.github/workflows/check-bindings.yaml (1)

49-52: Optimize the bindings generation step.
Currently nix develop -c loads the full development shell, which rebuilds most of the workspace and prolongs CI. You can:

• Add -L to lock the flake and avoid unnecessary rebuilds:

  - nix develop -c forge bind ...
  + nix develop -L -c forge bind ...

• Or install Foundry via a dedicated action (e.g., foundry-rs/foundry-action) and invoke forge bind directly, bypassing the heavy Nix environment.

Either approach will significantly reduce CI time.

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

.github/workflows/check-bindings.yaml (1)

13-14: Actionlint runner label configuration
Using the single custom label self-hosted-hoprnet-big may trigger actionlint validation errors because it’s not in the default label set. You can either whitelist it in your actionlint config or split it into standard labels, for example:

runs-on: [self-hosted, hoprnet-big]

🧰 Tools

🪛 actionlint (1.7.7)

14-14: label "self-hosted-hoprnet-big" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-2019", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "ubuntu-20.04", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file

(runner-label)

.github/workflows/check-bindings.yaml (2)

23-24: Address egress policy TODO
You’ve set egress-policy: audit for now, with a TODO to switch to block later. To ensure this doesn’t slip off the radar, consider opening an issue or adding a reminder in your backlog to revisit and update this policy once sufficient audit data has been collected.

Would you like me to create an issue to track changing the egress policy to block?

---

45-53: Optimize Nix environment for faster CI
The nix develop -c invocation will load your full development environment, which can be heavier than needed for just running forge bind. This may be why the "check smart contract" job takes a long time. Consider defining a minimal devshell or flake that only includes the Forge binary (and its dependencies), or use nix run if available, to significantly cut down CI startup and runtime.

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

.github/workflows/check-bindings.yaml (6)

4-11: Include pull_request opened trigger
The workflow currently runs on synchronize and ready_for_review events, but not on initial PR creation or reopens. Without opened/reopened, binding checks won’t run when a PR is first submitted or reopened from draft. Update to:

on:
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review]

---

49-51: Optimize Nix shell invocation for performance
Using nix develop -c can load or rebuild the full flake environment each run. Adding the -L flag reuses existing development shells and speeds up CI:

- nix develop -c \
+ nix develop -L -c \

---

24-24: Remove or resolve the TODO
The TODO notes switching egress-policy to block after a trial. If it's time to enforce stricter egress controls, update it now; otherwise, consider tracking this work as an issue to avoid stale comments.

---

45-54: Externalize the --select regex for maintainability
The long inline regex for forge bind --select is hard to read and update. You could move the contract list into an environment variable or file:

env:
  SELECT_MODULES: |
    HoprAnnouncements|HoprAnnouncementsEvents|HoprCapabilityPermissions|...
...
forge bind --select "^(${SELECT_MODULES})$"

This makes it easier to add/remove modules.

---

2-3: Use a more descriptive workflow name
Renaming name: Check to something like Check Smart Contract Bindings improves clarity when viewing workflows in GitHub Actions.

---

55-63: Fail early on binding generation errors
Currently, a failing forge bind won’t stop the job until the diff check. Consider adding set -o pipefail or explicit error handling to report binding generation failures immediately:

+ set -o pipefail
  rm -rf ./ethereum/bindings/src/codegen && cd ./ethereum/contracts && \
-   nix develop -c forge bind ...
+   nix develop -c forge bind ... || {
+     echo "::error::Binding generation failed."
+     exit 1
+   }

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

.github/workflows/check-bindings.yaml (1)

14-14: Split custom runner label into standard labels
The runner label self-hosted-hoprnet-big is not recognized by actionlint and may trigger validation errors. Please split it into an array of standard labels, for example:

runs-on: [self-hosted, hoprnet-big]

Alternatively, whitelist self-hosted-hoprnet-big in your actionlint configuration.

🧰 Tools

🪛 actionlint (1.7.7)

14-14: label "self-hosted-hoprnet-big" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-2019", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "ubuntu-20.04", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file

(runner-label)

.github/workflows/check-bindings.yaml (2)

23-24: Track the pending egress-policy change
The comment notes switching egress-policy to block after a trial period. Consider opening an issue or scheduling a reminder to revisit this TODO so the runner is fully locked down when ready.

---

49-54: Reduce maintenance overhead of the --select pattern
The hard-coded regex list of modules in --select is lengthy and error-prone. To avoid manual updates whenever contracts change, consider:

• Dynamically generating the list from the contracts directory.
• Using a broader pattern (e.g., ^Hopr.*) if safe.

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro