Push-free rainix-tag-release with a fail-closed publish guard

.github/workflows/rainix-autopublish.yaml

@@ -49,7 +49,7 @@ on:
       SOLDEER_API_TOKEN:
         required: false
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   release:
     if: ${{ !startsWith(github.event.head_commit.message, 'Package Release') }}

.github/workflows/rainix-copy-artifacts.yaml

@@ -2,7 +2,7 @@ name: rainix-copy-artifacts
 on:
   workflow_call:
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   copy-artifacts:
     runs-on: ubuntu-latest

.github/workflows/rainix-manual-sol-artifacts.yaml

@@ -83,7 +83,7 @@ on:
       CI_DEPLOY_FLARE_ETHERSCAN_API_KEY:
         required: false
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   deploy:
     runs-on: ubuntu-latest

.github/workflows/rainix-manual-sol-verify.yaml

@@ -65,7 +65,7 @@ on:
       CI_DEPLOY_FLARE_ETHERSCAN_API_KEY:
         required: false
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   verify:
     runs-on: ubuntu-latest

.github/workflows/rainix-rs-static.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-static
 on:
   workflow_call:
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   rs-static:
     runs-on: ubuntu-latest

.github/workflows/rainix-rs-test.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-test
 on:
   workflow_call:
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   rs-test:
     strategy:

.github/workflows/rainix-rs-wasm-test.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-wasm-test
 on:
   workflow_call:
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   rs-wasm-test:
     runs-on: ubuntu-latest

.github/workflows/rainix-rs-wasm.yaml

@@ -2,7 +2,7 @@ name: rainix-rs-wasm
 on:
   workflow_call:
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   rs-wasm:
     runs-on: ubuntu-latest

.github/workflows/rainix-sol-legal.yaml

@@ -2,7 +2,7 @@ name: rainix-sol-legal
 on:
   workflow_call:
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   legal:
     runs-on: ubuntu-latest

.github/workflows/rainix-sol-static.yaml

@@ -2,7 +2,7 @@ name: rainix-sol-static
 on:
   workflow_call:
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   static:
     runs-on: ubuntu-latest

.github/workflows/rainix-sol-test.yaml

@@ -23,7 +23,7 @@ on:
       RPC_URL_POLYGON_FORK:
         required: false
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/rainix-subgraph-test.yaml

@@ -2,7 +2,7 @@ name: rainix-subgraph-test
 on:
   workflow_call:
 env:
-  RAINIX_SHA: 5c00627bfaa83920c87596310be4c3f7b345b23d
+  RAINIX_SHA: 864816f68b114f7596f8e1f6f00315ef48783072
 jobs:
   subgraph-test:
     runs-on: ubuntu-latest

rainix-static/src/main.rs

@@ -57,12 +57,21 @@
 //       fails over instead of reddening every suite in the org. Candidates come
 //       from the RAINIX_RPC_SECRET_<NET> / RAINIX_RPC_VARS_<NET> env vars merged
 //       with hardcoded public archive defaults. Never prints a candidate URL.
+//   release-guard --version <x.y.z> [--root <src/generated>] [--foundry <foundry.toml>]
+//       Fail-closed publish guard for rainix-tag-release's push-free deploy flow:
+//       refuse to publish a tag whose commit did not actually cut this release's
+//       snapshot. Verifies foundry.toml's [package].version equals the tag
+//       version, that <root>/<version>/ (dots→underscores) exists in the tagged
+//       commit, and — after the caller re-runs the snapshot generator on the tree
+//       — that `git status` is empty (the committed snapshot is a deterministic
+//       regeneration, not stale/hand-edited). Runs where git is on PATH.
 
 mod agent_context_cap;
 mod context_bytes;
 mod frozen_snapshots;
 mod no_submodules;
 mod prompt_cap;
+mod release_guard;
 mod rpc_preflight;
 mod soldeer_gate;
 
@@ -175,6 +184,13 @@ fn main() {
                 }
             }
         }
+        "release-guard" => {
+            let version = flag(&args, "--version")
+                .unwrap_or_else(|| fail("release-guard: --version <x.y.z> required"));
+            let root = flag(&args, "--root").unwrap_or_else(|| "src/generated".to_string());
+            let foundry = flag(&args, "--foundry").unwrap_or_else(|| "foundry.toml".to_string());
+            release_guard::run(&version, &root, &foundry);
+        }
         "rpc-preflight" => {
             let root = flag(&args, "--root").unwrap_or_else(|| ".".to_string());
             // There is no stdout fallback on purpose: the selected URL may be
@@ -202,7 +218,7 @@ fn main() {
             eprintln!(
                 "rainix-static: unknown subcommand {other:?} \
                  (available: no-submodules, agent-context-cap, prompt-cap, \
-                 snapshots-append-only, soldeer-gate, rpc-preflight)"
+                 snapshots-append-only, soldeer-gate, rpc-preflight, release-guard)"
             );
             std::process::exit(2);
         }