[ryanio]

Motivation

• On 2026-11-09 a GitHub releases outage returned 504 for Foundry's download, and every job on v2: Record each Seaport call's mints in the ERC721 contract offerer #219 failed at "Install Foundry" before building anything. Each job downloads Foundry again on every run.
• Nothing in CI checks contract sizes. Several contracts are within a few kilobytes of EIP-170, and the agent extension in Add an agent NFT extension with ERC-8048 onchain metadata #212 is about 1 KB under it.
• cancel-in-progress: true also applies to pushes on main, so when two PRs merge close together, the first merge commit's run is cancelled and never gets a result.

Solution

• .github/actions/setup-foundry restores ~/.foundry/bin and ~/.foundry/versions (foundryup keeps the binaries in versions/ and links them from bin/) from the Actions cache, keyed on the runner OS and FOUNDRY_VERSION. It installs with foundry-toolchain only on a cache miss. All three jobs use it.
• scripts/check_sizes.sh builds src/ (skipping tests and scripts) with forge build --sizes --json. It fails if a contract it compiles is over 24,576 runtime bytes or 49,152 init code bytes. It prints the ten tightest margins, and writes them to the job summary, before failing. The test job runs it before the tests.
• A new push to a pull request still cancels its older run. Every other run gets its own concurrency group (github.run_id), so no run on main or a tag is cancelled or replaced while it waits.
• Jobs get timeouts: 15 minutes for lint and 20 for tests and coverage.
• The GOERLI_RPC_URL secret is gone from the jobs, since Goerli is shut down and nothing reads it.
• Third-party actions (foundry-rs/foundry-toolchain, coverallsapp/github-action) are pinned to commit SHAs. GitHub's own actions stay on major tags.

Testing

• ./scripts/check_sizes.sh passes locally on main with Foundry 1.9.0. Its tightest margin is ERC721SeaDropCloneable, with 3,522 runtime bytes left.
• biome ci . passes.
• This PR's first run fills the Foundry cache, and a re-run should restore it. I'll confirm that on this PR.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The Foundry cache omits the version directory, so cache hits on fresh runners restore dangling symlinks and skip installation, causing all three CI jobs to fail.

3 open issues

• Cache Foundry version directory to avoid dangling symlinks · New
• Use unique concurrency groups for non-PR runs · New
• Render size report before propagating oversized-contract failure · New

What changed in this PR

This PR aims to make SeaDrop’s CI more resilient to Foundry download outages, enforce contract-size limits, and preserve CI results for every main commit.

Changes:

• Adds a shared Foundry setup action with caching and a pinned installer.
• Adds runtime and init-code size checks with a job-summary report.
• Adjusts workflow cancellation, adds timeouts, removes Goerli secrets, and pins Coveralls.

File	Description
scripts/​check_sizes.sh	Checks contract-size limits and reports the ten tightest margins.
.github/​workflows/​test.yml	Integrates setup and size checks; updates concurrency, timeouts, and dependencies.
.github/​actions/​setup-foundry/​action.yml	Adds reusable cached Foundry installation and version reporting.

_{Review effort: Balanced}