`testBuildFileForContractCommittedArtifactIsCurrent` checks only the header, never the generated artifact body

[thedavidmeister]

Audit scope: whole-repo, commit 7aa85a4

Dimension 5 (correctness/intent) · medium

Location: test/src/lib/LibFs.buildFileForContract.t.sol:201-224

Path note: PR #56 is open and unmerged as of filing. On main today this file is test/lib/LibFs.buildFileForContract.t.sol; it becomes test/src/lib/LibFs.buildFileForContract.t.sol after #56 merges.

Problem

The name and docstring claim the committed src/generated/CodeGennable.sol is
current and that drift "reds the suite too". The body copies only
bytes(header).length bytes — prefix plus BYTECODE_HASH — and never looks at
the body the artifact actually carries.

Measured: changing the committed artifact's SOME_BYTES_CONSTANT from
hex"12345678" to hex"deadbeef" and rewriting its comment leaves all 134 tests
green. The exact failure the docstring says it exists to catch ("Nothing in
forge test noticed when it went stale") is still uncaught.

Relatedly, script/Build.sol has no test of any kind — nothing under test/
imports it.

Proposed fix

Regenerate and compare in full, which also gives script/Build.sol its
only coverage. Verified to pass on clean source and leave the working tree
byte-identical:

import {Build} from "script/Build.sol";

/// `src/generated/CodeGennable.sol` is committed and `script/Build.sol` writes
/// it. Regenerating and comparing the whole file is what makes a stale artifact
/// red `forge test` rather than only the separate `rainix-copy-artifacts` job.
function testBuildFileForContractCommittedArtifactIsCurrent() external {
    string memory path = LibFs.pathForContract("CodeGennable");
    string memory committed = vm.readFile(path);

    new Build().run();
    string memory regenerated = vm.readFile(path);
    vm.writeFile(path, committed);

    assertEq(regenerated, committed, "committed artifact is stale, regenerate with script/Build.sol");
}