[Siddharth2207]

Summary

Bumps this repo's flake.lock rainix entry from f22d4dc to 777d0d31dd4e5a3cd0d74db2e844c502d4cce3e9 (rainix main, 2026-10-24; only that lock node changed) and runs subgraph-deploy from .#subgraph-shell instead of a hardcoded github:rainlanguage/rainix/<sha>#subgraph-shell ref, matching raindex.deploy#2925. flake.nix already re-exports every rainix devShell (devShells = rainix.devShells.${system}), so no flake change was needed.

The step holding ORMI_DEPLOY_KEY (npm ci + graph deploy) now runs Node.js 22.23.4 from rainlanguage/rainix#419, which carries the 21 October 2026 Node.js security release fixes, and stays pinned to reviewed rainix via the lock rather than rainix main.

The lock bump also moves this repo's other nix develop / nix build .#... users (the default shell in this workflow's ABI check and codegen steps, and subgraph-report.yaml's nix build .#metaboard-subgraph-report) to rainix 777d0d3. The rainix reusable CI workflows pin their own RAINIX_SHA and are unaffected.

This is not a pure Node bump: please read before merging

Every rainix revision with the Node fix also includes rainix#412 ("subgraph-deploy: fail on a refused deploy, label versions by build"), so this pin cannot take the Node fix alone. Between 553ae01 and 777d0d3, subgraph-deploy changes in three ways:

• Version label. It was <address>-<commit> and is now <address>-<build hash>, where the hash is rainix-static subgraph-build-hash over each network's graph build output. The first run after this merges will not find the existing labels, so it will treat every network as not yet deployed.
• Ormi refuses an identical build under a second label (per the comment in lib/subgraph-deploy.sh). A network whose build has not changed since its last deploy may therefore be refused on that first run. rainix#412 makes a refused deploy fail the run instead of reading as success, so expect the first dispatch to fail for those networks rather than pass silently.
• A graph build per network now runs before the probe, and graph deploy gets --output-dir.

Unchanged: the log lines this workflow parses (Deploying subgraph <name>/<version>..., Deploy of <name>/<version> failed, already deployed, skipping) are identical at both revisions, as are the deploy key handling and the hardcoded Ormi endpoint.

Opened as a draft. Someone who runs these deploys should confirm how the first run behaves with the label change, or decide it is acceptable, before this merges.

Test plan

Local, against this branch's flake.lock shells:

• .#subgraph-shell: node --version = v22.23.4, subgraph-deploy present
• sol-shell: forge soldeer install, forge build, forge fmt --check, forge lint -D warnings, slither ., reuse lint, rainix-sol-single-contract, pre-commit run --all-files
• forge test -vvv with fork RPCs: 24/24 passed
• rust-shell: pre-commit run --all-files, rainix-rs-static, cargo test
• nix build .#metaboard-subgraph-report
• Workflow's subgraph path with rain.metadata main: assemble, manifest ABI check, npm ci && graph codegen, graph build --network for all 7 networks in networks.json
• A workflow_dispatch run of this workflow after merge, checking each network's outcome

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}