ci: pin sbpf and Solana versions in ASM workflow

[MarkFeder]

Problem

The ASM build-and-test job has been red on main since 2026-06-29, failing every ASM example with:

Program is not deployed
Program ... failed: invalid account data for instruction

Tests that expect custom program error: 0x1..0x6 instead get invalid account data for instruction, so checking-accounts, create-account, hello-solana, transfer-sol (and the rest of the ASM group) all fail.

Root cause

solana-asm.yml installs both tools unpinned, so they drift with upstream:

Tool	Last green (06-29 00:44 UTC)	Current
sbpf	v0.1.9 (0223df0e)	v0.2.2 (54a3a273)
solana-cli (stable)	4.0.3	4.1.1

sbpf bumped 0.1.9 → 0.2.2 and now emits an sBPF binary the runtime loader rejects at execution ("Program is not deployed"). The build still succeeds; the failure is at load/execute time. No repo commit touched the ASM examples in the break window — it is pure toolchain drift.

Fix

Pin to the exact last-green combination:

• sbpf → --rev 0223df0e (v0.1.9)
• Solana stable leg → 4.0.3

The beta leg is intentionally left unpinned — it is already continue-on-error and is meant to track the moving channel, so it cannot fail the job.

Note / follow-up

This restores CI by freezing the ASM toolchain to the last-known-good pair. A forward-fix (making the ASM examples compatible with sbpf 0.2.x / Solana 4.1.x) is the longer-term path and can be done separately; this unblocks the currently-red ASM check in the meantime.

[greptile-apps]

Greptile Summary

This PR pins the ASM workflow's sbpf assembler to a specific git commit and the Solana CLI to version 4.0.3 to restore CI that has been failing since 2026-06-29 due to toolchain drift.

• sbpf is pinned from HEAD to the full 40-character SHA 0223df0e7ba622d4956b4ecf3cf2397f6945b76b (v0.1.9), the last revision whose output the Solana runtime loader accepts without rejecting programs at execution time.
• solana-cli-version for the stable leg is changed from the floating stable channel to the concrete release 4.0.3; the beta leg is intentionally left unpinned and remains continue-on-error.

Confidence Score: 5/5

Safe to merge — the change is a minimal, targeted version pin that restores a broken CI job without touching any example code or build logic.

Both pins are immutable references: the full 40-character git SHA for sbpf and an explicit Solana release tag for the stable leg. The beta leg remains unpinned but is already wrapped in continue-on-error, so it cannot gate the required check. Step ordering is preserved, comments explain the rationale, and the change matches the root-cause analysis in the PR description exactly.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/solana-asm.yml	Pins sbpf assembler to full 40-char git SHA (v0.1.9) and Solana CLI stable leg to 4.0.3; beta leg intentionally left unpinned with continue-on-error. No logic changes, only version pinning.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant GH as GitHub Actions
    participant Cargo as cargo install
    participant sbpf as sbpf@0223df0e (v0.1.9)
    participant SolStable as Solana 4.0.3 (Stable)
    participant SolBeta as Solana beta (unpinned)
    participant Tests as Build & Test

    GH->>Cargo: cargo install --git sbpf.git --rev 0223df0e7ba6...
    Cargo->>sbpf: "Checkout & compile pinned revision"
    sbpf-->>GH: sbpf binary ready

    GH->>SolStable: "heyAyushh/setup-solana@v5.9 (4.0.3)"
    SolStable-->>GH: solana-cli 4.0.3 ready

    GH->>Tests: Build and Test with Stable
    Note over Tests: Uses sbpf v0.1.9 + Solana 4.0.3
    Tests-->>GH: Results (must pass)

    GH->>SolBeta: "heyAyushh/setup-solana@v5.9 (beta) [continue-on-error]"
    Note over SolBeta: Clears stable install
    SolBeta-->>GH: Solana beta ready (or 404 error, ignored)

    GH->>Tests: Build and Test with Beta [continue-on-error]
    Note over Tests: Uses sbpf v0.1.9 + Solana beta
    Tests-->>GH: Results (failures tolerated)

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant GH as GitHub Actions
    participant Cargo as cargo install
    participant sbpf as sbpf@0223df0e (v0.1.9)
    participant SolStable as Solana 4.0.3 (Stable)
    participant SolBeta as Solana beta (unpinned)
    participant Tests as Build & Test

    GH->>Cargo: cargo install --git sbpf.git --rev 0223df0e7ba6...
    Cargo->>sbpf: "Checkout & compile pinned revision"
    sbpf-->>GH: sbpf binary ready

    GH->>SolStable: "heyAyushh/setup-solana@v5.9 (4.0.3)"
    SolStable-->>GH: solana-cli 4.0.3 ready

    GH->>Tests: Build and Test with Stable
    Note over Tests: Uses sbpf v0.1.9 + Solana 4.0.3
    Tests-->>GH: Results (must pass)

    GH->>SolBeta: "heyAyushh/setup-solana@v5.9 (beta) [continue-on-error]"
    Note over SolBeta: Clears stable install
    SolBeta-->>GH: Solana beta ready (or 404 error, ignored)

    GH->>Tests: Build and Test with Beta [continue-on-error]
    Note over Tests: Uses sbpf v0.1.9 + Solana beta
    Tests-->>GH: Results (failures tolerated)

Loading

_{Reviews (3): Last reviewed commit: "ci: use full 40-char SHA for sbpf pin" | Re-trigger Greptile}

[MarkFeder]

Hi @Perelyn-sama — thanks again for reviewing my earlier pinocchio PRs! When you have a moment, could you take a look at this one? It's a small, self-contained ASM CI fix: it pins sbpf (rev 0223df0e…76b, v0.1.9) and Solana CLI (4.0.3) to the last-known-good combo, restoring the repo-wide ASM job that's been red on every PR since the toolchain drift on 2026-06-29. It's fully green. Merging this also clears the lone ASM red X on #624. Thanks!

[Perelyn-sama]

LGTM but I don't have write access after the repo move.

@dev-jodee can you approve this PR

[dev-jodee]

@MarkFeder thanks for this ! we require signed commits for our open source repo now, if you can re-sign that commit, i'll be happy to merge :)

[MarkFeder]

@dev-jodee thanks! Done — I've re-signed both commits with an SSH signing key and force-pushed. GitHub now shows both as Verified (7ee0799, a51e0fc). Ready to merge whenever you are 🙏

For context, merging this first also clears the pre-existing repo-wide ASM red X that every open PR (including my #624) currently inherits.

[dev-jodee]

thanks @MarkFeder !