chore(ci): clean up redundancies from the #606 CI repair (#607)

* chore(ci): drop redundant pnpm config from asm projects

The pnpm 10.33.0 pin in the asm workflow is what fixes the
ERR_PNPM_IGNORED_BUILDS failure (pinned pnpm treats ignored build scripts as
a warning, not a hard error). The per-project pnpm.ignoredBuiltDependencies
blocks only silenced the warning and did not fix CI, so remove them.

* ci(anchor): drop anchor build retry loop

The sparse registry protocol (CARGO_REGISTRIES_CRATES_IO_PROTOCOL) plus
CARGO_NET_RETRY handle the transient crates.io index fetch failures at the
cargo level, so the explicit 3x anchor build retry loop is redundant.

* ci(anchor): drop redundant explicit anchor keys sync

anchor test syncs program ids to the ephemeral keypair itself before
building and deploying, so the separate anchor keys sync step is redundant.

* refactor(anchor): stage cpi keypairs via pre_build hook

The cross-program-invocation example needs stable hand/lever program ids
(declare_program! bakes the lever address into hand). They were force-added
into the gitignored target/deploy. Move them to a tracked keypairs/ dir and
stage them into target/deploy with an Anchor.toml pre_build hook, so the
ids stay stable without committing into an ignored path.

* ci(anchor): verify cpi keypairs match Anchor.toml in pre_build

The global anchor build --ignore-keys skips the keypair/declare_id check, so
a drifted or missing committed keypair would only surface at test time. Have
the pre_build hook assert each staged keypair's pubkey appears in Anchor.toml
and fail the build loudly otherwise.

* docs(ci): note anchor 1.0.x key-sync assumption in anchor test

The reliance on anchor test syncing program ids itself is Anchor 1.0.x
behavior; flag it so it gets re-verified when anchor-version is bumped.

---------

Co-authored-by: Jo D <dev-jodee@users.noreply.github.com>

Author: dev-jodee

.github/workflows/anchor.yml

@@ -143,27 +143,17 @@ jobs:
             # Run anchor build
             # --ignore-keys: most examples don't commit program keypairs, so CI
             # generates ephemeral ones that won't match the source declare_id!
-            # Retry to ride out transient crates.io index fetch failures.
-            build_ok=false
-            for attempt in 1 2 3; do
-              if anchor build --ignore-keys; then
-                build_ok=true
-                break
-              fi
-              echo "anchor build attempt $attempt failed for $project; retrying"
-            done
-            if [ "$build_ok" != "true" ]; then
+            if ! anchor build --ignore-keys; then
               echo "::error::anchor build failed for $project"
               echo "$project: anchor build failed" >> $GITHUB_WORKSPACE/failed_projects.txt
               rm -rf target
               cd - > /dev/null
               return 1
             fi
 
-            # Align declare_id! and Anchor.toml with the ephemeral keypair
-            anchor keys sync
-
-            # Run anchor test
+            # Run anchor test. Anchor 1.0.x syncs program ids to the ephemeral
+            # keypair during its own build, so no separate keys sync is needed —
+            # re-verify this if anchor-version is bumped.
             # --validator legacy: surfpool (the Anchor 1.0 default) isn't installed in CI
             if ! anchor test --validator legacy; then
               echo "::error::anchor test failed for $project"

basics/checking-accounts/asm/package.json

@@ -18,11 +18,5 @@
     "ts-mocha": "^10.0.0",
     "typescript": "^4.3.5",
     "solana-bankrun": "^0.3.0"
-  },
-  "pnpm": {
-    "ignoredBuiltDependencies": [
-      "bufferutil",
-      "utf-8-validate"
-    ]
   }
 }

basics/create-account/asm/package.json

@@ -18,11 +18,5 @@
     "solana-bankrun": "^0.3.0",
     "ts-mocha": "^10.0.0",
     "typescript": "^4.3.5"
-  },
-  "pnpm": {
-    "ignoredBuiltDependencies": [
-      "bufferutil",
-      "utf-8-validate"
-    ]
   }
 }

basics/cross-program-invocation/anchor/Anchor.toml

@@ -5,6 +5,10 @@ solana_version = "3.1.8"
 resolution = true
 skip-lint = false
 
+[hooks]
+# program keypairs are committed under keypairs/ so ids stay stable (declare_program! bakes the lever id); stage them and fail loudly if one no longer matches Anchor.toml (the global anchor build --ignore-keys would otherwise hide drift until test time)
+pre_build = "mkdir -p target/deploy && cp keypairs/*.json target/deploy/ && for k in keypairs/*-keypair.json; do grep -q \"$(solana-keygen pubkey \"$k\")\" Anchor.toml || { echo \"keypair drift: $k does not match Anchor.toml\"; exit 1; }; done"
+
 [programs.localnet]
 hand = "59c3ER1YrnnnezUVH7ix4WDUw9TQ9k7xH6wQyAmWvc52"
 lever = "A6GUsa5Ej8iWzMMP3B6otFVB5aaUckVm8a31Y5TMLYRV"

…n/anchor/target/deploy/hand-keypair.json …cation/anchor/keypairs/hand-keypair.jsonbasics/cross-program-invocation/anchor/target/deploy/hand-keypair.json renamed to basics/cross-program-invocation/anchor/keypairs/hand-keypair.json basics/cross-program-invocation/anchor/target/deploy/hand-keypair.json renamed to basics/cross-program-invocation/anchor/keypairs/hand-keypair.json

@@ -19,11 +19,5 @@
     "solana-bankrun": "^0.3.1",
     "ts-mocha": "^10.1.0",
     "typescript": "^4.9.5"
-  },
-  "pnpm": {
-    "ignoredBuiltDependencies": [
-      "bufferutil",
-      "utf-8-validate"
-    ]
   }
 }

…/anchor/target/deploy/lever-keypair.json …ation/anchor/keypairs/lever-keypair.jsonbasics/cross-program-invocation/anchor/target/deploy/lever-keypair.json renamed to basics/cross-program-invocation/anchor/keypairs/lever-keypair.json basics/cross-program-invocation/anchor/target/deploy/lever-keypair.json renamed to basics/cross-program-invocation/anchor/keypairs/lever-keypair.json

@@ -20,11 +20,5 @@
     "solana-bankrun": "^0.3.0",
     "ts-mocha": "^10.0.0",
     "typescript": "^4.3.5"
-  },
-  "pnpm": {
-    "ignoredBuiltDependencies": [
-      "bufferutil",
-      "utf-8-validate"
-    ]
   }
 }