ci: add surfpool integration workflow

[shahan-khatchadourian-anchorage]

Summary

• Adds .github/workflows/surfpool-solana.yml triggered by the surfpool PR label
• Runs surfpool_fuzz_all_idls.sh against all 15 embedded IDLs
• Applies surfpool-failure label on failure, removes it on success
• Requires HELIUS_API_KEY repo secret for reliable mainnet RPC access

Stacked on #202.

Test plan

• Verify workflow triggers when surfpool label is applied to a PR
• Confirm surfpool-failure label is applied/removed based on test outcome
• Ensure HELIUS_API_KEY secret is configured as a repo secret

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a new GitHub Actions workflow to run Surfpool-based Solana integration fuzzing for PRs labeled surfpool, and automatically manage a surfpool-failure label based on the result.

Changes:

• Introduces .github/workflows/surfpool-solana.yml to run ./scripts/surfpool_fuzz_all_idls.sh when a PR has the surfpool label.
• Installs required tooling (Rust toolchain, protoc, surfpool), runs codegen, and executes the surfpool test script.
• Adds/removes the surfpool-failure label depending on the test step outcome.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[prasanna-anchorage]

Dependency check before this lands — none of the workflow's runtime prerequisites currently exist on main:

Dependency	Status
Trigger label surfpool (workflow's if: contains(github.event.pull_request.labels.*.name, 'surfpool'))	❌ does not exist on the repo
Script ./scripts/surfpool_fuzz_all_idls.sh	❌ not on main — added by #202 (still draft)
Secret HELIUS_API_KEY	❌ not in repo or org GitHub Actions secrets

Net effect of merging as-is: workflow registers but never runs in practice (label gate). If anyone did hand-add a surfpool label, the job would fail at Run surfpool integration tests (No such file or directory: ./scripts/surfpool_fuzz_all_idls.sh). The continue-on-error: true on that step would mask it as outcome=failure and the next step (Label PR on surfpool failure) would attempt to remove a (also-nonexistent) surfpool-failure label — squashed by || true, so the job goes green. End result: green CI signaling that surfpool ran cleanly, when it actually never ran. That's worse than no workflow at all.

Recommend either:

1. Land test: surfpool mainnet-fork integration for built-in IDL fuzz path #202 first (which adds the script + integration), then create the surfpool label and add HELIUS_API_KEY to org secrets, then merge this.
2. Fold this workflow into test: surfpool mainnet-fork integration for built-in IDL fuzz path #202 so the prerequisites land atomically and we never have a window where the workflow lies about its own coverage.

Either way, also worth replacing the continue-on-error: true + manual-label-toggle pattern with explicit failure on the surfpool step itself — silent green is the worst CI failure mode.

[shahan-khatchadourian-anchorage]

Closing as superseded by #202.

The workflow file is now part of #202 and has gone further than the original here:

• All 4 copilot review comments on this PR are addressed in test: surfpool mainnet-fork integration for built-in IDL fuzz path #202 (replies on each thread point to the relevant commits).
• prasanna's recommendation ("Fold this workflow into test: surfpool mainnet-fork integration for built-in IDL fuzz path #202") is exactly what landed: workflow + script + label + secret all wired up atomically there.
• Improvements beyond what was reviewed here: SHA256-pinned upstream prebuilt binary instead of `cargo install` (~5s vs ~10min), fork-PR gate, separate binary cache keyed on version+SHA, label re-trigger guard.
• test(surfpool): native cargo runner via build.rs + per-IDL macro #285 stacks on top of test: surfpool mainnet-fork integration for built-in IDL fuzz path #202 to replace the bash runner with native `cargo test` per-IDL.

No content from this branch is needed.

🤖 Generated with Claude Code