[thedavidmeister]

Closes #428

Adds rainix-subgraph-deploy.yaml, a workflow_call reusable that runs the flake's subgraph-deploy task. The flow is the one st0x.deploy and raindex.deploy both hand-roll: nix-cachix-setup with a 1G store budget, then nix develop github:rainlanguage/rainix/${{ env.RAINIX_SHA }}#subgraph-shell -c subgraph-deploy.

• Inputs: subgraph-name (SUBGRAPH_NAME) and ormi-query-base (ORMI_QUERY_BASE). The two consumers differ only in the name. Building, codegen, the network list (subgraph/networks.json), version labels and skip-if-live already happen inside the task, so nothing else is exposed.
• Secrets: ORMI_DEPLOY_KEY (required) and CACHIX_AUTH_TOKEN are declared, so S01-Issuer callers can pass them explicitly. Same-org callers use secrets: inherit.
• The shell is pinned to the same RAINIX_SHA as every other reusable (2aea60e). raindex.deploy's lock currently pins 777d0d3, which is 2aea60e plus a workflow-only commit, so its deploy tooling stays the same.
• The job has contents: read only. The callers' id-token: write is dropped because the task uses no OIDC.

Nothing runs a real deploy. The consumer PRs that call this (linked from #428) depend on this merging first.

QA

• Discriminating tests: all 7 tests in test/bats/workflow/rainix-subgraph-deploy.test.bats (wired into default-shell-test). Each fails on base because the workflow file does not exist there. All 7 pass on this branch locally.
• Mutations applied, each run against the whole bats file:
  • drop ORMI_QUERY_BASE from the deploy step env: killed by "every env var subgraph-deploy requires is wired into its step" and "the deploy name and query base come from the caller's inputs";
  • rainix/${{ env.RAINIX_SHA }}# to rainix#: killed by "runs in the subgraph shell at the pinned sha" and "every rainix ref … pinned sha";
  • add a push trigger: killed by "can only be called, never triggered";
  • add id-token: write: killed by "the job can only read the repo";
  • hoist ORMI_DEPLOY_KEY to workflow env: killed by "the deploy key is a required secret, scoped to the deploy step alone".
• Oracle: the required env var list comes from the task's own subgraph_require_env line in lib/subgraph-deploy.sh, not from the workflow. The pin rule comes from CLAUDE.md "Never use an unpinned flake ref".
• Category check: Add a reusable subgraph deploy workflow (rainix-subgraph-deploy.yaml) #428 asks for a common flow (setup, pinned subgraph shell, deploy task), inputs/secrets for what differs, and a test in the style of the other reusables. All three are covered. Moving the consumers is done in their own PRs.
• pre-commit run --all-files is clean.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: rainlanguage/rainix
• Branch: subgraph-deploy-reusable
• File: .coderabbit.yaml
• Commit: 08b5444
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: a14ce0f0-ac5c-4d57-ab2d-712e7341bcce

Commits

Reviewing files that changed from the base of the PR and between 1b58990 and 08b5444.

Files selected for processing: 3

• .github/workflows/rainix-subgraph-deploy.yaml
• flake.nix
• test/bats/workflow/rainix-subgraph-deploy.test.bats

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[linear]

RAI-4297