forge 1.7.2-nightly (commit 43923a4), which is what sol-shell at 8657b83 ships.
• Mutations applied: n/a — no src/ behaviour in the diff.
• Oracle: rainix's reusable workflows at @main — rainix-sol-static.yaml:5, rainix-sol-test.yaml:32, rainix-sol-legal.yaml:5, rainix-autopublish.yaml:63 all declare RAINIX_SHA: 8657b83b68f41957ab85da91132c3f652c1f32c0. Stability: nix flake lock over the committed file produces no diff.
• Category check: the class is "two pins of the same dependency with nothing reconciling them". The repo's other pins have no CI-side duplicate to diverge from — soldeer deps are pinned once in foundry.toml/soldeer.lock, and the uses: ...@main refs on the reusable workflows are the standing rainix convention (the reusables do the pinning), not a second pin of the same thing.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• flake.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 37c9578c-5b09-4028-832e-2f6eb35d795a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}